@lazehq/cli 0.1.60 → 0.1.61

package/dist/laze.mjs

@@ -35647,7 +35647,7 @@ function differenceInCalendarDays(later, earlier, options) {
 // src/config.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
-var DEFAULT_LAZE_URL = "https://laze.langwatch.ai";
+var DEFAULT_LAZE_URL = "https://laze.so";
 function harnessOf({
   env
 }) {
@@ -35883,7 +35883,7 @@ function flagText({
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.60";
+var STAMPED = "0.1.61";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -57737,6 +57737,7 @@ var FEATURE_NAMES = [
   "compute",
   "connector",
   "discord",
+  "download",
   "entitlement",
   "external-connection",
   "feature-flag",
@@ -58092,6 +58093,216 @@ var apiKeyMachineAlertSettledPayloadSchemaDefinition = external_exports.object({
   at: external_exports.iso.datetime()
 });
 
+// ../../packages/config/src/config.ts
+var ConfigLeaf = class {
+  constructor(env, schema) {
+    this.env = env;
+    this.schema = schema;
+  }
+  env;
+  schema;
+};
+var definer = {
+  env: (env, schema) => new ConfigLeaf(env, schema)
+};
+var Config = {
+  define(build) {
+    return build(definer);
+  }
+};
+
+// ../../packages/config/src/env-schemas.ts
+var nodeEnvironmentSchema = external_exports.enum(["development", "test", "production"]);
+var environmentBooleanSchema = external_exports.union([external_exports.boolean(), external_exports.literal("true"), external_exports.literal("false"), external_exports.literal("1"), external_exports.literal("0")]).transform((value) => value === true || value === "true" || value === "1");
+var environmentExactOnSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value === true || value === "on");
+var environmentNotExactOffSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value !== false && value !== "off");
+var environmentOneOrTrueSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform(
+  (value) => value === true || typeof value === "string" && (value === "1" || value.toLowerCase() === "true")
+);
+var environmentPresenceSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value === true || typeof value === "string" && value.length > 0);
+var environmentExactOneSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value === true || value === "1");
+var environmentNotExactOneSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value !== "1");
+var environmentLegacyTruthySchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform(
+  (value) => value === true || typeof value === "string" && /^(1|true|yes)$/i.test(value)
+);
+
+// ../../packages/config/src/deployment-facts.ts
+var positiveInteger = external_exports.coerce.number().int().positive();
+var optionalSetting = external_exports.preprocess(
+  (value) => value === "" ? void 0 : value,
+  external_exports.string().min(1).optional()
+);
+var { logSettings } = Config.define((c) => ({
+  logSettings: {
+    LOG_LEVEL: c.env("LOG_LEVEL", optionalSetting),
+    LOG_CONSOLE_LEVEL: c.env("LOG_CONSOLE_LEVEL", optionalSetting),
+    LOG_OTEL_LEVEL: c.env("LOG_OTEL_LEVEL", optionalSetting),
+    LOG_FORMAT: c.env("LOG_FORMAT", external_exports.enum(["pretty", "json"]).optional()),
+    PINO_LOG_LEVEL: c.env("PINO_LOG_LEVEL", optionalSetting),
+    _LOG_LEVEL: c.env("_LOG_LEVEL", optionalSetting),
+    PINO_CONSOLE_LEVEL: c.env("PINO_CONSOLE_LEVEL", optionalSetting),
+    PINO_OTEL_LEVEL: c.env("PINO_OTEL_LEVEL", optionalSetting)
+  }
+}));
+var { isSaas } = Config.define((c) => ({
+  isSaas: c.env("IS_SAAS", environmentOneOrTrueSchema)
+}));
+var { nodeEnvironment } = Config.define((c) => ({
+  nodeEnvironment: c.env("NODE_ENV", external_exports.string().optional())
+}));
+var { rawSocketPort } = Config.define((c) => ({
+  rawSocketPort: c.env("VOICE_WS_PORT", external_exports.coerce.number().int().min(0).max(65535).default(3300))
+}));
+var { outboundProxy } = Config.define((c) => ({
+  outboundProxy: {
+    HTTPS_PROXY: c.env("HTTPS_PROXY", external_exports.string().optional()),
+    https_proxy: c.env("https_proxy", external_exports.string().optional()),
+    HTTP_PROXY: c.env("HTTP_PROXY", external_exports.string().optional()),
+    http_proxy: c.env("http_proxy", external_exports.string().optional()),
+    NO_PROXY: c.env("NO_PROXY", external_exports.string().optional()),
+    no_proxy: c.env("no_proxy", external_exports.string().optional())
+  }
+}));
+var { blockLocalHttpCalls, allowedProxyHosts } = Config.define((c) => ({
+  blockLocalHttpCalls: c.env("BLOCK_LOCAL_HTTP_CALLS", environmentOneOrTrueSchema),
+  /** An unset allowlist is EMPTY, never a wildcard. */
+  allowedProxyHosts: c.env(
+    "ALLOWED_PROXY_HOSTS",
+    external_exports.string().optional().transform(
+      (value) => (value ?? "").split(",").map((host2) => host2.trim()).filter((host2) => host2.length > 0)
+    )
+  )
+}));
+var { telemetryExporterEndpoint } = Config.define((c) => ({
+  telemetryExporterEndpoint: c.env(
+    "OTEL_EXPORTER_OTLP_ENDPOINT",
+    external_exports.preprocess((value) => value === "" ? void 0 : value, external_exports.string().min(1).optional())
+  )
+}));
+var { publicBaseUrl } = Config.define((c) => ({
+  publicBaseUrl: c.env(
+    "BASE_HOST",
+    external_exports.string().optional().transform((value) => value?.trim() || void 0)
+  )
+}));
+var { publicOriginAliases } = Config.define((c) => ({
+  publicOriginAliases: c.env(
+    "BASE_HOST_ALIASES",
+    external_exports.string().optional().transform((value) => originsOf({ list: value ?? "" }))
+  )
+}));
+function originsOf({ list: list11 }) {
+  const origins = list11.split(",").map((entry) => entry.trim()).filter((entry) => URL.canParse(entry)).map((entry) => new URL(entry)).filter((url2) => url2.protocol === "https:" || url2.protocol === "http:").map((url2) => url2.origin);
+  return [...new Set(origins)];
+}
+var { appsDomain } = Config.define((c) => ({
+  appsDomain: c.env("APPS_DOMAIN", external_exports.string().min(1).default("lazeapps.com"))
+}));
+var optionalNonBlank = external_exports.preprocess(
+  (value) => value === "" ? void 0 : value,
+  external_exports.string().min(1).optional()
+);
+var { grafana } = Config.define((c) => ({
+  grafana: {
+    baseUrl: c.env("GRAFANA_BASE_URL", optionalNonBlank),
+    tempoDatasourceUid: c.env("GRAFANA_TEMPO_DATASOURCE_UID", optionalNonBlank),
+    lokiDatasourceUid: c.env("GRAFANA_LOKI_DATASOURCE_UID", optionalNonBlank)
+  }
+}));
+var { serviceVersion, otelResourceAttributes } = Config.define((c) => ({
+  serviceVersion: c.env("SERVICE_VERSION", optionalNonBlank),
+  otelResourceAttributes: c.env("OTEL_RESOURCE_ATTRIBUTES", optionalNonBlank)
+}));
+var { lazeDefaultModel } = Config.define((c) => ({
+  lazeDefaultModel: c.env(
+    "LAZE_DEFAULT_MODEL",
+    external_exports.string().optional().transform((value) => value?.trim() || void 0)
+  )
+}));
+var { gatewayPublicUrl, gatewayInternalUrl, gatewayLegacyUrl } = Config.define((c) => ({
+  gatewayPublicUrl: c.env("LW_GATEWAY_PUBLIC_URL", external_exports.string().optional()),
+  gatewayInternalUrl: c.env("LW_GATEWAY_INTERNAL_URL", external_exports.string().optional()),
+  gatewayLegacyUrl: c.env("LW_GATEWAY_BASE_URL", external_exports.string().optional())
+}));
+var publicProviderField = external_exports.string().min(1).optional();
+var signInProviders = Config.define((c) => ({
+  authProvider: c.env("AUTH_PROVIDER", publicProviderField),
+  /** The NextAuth-era name for `AUTH_PROVIDER`: deprecated, still applied. */
+  legacyProvider: c.env("NEXTAUTH_PROVIDER", publicProviderField),
+  googleClientId: c.env("GOOGLE_CLIENT_ID", publicProviderField),
+  githubClientId: c.env("GITHUB_CLIENT_ID", publicProviderField),
+  gitlabClientId: c.env("GITLAB_CLIENT_ID", publicProviderField),
+  azureAdClientId: c.env("AZURE_AD_CLIENT_ID", publicProviderField),
+  azureAdTenantId: c.env("AZURE_AD_TENANT_ID", publicProviderField),
+  auth0ClientId: c.env("AUTH0_CLIENT_ID", publicProviderField),
+  auth0Issuer: c.env("AUTH0_ISSUER", publicProviderField),
+  oktaClientId: c.env("OKTA_CLIENT_ID", publicProviderField),
+  oktaIssuer: c.env("OKTA_ISSUER", publicProviderField),
+  cognitoClientId: c.env("COGNITO_CLIENT_ID", publicProviderField),
+  cognitoIssuer: c.env("COGNITO_ISSUER", publicProviderField),
+  oneLoginClientId: c.env("ONELOGIN_CLIENT_ID", publicProviderField),
+  oneLoginIssuer: c.env("ONELOGIN_ISSUER", publicProviderField),
+  oidcClientId: c.env("OIDC_CLIENT_ID", publicProviderField),
+  oidcIssuer: c.env("OIDC_ISSUER", publicProviderField)
+}));
+var { adminEmails } = Config.define((c) => ({
+  adminEmails: c.env(
+    "ADMIN_EMAILS",
+    external_exports.string().optional().transform(
+      (raw) => (raw ?? "").split(",").map((email3) => email3.trim()).filter((email3) => email3.length > 0)
+    )
+  )
+}));
+var { signUpMode, signUpAllowedDomains } = Config.define((c) => ({
+  /** `open` admits anybody who reaches the installation; `invite_only` admits invited addresses. */
+  signUpMode: c.env(
+    "SIGN_UP_MODE",
+    external_exports.preprocess(
+      (value) => value === "" ? void 0 : value,
+      external_exports.enum(["open", "invite_only"]).default("open")
+    )
+  ),
+  /** Lowercased domains without a leading `@`; empty admits any domain. */
+  signUpAllowedDomains: c.env(
+    "SIGN_UP_ALLOWED_DOMAINS",
+    external_exports.string().optional().transform(
+      (raw) => (raw ?? "").split(",").map((domain2) => domain2.trim().toLowerCase().replace(/^@/, "")).filter((domain2) => domain2.length > 0)
+    )
+  )
+}));
+var { passkeysEnabled, mfaEnrollmentOpen, localPasswords } = Config.define((c) => ({
+  passkeysEnabled: c.env("PASSKEYS_ENABLED", environmentNotExactOffSchema),
+  mfaEnrollmentOpen: c.env("MFA_ENROLLMENT_OPEN", environmentExactOnSchema),
+  localPasswords: c.env("LOCAL_PASSWORDS_ENABLED", environmentExactOnSchema)
+}));
+var { trustedIdpOrigins, idpSimulatorUrl } = Config.define((c) => ({
+  trustedIdpOrigins: c.env("SSO_TRUSTED_IDP_ORIGINS", external_exports.string().optional()),
+  idpSimulatorUrl: c.env("LAZE_IDPSIM_URL", external_exports.string().optional())
+}));
+var { posthogKey, posthogHost } = Config.define((c) => ({
+  posthogKey: c.env("POSTHOG_KEY", external_exports.string().optional()),
+  posthogHost: c.env("POSTHOG_HOST", external_exports.string().optional())
+}));
+var { foldCacheTtlSeconds } = Config.define((c) => ({
+  foldCacheTtlSeconds: c.env("LAZE_FOLD_CACHE_TTL_SECONDS", positiveInteger.default(300))
+}));
+var { slackApiBase, slackWebhookBase } = Config.define((c) => ({
+  slackApiBase: c.env("SLACK_API_BASE", external_exports.string().url().default("https://slack.com/api")),
+  slackWebhookBase: c.env(
+    "SLACK_WEBHOOK_BASE",
+    external_exports.string().url().default("https://hooks.slack.com")
+  )
+}));
+var { allowInsecureLocalUrls } = Config.define((c) => ({
+  allowInsecureLocalUrls: c.env(
+    "WEBHOOKS_UNSAFE_ALLOW_LOCAL_URLS",
+    external_exports.union([external_exports.boolean(), external_exports.literal("1"), external_exports.literal("0"), external_exports.literal("")]).optional().transform((value) => value === true || value === "1")
+  )
+}));
+
+// ../../modules/api-key/contract/src/api-key.config.ts
+var apiKeyConfig = Config.define(() => ({ publicBaseUrl }));
+
 // ../../modules/chat/contract/src/chat.emoji.ts
 var CUSTOM_EMOJI_MAX_BYTES = 256 * 1024;
 var CUSTOM_EMOJI_UPLOAD_MAX_BYTES = 5 * 1024 * 1024;
@@ -58296,6 +58507,41 @@ var messageLayoutSchemaDefinition = external_exports.object({
 });
 var messageLayoutSchema = messageLayoutSchemaDefinition;
 
