@unoverse-platform/studio 0.1.115 → 0.1.117

package/vendor/base/src/platform/tokenCost.ts

@@ -0,0 +1,414 @@
+/**
+ * TOKEN USAGE AND ITS COST: raw usage from any model, read into one shape, and priced in USD per
+ * 1M tokens (or per minute for voice). One table for the platform: Canvas and Signal show it, and
+ * an Agent's budget is counted with it (docs/architecture/signal/AGENTS.md § 9). Moved here from
+ * Canvas (`pages/dashboard/tokenConverters.js`) so the server reads the same prices.
+ */
+
+/** A raw usage block as a vendor sent it. */
+type RawUsage = any;
+/** What a model costs, per 1M tokens (or per minute). */
+export interface ModelPricing {
+  input?: number; cachedInput?: number; cacheWrite?: number; output?: number; perMinute?: number;
+  audioInput?: number; cachedAudioInput?: number; audioOutput?: number; imageInput?: number; cachedImageInput?: number;
+}
+
+/**
+ * Parse token usage based on model type
+ * @param {string} model - The model name
+ * @param {object} usage - Raw usage object from AI model
+ * @returns {object|null} Parsed usage with standardized fields
+ */
+export const parseTokenUsage = (model: string, usage: RawUsage): any => {
+  if (!usage) return null;
+
+  // Handle string usage (JSON stored as string)
+  if (typeof usage === "string") {
+    try {
+      usage = JSON.parse(usage);
+    } catch {
+      return null;
+    }
+  }
+
+  const parsed = parseByVendor(model, usage);
+  // A VOICE CALL'S LENGTH, timed by the platform on every call. Per-minute vendors bill on it.
+  return parsed && typeof usage.seconds === "number" ? { ...parsed, seconds: usage.seconds } : parsed;
+};
+
+const parseByVendor = (model: string, usage: RawUsage): any => {
+  if (model.startsWith("gpt-")) return parseOpenAI(usage);
+  if (model.startsWith("claude-")) return parseClaude(usage);
+  if (model.startsWith("amazon.")) return parseBedrock(usage);
+  if (model.startsWith("us.anthropic.")) return parseBedrockClaude(usage);
+  if (model.startsWith("anthropic.")) return parseBedrockClaude(usage);
+
+  return parseGeneric(usage);
+};
+
+/**
+ * OpenAI Models (GPT-4, GPT-5, etc.)
+ * Handles both Chat Completions API and Responses API
+ */
+const parseOpenAI = (usage: RawUsage) => {
+  // Handle string usage (JSON stored as string)
+  if (typeof usage === "string") {
+    try {
+      usage = JSON.parse(usage);
+    } catch {
+      return { total: 0, input: 0, output: 0, reasoning: 0, cached: 0, breakdown: {} };
+    }
+  }
+
+  // Responses API format (GPT-5) or generic input_tokens format
+  if ("input_tokens" in usage) {
+    // TWO SPELLINGS, ONE WORD APART. Responses says `input_tokens_details`; the REALTIME API says
+    // `input_token_details`, singular. Reading only the plural made every voice call report zero
+    // reasoning and zero cached — silently, since the totals beside them were right (confirmed
+    // against a live response.done, 2026-08-12).
+    const inDetails = usage.input_tokens_details || usage.input_token_details || {};
+    const outDetails = usage.output_tokens_details || usage.output_token_details || {};
+    const cachedTokens = inDetails.cached_tokens || 0;
+    // WRITTEN TO THE CACHE, the other part of input with its own price (GPT-5.6 bills a cache write
+    // above a fresh token). Like cached, it is counted inside `input_tokens`.
+    const cacheWriteTokens = inDetails.cache_write_tokens || 0;
+    const reasoningTokens = outDetails.reasoning_tokens || 0;
+    // AUDIO IS PRICED DIFFERENTLY from text, so voice cost cannot be read off a total alone.
+    const audioIn = inDetails.audio_tokens || 0;
