@usenaive-sdk/blueprints 0.4.0 → 0.6.0

package/dist/index.js

@@ -203,6 +203,10 @@ var AUDIT_ACTIONS_P3 = [
   "app.db_queried",
   /** A ticket was minted that lets one browser past an app's own operator gate (§29.7). */
   "app.entered",
+  /** The dashboard password was read — the one audited reveal of an app secret (§29.7, ADR-0656). */
+  "app.access_read",
+  /** The dashboard password was regenerated (and a lost `DASHBOARD_TOKEN` copy repaired). */
+  "app.access_rotated",
   /** A link was minted that serves one file's bytes to anyone holding it, for seven days (§40). */
   "file.linked",
   "blueprint.installed",
@@ -411,6 +415,19 @@ var AuditEntrySchema = z3.object({
 var BROWSER_MAX_TIMEOUT_MINUTES = 360;
 var BROWSER_REGIONS = ["us-west", "us-east", "eu-central", "ap-southeast"];
 var BROWSER_OS = ["windows", "mac", "linux", "mobile", "tablet"];
+var BROWSER_TOOL_ACTIONS = [
+  "goto",
+  "click",
+  "type",
+  "extract",
+  "act",
+  "observe",
+  "links",
+  "screenshot",
+  "login",
+  "signup",
+  "save_context"
+];
 var BrowserOptionsSchema = z4.object({
   allowed_domains: z4.array(z4.string().min(1)).min(1),
   timeout_minutes: z4.number().int().min(1).max(BROWSER_MAX_TIMEOUT_MINUTES).default(15),
@@ -426,7 +443,8 @@ var BrowserOptionsSchema = z4.object({
   context_name: z4.string().min(1).max(64).optional(),
   persist_context: z4.boolean().default(false),
   human_login: z4.boolean().default(false),
-  proxy: z4.boolean().default(false)
+  proxy: z4.boolean().default(false),
+  ask_actions: z4.array(z4.enum(BROWSER_TOOL_ACTIONS)).default(["signup"])
 }).refine((options) => !(options.proxy && options.allowed_domains.includes("*")), {
   error: "a proxied browser needs a bounded allow-list, not *",
   path: ["proxy"]
@@ -590,6 +608,9 @@ function normaliseMultiagent(value) {
   if (value === false || value === null) return null;
   return value;
 }
+var HandoffsField = z5.union([z5.boolean(), z5.literal("team"), z5.array(z5.string().min(1)).max(50)]);
+var handoffsOf = (config) => config.handoffs ?? true;
+var handoffsEnabled = (handoffs) => handoffs === true || handoffs === "team" || handoffs !== false && handoffs.length > 0;
 var agentConfigShape = {
   model: z5.string(),
   window: WindowSchema,
@@ -598,6 +619,8 @@ var agentConfigShape = {
   mcp_servers: z5.array(McpServerSchema),
   skills: z5.array(SkillRefSchema),
   multiagent: MultiagentField,
+  /** Optional on the type so a version minted before §28.15 still parses; read it through `handoffsOf`. */
+  handoffs: HandoffsField.optional(),
   budget: BudgetSchema,
   output_schema: JsonSchemaDocument.nullable(),
   structured_output_required: z5.boolean(),
@@ -765,7 +788,11 @@ var SessionSchema = z6.object({
 var SendMessageSchema = z6.object({
   message: z6.string(),
   interrupt: z6.boolean().optional(),
+  queue: z6.boolean().optional(),
   idempotency_key: z6.string().optional()
+}).refine((body) => !(body.interrupt === true && body.queue === true), {
+  message: "a send is either an interrupt or queued, not both",
+  path: ["queue"]
 });
 var SendAcceptedSchema = z6.object({
   session_id: z6.string(),
@@ -869,11 +896,16 @@ var BoardCardSchema = z8.object({
   object: z8.literal("board_card"),
   board_id: idOf("brd"),
   title: z8.string().min(1),
+  /** The brief — what was asked. */
   body: z8.string(),
+  /** What the holder wrote back; a `done` carries one. */
+  note: z8.string().nullable(),
   status: BoardStatusSchema,
   assignee: z8.string().nullable(),
   /** The cards this one waits on. A `blocked` card with an empty list is stuck on the world. */
   blocked_by: z8.array(idOf("crd")),
+  woken_session_id: idOf("ses").nullable(),
+  reported_status: BoardStatusSchema.nullable(),
   created_at: Timestamp,
   updated_at: Timestamp
 });
@@ -1238,6 +1270,12 @@ var AppSchema = z13.object({
   error: z13.string().nullable(),
   /** Where the app serves MCP, or `null`. The bearer token for it is a server column. */
   mcp: AppMcpPathSchema.nullable(),
+  /**
+   * Is this a gated blueprint dashboard — one the Studio opens through `/apps/{id}/open` rather
+   * than linking its `url` (`§29.1`)? True when the platform holds the app's `DASHBOARD_TOKEN`
+   * or a secret of that name exists on the app; derived on read, never stored.