+// ../../modules/chat/contract/src/chat.possible-secrets.ts
+var possibleSecretInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  messageId: external_exports.string().min(1),
+  /** The `{{vault:<name>}}` the message shows: `possible-<vendor>-<8 hex>`. */
+  name: external_exports.string().regex(/^possible-[a-z0-9-]+-[0-9a-f]{8}$/)
+});
+var possibleSecretInputSchema = possibleSecretInputSchemaDefinition;
+var possibleSecretSchemaDefinition = external_exports.object({
+  name: external_exports.string(),
+  messageId: external_exports.string(),
+  channelId: external_exports.string(),
+  /** The kind the detector took it for, as people say it: "OpenAI key", "Secret key". */
+  kindLabel: external_exports.string(),
+  /** The variable name a save suggests, such as OPENAI_API_KEY. */
+  field: external_exports.string(),
+  poster: external_exports.object({
+    kind: external_exports.enum(["person", "agent", "external"]),
+    id: external_exports.string(),
+    /** The name the source gave, for a mirrored message; null for a Laze author. */
+    sourceName: external_exports.string().nullable()
+  }),
+  /** Where it was posted, in words: "#ops, mirrored from Slack (ACME)". */
+  where: external_exports.string(),
+  /** slack, discord, whatsapp_business or laze when a mirror brought the message in. */
+  source: external_exports.string().nullable(),
+  unmasked: external_exports.boolean(),
+  /** The reader may say it is not a secret: the poster, or anyone for a mirrored message. */
+  mayUnmask: external_exports.boolean()
+});
+var possibleSecretSchema = possibleSecretSchemaDefinition;
+var possibleSecretValueSchemaDefinition = external_exports.object({ value: external_exports.string() });
+var possibleSecretValueSchema = possibleSecretValueSchemaDefinition;
+var chatPossibleSecretsTrpc = defineTrpcContract("chat").query("possibleSecret").withInput(possibleSecretInputSchema).withOutput(possibleSecretSchema).mutation("revealPossibleSecret").withInput(possibleSecretInputSchema).withOutput(possibleSecretValueSchema).mutation("unmaskPossibleSecret").withInput(possibleSecretInputSchema).withOutput(external_exports.object({ unmasked: external_exports.boolean() })).build();
+
 // ../../modules/chat/contract/src/chat.presence.ts
 var STATUS_TEXT_MAX = 100;
 var idSchema = external_exports.string().min(1).max(64);
@@ -59298,7 +59544,7 @@ var postMirroredInputSchemaDefinition = external_exports.object({
   channelId: idSchema4,
   /** The Laze person behind the outside account when linked; else the outside author. */
   author: messageAuthorSchemaDefinition,
-  /** Whose vault holds a key in the text: the linked author, else whoever mirrored the channel. */
+  /** The Laze person the mirror acts for: the linked author, else whoever mirrored the channel. */
   keyOwnerUserId: idSchema4,
   origin: messageOriginSchemaDefinition,
   body: external_exports.string().max(MESSAGE_BODY_MAX),
@@ -59314,7 +59560,7 @@ var postMirroredInputSchemaDefinition = external_exports.object({
 var updateMirroredInputSchemaDefinition = external_exports.object({
   workspaceId: workspaceIdSchema,
   messageId: idSchema4,
-  /** Whose vault holds a key in the new text: the linked author, else whoever mirrored it. */
+  /** The Laze person the mirror acts for: the linked author, else whoever mirrored it. */
   keyOwnerUserId: idSchema4,
   body: external_exports.string().max(MESSAGE_BODY_MAX).optional(),
   /** The source's blocks and attachments now; null drops them; left out keeps them. */
@@ -59908,7 +60154,7 @@ var joinedChannelSchemaDefinition = external_exports.object({
 var ChatApi = moduleApi()("chat");
 var chatConversationsTrpc = defineTrpcContract("chat").query("overview").withInput(workspaceInputSchema).withOutput(chatOverviewSchema).query("unreadSummary").withInput(external_exports.object({})).withOutput(external_exports.array(workspaceUnreadSchema)).query("browse").withInput(workspaceInputSchema).withOutput(external_exports.array(browsableChannelSchema)).mutation("createChannel").withInput(createChannelInputSchema).withOutput(conversationSchema).mutation("join").withInput(channelInputSchema).withOutput(conversationSchema).mutation("leave").withInput(channelInputSchema).withOutput(external_exports.object({ left: external_exports.literal(true) })).mutation("updateChannel").withInput(updateChannelInputSchema).withOutput(conversationSchema).mutation("setDefaultAgent").withInput(setDefaultAgentInputSchema).withOutput(conversationSchema).query("logChannelHint").withInput(channelInputSchema).withOutput(logChannelHintSchema).mutation("dismissLogChannelHint").withInput(channelInputSchema).withOutput(external_exports.object({ dismissed: external_exports.literal(true) })).query("externalNotice").withInput(channelInputSchema).withOutput(externalNoticeSchema).mutation("dismissExternalNotice").withInput(dismissExternalNoticeInputSchema).withOutput(externalNoticeSchema).mutation("archiveChannel").withInput(channelInputSchema).withOutput(conversationSchema).mutation("unarchiveChannel").withInput(channelInputSchema).withOutput(conversationSchema).mutation("addMembers").withInput(addMembersInputSchema).withOutput(conversationSchema).mutation("removeMember").withInput(removeMemberInputSchema).withOutput(conversationSchema).mutation("openDirect").withInput(openDirectInputSchema).withOutput(conversationSchema).query("conversation").withInput(channelInputSchema).withOutput(conversationSchema).build();
 var chatChannelRolesTrpc = defineTrpcContract("chat").mutation("setChannelRole").withInput(setChannelRoleInputSchema).withOutput(conversationSchema).mutation("extendChannel").withInput(extendChannelInputSchema).withOutput(conversationSchema).build();
-var chatMessagesTrpc = defineTrpcContract("chat").query("history").withInput(historyInputSchema).withOutput(historyPageSchema).query("thread").withInput(messageInputSchema).withOutput(threadSchema).mutation("post").withInput(postMessageInputSchema).withOutput(messageSchema).mutation("forward").withInput(forwardMessageInputSchema).withOutput(messageSchema).mutation("addMentioned").withInput(addMentionedInputSchema).withOutput(messageSchema).mutation("edit").withInput(editMessageInputSchema).withOutput(messageSchema).mutation("delete").withInput(messageInputSchema).withOutput(messageSchema).mutation("remove").withInput(messageInputSchema).withOutput(messageSchema).mutation("react").withInput(reactInputSchema).withOutput(messageSchema).mutation("signalTyping").withInput(signalTypingInputSchema).withOutput(external_exports.object({ sent: external_exports.literal(true) })).mutation("markRead").withInput(markReadInputSchema).withOutput(external_exports.object({ lastReadSeq: external_exports.number().int().nonnegative() })).mutation("markUnread").withInput(markUnreadInputSchema).withOutput(external_exports.object({ lastReadSeq: external_exports.number().int().nonnegative() })).query("search").withInput(searchInputSchema).withOutput(searchResultSchema).build();
+var chatMessagesTrpc = defineTrpcContract("chat").query("history").withInput(historyInputSchema).withOutput(historyPageSchema).query("thread").withInput(messageInputSchema).withOutput(threadSchema).query("message").withInput(messageInputSchema).withOutput(messageSchema).mutation("post").withInput(postMessageInputSchema).withOutput(messageSchema).mutation("forward").withInput(forwardMessageInputSchema).withOutput(messageSchema).mutation("addMentioned").withInput(addMentionedInputSchema).withOutput(messageSchema).mutation("edit").withInput(editMessageInputSchema).withOutput(messageSchema).mutation("delete").withInput(messageInputSchema).withOutput(messageSchema).mutation("remove").withInput(messageInputSchema).withOutput(messageSchema).mutation("react").withInput(reactInputSchema).withOutput(messageSchema).mutation("signalTyping").withInput(signalTypingInputSchema).withOutput(external_exports.object({ sent: external_exports.literal(true) })).mutation("markRead").withInput(markReadInputSchema).withOutput(external_exports.object({ lastReadSeq: external_exports.number().int().nonnegative() })).mutation("markUnread").withInput(markUnreadInputSchema).withOutput(external_exports.object({ lastReadSeq: external_exports.number().int().nonnegative() })).query("search").withInput(searchInputSchema).withOutput(searchResultSchema).build();
 var chatFilesTrpc = defineTrpcContract("chat").mutation("startUpload").withInput(startUploadInputSchema).withOutput(uploadTicketSchema).mutation("completeUpload").withInput(completeUploadInputSchema).withOutput(attachmentSchema).mutation("abortUpload").withInput(fileInputSchema).withOutput(external_exports.object({ aborted: external_exports.literal(true) })).query("fileLink").withInput(fileLinkInputSchema).withOutput(fileLinkSchema).query("channelFiles").withInput(channelFilesInputSchema).withOutput(channelFilesSchema).mutation("renameAttachment").withInput(renameAttachmentInputSchema).withOutput(attachmentSchema).mutation("hideUnfurl").withInput(hideUnfurlInputSchema).withOutput(messageSchema).query("unfurlImage").withInput(unfurlImageInputSchema).withOutput(fileLinkSchema).query("searchGifs").withInput(searchGifsInputSchema).withOutput(gifResultsSchema).build();
 var chatFollowingTrpc = defineTrpcContract("chat").mutation("setNotify").withInput(setNotifyInputSchema).withOutput(conversationSummarySchema).mutation("hideConversation").withInput(channelInputSchema).withOutput(external_exports.object({ hidden: external_exports.literal(true) })).mutation("followThread").withInput(followThreadInputSchema).withOutput(threadFollowSchema).query("threadFollow").withInput(messageInputSchema).withOutput(threadFollowSchema).query("threads").withInput(threadsInputSchema).withOutput(threadsPageSchema).query("threadsUnread").withInput(workspaceInputSchema).withOutput(threadsUnreadSchema).query("notificationCount").withInput(workspaceInputSchema).withOutput(external_exports.object({ count: external_exports.number().int().nonnegative() })).mutation("markThreadRead").withInput(messageInputSchema).withOutput(external_exports.object({ read: external_exports.literal(true) })).mutation("pin").withInput(pinMessageInputSchema).withOutput(messageSchema).query("pins").withInput(channelInputSchema).withOutput(pinsPageSchema).query("saved").withInput(savedInputSchema).withOutput(savedPageSchema).query("savedMarks").withInput(workspaceInputSchema).withOutput(savedMarksSchema).mutation("saveMessage").withInput(saveMessageInputSchema).withOutput(savedStatusSchema).mutation("markSavedDone").withInput(markSavedDoneInputSchema).withOutput(savedStatusSchema).mutation("setReminder").withInput(setReminderInputSchema).withOutput(savedStatusSchema).query("activity").withInput(activityInputSchema).withOutput(activityPageSchema).mutation("markActivityRead").withInput(markActivityReadInputSchema).withOutput(external_exports.object({ read: external_exports.literal(true) })).build();
 var chatSessionTrpc = defineTrpcContract("chat").mutation("realtimeToken").withInput(workspaceInputSchema).withOutput(realtimeTokenSchema).query("drafts").withInput(workspaceInputSchema).withOutput(draftListSchema).mutation("saveDraft").withInput(saveDraftInputSchema).withOutput(draftSavedSchema).mutation("deleteDraft").withInput(deleteDraftInputSchema).withOutput(draftSavedSchema).query("sent").withInput(listSentInputSchema).withOutput(sentPageSchema).query("sidebarLayout").withInput(workspaceInputSchema).withOutput(sidebarLayoutSchema).mutation("editSidebar").withInput(editSidebarInputSchema).withOutput(sidebarLayoutSchema).mutation("star").withInput(starInputSchema).withOutput(starStatusSchema).query("starred").withInput(workspaceInputSchema).withOutput(starredListSchema).mutation("scrubSecrets").withInput(scrubChatInputSchema).withOutput(chatScrubReportSchema).mutation("restoreScrubbed").withInput(messageInputSchema).withOutput(messageSchema).build();
@@ -59924,7 +60170,8 @@ var chatTrpc = joinTrpcContracts(
   chatFollowingTrpc,
   chatSessionTrpc,
   chatScheduledTrpc,
-  chatPresenceTrpc
+  chatPresenceTrpc,
+  chatPossibleSecretsTrpc
 );
 
 // ../../modules/notification/contract/src/apns.ts
@@ -59972,7 +60219,17 @@ var apnsPayloadSchemaDefinition = external_exports.object({
   link: external_exports.string().startsWith("laze://").max(2048).optional(),
   /** The message's place in its conversation, so a later clear can match it. */
   seq: external_exports.number().int().nonnegative().optional(),
-  clear: external_exports.object({ threadId: external_exports.string().min(1).max(200), upToSeq: external_exports.number().int().nonnegative() }).strict().optional()
+  clear: external_exports.object({ threadId: external_exports.string().min(1).max(200), upToSeq: external_exports.number().int().nonnegative() }).strict().optional(),
+  /** Absent on an alert; "read" on the silent push a read sends. */
+  type: external_exports.literal("read").optional(),
+  /** The conversation an alert tells of, or a read push covers. */
+  conversationId: external_exports.string().min(1).max(200).optional(),
+  /** The thread's root message, when the alert or the read is in a thread. */
+  threadRootId: external_exports.string().min(1).max(200).optional(),
+  /** A read push: everything in the conversation (or thread) up to this seq is read. */
+  readUpToSeq: external_exports.number().int().nonnegative().optional(),
+  /** A read push: the person's Notifications total, the number alert pushes carry. */
+  badge: external_exports.number().int().nonnegative().optional()
 }).strict();
 