+    const audioOut = outDetails.audio_tokens || 0;
+    const imageIn = inDetails.image_tokens || 0;
+
+    /**
+     * HOW THE CACHED TOKENS SPLIT ACROSS MODALITIES, which is what makes them priceable.
+     *
+     * A cached token costs $0.40 against $32 for fresh audio or $4 for fresh text, so getting
+     * this wrong is most of the bill. `cached_tokens` alone does not say which modality it came
+     * from, and `cached_tokens_details` — which does — is absent from every row written before
+     * the collector stopped dropping it, and from any vendor that never sends it.
+     *
+     * So: use the details when present, and otherwise APPORTION BY SHARE. Proportional is a
+     * genuine estimate rather than a fact, but it is far closer than the alternative of billing
+     * every cached token at the full fresh rate, which overcharged a real call by ~45%.
+     */
+    const cachedTotal = inDetails.cached_tokens || 0;
+    const cachedDetails = inDetails.cached_tokens_details;
+    const freshTotal = (inDetails.text_tokens || 0) + audioIn + imageIn;
+    const share = (n: number) => (freshTotal > 0 ? Math.round((cachedTotal * n) / freshTotal) : 0);
+    const cachedTextIn = cachedDetails ? cachedDetails.text_tokens || 0 : share(inDetails.text_tokens || 0);
+    const cachedAudioIn = cachedDetails ? cachedDetails.audio_tokens || 0 : share(audioIn);
+    const cachedImageIn = cachedDetails ? cachedDetails.image_tokens || 0 : share(imageIn);
+
+    return {
+      total: usage.total_tokens || (usage.input_tokens || 0) + (usage.output_tokens || 0),
+      input: usage.input_tokens || 0,
+      output: usage.output_tokens || 0,
+      reasoning: reasoningTokens,
+      cached: cachedTokens,
+      cacheWrite: cacheWriteTokens,
+      breakdown: {
+        input: usage.input_tokens || 0,
+        cached: cachedTokens,
+        ...(cacheWriteTokens ? { cacheWrite: cacheWriteTokens } : {}),
+        reasoning: reasoningTokens,
+        completion: (usage.output_tokens || 0) - reasoningTokens,
+        // Present only on a voice call; omitted rather than shown as 0 for text models, so a
+        // zero in the panel always means "no audio" rather than "not measured".
+        ...(audioIn || audioOut ? { audioIn, audioOut } : {}),
+      },
+      /**
+       * THE PER-MODALITY SPLIT, for pricing. Only present when the vendor sent one.
+       *
+       * CACHED IS A SUBSET, not a fourth category: `cached_tokens_details` breaks the cached
+       * count down by modality, so a cached audio token is already counted in `audio_tokens`.
+       * Subtracting it is what stops it being billed twice, once at $32 and again at $0.40.
+       */
+      ...(audioIn || audioOut || inDetails.text_tokens !== undefined
+        ? {
+            modality: {
+              textIn: Math.max(0, (inDetails.text_tokens || 0) - cachedTextIn),
+              cachedTextIn,
+              audioIn: Math.max(0, audioIn - cachedAudioIn),
+              cachedAudioIn,
+              imageIn: Math.max(0, imageIn - cachedImageIn),
+              cachedImageIn,
+              textOut: outDetails.text_tokens || 0,
+              audioOut,
+            },
+          }
+        : {}),
+    };
+  }
+
+  // Chat Completions API format (GPT-4, GPT-3.5)
+  const cachedTokens = usage.prompt_tokens_details?.cached_tokens || 0;
+  const input = usage.prompt_tokens || usage.promptTokens || 0;
+  const output = usage.completion_tokens || usage.completionTokens || 0;
+
+  return {
+    total: usage.total_tokens || usage.totalTokens || input + output,
+    input,
+    output,