+   */
+  dashboard: z13.boolean(),
   created_at: Timestamp
 });
 var AppDeploymentStatusSchema = z13.enum(["queued", "building", "ready", "error"]);
@@ -1269,6 +1307,11 @@ var AppEntrySchema = z13.object({
   url: z13.string(),
   ticket: z13.string()
 });
+var AppAccessSchema = z13.object({
+  object: z13.literal("app_access"),
+  url: z13.string().nullable(),
+  password: z13.string().nullable()
+});
 var AppDomainStatusSchema = z13.enum(["pending", "connected", "failed"]);
 var AppDomainSchema = z13.object({
   object: z13.literal("app_domain"),
@@ -1303,6 +1346,8 @@ var BlueprintReportSchema = z14.object({
   agents: z14.array(ResourceReportSchema),
   schedules: z14.array(ResourceReportSchema),
   intake: z14.array(ResourceReportSchema),
+  /** One line per declared task (§31.11), `id` the card's `crd_`. Defaulted so older rows parse. */
+  tasks: z14.array(ResourceReportSchema).default([]),
   skipped: z14.array(z14.string()),
   deselected: z14.array(z14.string()).default([])
 });
@@ -1392,231 +1437,301 @@ var ProjectContextSchema = z14.object({
 });
 
 // ../core/src/schema/blueprint.ts
+import { z as z16 } from "zod";
+
+// ../core/src/schema/social.ts
 import { z as z15 } from "zod";
-var BlueprintScheduleSchema = z15.object({
-  agent: z15.string().min(1),
-  cron: z15.string().min(1),
-  timezone: z15.string().nullable(),
+var SOCIAL_PLATFORMS = [
+  "bluesky",
+  "facebook",
+  "instagram",
+  "linkedin",
+  "mastodon",
+  "pinterest",
+  "reddit",
+  "threads",
+  "tiktok",
+  "x",
+  "youtube"
+];
+var SOCIAL_TEXT_PLATFORMS = [
+  "bluesky",
+  "facebook",
+  "linkedin",
+  "mastodon",
+  "threads",
+  "x"
+];
+var SOCIAL_MEDIA_PLATFORMS = ["instagram", "tiktok", "youtube"];
+var SOCIAL_VISIBILITIES = ["public", "unlisted", "private"];
+var SOCIAL_VISIBILITY_PLATFORMS = ["mastodon", "youtube"];
+var SocialVisibilitySchema = z15.enum(SOCIAL_VISIBILITIES);
+var SOCIAL_VISIBILITY_RULE = `visibility is ${SOCIAL_VISIBILITIES.join(", ")} and only ${SOCIAL_VISIBILITY_PLATFORMS.join(" and ")} accept it; omit it and the post publishes at the account's own default, which on a video channel is normally public`;
+var SocialPlatformSchema = z15.enum(SOCIAL_PLATFORMS);
+var SocialTextPlatformSchema = z15.enum(SOCIAL_TEXT_PLATFORMS);
+var isText = (platform) => SOCIAL_TEXT_PLATFORMS.includes(platform);
+var isMedia = (platform) => SOCIAL_MEDIA_PLATFORMS.includes(platform);
+var SOCIAL_PLATFORM_RULE = `${SOCIAL_TEXT_PLATFORMS.join(", ")} take a text-only post; ${SOCIAL_MEDIA_PLATFORMS.join(", ")} may be named only when the post carries media_urls or file_ids; ${SOCIAL_PLATFORMS.filter((platform) => !isText(platform) && !isMedia(platform)).join(", ")} cannot be posted to`;
+var SocialAccountSchema = z15.object({
+  id: z15.string().min(1),
+  object: z15.literal("social_account"),
+  identity_id: idOf("idn"),
+  platform: SocialPlatformSchema,
+  username: z15.string().nullable(),
+  display_name: z15.string().nullable(),
+  avatar_url: z15.url().nullable(),
+  connected_at: Timestamp.nullable()
+});
+var SocialPostStatusSchema = z15.enum([
+  "draft",
+  "scheduled",
+  "processing",
+  "posted",
+  "failed",
+  "deleted"
+]);
+var SocialPostSchema = z15.object({
+  id: z15.string().min(1),
+  object: z15.literal("social_post"),
+  identity_id: idOf("idn"),
+  title: z15.string(),
+  platforms: z15.array(SocialPlatformSchema),
+  status: SocialPostStatusSchema,
+  scheduled_at: Timestamp.nullable(),
+  posted_at: Timestamp.nullable(),
+  error: z15.string().nullable()
+});
+var SocialUploadSchema = z15.object({
+  id: z15.string().min(1),
+  object: z15.literal("social_upload"),
+  identity_id: idOf("idn"),
+  type: z15.enum(["image", "video", "document"]),
+  url: z15.url().nullable()
+});
+var SocialAnalyticsSchema = z15.object({
+  object: z15.literal("social_analytics"),
+  identity_id: idOf("idn"),
+  resource_id: z15.string().min(1),
+  platform: SocialPlatformSchema.nullable(),
+  data: z15.unknown()
+});
+var SocialCommentSchema = z15.object({
+  id: z15.string().min(1),