 // ../../modules/notification/contract/src/web-push.ts
@@ -60060,6 +60317,13 @@ var emailMessageSchemaDefinition = external_exports.discriminatedUnion("template
     lines: external_exports.array(external_exports.string()).min(1),
     action: external_exports.string().min(1)
   }),
+  /** A Laze app a person waited for is out; `url` is its store page. */
+  external_exports.object({
+    template: external_exports.literal("appAvailable"),
+    to: external_exports.email(),
+    url: external_exports.url(),
+    platformName: external_exports.string().min(1).max(40)
+  }),
   /** An app's own end user signs in: sent from the app's name, replies go to `replyTo`. */
   external_exports.object({
     template: external_exports.literal("appUserCode"),
@@ -60308,213 +60572,6 @@ var notificationTrpc = defineTrpcContract("notification").query("settings").with
   })
 ).withOutput(external_exports.object({ subscribed: external_exports.literal(true) })).mutation("unsubscribeWebPush").withInput(external_exports.object({ workspaceId: workspaceIdSchema2, endpoint: external_exports.string().min(1).max(2048) })).withOutput(external_exports.object({ unsubscribed: external_exports.literal(true) })).query("apnsStatus").withInput(workspaceInputSchema2).withOutput(apnsStatusSchema).mutation("registerApnsDevice").withInput(registerApnsDeviceInputSchema).withOutput(external_exports.object({ registered: external_exports.literal(true) })).mutation("unregisterApnsDevice").withInput(unregisterApnsDeviceInputSchema).withOutput(external_exports.object({ unregistered: external_exports.literal(true) })).build();
 
-// ../../packages/config/src/config.ts
-var ConfigLeaf = class {
-  constructor(env, schema) {
-    this.env = env;
-    this.schema = schema;
-  }
-  env;
-  schema;
-};
-var definer = {
-  env: (env, schema) => new ConfigLeaf(env, schema)
-};
-var Config = {
-  define(build) {
-    return build(definer);
-  }
-};
-
-// ../../packages/config/src/env-schemas.ts
-var nodeEnvironmentSchema = external_exports.enum(["development", "test", "production"]);
-var environmentBooleanSchema = external_exports.union([external_exports.boolean(), external_exports.literal("true"), external_exports.literal("false"), external_exports.literal("1"), external_exports.literal("0")]).transform((value) => value === true || value === "true" || value === "1");
-var environmentExactOnSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value === true || value === "on");
-var environmentNotExactOffSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value !== false && value !== "off");
-var environmentOneOrTrueSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform(
-  (value) => value === true || typeof value === "string" && (value === "1" || value.toLowerCase() === "true")
-);
-var environmentPresenceSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value === true || typeof value === "string" && value.length > 0);
-var environmentExactOneSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value === true || value === "1");
-var environmentNotExactOneSchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform((value) => value !== "1");
-var environmentLegacyTruthySchema = external_exports.union([external_exports.string(), external_exports.boolean()]).optional().transform(
-  (value) => value === true || typeof value === "string" && /^(1|true|yes)$/i.test(value)
-);
-
-// ../../packages/config/src/deployment-facts.ts
-var positiveInteger = external_exports.coerce.number().int().positive();
-var optionalSetting = external_exports.preprocess(
-  (value) => value === "" ? void 0 : value,
-  external_exports.string().min(1).optional()
-);
-var { logSettings } = Config.define((c) => ({
-  logSettings: {
-    LOG_LEVEL: c.env("LOG_LEVEL", optionalSetting),
-    LOG_CONSOLE_LEVEL: c.env("LOG_CONSOLE_LEVEL", optionalSetting),
-    LOG_OTEL_LEVEL: c.env("LOG_OTEL_LEVEL", optionalSetting),
-    LOG_FORMAT: c.env("LOG_FORMAT", external_exports.enum(["pretty", "json"]).optional()),
-    PINO_LOG_LEVEL: c.env("PINO_LOG_LEVEL", optionalSetting),
-    _LOG_LEVEL: c.env("_LOG_LEVEL", optionalSetting),
-    PINO_CONSOLE_LEVEL: c.env("PINO_CONSOLE_LEVEL", optionalSetting),
-    PINO_OTEL_LEVEL: c.env("PINO_OTEL_LEVEL", optionalSetting)
-  }
-}));
-var { isSaas } = Config.define((c) => ({
-  isSaas: c.env("IS_SAAS", environmentOneOrTrueSchema)
-}));
-var { nodeEnvironment } = Config.define((c) => ({
-  nodeEnvironment: c.env("NODE_ENV", external_exports.string().optional())
-}));
-var { rawSocketPort } = Config.define((c) => ({
-  rawSocketPort: c.env("VOICE_WS_PORT", external_exports.coerce.number().int().min(0).max(65535).default(3300))
-}));
-var { outboundProxy } = Config.define((c) => ({
-  outboundProxy: {
-    HTTPS_PROXY: c.env("HTTPS_PROXY", external_exports.string().optional()),
-    https_proxy: c.env("https_proxy", external_exports.string().optional()),
-    HTTP_PROXY: c.env("HTTP_PROXY", external_exports.string().optional()),
-    http_proxy: c.env("http_proxy", external_exports.string().optional()),
-    NO_PROXY: c.env("NO_PROXY", external_exports.string().optional()),
-    no_proxy: c.env("no_proxy", external_exports.string().optional())
-  }
-}));
-var { blockLocalHttpCalls, allowedProxyHosts } = Config.define((c) => ({
-  blockLocalHttpCalls: c.env("BLOCK_LOCAL_HTTP_CALLS", environmentOneOrTrueSchema),
-  /** An unset allowlist is EMPTY, never a wildcard. */
-  allowedProxyHosts: c.env(
-    "ALLOWED_PROXY_HOSTS",
-    external_exports.string().optional().transform(
-      (value) => (value ?? "").split(",").map((host2) => host2.trim()).filter((host2) => host2.length > 0)
-    )
-  )
-}));
-var { telemetryExporterEndpoint } = Config.define((c) => ({
-  telemetryExporterEndpoint: c.env(
-    "OTEL_EXPORTER_OTLP_ENDPOINT",
-    external_exports.preprocess((value) => value === "" ? void 0 : value, external_exports.string().min(1).optional())
-  )
-}));
-var { publicBaseUrl } = Config.define((c) => ({
-  publicBaseUrl: c.env(
-    "BASE_HOST",
-    external_exports.string().optional().transform((value) => value?.trim() || void 0)
-  )
-}));
-var { publicOriginAliases } = Config.define((c) => ({
-  publicOriginAliases: c.env(
-    "BASE_HOST_ALIASES",
-    external_exports.string().optional().transform((value) => originsOf({ list: value ?? "" }))
-  )
-}));
-function originsOf({ list: list11 }) {
-  const origins = list11.split(",").map((entry) => entry.trim()).filter((entry) => URL.canParse(entry)).map((entry) => new URL(entry)).filter((url2) => url2.protocol === "https:" || url2.protocol === "http:").map((url2) => url2.origin);
-  return [...new Set(origins)];
-}
-var { appsDomain } = Config.define((c) => ({
-  appsDomain: c.env("APPS_DOMAIN", external_exports.string().min(1).default("lazeapps.com"))
-}));
-var optionalNonBlank = external_exports.preprocess(
-  (value) => value === "" ? void 0 : value,
-  external_exports.string().min(1).optional()
-);
-var { grafana } = Config.define((c) => ({
-  grafana: {
-    baseUrl: c.env("GRAFANA_BASE_URL", optionalNonBlank),
-    tempoDatasourceUid: c.env("GRAFANA_TEMPO_DATASOURCE_UID", optionalNonBlank),
-    lokiDatasourceUid: c.env("GRAFANA_LOKI_DATASOURCE_UID", optionalNonBlank)
-  }
-}));
-var { serviceVersion, otelResourceAttributes } = Config.define((c) => ({
-  serviceVersion: c.env("SERVICE_VERSION", optionalNonBlank),
-  otelResourceAttributes: c.env("OTEL_RESOURCE_ATTRIBUTES", optionalNonBlank)
-}));
-var { lazeDefaultModel } = Config.define((c) => ({
-  lazeDefaultModel: c.env(
-    "LAZE_DEFAULT_MODEL",
-    external_exports.string().optional().transform((value) => value?.trim() || void 0)
-  )
-}));
-var { gatewayPublicUrl, gatewayInternalUrl, gatewayLegacyUrl } = Config.define((c) => ({
-  gatewayPublicUrl: c.env("LW_GATEWAY_PUBLIC_URL", external_exports.string().optional()),
-  gatewayInternalUrl: c.env("LW_GATEWAY_INTERNAL_URL", external_exports.string().optional()),
-  gatewayLegacyUrl: c.env("LW_GATEWAY_BASE_URL", external_exports.string().optional())
-}));
-var publicProviderField = external_exports.string().min(1).optional();
-var signInProviders = Config.define((c) => ({
-  authProvider: c.env("AUTH_PROVIDER", publicProviderField),
-  /** The NextAuth-era name for `AUTH_PROVIDER`: deprecated, still applied. */
-  legacyProvider: c.env("NEXTAUTH_PROVIDER", publicProviderField),
-  googleClientId: c.env("GOOGLE_CLIENT_ID", publicProviderField),
-  githubClientId: c.env("GITHUB_CLIENT_ID", publicProviderField),
-  gitlabClientId: c.env("GITLAB_CLIENT_ID", publicProviderField),
-  azureAdClientId: c.env("AZURE_AD_CLIENT_ID", publicProviderField),
-  azureAdTenantId: c.env("AZURE_AD_TENANT_ID", publicProviderField),
-  auth0ClientId: c.env("AUTH0_CLIENT_ID", publicProviderField),
-  auth0Issuer: c.env("AUTH0_ISSUER", publicProviderField),
-  oktaClientId: c.env("OKTA_CLIENT_ID", publicProviderField),
-  oktaIssuer: c.env("OKTA_ISSUER", publicProviderField),
-  cognitoClientId: c.env("COGNITO_CLIENT_ID", publicProviderField),
-  cognitoIssuer: c.env("COGNITO_ISSUER", publicProviderField),
-  oneLoginClientId: c.env("ONELOGIN_CLIENT_ID", publicProviderField),
-  oneLoginIssuer: c.env("ONELOGIN_ISSUER", publicProviderField),
-  oidcClientId: c.env("OIDC_CLIENT_ID", publicProviderField),
-  oidcIssuer: c.env("OIDC_ISSUER", publicProviderField)
-}));
-var { adminEmails } = Config.define((c) => ({
-  adminEmails: c.env(
-    "ADMIN_EMAILS",
-    external_exports.string().optional().transform(
-      (raw) => (raw ?? "").split(",").map((email3) => email3.trim()).filter((email3) => email3.length > 0)
-    )
-  )
-}));
-var { signUpMode, signUpAllowedDomains } = Config.define((c) => ({
-  /** `open` admits anybody who reaches the installation; `invite_only` admits invited addresses. */
-  signUpMode: c.env(
-    "SIGN_UP_MODE",
-    external_exports.preprocess(
-      (value) => value === "" ? void 0 : value,
-      external_exports.enum(["open", "invite_only"]).default("open")
-    )
-  ),
-  /** Lowercased domains without a leading `@`; empty admits any domain. */
-  signUpAllowedDomains: c.env(
-    "SIGN_UP_ALLOWED_DOMAINS",
-    external_exports.string().optional().transform(
-      (raw) => (raw ?? "").split(",").map((domain2) => domain2.trim().toLowerCase().replace(/^@/, "")).filter((domain2) => domain2.length > 0)
-    )
-  )
-}));
-var { passkeysEnabled, mfaEnrollmentOpen, localPasswords } = Config.define((c) => ({
-  passkeysEnabled: c.env("PASSKEYS_ENABLED", environmentNotExactOffSchema),
-  mfaEnrollmentOpen: c.env("MFA_ENROLLMENT_OPEN", environmentExactOnSchema),
-  localPasswords: c.env("LOCAL_PASSWORDS_ENABLED", environmentExactOnSchema)
-}));
-var { trustedIdpOrigins, idpSimulatorUrl } = Config.define((c) => ({
-  trustedIdpOrigins: c.env("SSO_TRUSTED_IDP_ORIGINS", external_exports.string().optional()),
-  idpSimulatorUrl: c.env("LAZE_IDPSIM_URL", external_exports.string().optional())
-}));
-var { posthogKey, posthogHost } = Config.define((c) => ({
-  posthogKey: c.env("POSTHOG_KEY", external_exports.string().optional()),
-  posthogHost: c.env("POSTHOG_HOST", external_exports.string().optional())
-}));
-var { foldCacheTtlSeconds } = Config.define((c) => ({
-  foldCacheTtlSeconds: c.env("LAZE_FOLD_CACHE_TTL_SECONDS", positiveInteger.default(300))
-}));
-var { slackApiBase, slackWebhookBase } = Config.define((c) => ({
-  slackApiBase: c.env("SLACK_API_BASE", external_exports.string().url().default("https://slack.com/api")),
-  slackWebhookBase: c.env(
-    "SLACK_WEBHOOK_BASE",
-    external_exports.string().url().default("https://hooks.slack.com")
-  )
-}));
-var { allowInsecureLocalUrls } = Config.define((c) => ({
-  allowInsecureLocalUrls: c.env(
-    "WEBHOOKS_UNSAFE_ALLOW_LOCAL_URLS",
-    external_exports.union([external_exports.boolean(), external_exports.literal("1"), external_exports.literal("0"), external_exports.literal("")]).optional().transform((value) => value === true || value === "1")
-  )
-}));
-
 // ../../modules/notification/contract/src/notification.config.ts
 var notificationConfig = Config.define((c) => ({
   emailProvider: c.env("EMAIL_PROVIDER", external_exports.enum(["scaleway-tem", "smtp"]).default("smtp")),
@@ -60991,6 +61048,7 @@ var ChatPlaceHooksToken = chatUi.hooks("place");
 var ChatPresenceHooksToken = chatUi.hooks("presence");
 var ChatStatusDialogSlot = chatUi.component("status-dialog");
 var ChatExternalPersonCardSlot = chatUi.extension("external-person-card");
+var ChatNewChannelDialogSlot = chatUi.component("new-channel-dialog");
 