+    reasoning: usage.reasoning_tokens || 0,
+    cached: cachedTokens,
+    breakdown: {
+      prompt: input,
+      cached: cachedTokens,
+      reasoning: usage.reasoning_tokens || 0,
+      completion: output,
+    },
+  };
+};
+
+/**
+ * Claude Models (Anthropic)
+ */
+const parseClaude = (usage: RawUsage) => {
+  return {
+    total: (usage.input_tokens || 0) + (usage.output_tokens || 0),
+    input: usage.input_tokens || 0,
+    output: usage.output_tokens || 0,
+    reasoning: 0,
+    breakdown: {
+      input: usage.input_tokens || 0,
+      output: usage.output_tokens || 0,
+    },
+  };
+};
+
+/**
+ * Bedrock Models (AWS)
+ */
+const parseBedrock = (usage: RawUsage) => {
+  return {
+    total: (usage.inputTokens || 0) + (usage.outputTokens || 0),
+    input: usage.inputTokens || 0,
+    output: usage.outputTokens || 0,
+    reasoning: 0,
+    breakdown: {
+      input: usage.inputTokens || 0,
+      output: usage.outputTokens || 0,
+    },
+  };
+};
+
+/**
+ * Bedrock Claude Models
+ * Handles both native Bedrock format (inputTokens) and OpenAI-style format (prompt_tokens)
+ */
+const parseBedrockClaude = (usage: RawUsage) => {
+  const input = usage.input_tokens || usage.inputTokens || usage.prompt_tokens || 0;
+  const output = usage.output_tokens || usage.outputTokens || usage.completion_tokens || 0;
+  return {
+    total: usage.total_tokens || usage.totalTokens || input + output,
+    input,
+    output,
+    reasoning: 0,
+    breakdown: { input, output },
+  };
+};
+
+/**
+ * Generic fallback for unknown models
+ */
+const parseGeneric = (usage: RawUsage) => {
+  const input = usage.input_tokens || usage.inputTokens || usage.prompt_tokens || 0;
+  const output = usage.output_tokens || usage.outputTokens || usage.completion_tokens || 0;
+  // CACHED IS A SUBSET OF INPUT, as OpenAI reports it, and every OpenAI-compatible vendor (Z.AI
+  // GLM) copies that shape. Dropping it priced every cached token at the fresh rate: a GLM Agent's
+  // turn cost about three times what Z.AI bills.
+  const cached = usage.prompt_tokens_details?.cached_tokens || usage.input_tokens_details?.cached_tokens || 0;
+
+  return {
+    total: usage.total_tokens || input + output,
+    input,
+    output,
+    reasoning: 0,
+    cached,
+    breakdown: { input, cached, output },
+  };
+};
+
+/**
+ * Calculate cost based on model and parsed usage
+ * @param {string} model - The model name
+ * @param {object} parsedUsage - Parsed usage object
+ * @returns {string} Cost in USD (formatted to 4 decimal places)
+ */
+export const calculateTokenCost = (model: string, parsedUsage: any): string => {
+  if (!parsedUsage) return "0.0000";
+
+  const pricing = getModelPricing(model);
+  if (!pricing) return "0.0000";
+
+  // PER MINUTE, for vendors that bill a voice call on its length rather than its tokens.
+  if (pricing.perMinute && parsedUsage.seconds) {
+    return ((parsedUsage.seconds / 60) * pricing.perMinute).toFixed(4);
+  }
+
+  const per = (tokens: number | undefined, rate: number | undefined) => ((tokens || 0) / 1000000) * (rate || 0);
+
+  /**
+   * PER-MODALITY, when the model prices that way AND the usage block carried the split.
+   *
+   * Realtime bills audio at up to 8x text ($32 against $4 per 1M in), so a voice call priced on
+   * flat input/output is not approximately right, it is wrong by most of the bill. Both
+   * conditions are required: a model with no audio rates, or a usage block with no split, falls
+   * through to the flat path below and behaves exactly as it always did.
+   */
+  if (pricing.audioInput && parsedUsage.modality) {