+  object: z15.literal("social_comment"),
+  identity_id: idOf("idn"),
+  post_id: z15.string().min(1),
+  platforms: z15.array(SocialPlatformSchema),
+  status: SocialPostStatusSchema,
+  posted_at: Timestamp.nullable(),
+  data: z15.unknown()
+});
+
+// ../core/src/schema/blueprint.ts
+var BlueprintScheduleSchema = z16.object({
+  agent: z16.string().min(1),
+  cron: z16.string().min(1),
+  timezone: z16.string().nullable(),
   /** The message each fire opens its session with — the sentence worth printing. */
-  input: z15.string().min(1),
+  input: z16.string().min(1),
   budget_micro_usd: MicroUsdField.nonnegative()
 });
 var BlueprintBudgetSchema = BlueprintScheduleSchema.pick({ agent: true, cron: true, budget_micro_usd: true });
-var BlueprintCrewSchema = z15.object({
-  name: z15.string().min(1),
-  description: z15.string().nullable(),
-  model: z15.string().min(1),
-  briefed: z15.boolean(),
-  intake: z15.string().nullable().optional(),
+var BlueprintCrewSchema = z16.object({
+  name: z16.string().min(1),
+  description: z16.string().nullable(),
+  model: z16.string().min(1),
+  briefed: z16.boolean(),
+  intake: z16.string().nullable().optional(),
   /** What the first session may spend: the intake's own cap, else the agent's (§31.4). Set iff `briefed`. */
   intake_micro_usd: MicroUsdField.nonnegative().optional(),
-  role: z15.string().min(1).optional(),
-  skills: z15.array(SkillRefSchema).optional(),
-  tools: z15.array(z15.string().min(1)).optional(),
-  required: z15.boolean().optional()
+  role: z16.string().min(1).optional(),
+  skills: z16.array(SkillRefSchema).optional(),
+  tools: z16.array(z16.string().min(1)).optional(),
+  required: z16.boolean().optional()
 });
-var BlueprintAppSchema = z15.object({
-  name: z15.string().min(1),
+var BlueprintAppSchema = z16.object({
+  name: z16.string().min(1),
   type: AppTypeSchema,
-  description: z15.string().nullable(),
-  mcp: z15.string().nullable().optional(),
-  tools: z15.array(z15.string().min(1)).optional(),
+  description: z16.string().nullable(),
+  mcp: z16.string().nullable().optional(),
+  tools: z16.array(z16.string().min(1)).optional(),
   /** Whether an install may deselect it (§31.2). Optional: the rollout argument above. */
-  required: z15.boolean().optional()
+  required: z16.boolean().optional()
+});
+var BlueprintIdentityConnectionsSchema = z16.object({
+  social: z16.object({
+    from: z16.string().min(1),
+    map: z16.record(z16.string().min(1), SocialPlatformSchema)
+  }).optional()
 });
-var ContentHashSchema = z15.string().regex(/^[0-9a-f]{64}$/, "a lowercase sha-256 hex digest");
-var BlueprintTreeSchema = z15.object({
+var BlueprintIdentitySchema = z16.object({
+  name: z16.string().min(1),
+  description: z16.string().nullable(),
+  connections: BlueprintIdentityConnectionsSchema.optional()
+});
+var ContentHashSchema = z16.string().regex(/^[0-9a-f]{64}$/, "a lowercase sha-256 hex digest");
+var BlueprintTreeSchema = z16.object({
   /** `apps[].name` in the declaration — the same name §31.5 prints and the install ensures by. */
-  app: z15.string().min(1),
+  app: z16.string().min(1),
   content_hash: ContentHashSchema
 });
-var BlueprintArtifactSchema = z15.object({
+var BlueprintArtifactSchema = z16.object({
   id: idOf("bpa"),
-  object: z15.literal("blueprint_artifact"),
+  object: z16.literal("blueprint_artifact"),
   /** The machine — its repository, screens and `/api/*`. */
-  blueprint: z15.string().min(1),
+  blueprint: z16.string().min(1),
   /** Which of that blueprint's templates provides the crew. */
-  template: z15.string().min(1),
+  template: z16.string().min(1),
   /** The blueprint repository's own released version. Stored, never parsed (ADR-0401). */
-  version: z15.string().min(1),
+  version: z16.string().min(1),
   /**
    * The built trees, one per deployable app, ordered as the declaration orders its apps. Never
    * empty: an artifact that built nothing is not an artifact, and the column behind it says so
    * (migration 0040) exactly as the single `content_hash` it replaces was `not null`.