 // ../../modules/chat/contract/src/chat.text.ts
 function withoutMarkdownMarks(text2) {
@@ -61166,6 +61224,7 @@ var vaultSealedApprovalSchema = vaultSealedApprovalSchemaDefinition;
 var vaultUi = uiTokens("vault");
 var VaultSealedApprovalSlot = vaultUi.component("sealedApproval");
 var VaultShareApprovalSlot = vaultUi.component("shareApproval");
+var VaultMachineKeyApprovalSlot = vaultUi.component("machineKeyApproval");
 var VaultPasskeyStepSlot = vaultUi.component("passkeyStep");
 var VaultNavSlot = vaultUi.component("nav");
 var answerSealedApprovalInputSchemaDefinition = external_exports.object({
@@ -61551,6 +61610,29 @@ var approveVaultShareInputSchemaDefinition = external_exports.object({
   reauthToken: external_exports.string().min(1)
 });
 var approveVaultShareInputSchema = approveVaultShareInputSchemaDefinition;
+var approveVaultMachineKeyInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  apiKeyId: external_exports.string().min(1),
+  reauthToken: external_exports.string().min(1)
+});
+var approveVaultMachineKeyInputSchema = approveVaultMachineKeyInputSchemaDefinition;
+var approvedVaultMachineKeySchemaDefinition = external_exports.object({
+  /** When the key needs the owner's passkey again. */
+  recheckDueAt: external_exports.string().nullable()
+});
+var approvedVaultMachineKeySchema = approvedVaultMachineKeySchemaDefinition;
+var vaultReadLockSchemaDefinition = external_exports.object({
+  locked: external_exports.boolean(),
+  /** The CLI key whose burst locked them, as it named itself; null when not locked. */
+  clientName: external_exports.string().nullable(),
+  lockedAt: external_exports.iso.datetime().nullable()
+});
+var vaultReadLockSchema = vaultReadLockSchemaDefinition;
+var unlockVaultReadsInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  reauthToken: external_exports.string().min(1)
+});
+var unlockVaultReadsInputSchema = unlockVaultReadsInputSchemaDefinition;
 var revokeVaultGrantInputSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
   grantId: external_exports.string().min(1),
@@ -61958,7 +62040,7 @@ var vaultTrpc = defineTrpcContract("vault").mutation("createConnection").withInp
     reason: external_exports.string().trim().min(1).max(200),
     reauthToken: external_exports.string().min(1).max(200).optional()
   })
-).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(revokeVaultGrantInputSchema).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).mutation("shareConnection").withInput(shareVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("approveShare").withInput(approveVaultShareInputSchema).withOutput(vaultGrantSchema).mutation("sealConnection").withInput(sealVaultConnectionInputSchema).withOutput(vaultConnectionSchema).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalListStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
+).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(revokeVaultGrantInputSchema).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).mutation("shareConnection").withInput(shareVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("approveShare").withInput(approveVaultShareInputSchema).withOutput(vaultGrantSchema).mutation("approveMachineKey").withInput(approveVaultMachineKeyInputSchema).withOutput(approvedVaultMachineKeySchema).query("readLock").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(vaultReadLockSchema).mutation("unlockReads").withInput(unlockVaultReadsInputSchema).withOutput(vaultReadLockSchema).mutation("sealConnection").withInput(sealVaultConnectionInputSchema).withOutput(vaultConnectionSchema).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalListStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
   external_exports.object({
     ...connectionInput.shape,
     reason: external_exports.string().trim().min(1).max(200),
@@ -62389,28 +62471,26 @@ var vaultAlertRaisedPayloadSchemaDefinition = external_exports.object({
   at: external_exports.iso.datetime()
 });
 
-// ../../modules/vault/contract/src/vault-reference-chip.ts
-var VaultReferenceChipSlot = uiTokens("vault").component("referenceChip");
-var VaultMessageFootSlot = uiTokens("vault").component("messageFoot");
-var REFERENCE = /\{\{vault:([A-Za-z0-9_][A-Za-z0-9_./:-]*)\}\}/g;
-function vaultReferenceNames({ text: text2 }) {
-  return [...new Set([...text2.matchAll(REFERENCE)].map((match) => match[1] ?? ""))].filter(
-    (name3) => name3 !== ""
-  );
-}
-function vaultReferenceConnectionName({ name: name3 }) {
-  return name3.split(".")[0] ?? name3;
-}
-
 // ../../modules/vault/contract/src/vault-pending.ts
 var connectionName2 = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/);
+var VAULT_HOLD_MAX_TEXTS = 64;
 var holdPastedSecretsInputSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
   senderUserId: external_exports.string().min(1),
   channelId: external_exports.string().min(1),
   /** The message the text belongs to; only its own delivery opens what it held. */
   messageId: external_exports.string().min(1),
-  texts: external_exports.array(external_exports.string().max(VAULT_SCRUB_MAX_TEXT)).min(1).max(64)
+  texts: external_exports.array(external_exports.string().max(VAULT_SCRUB_MAX_TEXT)).min(1).max(VAULT_HOLD_MAX_TEXTS),
+  /**
+   * `pending`: new keys go to the sender's vault. `possible`: the text is someone else's (a
+   * mirror brought it in), so new keys are saved nowhere and come back as possible secrets.
+   */
+  found: external_exports.enum(["pending", "possible"]).default("pending"),
+  /**
+   * Seals each run of many flagged values (a stack trace, a log) as one redacted block, returned
+   * in `possible` and saved in no vault. Chat messages ask for it; other texts hold per value.
+   */
+  blocks: external_exports.boolean().default(false)
 });
 var vaultPendingSecretSchemaDefinition = external_exports.object({
   pendingId: external_exports.string().min(1),
@@ -62421,12 +62501,23 @@ var vaultPendingSecretSchemaDefinition = external_exports.object({
   /** The connection's one field, such as `OPENAI_API_KEY`. */
   field: external_exports.string().min(1)
 });
+var vaultPossibleSecretSchemaDefinition = external_exports.object({
+  name: connectionName2,
+  value: external_exports.string().min(1),
+  vendor: external_exports.string().min(1),
+  field: external_exports.string().min(1)
+});
 var vaultHeldSecretsSchemaDefinition = external_exports.object({
   texts: external_exports.array(external_exports.string()),
   changed: external_exports.boolean(),
   /** Values the vault already held, now references. */
   held: external_exports.number().int().nonnegative(),
-  pending: external_exports.array(vaultPendingSecretSchemaDefinition)
+  pending: external_exports.array(vaultPendingSecretSchemaDefinition),
+  /**
+   * With `found: "possible"`: each flagged value once, as its `{{vault:NAME}}` in `texts`. With
+   * `blocks`: each redacted block too, in either mode.
+   */
+  possible: external_exports.array(vaultPossibleSecretSchemaDefinition).optional()
 });
 var vaultRevealRecipientSchemaDefinition = external_exports.discriminatedUnion("kind", [
   external_exports.object({ kind: external_exports.literal("laze_agent"), agentId: external_exports.string().min(1) }),
@@ -62491,6 +62582,114 @@ var vaultPendingSecretReleasedPayloadSchemaDefinition = external_exports.object(
   text: external_exports.string().min(1).max(VAULT_SCRUB_MAX_TEXT),
   at: external_exports.iso.datetime()
 });
+var vaultPendingKeepReasonSchema = external_exports.enum(["named", "used", "shared", "sealed"]);
+
+// ../../modules/vault/contract/src/vault-redacted-block.ts
+var REDACTED_BLOCK_MIN_VALUES = 3;
+var REDACTED_BLOCK_MIN_LINES = 2;
+var REDACTED_BLOCK_MAX_GAP = 3;
+var FENCE = /^\s*(?:>\s?)*(`{3,}|~{3,})/;
+var BLANK = /^\s*(?:>\s*)*$/;
+function segmentsOf({ lines: lines2 }) {
+  const out = [];
+  let open4 = null;
+  let fence = null;
+  const close = (end) => {
+    if (open4 && end >= open4.start) out.push({ start: open4.start, end, fenced: open4.fenced });
+    open4 = null;
+  };
+  lines2.forEach((line, index) => {
+    const marker = FENCE.exec(line)?.[1];
+    if (fence !== null) {
+      if (marker && marker[0] === fence[0] && marker.length >= fence.length) {
+        close(index - 1);
+        fence = null;
+      } else if (!open4) open4 = { start: index, fenced: true };
+      return;
+    }
+    if (marker) {
+      close(index - 1);
+      fence = marker;
+      return;
+    }
+    if (BLANK.test(line)) close(index - 1);
+    else if (!open4) open4 = { start: index, fenced: false };
+  });
+  close(lines2.length - 1);
+  return out;
+}
+function clustersIn({
+  segment,
+  flagged
+}) {
+  const out = [];
+  let current2 = null;
+  for (let index = segment.start; index <= segment.end; index += 1) {
+    const count5 = flagged[index] ?? 0;
+    if (count5 === 0) continue;
+    if (current2 && index - current2.end - 1 <= REDACTED_BLOCK_MAX_GAP) {
+      current2.end = index;
+      current2.values += count5;
+      continue;
+    }
+    if (current2) out.push(current2);
+    current2 = { start: index, end: index, values: count5 };
+  }
+  if (current2) out.push(current2);
+  return out;
+}
+function redactedBlocks({
+  lines: lines2,
+  flagged
+}) {
+  const out = [];
+  for (const segment of segmentsOf({ lines: lines2 })) {
+    for (const cluster of clustersIn({ segment, flagged })) {
+      const span = cluster.end - cluster.start + 1;
+      if (cluster.values < REDACTED_BLOCK_MIN_VALUES || span < REDACTED_BLOCK_MIN_LINES) continue;
+      const whole = segment.fenced && cluster.start === segment.start && cluster.end === segment.end;
+      const closed = whole && FENCE.test(lines2[segment.end + 1] ?? "");
+      out.push(closed ? { ...cluster, start: cluster.start - 1, end: cluster.end + 1 } : cluster);
+    }
+  }
+  return out;
+}
+function redactedBlocksAt({
+  text: text2,
+  offsets
+}) {
+  const lines2 = text2.split("\n");
+  const starts = [];
+  let at = 0;
+  for (const line of lines2) {
+    starts.push(at);
+    at += line.length + 1;
+  }
+  const lineAt = (offset) => starts.findLastIndex((start2) => start2 <= offset);
+  const flagged = lines2.map(() => 0);
+  for (const offset of offsets) {
+    const line = lineAt(offset);
+    flagged[line] = (flagged[line] ?? 0) + 1;
+  }
+  const blocks = redactedBlocks({ lines: lines2, flagged });
+  const inside = (line) => blocks.some((block2) => line >= block2.start && line <= block2.end);
+  const values = flagged.reduce((sum, count5, line) => inside(line) ? sum + count5 : sum, 0);
+  return { values, insideAt: (offset) => inside(lineAt(offset)) };
+}
+
+// ../../modules/vault/contract/src/vault-reference-chip.ts
+var VaultReferenceChipSlot = uiTokens("vault").component("referenceChip");
+var VaultSaveFoundSecretSlot = uiTokens("vault").component("saveFoundSecret");
+var VaultMessageFootSlot = uiTokens("vault").component("messageFoot");
+var REFERENCE = /\{\{vault:([A-Za-z0-9_][A-Za-z0-9_./:-]*)\}\}/g;
+function vaultReferenceNames({ text: text2 }) {
+  return [...new Set([...text2.matchAll(REFERENCE)].map((match) => match[1] ?? ""))].filter(
+    (name3) => name3 !== ""
+  );
+}
+function vaultReferenceConnectionName({ name: name3 }) {
+  return name3.split(".")[0] ?? name3;
+}
 