+    const m = parsedUsage.modality;
+    return (
+      per(m.textIn, pricing.input) +
+      per(m.cachedTextIn, pricing.cachedInput ?? pricing.input) +
+      per(m.audioIn, pricing.audioInput) +
+      per(m.cachedAudioIn, pricing.cachedAudioInput ?? pricing.audioInput) +
+      per(m.imageIn, pricing.imageInput ?? pricing.input) +
+      per(m.cachedImageIn, pricing.cachedImageInput ?? pricing.imageInput ?? pricing.input) +
+      per(m.textOut, pricing.output) +
+      per(m.audioOut, pricing.audioOutput ?? pricing.output)
+    ).toFixed(4);
+  }
+
+  // Cached input and cache writes are parts of input, each billed at its own rate where the vendor
+  // has one; the rest is fresh.
+  const cached = Math.min(parsedUsage.cached || 0, parsedUsage.input || 0);
+  const written = Math.min(parsedUsage.cacheWrite || 0, (parsedUsage.input || 0) - cached);
+  const inputCost =
+    per((parsedUsage.input || 0) - cached - written, pricing.input) +
+    per(cached, pricing.cachedInput ?? pricing.input) +
+    per(written, pricing.cacheWrite ?? pricing.input);
+  const outputCost = per(parsedUsage.output, pricing.output);
+
+  return (inputCost + outputCost).toFixed(4);
+};
+
+/**
+ * Get pricing for a model (per million tokens)
+ */
+export const getModelPricing = (model: string): ModelPricing => {
+  const pricing: Record<string, ModelPricing> = {
+    // GPT-5.6 family (Sol/Terra/Luna): standard, short context (up to 272K input), verified against
+    // developers.openai.com/api/docs/pricing 2026-10-11. Cached input and cache writes have their own
+    // rates; without them every cached token was billed fresh.
+    "gpt-5.6": { input: 4.0, cachedInput: 0.4, cacheWrite: 5.0, output: 20.0 }, // alias of gpt-5.6-sol
+    "gpt-5.6-sol": { input: 4.0, cachedInput: 0.4, cacheWrite: 5.0, output: 20.0 },
+    "gpt-5.6-terra": { input: 2.0, cachedInput: 0.2, cacheWrite: 2.5, output: 12.0 },
+    "gpt-5.6-luna": { input: 0.2, cachedInput: 0.02, cacheWrite: 0.25, output: 1.2 },
+
+    // Z.AI GLM — verified against docs.z.ai/guides/overview/pricing 2026-10-09
+    "glm-5.3": { input: 1.4, cachedInput: 0.26, output: 4.4 },
+    "glm-5.3-flash": { input: 0.15, cachedInput: 0.03, output: 0.5 },
+    "glm-5.2": { input: 1.4, cachedInput: 0.26, output: 4.4 },
+
+    /**
+     * GPT-Realtime family — PRICED PER MODALITY, verified against the OpenAI model pages
+     * 2026-08-12 (developers.openai.com/api/docs/models/gpt-realtime-2.1{,-mini}).
+     *
+     * `input`/`output` here are the TEXT rates, and pricing a voice call at them — which is
+     * what this table did — understates it by up to 8x, because a call is almost entirely
+     * AUDIO tokens: $32/$64 against $4/$24 on the pro model. The label said "(text tokens)",
+     * so the limitation was known; nothing downstream acted on it.
+     *
+     * `calculateTokenCost` uses these per-modality fields when the usage block carries the
+     * split, and falls back to flat input/output when it does not. Every other model in this
+     * table is unaffected.
+     */
+    "gpt-realtime-2.1": {
+      input: 4.0, cachedInput: 0.4, output: 24.0,
+      audioInput: 32.0, cachedAudioInput: 0.4, audioOutput: 64.0,
+      imageInput: 5.0, cachedImageInput: 0.5,
+    },
+    "gpt-realtime-2.1-mini": {
+      input: 0.6, cachedInput: 0.06, output: 2.4,
+      audioInput: 10.0, cachedAudioInput: 0.3, audioOutput: 20.0,
+      imageInput: 0.8, cachedImageInput: 0.08,
+    },
+
+    /**
+     * xAI GROK VOICE — the vendor bills per MINUTE, not per token: $0.08/min audio plus
+     * $0.004 per text input (docs.x.ai/developers/pricing, 2026-08-15). The realtime
+     * `response.done.usage` carries only flat input/output/total token counts — no
+     * audio/text split, no duration — so a per-minute price cannot be computed from what
+     * this table is given.
+     *
+     * The platform now times every call and records `seconds`, so a call is priced at the
+     * vendor's $0.08/min. The per-token rates below are an ESTIMATE kept only for rows written
+     * before calls were timed. The $0.004 text-input charge is not included; it is small beside
+     * the minutes.
+     */
+    "grok-voice-think-fast-2.0": { perMinute: 0.08, input: 4.0, output: 8.0 },
+    "grok-voice-latest": { perMinute: 0.08, input: 4.0, output: 8.0 },
+    "grok-voice-think-fast-1.0": { perMinute: 0.08, input: 4.0, output: 8.0 },
+
+    /**
+     * OpenAI GPT-LIVE — billed per second at $0.05/min (developers.openai.com/api/docs/models/
+     * gpt-live-1). Priced on the `seconds` the platform times; it reports no tokens of its own.
+     */
+    "gpt-live-1": { perMinute: 0.05 },
+
+    // GPT-5.x family (older, kept for historical executions)
+    "gpt-5.2": { input: 1.75, output: 14.0 },
+    "gpt-5": { input: 1.25, output: 10.0 },
+    "gpt-5-mini": { input: 0.25, output: 2.0 },
+    "gpt-5-nano": { input: 0.05, output: 0.4 },
+    "gpt-5-pro": { input: 15.0, output: 120.0 },
+    "gpt-5-chat-latest": { input: 1.25, output: 10.0 },
+    "gpt-5-codex": { input: 1.25, output: 10.0 },
+
+    // GPT-4.1 family
+    "gpt-4.1": { input: 2.0, output: 8.0 },
+    "gpt-4.1-mini": { input: 0.4, output: 1.6 },
+
+    // GPT-4o family
+    "gpt-4o": { input: 2.5, output: 10.0 },
+    "gpt-4o-mini": { input: 0.15, output: 0.6 },
+
+    // GPT-3.5 family
+    "gpt-3.5-turbo": { input: 0.5, output: 1.5 },
+    "gpt-3.5-turbo-16k": { input: 1.0, output: 2.0 },
+
+    // Claude models
+    "claude-3-opus": { input: 15.0, output: 75.0 },
+    "claude-3-sonnet": { input: 3.0, output: 15.0 },
+    "claude-3-haiku": { input: 0.25, output: 1.25 },
+
+    // Bedrock Claude 4.5 (latest)
+    "us.anthropic.claude-opus-4-5-20250514-v1:0": { input: 5.0, output: 25.0 },
+    "us.anthropic.claude-sonnet-4-5-20250514-v1:0": { input: 3.0, output: 15.0 },
+    "us.anthropic.claude-haiku-4-5-20251001-v1:0": { input: 1.0, output: 5.0 },
+
+    // Bedrock Claude 4
+    "us.anthropic.claude-sonnet-4-20250514-v1:0": { input: 3.0, output: 15.0 },
+
+    // Bedrock Claude 3.5
+    "us.anthropic.claude-3-5-sonnet-20241022-v2:0": { input: 3.0, output: 15.0 },
+    "us.anthropic.claude-3-5-haiku-20241022-v1:0": { input: 0.25, output: 1.25 },
+
+    // Bedrock Claude 3
+    "anthropic.claude-3-sonnet-20240229-v1:0": { input: 3.0, output: 15.0 },
+    "anthropic.claude-3-haiku-20240307-v1:0": { input: 0.25, output: 1.25 },
+
+    // AWS Nova
+    "amazon.nova-sonic-v1:0": { input: 3.4, output: 13.6 },
+    "amazon.nova-2-sonic-v1:0": { input: 3.4, output: 13.6 },
+
+    // Embedding models
+    "text-embedding-ada-002": { input: 0.1, output: 0 },
+    "text-embedding-3-small": { input: 0.02, output: 0 },
+    "text-embedding-3-large": { input: 0.13, output: 0 },
+  };
+
+  // Try exact match first
+  if (pricing[model]) return pricing[model];
+
+  // Try partial match for Bedrock models
+  for (const [key, value] of Object.entries(pricing)) {
+    if (model.includes(key) || key.includes(model)) {
+      return value;
+    }
+  }
+
+  // Default fallback - use Claude Sonnet pricing as reasonable default
+  console.warn(`Unknown model pricing: ${model}, using default $3/$15 per 1M tokens`);
+  return { input: 3.0, output: 15.0 };
+};