 // ../../modules/vault/contract/src/vault-apps.ts
 var vaultAppConnectionSchemaDefinition = external_exports.object({
@@ -62631,6 +62830,13 @@ var vaultLockdownSchemaDefinition = external_exports.object({
   }).nullable(),
   override: vaultLockdownOverrideSchemaDefinition.nullable()
 });
+var vaultAlertsSettleRequestedPayloadSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  kind: external_exports.string().regex(/^[a-z_]{1,64}$/),
+  label: external_exports.string().min(1).max(80),
+  requestId: external_exports.string().min(1),
+  at: external_exports.iso.datetime()
+});
 var vaultWatchReportReceivedPayloadSchemaDefinition = external_exports.object({
   /** The alert workspace (VAULT_ALERT_WORKSPACE_ID), where a stopped watchdog's card lands. */
   workspaceId: external_exports.string().min(1),
@@ -64123,7 +64329,9 @@ var startConversationInputSchemaDefinition = external_exports.object({
   agentId: idSchema7,
   /** The first message: a conversation is only made once there is something to say. */
   body: firstMessageSchema,
-  clientKey: clientKeySchema
+  clientKey: clientKeySchema,
+  /** A message the starter may read: the first message quotes it, as a forward does. */
+  contextMessageId: idSchema7.optional()
 });
 var startConversationInputSchema = startConversationInputSchemaDefinition;
 var startedConversationSchemaDefinition = external_exports.object({
@@ -64150,7 +64358,8 @@ var listConversationsInputSchema = listConversationsInputSchemaDefinition;
 var conversationSummarySchema2 = chatSummarySchema;
 var startConversationAsCallerInputSchemaDefinition = external_exports.object({
   agent: agentRefSchema2,
-  text: firstMessageSchema
+  text: firstMessageSchema,
+  about: idSchema7.optional().describe("The id of a message to continue from: the first message quotes it.")
 });
 var listConversationsAsCallerInputSchemaDefinition = external_exports.object({
   agent: agentRefSchema2.optional(),
@@ -65913,6 +66122,8 @@ var remoteHttpRequestSchemaDefinition = external_exports.object({
   authorization: external_exports.string().optional(),
   contentType: external_exports.string().optional(),
   body: external_exports.string(),
+  /** The host the request came to (`X-Forwarded-Host`, else `Host`): the origin it names. */
+  host: external_exports.string().optional(),
   /** This api process on loopback, where the MCP tools call the REST operations. */
   loopbackOrigin: external_exports.string(),
   /** The MCP-Protocol-Version, Mcp-Method and Mcp-Name headers, which 2026-07-28 checks. */
@@ -66315,6 +66526,16 @@ var inboxWaitingSchemaDefinition = external_exports.object({
   oldestPostedAt: external_exports.iso.datetime().nullable(),
   session: agentSessionSchemaDefinition.nullable()
 });
+var inboxPreviewSchemaDefinition = external_exports.object({
+  messageId: idSchema17,
+  channelId: idSchema17,
+  channelName: external_exports.string(),
+  channelKind: external_exports.enum(["public", "private", "dm", "group", "chat"]),
+  author: external_exports.object({ kind: external_exports.enum(["person", "agent"]), id: idSchema17, name: external_exports.string() }),
+  /** At most 200 characters of the message. */
+  preview: external_exports.string().max(200),
+  postedAt: external_exports.iso.datetime()
+});
 var callerSchemaDefinition = external_exports.object({
   kind: external_exports.enum(["person", "agent"]),
   id: idSchema17,
@@ -66323,6 +66544,8 @@ var callerSchemaDefinition = external_exports.object({
   agent: agentSchemaDefinition.nullable(),
   /** Messages waiting in the agent's inbox, not taken yet; 0 for a person. */
   pendingCount: external_exports.number().int().min(0).optional(),
+  /** The newest of them, at most 3, still waiting for read_inbox; absent when none wait. */
+  pendingNewest: external_exports.array(inboxPreviewSchemaDefinition).max(3).optional(),
   /** The person's language, or the agent owner's (BCP 47; en-US until they pick one). */
   language: external_exports.string().optional(),
   /** The person's time zone, or the agent owner's (IANA; UTC while Laze does not know it). */
@@ -66603,6 +66826,16 @@ var agentConfig = Config.define((c) => ({
   attentionTimeoutMinutes: c.env("AGENT_ATTENTION_TIMEOUT_MINUTES", positiveInt3.default(30)),
   /** Where a GitHub signature links back; the origin the connect command fetches the CLI from. */
   publicBaseUrl,
+  /** Other origins this Laze answers on; MCP and OAuth describe the one a request used. */
+  publicOriginAliases,
+  /**
+   * The origin people and agents are told to connect to (MCP server URL, setup prompt, link
+   * command): `BASE_HOST` or one of its aliases, else ignored for `BASE_HOST`. docs/ops/domains.md
+   */
+  connectOrigin: c.env(
+    "AGENT_CONNECT_ORIGIN",
+    external_exports.string().optional().transform((value) => value?.trim() || void 0)
+  ),
   /** The packed Laze CLI tarballs and their `laze-cli.json` manifest, from scripts/pack-cli.mjs. */
   cliPackageDirectory: c.env(
     "AGENT_CLI_PACKAGE_DIR",
@@ -66615,6 +66848,12 @@ var agentConfig = Config.define((c) => ({
   )
 }));
 
+// ../../modules/agent/contract/src/agent-browser-config.ts
+var agentBrowserConfigDefinition = external_exports.strictObject({
+  /** The origin the connect dialog names (`AGENT_CONNECT_ORIGIN`); null shows the page's own. */
+  connectOrigin: external_exports.string().nullable()
+});
+
 // ../../modules/agent/contract/src/agent-delivery.ts
 var agentDeliveryDuePayloadSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
@@ -67509,7 +67748,7 @@ async function namingFirst({ client, args }) {
   throw new CliUsageError(namingFirstTextOf({ channelIds: unnamed.map((chat) => chat.id) }));
 }
 function serverUrlOf({ context, args }) {
-  return flagText({ args, name: "url" }) || context.environment.url || "https://laze.langwatch.ai";
+  return flagText({ args, name: "url" }) || context.environment.url || DEFAULT_LAZE_URL;
 }
 
 // src/services/agent-access-commands.service.ts
@@ -69752,12 +69991,15 @@ async function actOn({
 // src/services/secret-offer.service.ts
 function secretsIn(text2) {
   const seen = /* @__PURE__ */ new Set();
-  return draftSecretsIn({ text: text2 }).flatMap((secret) => {
-    if (seen.has(secret.value)) return [];
+  const found = draftSecretsIn({ text: text2 });
+  const blocks = redactedBlocksAt({ text: text2, offsets: found.map((secret) => secret.start) });
+  const secrets = found.flatMap((secret) => {
+    if (seen.has(secret.value) || blocks.insideAt(secret.start)) return [];
     seen.add(secret.value);
     const field = secret.suggestedName;
     return [{ value: secret.value, field, suggested: connectionNameForField(field) }];
   });
+  return { secrets, blockValues: blocks.values };
 }
 function keychainOf(args) {
   const keychain2 = flagText({ args, name: "keychain", fallback: "personal" });
@@ -69802,7 +70044,13 @@ async function textToSend({
   leaves
 }) {
   if (profile.kind !== "person" || args.flags["as-is"]) return text2;
-  const secrets = secretsIn(text2);
+  const { secrets, blockValues } = secretsIn(text2);
+  if (blockValues > 0) {
+    context.err(
+      `This looks like a log or stack trace: ${blockValues} flagged values go as one redacted block, saved in no vault.
+`
+    );
+  }
   if (secrets.length === 0) return text2;
   const keychain2 = keychainOf(args);
   if (!args.flags.save && !await leaves()) return text2;
@@ -70432,8 +70680,8 @@ var openclawConfig = Config.define((c) => ({
   reconnectMaxSeconds: c.env("OPENCLAW_RECONNECT_MAX_SECONDS", positiveInt5.default(60)),
   /** How long one inbox read waits for an agent's next message. */
   inboxWaitSeconds: c.env("OPENCLAW_INBOX_WAIT_SECONDS", positiveInt5.max(55).default(25)),
-  /** A run that shows no progress for this long is given up and said so in the conversation. */
-  runTimeoutMinutes: c.env("OPENCLAW_RUN_TIMEOUT_MINUTES", positiveInt5.default(30)),
+  /** A run that shows no progress for this long is aborted and said so in the conversation. */
+  runTimeoutMinutes: c.env("OPENCLAW_RUN_TIMEOUT_MINUTES", positiveInt5.default(15)),
   /** The hard limit of one run, progress or not; OpenClaw gets it as the run's `timeoutMs`. */
   runMaxHours: c.env("OPENCLAW_RUN_MAX_HOURS", positiveInt5.default(6)),
   /** Where the progress board ops card for a gateway that stopped answering is written. */
@@ -72270,10 +72518,14 @@ are waiting, if you think one was missed.
 ## Apps
 
 Asked for an app (a tracker, a CRM, a dashboard, a page that explains something), read the full
-guide first: https://laze.langwatch.ai/docs/agents/apps.md. The short version:
-
-- Create it where it was asked for, from the closest template:
-  \`laze app create "<Name>" --template tracker|crm|dashboard|form --channel <channel>\`.
+guide first: https://laze.so/docs/agents/apps.md. The short version:
+
+- Create it where it was asked for, from the closest template (\`laze app templates\` lists
+  them): \`laze app create "<Name>" --template <template> --channel <channel>\`. The template is
+  the first live version, copied into a folder that is yours to change.
+- Slides, a deck or a talk: start from \`laze app create <name> --template slides\`. Each slide
+  is a file in slides/, listed in order in slides/deck.json; the deck presents full screen and
+  exports PDF and HTML on its own.
   An app that already exists goes in with \`laze app pin <app> --channel <channel>\`, never as a
   pinned message with a link. A pin opens it to everyone there, and their agents may build on it.
 - A new app is Restricted. Do not share it with only the person who asked when they asked in a
@@ -72332,7 +72584,7 @@ function lazePluginFiles({
   const json7 = (value) => `${JSON.stringify(value, null, 2)}
 `;
   const description = "Laze messages reach this session, and the laze tools to answer them";
-  const author = { name: "Laze", url: "https://laze.langwatch.ai" };
+  const author = { name: "Laze", url: "https://laze.so" };
   return {
     ".claude-plugin/marketplace.json": json7({
       name: LAZE_PLUGIN,
@@ -72345,7 +72597,7 @@ function lazePluginFiles({
       version: version2,
       description,
       author,
-      homepage: "https://laze.langwatch.ai/docs/agents/connect",
+      homepage: "https://laze.so/docs/agents/connect",
       keywords: ["laze", "chat", "agents"],
       extensions: { "ai.laze": { delivery: "ai.laze/delivery.json" } }
     }),
@@ -74334,6 +74586,7 @@ var appConnectionAnswerSchemaDefinition = external_exports.object({
 
 // ../../modules/app/contract/src/app.api.ts
 var appSlugSchema = external_exports.string().min(2).max(24).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "lower case letters and digits, joined by single hyphens");
+var appTemplateNameSchema = external_exports.string().min(2).max(40).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "lower case letters and digits, joined by single hyphens");
 var APP_VISIBILITIES = ["restricted", "channel", "internal", "public"];
 var appVisibilitySchema = external_exports.enum(APP_VISIBILITIES);
 var APP_ROLES = ["viewer", "editor", "builder"];
@@ -74400,6 +74653,10 @@ var appSchemaDefinition = external_exports.object({
   role: appRoleSchema.nullable().optional(),
   /** The agent that built it, a Builder by standing; null or absent when a person did. */
   creatorAgentId: external_exports.string().nullable().optional(),
+  /** The template the app started from; null or absent for an app built from nothing. */
+  templateName: external_exports.string().nullable().optional(),
+  /** That template's version when the app was made, so a later version can be offered. */
+  templateVersion: external_exports.number().int().positive().nullable().optional(),
   createdAt: external_exports.iso.datetime(),
   updatedAt: external_exports.iso.datetime()
 });
@@ -74499,7 +74756,9 @@ var createAppInputSchemaDefinition = external_exports.object({
   /** Restricted unless chosen: owner, admins, shares and the conversations it is pinned to. */
   visibility: appVisibilitySchema.default("restricted"),
   /** The agent a person hands the new app to, which becomes its creator and a Builder. */
-  creatorAgentId: external_exports.string().min(1).optional()
+  creatorAgentId: external_exports.string().min(1).optional(),
+  /** Starts the app from this template: its files are the first live version. */
+  template: appTemplateNameSchema.optional()
 });
 var createAppInputSchema = createAppInputSchemaDefinition;
 var listAppsInputSchemaDefinition = external_exports.object({
@@ -75124,7 +75383,7 @@ var appFaultClaimsSchemaDefinition = external_exports.object({
   ver: external_exports.string().min(1).max(64),
   vid: external_exports.string().min(1),
   vname: external_exports.string().max(200),
-  kind: external_exports.enum(["error", "rejection", "banner", "api"]),
+  kind: external_exports.enum(["error", "rejection", "banner", "api", "resource", "csp"]),
   msg: external_exports.string().min(1).max(1e3),
   stack: external_exports.string().max(4e3).optional(),
   req: external_exports.object({
@@ -75133,6 +75392,14 @@ var appFaultClaimsSchemaDefinition = external_exports.object({
     status: external_exports.number().int(),
     code: external_exports.string().max(160).optional()
   }).optional(),
+  /** Files the page could not load, with the policy directive that blocked each, if one did. */
+  res: external_exports.array(
+    external_exports.object({
+      el: external_exports.string().max(80),
+      url: external_exports.string().max(600),
+      dir: external_exports.string().max(80).optional()
+    })
+  ).max(10).optional(),
   act: external_exports.string().max(400),
   page: external_exports.string().max(600)
 });
@@ -75584,11 +75851,55 @@ var appBackupCheckAlertsSchemaDefinition = external_exports.object({
   adminUserIds: external_exports.array(external_exports.string())
 });
 