package/vendor/base/src/security/permissions.ts

@@ -53,7 +53,15 @@ export const PERMISSIONS = [
    * what widens it. A route table would be the wrong shape for that, which is why memory
    * shares this vocabulary and not the policy table.
    */
-  "memory:read-all",
+  "signal:read-all",
+
+  /**
+   * Add a person to Signal, or add to one already held, WITHOUT reading anyone
+   * (docs/architecture/signal/AGENTS.md § 7a). Apart from `signal:read-all` so a caller that finds
+   * leads, an Agent above all, never needs to read every contact and user to save one. The Signal
+   * Save node answers only whether it was saved, never the record.
+   */
+  "signal:write",
 ] as const;
 
 export type Permission = (typeof PERMISSIONS)[number];
@@ -68,7 +76,7 @@ const AUTHOR_GRANTS: Permission[] = ["workflow:author", "marketplace:publish"];
 
 export const ROLE_GRANTS: Record<string, readonly Permission[]> = {
   author: AUTHOR_GRANTS,
-  admin: [...AUTHOR_GRANTS, "credentials:manage", "memory:read-all"],
+  admin: [...AUTHOR_GRANTS, "credentials:manage", "signal:read-all", "signal:write"],
 };
 
 /**

package/vendor/sdk/appEngine.ts

@@ -65,6 +65,7 @@ export function mountAppEngine(el: HTMLElement, first: AppConfig): AppEngine {
   let voiceKey = "";
   let app: AppMount | null = null;
   let page: { destroy(): void } | null = null;
+  let pageFor: unknown[] = [];
   let lastWidth: string | undefined;
   let stopStore = () => {};
   let stopVoice = () => {};
@@ -126,9 +127,36 @@ export function mountAppEngine(el: HTMLElement, first: AppConfig): AppEngine {
       : inertVoice();
     stopVoice = voice.subscribe(syncConnection);
     app?.update({ voice });
+    voiceListeners.forEach((l) => l());
     mountPage();
   };
 
+  // THE PAGE'S VOICE STAYS ONE OBJECT. The real service is swapped underneath when the app's
+  // settings arrive, so the page's templates (and the task each already asked for) are kept.
+  const voiceListeners = new Set<() => void>();
+  const pageVoice: VoiceService = {
+    get state() { return voice.state; },
+    subscribe(listener) {
+      let stop = voice.subscribe(listener);
+      let bound = voice;
+      const rebind = () => {
+        if (bound === voice) return;
+        stop();
+        bound = voice;
+        stop = voice.subscribe(listener);
+        listener();
+      };
+      voiceListeners.add(rebind);
+      return () => { voiceListeners.delete(rebind); stop(); };
+    },
+    startCall: (start) => voice.startCall(start),
+    joinCall: (workflowId) => voice.joinCall(workflowId),
+    unlock: () => voice.unlock(),
+    endCall: () => voice.endCall(),
+    toggleMute: () => voice.toggleMute(),
+    destroy: () => {},
+  };
+
   /**
    * THE CONNECTION, open once the user is known AND there is something to hear from: the app's
    * own workflow, a call, or a task the page is in. Nothing is held open while a visitor reads.
@@ -172,6 +200,7 @@ export function mountAppEngine(el: HTMLElement, first: AppConfig): AppEngine {
     lastWidth = undefined;
     syncConnection();
     syncVoice();
+    mountPage();
     const orgFromId = appId.includes("/") ? appId.split("/")[0] : null;
     if (orgFromId) loadTheme(`${orgFromId}/light`, token);
     client
@@ -224,6 +253,14 @@ export function mountAppEngine(el: HTMLElement, first: AppConfig): AppEngine {
     });
   };
 
+  // THE TASK A PAGE TEMPLATE CARRIES (docs/design/lifecycle-hooks.md): the server runs the YAML in
+  // the template's folder as this viewer and answers with the template's fields.
+  const runTask = async (uri: string, phase: "onStart", input?: Record<string, unknown>): Promise<Record<string, unknown>> => {
+    const res = (await client.callTool("template_task", { uri, phase, ...(input ? { input } : {}) })) as { content?: Array<{ text?: string }> };
+    const text = res?.content?.[0]?.text;
+    return text ? (JSON.parse(text) as Record<string, unknown>) : {};
+  };
+
   // A PAGE TEMPLATE'S TASK, called at its own workflow's trigger with the user's token.
   // `metadata.task` names the task its Task Runner loads; the submit carries the answers.
   const startTask = async (b: Binding, task: string, submit?: Record<string, unknown>) => {
@@ -322,9 +359,13 @@ export function mountAppEngine(el: HTMLElement, first: AppConfig): AppEngine {
     el.append(...app.nodes);
   };
   // The page's own templates, drawn into its elements by this one runtime.
+  /** Drawn again only when what the page reads from changes: the org, the client, the store. */
   const mountPage = () => {
+    const wanted = [appId.split("/")[0], client, store];
+    if (page && wanted.every((v, i) => v === pageFor[i])) return;
+    pageFor = wanted;
     page?.destroy();
-    page = mountPageInterfaces({ org: appId.split("/")[0], client, voice, appStore: store, toServer, startTask });
+    page = mountPageInterfaces({ org: appId.split("/")[0], client, voice: pageVoice, appStore: store, toServer, startTask, runTask });
   };
 
   const watchStore = () => {

package/vendor/sdk/lib/core/actions.ts

@@ -22,6 +22,8 @@ export interface ActionContext {
   /** Where APP state lives, when it is not `store`: a template a website page draws keeps its
    *  own slice in its own store and shares the app's state with everything on the page. */
   appStore?: ComponentStore;
+  /** Print what is on screen (host-provided; the `print` action). Resolves when it is done. */
+  print?: () => void | Promise<void>;
 }
 
 /** Resolve a value: a `"{{path}}"` template reads from `scope` (dot-path); anything
@@ -103,6 +105,14 @@ export function dispatchAction(
       if (ctx.nodeId) ctx.store.apply({ type: "COMPONENT_DATA", chatId: ctx.chatId, nodeId: ctx.nodeId, data: { [field]: scope.text } });
       else (ctx.appStore ?? ctx.store).mergeAppState({ [field]: scope.text });
     }
+  } else if (spec.type === "print") {
+    // PRINT asks the host to print what is on screen (`ctx.print`; the web host waits for a still
+    // screen first, dom/element.ts printWhenStill). `then` runs once the print is done. A host
+    // that cannot print does nothing.
+    if (!ctx.print) return;
+    const then = spec.then;
+    void Promise.resolve(ctx.print()).then(() => { if (then) dispatchAction(then, scope, ctx); });
+    return;
   } else {
     // SERVER — narrow the payload by `send` if given, else forward the whole scope.
     const payload = spec.send ? Object.fromEntries(spec.send.map((k) => [k, scope[k]])) : scope;

package/vendor/sdk/lib/core/apps.ts

@@ -57,7 +57,7 @@ export const cssWidth = (w: unknown): string | undefined => (typeof w === "strin
  *
  * ONE function for every caller, because the slot frame once had its own copy without the
  * `flex` word: beside a full-width app it rendered the task surface in a zero-width frame
- * the moment the org's `flex` token went (SAB's comparison, blank, 2026-09-07).
+ * the moment the org's `flex` token went (a bank's comparison, blank, 2026-09-07).
  */
 export function placeWidthStyle(declared: unknown, appSize?: Record<string, string>): Record<string, unknown> | null {
   const width = cssWidth(typeof declared === "string" ? (appSize?.[declared] ?? declared) : undefined);
@@ -377,7 +377,7 @@ export function selectPointers(store: ComponentStore, node: UnoverseNode, scope?
   // THE MOST RECENT WINS (the `limit: 1` law) for EVERY capped select, not only a state
   // select. A slot pinned to a component by `type` with `limit: 1` kept the OLDEST card:
   // the sort lived inside the `where` branch, so a name-pinned cap sliced arrival order
-  // (SAB voice, two Account Agent cards, 2026-09-10). A cap means "the newest N"; an
+  // (a bank's voice app, two Account Agent cards, 2026-09-10). A cap means "the newest N"; an
   // uncapped flow keeps arrival order.
   if (sel.where || sel.limit != null) pointers = [...pointers].sort((a, b) => store.touchOf(b) - store.touchOf(a));
   if (sel.limit != null) pointers = pointers.slice(0, sel.limit);

package/vendor/sdk/lib/core/client.ts

@@ -129,6 +129,17 @@ export class UnoverseClient {
     return this.withSession(() => this.client.callTool({ name, arguments: args }));
   }
 