+// ../../modules/app/contract/src/app.templates.ts
+var APP_TEMPLATE_SOURCES = ["laze"];
+var templateCollectionsSchema = external_exports.record(
+  collectionNameSchema,
+  external_exports.object({
+    fields: external_exports.array(collectionFieldSchema).min(1),
+    rules: collectionRulesSchema.optional()
+  })
+).default({});
+var appTemplateManifestSchemaDefinition = external_exports.object({
+  name: appTemplateNameSchema,
+  title: external_exports.string().trim().min(1).max(60),
+  description: external_exports.string().trim().min(1).max(300),
+  /** Grows when the template changes; an app records the version it copied. */
+  version: external_exports.number().int().positive(),
+  /** The page the app opens on, a path in the folder. */
+  entry: external_exports.string().min(1).max(200),
+  /** One or two sentences an agent reads first: how to change an app made from it. */
+  guide: external_exports.string().trim().max(500).optional(),
+  collections: templateCollectionsSchema,
+  views: external_exports.array(appViewSpecSchema).default([]),
+  seed: external_exports.record(collectionNameSchema, external_exports.array(appRecordSchema)).default({})
+});
+var appTemplateSchemaDefinition = external_exports.object({
+  ...appTemplateManifestSchemaDefinition.shape,
+  source: external_exports.enum(APP_TEMPLATE_SOURCES)
+});
+var appTemplateSchema = appTemplateSchemaDefinition;
+var writeAppFilesShape = {
+  appId: external_exports.string().min(1),
+  files: external_exports.array(appFileSchema).max(200).default([]),
+  /** Paths to remove from the version. */
+  remove: external_exports.array(appFileSchema.shape.path).max(200).default([]),
+  /** What changed, for a person; empty or throwaway messages are refused. */
+  message: external_exports.string().trim().max(500)
+};
+var somethingToWrite = {
+  check: (input2) => input2.files.length + input2.remove.length > 0,
+  message: "Give a file to write or a path to remove"
+};
+var writeAppFilesInputSchemaDefinition = external_exports.object({ workspaceId: external_exports.string().min(1), ...writeAppFilesShape }).refine(somethingToWrite.check, { message: somethingToWrite.message });
+var writeAppFilesByKeyInputSchemaDefinition = external_exports.object(writeAppFilesShape).refine(somethingToWrite.check, { message: somethingToWrite.message });
+var appTemplatesByKeyQuerySchemaDefinition = external_exports.object({});
+
 // ../../modules/app/contract/src/app.trpc.ts
 var appMainTrpc = defineTrpcContract("app").query("list").withInput(listAppsInputSchema).withOutput(external_exports.array(appSchema)).query("get").withInput(appRefSchema).withOutput(appSchema).mutation("create").withInput(createAppInputSchema).withOutput(appSchema).mutation("rename").withInput(renameAppInputSchema).withOutput(appSchema).mutation("archive").withInput(appRefSchema).withOutput(appSchema).mutation("unarchive").withInput(appRefSchema).withOutput(appSchema).mutation("delete").withInput(deleteAppInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("versions").withInput(appRefSchema).withOutput(external_exports.array(appVersionSchema)).mutation("revert").withInput(revertInputSchema).withOutput(appPushSchema).mutation("publish").withInput(publishInputSchema).withOutput(publishOutcomeSchema).query("collections").withInput(appDataRefSchema).withOutput(external_exports.array(collectionSchema)).query("records").withInput(listRecordsInputSchema).withOutput(recordPageSchema).mutation("writeRecord").withInput(writeRecordInputSchema).withOutput(appRecordSchema).mutation("deleteRecord").withInput(deleteRecordInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("views").withInput(appDataRefSchema).withOutput(external_exports.array(appViewSchema)).mutation("saveView").withInput(saveViewInputSchema).withOutput(appViewSchema).mutation("deleteView").withInput(deleteViewInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).mutation("chooseCardRows").withInput(chooseCardRowsInputSchema).withOutput(appCardChoiceSchema).query("exportRecords").withInput(exportRecordsInputSchema).withOutput(recordExportSchema).mutation("importRecords").withInput(importRecordsInputSchema).withOutput(recordImportSchema).mutation("decidePublish").withInput(decidePublishInputSchema).withOutput(publishOutcomeSchema).mutation("nameVersion").withInput(nameVersionInputSchema).withOutput(appVersionSchema).mutation("makeInternal").withInput(appRefSchema).withOutput(appSchema).mutation("revokePublishLease").withInput(appRefSchema).withOutput(appSchema).mutation("signInHandoff").withInput(signInHandoffInputSchema).withOutput(signInHandoffSchema).query("functionLogs").withInput(listFunctionLogsInputSchema).withOutput(external_exports.array(appFunctionLogEntrySchema)).query("access").withInput(appRefSchema).withOutput(appAccessSchema).query("members").withInput(appRefSchema).withOutput(appMembersSchema).mutation("grantAccess").withInput(grantAppAccessInputSchema).withOutput(appAccessSchema).mutation("revokeAccess").withInput(revokeAppAccessInputSchema).withOutput(appAccessSchema).mutation("setVisibility").withInput(setAppVisibilityInputSchema).withOutput(visibilityOutcomeSchema).mutation("setMemberRole").withInput(setMemberRoleInputSchema).withOutput(appAccessSchema).mutation("unpublish").withInput(appRefSchema).withOutput(appSchema).query("door").withInput(appRefSchema).withOutput(appDoorSchema).mutation("requestAccess").withInput(appRefSchema).withOutput(appDoorSchema).mutation("decideAccess").withInput(decideAppAccessInputSchema).withOutput(appAccessRequestSchema).query("users").withInput(appRefSchema).withOutput(appUsersSchema).mutation("blockUser").withInput(blockAppUserInputSchema).withOutput(appUsersSchema).mutation("deleteUser").withInput(deleteAppUserInputSchema).withOutput(deletedAppUserSchema).query("backups").withInput(appRefSchema).withOutput(appBackupStatusSchema).mutation("restoreData").withInput(restoreAppDataInputSchema).withOutput(appRestoreSchema).query("cost").withInput(appRefSchema).withOutput(appCostSchema).mutation("setBudget").withInput(setAppBudgetInputSchema).withOutput(appCostSchema).query("triggers").withInput(appRefSchema).withOutput(appTriggersSchema).mutation("setTriggerPaused").withInput(setAppTriggerPausedInputSchema).withOutput(appTriggerSchema).mutation("removeTrigger").withInput(appTriggerRefSchema).withOutput(external_exports.object({ removed: external_exports.literal(true) })).build();
 var appConnectionsTrpc = defineTrpcContract("app").query("connections").withInput(appRefSchema).withOutput(appConnectionsSchema).mutation("allowConnection").withInput(appConnectionRefSchema).withOutput(appConnectionsSchema).mutation("revokeConnection").withInput(appConnectionRefSchema).withOutput(appConnectionsSchema).build();
 var appPinsTrpc = defineTrpcContract("app").query("pins").withInput(channelPinsInputSchema).withOutput(channelAppPinsSchema).mutation("pin").withInput(pinAppInputSchema).withOutput(channelAppPinsSchema).mutation("unpin").withInput(pinAppInputSchema).withOutput(channelAppPinsSchema).mutation("setPinView").withInput(setPinViewInputSchema).withOutput(channelAppPinsSchema).mutation("reorderPins").withInput(reorderPinsInputSchema).withOutput(channelAppPinsSchema).mutation("setPinRole").withInput(setPinRoleInputSchema).withOutput(appAccessSchema).build();
-var appSettingsTrpc = defineTrpcContract("app").query("workspaceSettings").withInput(appWorkspaceRefSchema).withOutput(appWorkspaceSettingsSchema).query("functionSettings").withInput(appWorkspaceRefSchema).withOutput(appFunctionSettingsSchema).mutation("setFunctionsEnabled").withInput(setFunctionsEnabledInputSchema).withOutput(appFunctionSettingsSchema).mutation("setPublicAppsAllowed").withInput(setPublicAppsAllowedInputSchema).withOutput(appFunctionSettingsSchema).build();
+var appSettingsTrpc = defineTrpcContract("app").query("workspaceSettings").withInput(appWorkspaceRefSchema).withOutput(appWorkspaceSettingsSchema).query("functionSettings").withInput(appWorkspaceRefSchema).withOutput(appFunctionSettingsSchema).mutation("setFunctionsEnabled").withInput(setFunctionsEnabledInputSchema).withOutput(appFunctionSettingsSchema).mutation("setPublicAppsAllowed").withInput(setPublicAppsAllowedInputSchema).withOutput(appFunctionSettingsSchema).query("templates").withInput(appWorkspaceRefSchema).withOutput(external_exports.array(appTemplateSchema)).build();
 var appTrpc = joinTrpcContracts(
   "app",
   appMainTrpc,
@@ -75654,7 +75965,6 @@ var deleteAppUserByKeyInputSchemaDefinition = deleteAppUserInputSchema.omit(byKe
 var appListByKeyQuerySchemaDefinition = external_exports.object({ archived: external_exports.enum(["true"]).optional() });
 
 // ../../modules/app/contract/src/app.cli.ts
-var APP_TEMPLATES = ["tracker", "crm", "dashboard", "form"];
 var APP_MANIFEST_FILE = "laze.app.json";
 var appManifestSchemaDefinition = external_exports.object({
   app: external_exports.object({ id: external_exports.string().min(1), name: external_exports.string(), slug: appSlugSchema }),
@@ -75684,8 +75994,14 @@ var appCliCommands = [
   {
     command: "laze app create",
     operation: "createApp",
-    arguments: ["<name>", "--template tracker|crm|dashboard|form", "--dir <dir>", "--channel <c>"],
-    summary: "Create an app and scaffold a starter template into a folder linked to it"
+    arguments: ["<name>", "--template <template>", "--dir <dir>", "--channel <c>"],
+    summary: "Create an app in a folder linked to it. --template starts it from a template (laze app templates lists them; decks start from slides): its files are the first live version and land in the folder to change"
+  },
+  {
+    command: "laze app templates",
+    operation: "listTemplates",
+    arguments: [],
+    summary: "List the templates an app can start from, with their versions"
   },
   {
     command: "laze app list",
@@ -75699,6 +76015,12 @@ var appCliCommands = [
     arguments: ["[dir]", "-m <what changed>", "--seed"],
     summary: `Record the folder as a new version: it is the live app at once, with laze.app.json's collections applied to the live data (records keep their values). -m says what changed in plain words ("update" or "wip" is refused). Going live waits only when an admin must approve it, and the push asks. Server functions in functions/<name>.js ship with it`
   },
+  {
+    command: "laze app write",
+    operation: "writeFiles",
+    arguments: ["<file>...", "-m <what changed>", "--remove <path,...>"],
+    summary: "Write some files of the app's folder over the live version and keep every other file, or remove paths: a new live version like a push, for changing one slide or page without pushing the whole folder"
+  },
   {
     command: "laze app logs",
     operation: "listFunctionLogs",
@@ -76108,530 +76430,6 @@ function unknownCollectionsOf({
   );
 }
 