+  /**
+   * THE TASK A COMPONENT CARRIES (docs/design/lifecycle-hooks.md), run as this viewer: the server
+   * runs the hook in the component's own folder with the instance's fields as `props` and answers
+   * with the fields it filled. A component with no hook for the phase answers `{}`.
+   */
+  async runTask(uri: string, phase: "onStart" | "onEnterView", props?: Record<string, unknown>, state?: string): Promise<Record<string, unknown>> {
+    const res = (await this.callTool("template_task", { uri, phase, ...(props ? { props } : {}), ...(state ? { state } : {}) })) as { content?: Array<{ text?: string }> };
+    const text = res?.content?.[0]?.text;
+    return text ? (JSON.parse(text) as Record<string, unknown>) : {};
+  }
+
 
   /** resources/read a definition by URI (e.g. unoverse://components/card). Cached. A hash on
    *  the address names the state it opens in (`stateOfUri`) and is never sent to the server. */

package/vendor/sdk/lib/core/store.ts

@@ -493,7 +493,7 @@ export class ComponentStore {
       // recomputed order on EVERY update, which is stable only while one thing is updating.
       // A held Agent task has two: the task's face ticking through its steps, and the
       // reply resuming once the result lands. They alternate, so the bottom slot alternated
-      // with them and the pair visibly swapped places on screen (SAB Account Agent,
+      // with them and the pair visibly swapped places on screen (a bank's account agent,
       // 2026-09-08). The case it was written for is served by arrival order too: text
       // placed before a form stays above it.
       this.merge(key, this.shieldGuestFace(key, event.data));

package/vendor/sdk/lib/core/types.ts

@@ -42,6 +42,8 @@ export interface UnoverseNode {
    *  content grows (new turn or streaming text), unless the user has scrolled up. Generic
    *  scroll-container behavior, opt-in via data (e.g. the conversation state's scroll box). */
   autoScroll?: boolean;
+  /** Drag to move around this box's overflow, keeping the centre when its content changes size. */
+  pan?: boolean;
   /** Box: a sticky bar (its own `position: sticky` + `top` in the design definition) that stays HIDDEN while
    *  the element before it (its previous sibling — e.g. a hero image) is on screen, then
    *  fades in once that sibling scrolls away. Overlays the content (no flow gap). Generic

package/vendor/sdk/lib/dom/app.ts

@@ -29,7 +29,7 @@ import { guestHeldPointers } from "../transition/guestHold";
 import { keyframesCss, styleToCss, type CssStyle } from "../style";
 import type { ActionHandler } from "../actions";
 import { mountComponent, type ComponentMount, type DefinitionSource } from "./component";
-import { setChildren, setStyle } from "./element";
+import { printWhenStill, setChildren, setStyle } from "./element";
 import { isolatedRoot } from "./isolate";
 import { mountQueue } from "./mounted";
 import { regionView, type Leaf, type Region, type SlotCompute } from "./region";
@@ -273,6 +273,7 @@ export function mountApp(options: AppOptions): AppMount {
       chatId: "",
       nodeId: "",
       sendToServer: o.onAction ? (t, payload) => o.onAction!(t, payload, meta) : undefined,
+      print: printWhenStill,
     });
   };
 
@@ -298,7 +299,7 @@ export function mountApp(options: AppOptions): AppMount {
 
     const leaf = (pointer: string, extraData?: Data, fill?: boolean) => {
       const { chatId, nodeId } = store.split(pointer);
-      const opts = { client: o.client, store, chatId, nodeId, onAction: dispatch, theme, extraData, fill, doc };
+      const opts = { client: o.client, store, chatId, nodeId, onAction: dispatch, theme, extraData, fill, doc, appStore: store };
       // Keyed by the INSTANCE: one re-delivered later keeps its elements (no flicker).
       return { key: nodeId, make: (): Leaf => mountComponent(opts), refresh: (l: Leaf) => (l as ComponentMount).update(opts) };
     };