-// src/templates/crm.template.ts
-var APP_JS = String.raw`(function () {
-  var h = Laze.h;
-  var contacts = Laze.records("contacts");
-  var STAGES = ["lead", "qualified", "proposal", "won", "lost"];
-  var TONE = { lead: "", qualified: "info", proposal: "primary", won: "success", lost: "danger" };
-  var view = "board";
-  var adding = false;
-  var rows = [];
-
-  function badge(stage) {
-    return h("span", { class: "lz-badge" + (TONE[stage] ? " lz-badge-" + TONE[stage] : "") }, stage);
-  }
-
-  function stagePicker(contact) {
-    return h("select", {
-      class: "lz-select", "aria-label": "Stage of " + contact.name,
-      onchange: function (event) { contacts.update(contact.id, { stage: event.target.value }).then(load, Laze.fail); },
-    }, STAGES.map(function (stage) {
-      return h("option", { value: stage, selected: stage === contact.stage }, stage);
-    }));
-  }
-
-  function board() {
-    return h("div", { class: "lz-board" }, STAGES.map(function (stage) {
-      var inStage = rows.filter(function (row) { return row.stage === stage; });
-      var total = inStage.reduce(function (sum, row) { return sum + Number(row.value || 0); }, 0);
-      return h("section", { class: "lz-column", "aria-label": stage },
-        h("div", { class: "lz-column-head" }, badge(stage), h("span", { class: "lz-muted" }, Laze.money(total))),
-        inStage.length ? inStage.map(function (row) {
-          return h("article", { class: "lz-tile" },
-            h("strong", {}, row.name),
-            h("span", { class: "lz-muted" }, row.company || "No company"),
-            h("span", {}, Laze.money(row.value)));
-        }) : h("p", { class: "lz-muted" }, "No one here yet"));
-    }));
-  }
-
-  function table() {
-    return h("div", { class: "lz-card lz-table-wrap" }, h("table", { class: "lz-table" },
-      h("thead", {}, h("tr", {}, ["Name", "Company", "Email", "Stage", "Value"].map(function (label) {
-        return h("th", { class: label === "Value" ? "lz-num" : "" }, label);
-      }))),
-      h("tbody", {}, rows.map(function (row) {
-        return h("tr", {},
-          h("td", {}, h("strong", {}, row.name)),
-          h("td", {}, row.company || ""),
-          h("td", { class: "lz-muted" }, row.email || ""),
-          h("td", {}, stagePicker(row)),
-          h("td", { class: "lz-num" }, Laze.money(row.value)));
-      }))));
-  }
-
-  function addForm() {
-    var form = h("form", { class: "lz-card lz-card-body lz-form", onsubmit: function (event) {
-      event.preventDefault();
-      var data = Object.fromEntries(new FormData(form).entries());
-      data.value = Number(data.value || 0);
-      contacts.create(data).then(function () { form.reset(); adding = false; load(); }, Laze.fail);
-    } },
-      h("label", { class: "lz-field" }, "Name", h("input", { class: "lz-input", name: "name", required: true })),
-      h("label", { class: "lz-field" }, "Company", h("input", { class: "lz-input", name: "company" })),
-      h("label", { class: "lz-field" }, "Email", h("input", { class: "lz-input", name: "email", type: "email" })),
-      h("label", { class: "lz-field" }, "Value", h("input", { class: "lz-input", name: "value", type: "number", min: "0" })),
-      h("button", { class: "lz-btn lz-btn-primary", type: "submit" }, "Add contact"),
-      rows.length ? h("button", { class: "lz-btn lz-btn-ghost", type: "button", onclick: function () { adding = false; render(); } }, "Cancel") : null);
-    return form;
-  }
-
-  function render() {
-    var open = rows.filter(function (row) { return row.stage !== "won" && row.stage !== "lost"; });
-    var pipeline = open.reduce(function (sum, row) { return sum + Number(row.value || 0); }, 0);
-    Laze.mount(h("div", { class: "lz-page" },
-      h("header", { class: "lz-header" },
-        h("div", {}, h("h1", { class: "lz-title" }, document.title),
-          h("p", { class: "lz-lede" }, open.length + " open deals worth " + Laze.money(pipeline) + ".")),
-        h("div", { class: "lz-row" },
-          h("div", { class: "lz-tabs", role: "group", "aria-label": "View" }, ["board", "table"].map(function (name) {
-            return h("button", { class: "lz-tab", "aria-pressed": String(view === name), onclick: function () { view = name; render(); } },
-              name === "board" ? "Pipeline" : "Table");
-          })),
-          adding ? null : h("button", { class: "lz-btn lz-btn-primary", onclick: function () { adding = true; render(); } }, "New contact"))),
-      adding || !rows.length ? addForm() : null,
-      view === "board" ? board() : table()));
-  }
-
-  function load() {
-    return contacts.list({ sort: "-value" }).then(function (items) { rows = items; render(); }, Laze.fail);
-  }
-
-  load();
-  Laze.subscribe("contacts", load);
-})();
-`;
-var CRM_TEMPLATE = {
-  title: "CRM",
-  summary: "Contacts on a pipeline board and a table, with stages and deal values",
-  appJs: APP_JS,
-  collections: {
-    contacts: {
-      fields: [
-        { name: "name", type: "text", required: true },
-        { name: "company", type: "text" },
-        { name: "email", type: "text" },
-        {
-          name: "stage",
-          type: "select",
-          options: ["lead", "qualified", "proposal", "won", "lost"],
-          default: "lead"
-        },
-        { name: "value", type: "number", default: 0 },
-        { name: "notes", type: "text" }
-      ]
-    }
-  },
-  seed: {
-    contacts: [
-      {
-        name: "Ada Park",
-        company: "ACME Corp",
-        email: "ada@acme.example",
-        stage: "proposal",
-        value: 18e3
-      },
-      {
-        name: "Ben Ito",
-        company: "ACME Labs",
-        email: "ben@acme.example",
-        stage: "qualified",
-        value: 9500
-      },
-      {
-        name: "Cleo Ruiz",
-        company: "ACME Retail",
-        email: "cleo@acme.example",
-        stage: "lead",
-        value: 4e3
-      },
-      {
-        name: "Dev Shah",
-        company: "ACME Freight",
-        email: "dev@acme.example",
-        stage: "won",
-        value: 22e3
-      }
-    ]
-  }
-};
-
-// src/templates/dashboard.template.ts
-var APP_JS2 = String.raw`(function () {
-  // One stat tile and one chart per metric name, newest period last. "better" on a metric's
-  // newest row says whether a rise is good ("up") or bad ("down"), which colours its change.
-  var h = Laze.h;
-  var metrics = Laze.records("metrics");
-
-  function number(value) { return Number(value) || 0; }
-  function shown(row) { return number(row.value).toLocaleString() + (row.unit ? " " + row.unit : ""); }
-
-  function seriesOf(rows) {
-    var names = [];
-    rows.forEach(function (row) { if (names.indexOf(row.name) < 0) names.push(row.name); });
-    return names.map(function (name) {
-      var series = rows.filter(function (row) { return row.name === name; })
-        .sort(function (a, b) { return String(a.period).localeCompare(String(b.period)); });
-      return { name: name, series: series, last: series[series.length - 1], before: series[series.length - 2] };
-    });
-  }
-
-  function tile(entry) {
-    var change = entry.before ? number(entry.last.value) - number(entry.before.value) : null;
-    var good = change === null || change === 0 ? null : (change > 0) === (entry.last.better !== "down");
-    return h("div", { class: "lz-card lz-card-body" },
-      h("p", { class: "lz-card-title" }, entry.name),
-      h("div", { class: "lz-stat-value" }, shown(entry.last)),
-      change === null ? h("span", { class: "lz-muted" }, Laze.day(entry.last.period)) :
-        h("span", { class: "lz-badge" + (good === null ? "" : good ? " lz-badge-success" : " lz-badge-danger") },
-          (change > 0 ? "+" : "") + change.toLocaleString() + " vs " + Laze.day(entry.before.period)));
-  }
-
-  function chart(entry) {
-    var peak = Math.max.apply(null, entry.series.map(function (row) { return number(row.value); })) || 1;
-    return h("section", { class: "lz-card lz-card-body" },
-      h("p", { class: "lz-card-title" }, entry.name + " by period"),
-      h("div", { class: "lz-chart", role: "img", "aria-label": entry.name + " by period" }, entry.series.map(function (row) {
-        return h("div", { class: "lz-chart-col" },
-          h("div", { class: "lz-chart-track" },
-            h("div", { class: "lz-chart-bar", title: shown(row), style: "height:" + Math.max(1, Math.round((number(row.value) / peak) * 100)) + "%" },
-              h("span", { class: "lz-chart-value" }, number(row.value).toLocaleString()))),
-          h("span", { class: "lz-chart-label" }, Laze.day(row.period)));
-      })));
-  }
-
-  function render(rows) {
-    var all = seriesOf(rows);
-    Laze.mount(h("div", { class: "lz-page" },
-      h("header", { class: "lz-header" }, h("div", {}, h("h1", { class: "lz-title" }, document.title),
-        h("p", { class: "lz-lede" }, all.length ? "Updated " + Laze.day(rows.reduce(function (latest, row) {
-          return String(row.period) > String(latest) ? row.period : latest;
-        }, "")) + "." : "The numbers an agent keeps current for this channel."))),
-      all.length ? [
-        h("section", { class: "lz-stats" }, all.map(tile)),
-        h("div", { class: "lz-grid" }, all.map(chart)),
-      ] : h("div", { class: "lz-card lz-empty" }, "No numbers yet. Records in metrics show here, one tile and one chart per name.")));
-  }
-
-  function load() { return metrics.list({ sort: "period" }).then(render, Laze.fail); }
-  load();
-  Laze.subscribe("metrics", load);
-})();
-`;
-var DASHBOARD_TEMPLATE = {
-  title: "Dashboard",
-  summary: "A stat tile and a bar chart per metric, its change coloured by whether up is good",
-  appJs: APP_JS2,
-  collections: {
-    metrics: {
-      fields: [
-        { name: "name", type: "text", required: true },
-        { name: "value", type: "number", required: true },
-        { name: "unit", type: "text" },
-        { name: "period", type: "date", required: true },
-        { name: "better", type: "select", options: ["up", "down"], default: "up" }
-      ]
-    }
-  },
-  seed: {
-    metrics: [
-      { name: "Signups", value: 120, period: "2026-07-01" },
-      { name: "Signups", value: 164, period: "2026-08-01" },
-      { name: "Signups", value: 151, period: "2026-09-01" },
-      { name: "Signups", value: 203, period: "2026-10-01" },
-      { name: "Open tickets", value: 38, period: "2026-07-01", better: "down" },
-      { name: "Open tickets", value: 35, period: "2026-08-01", better: "down" },
-      { name: "Open tickets", value: 31, period: "2026-09-01", better: "down" },
-      { name: "Open tickets", value: 24, period: "2026-10-01", better: "down" }
-    ]
-  }
-};
-
-// src/templates/form.template.ts
-var APP_JS3 = String.raw`(function () {
-  var h = Laze.h;
-  var responses = Laze.records("responses");
-  var sent = false;
-
-  function render(rows) {
-    var form = h("form", { class: "lz-card lz-card-body", onsubmit: function (event) {
-      event.preventDefault();
-      var data = Object.fromEntries(new FormData(form).entries());
-      data.rating = Number(data.rating || 0);
-      responses.create(data).then(function () { sent = true; load(); }, Laze.fail);
-    } },
-      h("div", { class: "lz-form" },
-        h("label", { class: "lz-field" }, "Your name", h("input", { class: "lz-input", name: "name", required: true })),
-        h("label", { class: "lz-field" }, "Email", h("input", { class: "lz-input", name: "email", type: "email" })),
-        h("label", { class: "lz-field" }, "Rating", h("select", { class: "lz-select", name: "rating" },
-          [5, 4, 3, 2, 1].map(function (n) { return h("option", { value: n }, n + " of 5"); })))),
-      h("label", { class: "lz-field", style: "margin-top:10px" }, "Message",
-        h("textarea", { class: "lz-textarea", name: "message", rows: 4 })),
-      h("div", { class: "lz-row", style: "margin-top:12px" },
-        h("button", { class: "lz-btn lz-btn-primary", type: "submit" }, "Send"),
-        sent ? h("span", { class: "lz-badge lz-badge-success" }, "Thanks, it is in.") : null));
-    Laze.mount(h("div", { class: "lz-page" },
-      h("header", { class: "lz-header" }, h("div", {}, h("h1", { class: "lz-title" }, document.title),
-        h("p", { class: "lz-lede" }, "Tell us how it went. Answers land in this app's responses.")),
-        rows && rows.length ? h("div", { class: "lz-row" },
-          h("span", { class: "lz-badge lz-badge-primary" }, rows.length + (rows.length === 1 ? " answer" : " answers")),
-          h("span", { class: "lz-badge" }, "Average " + (rows.reduce(function (sum, row) { return sum + (Number(row.rating) || 0); }, 0) / rows.length).toFixed(1) + " of 5")) : null),
-      form,
-      rows && rows.length ? h("section", { class: "lz-card lz-table-wrap" }, h("table", { class: "lz-table" },
-        h("thead", {}, h("tr", {}, h("th", {}, "Name"), h("th", {}, "Rating"), h("th", {}, "Message"))),
-        h("tbody", {}, rows.map(function (row) {
-          return h("tr", {}, h("td", {}, row.name), h("td", { "data-label": "Rating" }, row.rating + " of 5"), h("td", { class: "lz-muted", "data-label": "Message" }, row.message || ""));
-        })))) : rows ? h("p", { class: "lz-card lz-empty" }, "No answers yet.") : null));
-  }
-
-  function load() {
-    return responses.list().then(render, function () { render(null); });
-  }
-  load();
-})();
-`;
-var FORM_TEMPLATE = {
-  title: "Form",
-  summary: "A feedback form with a rating, and the answers below it",
-  appJs: APP_JS3,
-  collections: {
-    responses: {
-      fields: [
-        { name: "name", type: "text", required: true },
-        { name: "email", type: "text" },
-        { name: "rating", type: "number", default: 5 },
-        { name: "message", type: "text" }
-      ]
-    }
-  },
-  seed: {
-    responses: [
-      { name: "Ada", email: "ada@acme.example", rating: 5, message: "Fast and clear." },
-      {
-        name: "Ben",
-        email: "ben@acme.example",
-        rating: 4,
-        message: "Good, the export could be quicker."
-      }
-    ]
-  }
-};
-
-// src/templates/shared.template.ts
-function indexHtml({ title }) {
-  return String.raw`<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${title}</title>
-    <link rel="stylesheet" href="/_laze/theme.css" />
-    <link rel="stylesheet" href="/_laze/kit.css" />
-  </head>
-  <body>
-    <main id="app"><p class="lz-page lz-muted">Loading...</p></main>
-    <script src="/_laze/laze.js"></script>
-    <script src="/app.js"></script>
-  </body>
-</html>
-`;
-}
-
-// src/templates/tracker.template.ts
-var APP_JS4 = String.raw`(function () {
-  // The page reads its fields from the app's schema, so renaming or adding fields in
-  // laze.app.json needs no change here. The status field is the select named "status"
-  // (or the first select); its last option counts as done.
-  var h = Laze.h;
-  var name = "items";
-  var fields = [];
-  var status = null;
-  var shown = "open";
-  var adding = false;
-  var rows = [];
-  var EMPTY = { open: "Nothing open.", done: "Nothing done yet.", all: "No items yet." };
-  var TONES = ["", "info", "warning", "success"];
-
-  function label(text) { return text.charAt(0).toUpperCase() + text.slice(1).replace(/_/g, " "); }
-  function options() { return status ? status.options || [] : []; }
-  function isDone(row) { return status ? row[status.name] === options()[options().length - 1] : false; }
-  function next(value) { var all = options(); return all[(all.indexOf(value) + 1) % all.length]; }
-  function tone(value) {
-    var all = options();
-    if (value === all[all.length - 1]) return "success";
-    return TONES[Math.min(all.indexOf(value), TONES.length - 2)] || "";
-  }
-
-  function input(field) {
-    var props = { class: "lz-input", name: field.name };
-    if (field.required) props.required = true;
-    if (field.type === "select") {
-      return h("select", { class: "lz-input", name: field.name },
-        (field.options || []).map(function (option) {
-          return h("option", option === field.default ? { value: option, selected: true } : { value: option }, option);
-        }));
-    }
-    if (field.type === "number") props.type = "number";
-    if (field.type === "date") props.type = "date";
-    if (field.type === "bool") { props.type = "checkbox"; props.class = ""; }
-    return h("input", props);
-  }
-
-  function cell(field, row) {
-    var value = row[field.name];
-    if (value === undefined || value === null || value === "") return "";
-    if (field.type === "date") return Laze.day(value);
-    if (field.type === "bool") return value ? "Yes" : "No";
-    if (field.type === "json") return JSON.stringify(value);
-    return String(value);
-  }
-
-  function render() {
-    var first = fields[0];
-    var others = fields.filter(function (field) { return field !== first && field !== status && field.type !== "file"; });
-    var visible = rows.filter(function (row) {
-      return shown === "all" || (shown === "open" ? !isDone(row) : isDone(row));
-    });
-    var form = h("form", { class: "lz-card lz-card-body lz-form", onsubmit: function (event) {
-      event.preventDefault();
-      var data = {};
-      fields.forEach(function (field) {
-        var element = form.elements[field.name];
-        if (!element) return;
-        if (field.type === "bool") data[field.name] = element.checked;
-        else if (element.value === "") return;
-        else data[field.name] = field.type === "number" ? Number(element.value) : element.value;
-      });
-      Laze.records(name).create(data).then(function () { form.reset(); adding = false; load(); }, Laze.fail);
-    } },
-      fields.filter(function (field) { return field.type !== "file" && field.type !== "json"; }).map(function (field) {
-        return h("label", { class: "lz-field" }, label(field.name), input(field));
-      }),
-      h("button", { class: "lz-btn lz-btn-primary", type: "submit" }, "Add"),
-      rows.length ? h("button", { class: "lz-btn lz-btn-ghost", type: "button", onclick: function () { adding = false; render(); } }, "Cancel") : null);
-    var open = rows.filter(function (row) { return !isDone(row); }).length;
-    Laze.mount(h("div", { class: "lz-page" },
-      h("header", { class: "lz-header" },
-        h("div", {}, h("h1", { class: "lz-title" }, document.title),
-          h("p", { class: "lz-lede" }, open + (open === 1 ? " open item." : " open items."))),
-        h("div", { class: "lz-row" },
-          status ? h("div", { class: "lz-tabs", role: "group", "aria-label": "Show" }, ["open", "done", "all"].map(function (tab) {
-            return h("button", { class: "lz-tab", "aria-pressed": String(shown === tab), onclick: function () { shown = tab; render(); } }, label(tab));
-          })) : null,
-          adding ? null : h("button", { class: "lz-btn lz-btn-primary", onclick: function () { adding = true; render(); } }, "New item"))),
-      adding || !rows.length ? form : null,
-      h("div", { class: "lz-card lz-table-wrap" }, visible.length ? h("table", { class: "lz-table" },
-        h("thead", {}, h("tr", {},
-          h("th", {}, label(first.name)),
-          others.map(function (field) { return h("th", {}, label(field.name)); }),
-          status ? h("th", {}, label(status.name)) : null)),
-        h("tbody", {}, visible.map(function (row) {
-          return h("tr", {},
-            h("td", {}, h("strong", {}, cell(first, row))),
-            others.map(function (field) { return h("td", { class: "lz-muted", "data-label": label(field.name) }, cell(field, row)); }),
-            status ? h("td", {}, h("button", { class: "lz-btn lz-btn-ghost", title: "Move to " + next(row[status.name]),
-              onclick: function () {
-                var change = {};
-                change[status.name] = next(row[status.name]);
-                Laze.records(name).update(row.id, change).then(load, Laze.fail);
-              } },
-              h("span", { class: "lz-badge" + (tone(row[status.name]) ? " lz-badge-" + tone(row[status.name]) : "") }, row[status.name] || ""))) : null);
-        }))) : h("p", { class: "lz-empty" }, status ? EMPTY[shown] : EMPTY.all))));
-  }
-
-  function load() {
-    return Laze.records(name).list({ sort: "-created" }).then(function (list) { rows = list; render(); }, Laze.fail);
-  }
-
-  Laze.collections().then(function (all) {
-    var collection = all.filter(function (c) { return c.name === name; })[0] || all[0];
-    if (!collection) return Laze.fail(new Error("This app has no collection yet"));
-    name = collection.name;
-    fields = collection.schema.fields;
-    var selects = fields.filter(function (field) { return field.type === "select"; });
-    status = selects.filter(function (field) { return field.name === "status"; })[0] || selects[0] || null;
-    load();
-    Laze.subscribe(name, load);
-  }, Laze.fail);
-})();
-`;
-var SUMMARY_FUNCTION = `// A server function: the app's origin answers /_laze/fn/summary by running this file.
-// env.LAZE reads and writes this app's records as the person who asked; there is no other network.
-export default {
-  async fetch(request, env) {
-    const page = await env.LAZE.records("items").list({ filter: "status != 'done'", perPage: 500 });
-    const today = new Date().toISOString().slice(0, 10);
-    const byStatus = {};
-    const byOwner = {};
-    let overdue = 0;
-    for (const item of page.items) {
-      byStatus[item.status] = (byStatus[item.status] || 0) + 1;
-      const owner = item.owner || "Unassigned";
-      byOwner[owner] = (byOwner[owner] || 0) + 1;
-      if (item.due && item.due.slice(0, 10) < today) overdue += 1;
-    }
-    console.log("summarised", page.totalItems, "open items");
-    return Response.json({ open: page.totalItems, overdue, byStatus, byOwner });
-  },
-};
-`;
-var TRACKER_TEMPLATE = {
-  title: "Tracker",
-  summary: "A list of items with a status you click forward; the page follows the fields in laze.app.json",
-  appJs: APP_JS4,
-  functions: { summary: SUMMARY_FUNCTION },
-  collections: {
-    items: {
-      fields: [
-        { name: "title", type: "text", required: true },
-        { name: "owner", type: "text" },
-        { name: "due", type: "date" },
-        { name: "status", type: "select", options: ["todo", "doing", "done"], default: "todo" }
-      ]
-    }
-  },
-  views: [
-    {
-      name: "Board by status",
-      collection: "items",
-      type: "board",
-      groupBy: "status",
-      fields: ["owner", "due"]
-    }
-  ],
-  seed: {
-    items: [
-      { title: "Send the October invoices", owner: "Ada", status: "doing", due: "2026-10-20" },
-      { title: "Renew the ACME contract", owner: "Ben", status: "todo", due: "2026-10-28" },
-      { title: "Book the offsite venue", owner: "Cleo", status: "done", due: "2026-10-10" }
-    ]
-  }
-};
-
-// src/templates/app-templates.ts
-var STARTER_TEMPLATES = {
-  tracker: TRACKER_TEMPLATE,
-  crm: CRM_TEMPLATE,
-  dashboard: DASHBOARD_TEMPLATE,
-  form: FORM_TEMPLATE
-};
-function templateFiles({
-  template,
-  name: name3
-}) {
-  return {
-    "index.html": indexHtml({ title: name3.replaceAll("&", "&amp;").replaceAll("<", "&lt;") }),
-    "app.js": template.appJs,
-    ...Object.fromEntries(
-      Object.entries(template.functions ?? {}).map(([fn, source]) => [
-        `functions/${fn}.js`,
-        source
-      ])
-    )
-  };
-}
-
 // src/services/app-connection-commands.service.ts
 var USAGE2 = `Usage:
   laze app connections
@@ -77394,13 +77192,7 @@ function print5({
 var appCreate = async ({ context, args }) => {
   const name3 = args.words.slice(2).join(" ").trim();
   if (!name3) throw new CliUsageError(USAGE5);
-  const templateName = flagText({ args, name: "template" });
-  if (templateName && !APP_TEMPLATES.includes(templateName)) {
-    throw new CliUsageError(
-      `No template called ${templateName}: pick one of ${APP_TEMPLATES.join(", ")}`
-    );
-  }
-  const template = templateName ? STARTER_TEMPLATES[templateName] : void 0;
+  const template = flagText({ args, name: "template" });
   const client = await appClient({ context, args });
   const channel = flagText({ args, name: "channel" });
   const slug = flagText({ args, name: "slug" });
@@ -77409,32 +77201,67 @@ var appCreate = async ({ context, args }) => {
     name: name3,
     ...slug ? { slug } : {},
     ...channel ? { channel } : {},
-    ...visibility ? { visibility } : {}
+    ...visibility ? { visibility } : {},
+    ...template ? { template } : {}
   });
   const folder = resolve6(context.cwd, flagText({ args, name: "dir", fallback: app2.slug }));
   await mkdir16(folder, { recursive: true });
-  const files2 = template ? templateFiles({ template, name: name3 }) : {};
-  for (const [path, content] of Object.entries(files2)) {
-    await mkdir16(dirname16(join20(folder, path)), { recursive: true });
-    await writeFile16(join20(folder, path), content);
+  const start2 = template ? await templateStart({ client, appId: app2.id, template }) : null;
+  for (const file3 of start2?.files ?? []) {
+    const target = join20(folder, ...file3.path.split("/"));
+    await mkdir16(dirname16(target), { recursive: true });
+    await writeFile16(
+      target,
+      file3.encoding === "base64" ? Buffer.from(file3.content, "base64") : file3.content
+    );
   }
   const manifest = {
     app: { id: app2.id, name: app2.name, slug: app2.slug },
-    collections: template ? { ...template.collections } : {},
-    views: template?.views ? [...template.views] : [],
-    seed: template ? { ...template.seed } : {}
+    collections: { ...start2?.template.collections },
+    views: [...start2?.template.views ?? []],
+    seed: { ...start2?.template.seed }
   };
   await writeFile16(join20(folder, APP_MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
 `);
+  const where = relative3(context.cwd, folder) || ".";
   print5({
     context,
     args,
     value: { app: app2, folder },
-    text: `Created ${app2.name} (${app2.id}) in ${relative3(context.cwd, folder) || "."}${template ? ` from the ${templateName} template` : ""}.
-Next: cd ${relative3(context.cwd, folder) || "."} && laze app push -m "First version" --seed
+    text: start2 ? `Created ${app2.name} (${app2.id}) from the ${template} template in ${where}; its first version is live at ${app2.publishedUrl}.
+Next: change the files in ${where} (start with README.md when there is one), then laze app push -m "<what changed>"
+` : `Created ${app2.name} (${app2.id}) in ${where}.
+Next: cd ${where} && laze app push -m "First version" --seed
 `
   });
 };
+async function templateStart({
+  client,
+  appId,
+  template
+}) {
+  const [pulled, templates2] = await Promise.all([
+    client.post("/api/apps/pull", { appId }),
+    client.get("/api/apps/templates")
+  ]);
+  const found = templates2.find((entry) => entry.name === template);
+  if (!found) throw new CliUsageError(`No template called ${template}`);
+  return { files: pulled.files, template: found };
+}
+var appTemplates = async ({ context, args }) => {
+  const client = await appClient({ context, args });
+  const templates2 = await client.get("/api/apps/templates");
+  const lines2 = templates2.map(
+    (template) => `${template.name}	v${template.version}	${template.description}
+`
+  );
+  print5({
+    context,
+    args,
+    value: templates2,
+    text: lines2.join("") + 'Start one with laze app create "<name>" --template <template>; its files are yours to change.\n'
+  });
+};
 var appList = async ({ context, args }) => {
   const client = await appClient({ context, args });
   const apps = await client.get("/api/apps");
@@ -77521,6 +77348,45 @@ var appPush = async ({ context, args }) => {
 ` + (seeded ? seedLine(seeded) : "") + publishLine(publish)
   });
 };
+var appWrite = async ({ context, args }) => {
+  const { message: message2, words } = messageOf({ args });
+  const verdict = versionMessageVerdict(message2);
+  if (verdict !== "ok") {
+    throw new CliUsageError(
+      `laze: a write needs -m "<what changed, in plain words>", such as -m "Agenda names the three goals" (${verdict})`
+    );
+  }
+  const folder = folderOf({ context, word: void 0 });
+  const remove7 = (flagText({ args, name: "remove" }) ?? "").split(",").map((path) => path.trim()).filter(Boolean);
+  const files2 = await Promise.all(
+    words.slice(2).map(async (word3) => {
+      const path = resolve6(context.cwd, word3);
+      const { bytes: _bytes, ...file3 } = buildFileOf({
+        path: relative3(folder, path).split(sep3).join("/"),
+        bytes: await readFile18(path)
+      });
+      return file3;
+    })
+  );
+  if (files2.length + remove7.length === 0) {
+    throw new CliUsageError("laze app write needs a file to write or --remove <path,...>");
+  }
+  const client = await appClient({ context, args });
+  const appId = await appIdOf({ client, args, folder });
+  const { publish, ...version2 } = await client.post("/api/apps/files/write", {
+    appId,
+    files: files2,
+    remove: remove7,
+    message: message2
+  });
+  print5({
+    context,
+    args,
+    value: { version: version2, app: publish.app, publish },
+    text: `Wrote ${version2.version.slice(0, 7)} "${version2.message}" (${files2.length} written, ${remove7.length} removed)
+` + publishLine(publish)
+  });
+};
 function seedLine(seeded) {
   const created = Object.entries(seeded.created).map(([name3, count5]) => `${count5} in ${name3}`);
   const parts = [
@@ -78278,8 +78144,10 @@ function managed(command) {
 }
 var APP_COMMANDS = {
   create: appCreate,
+  templates: appTemplates,
   list: appList,
   push: appPush,
+  write: appWrite,
   url: appUrl,
   preview: appUrl,
   serve: appServe,
@@ -81487,6 +81355,8 @@ var computeConfig = Config.define((c) => ({
 var priceId = external_exports.string().min(1).optional();
 var billingConfig = Config.define((c) => ({
   publicBaseUrl,
+  /** The first alias (`laze.so` on prod) is the short origin referral links are shared on. */
+  publicOriginAliases,
   /** Stripe's API, or the payment simulator in tests and local stacks. */
   stripeApiBase: c.env("STRIPE_API_BASE", external_exports.url().default("https://api.stripe.com")),
   /** Team's graduated per-person price (`TEAM_PRICING`), one quantity per person. */
@@ -84181,6 +84051,7 @@ function conversationLineOf(chat) {
 // src/services/conversation-commands.service.ts
 var CONVERSATION_USAGE = `Usage:
   laze conversation new <agent> <text|->      start a conversation with an agent (people)
+    [--about <message id>]                    continue from a message: the first one quotes it
   laze conversation list [--agent <agent>]    yours (an agent: its own; --unnamed for untitled)
   laze conversation rename <id> <title>       name it (its agent, or a person in it)
   laze conversation join <id>                 open one of an agent shared with you
@@ -84201,9 +84072,11 @@ async function conversationNew({ context, args }) {
     text: typed,
     leaves: async () => false
   });
+  const about = flagText({ args, name: "about" });
   const started = await client.post("/api/agents/me/conversations", {
     agent: agent3,
-    text: text2
+    text: text2,
+    ...about ? { about } : {}
   });
   if (args.flags.json) return context.out(`${JSON.stringify(started, null, 2)}
 `);
@@ -92599,7 +92472,7 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze emoji list | add <name> <file> [--alias <a,b>] | alias <alias> <name> | remove <name>   the workspace's custom emoji
   laze status set <emoji> [text] [--for 30m|1h|4h|today|week|never]   your status next to your name (people)
   laze status clear | away | active              clear it, or set yourself away by hand until active
-  laze conversation new <agent> <text|->         start a conversation with an agent; it names it
+  laze conversation new <agent> <text|-> [--about <message id>]   start a conversation with an agent; it names it
   laze conversation list [--agent <agent>] [--unnamed]   your conversations with agents
   laze conversation rename <id> <title>          name a conversation (its agent, or a person in it)
   laze conversation join|close <id>              open one of an agent shared with you, or leave it
@@ -92643,7 +92516,7 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze memory get|set|append|history <file>, search, pull   SOUL.md, AGENTS.md, a channel's MEMORY.md
   laze wiki list|get|put|search|history|mv|rm    the workspace wiki
   laze skill list|install|show|pull|rm|update|pin|unpin   your agent's skills and the catalogue
-  laze app create <name> --template crm ...      build an app: create, push (live at once), versions, revert
+  laze app create <name> --template slides ...   build an app from a template (laze app templates), push, revert
   laze app                                       every laze app command, with its flags
   laze agents list | laze agents status <name>   the workspace's agents and their context
   laze agents show <name> [--json]              an agent's profile: kind, how it runs, intelligence