    */
-  trees: z15.array(BlueprintTreeSchema).min(1),
+  trees: z16.array(BlueprintTreeSchema).min(1),
   /**
    * The setup questions, asked by the studio **before** provisioning. `QuestionField` (§7.1) is
    * reused rather than restated: a setup question and a question a parked agent asks are the same
    * object at different times, so one component renders both.
    */
-  questions: z15.array(QuestionFieldSchema),
-  schedules: z15.array(BlueprintScheduleSchema),
+  questions: z16.array(QuestionFieldSchema),
+  schedules: z16.array(BlueprintScheduleSchema),
   /** Who the crew is, and what it deploys — §31.5. Derived from `declaration`, never stored twice. */
-  agents: z15.array(BlueprintCrewSchema),
-  apps: z15.array(BlueprintAppSchema),
+  agents: z16.array(BlueprintCrewSchema),
+  apps: z16.array(BlueprintAppSchema),
   /**
    * The agents a template creates per client the operator signs — printed, never provisioned by an
    * apply (§31.1). Absent on rows published before WS12 v2, hence optional.
    */
-  crew_per_client: z15.array(BlueprintCrewSchema).optional(),
+  crew_per_client: z16.array(BlueprintCrewSchema).optional(),
+  /**
+   * The personas the crew posts from, and which accounts to connect to each before the crew
+   * exists (§31.10). Derived from `declaration` like `agents`; optional for the §31.5 rollout reason.
+   */
+  identities: z16.array(BlueprintIdentitySchema).optional(),
   /**
    * The creator template a row was published from (§42.8), `null` on every first-party row.
    * `creator_name` is the public display name the landing page credits. The API sends all three
    * on every row; they are optional here only so an artifact typed before §42 still reads.
    */
   creator_template_id: idOf("ctp").nullish(),
-  creator_template_version: z15.number().int().positive().nullish(),
-  creator_name: z15.string().min(1).nullish(),
+  creator_template_version: z16.number().int().positive().nullish(),
+  creator_name: z16.string().min(1).nullish(),
   published_at: Timestamp
 });
 
 // ../core/src/schema/vault.ts
-import { z as z16 } from "zod";
-var VaultCredentialKindSchema = z16.enum(["env_var", "static_bearer", "mcp_oauth"]);
-var VaultSchema = z16.object({
+import { z as z17 } from "zod";
+var VaultCredentialKindSchema = z17.enum(["env_var", "static_bearer", "mcp_oauth"]);
+var VaultSchema = z17.object({
   id: idOf("vlt"),
-  object: z16.literal("vault"),
+  object: z17.literal("vault"),
   identity_id: idOf("idn").nullable(),
-  display_name: z16.string().min(1).max(128),
-  credential_count: z16.number().int().nonnegative(),
+  display_name: z17.string().min(1).max(128),
+  credential_count: z17.number().int().nonnegative(),
   created_at: Timestamp
 });
-var VaultCredentialSchema = z16.object({
+var VaultCredentialSchema = z17.object({
   id: idOf("vcr"),
-  object: z16.literal("vault_credential"),
+  object: z17.literal("vault_credential"),
   vault_id: idOf("vlt"),
   kind: VaultCredentialKindSchema,
   /** For `env_var`, the environment variable name. For the MCP kinds, a display label. */
-  key: z16.string().min(1).max(128),
+  key: z17.string().min(1).max(128),
   /** The exact destination host an `env_var` credential is bound to. Never a wildcard. */
-  host: z16.string().nullable(),
+  host: z17.string().nullable(),
   /** The exact MCP server URL an `mcp_*` token is matched to. */
-  mcp_server_url: z16.url().nullable(),
-  placeholder_ref: z16.string(),
+  mcp_server_url: z17.url().nullable(),
+  placeholder_ref: z17.string(),
   expires_at: Timestamp.nullable(),
   last_injected_at: Timestamp.nullable(),
   created_at: Timestamp
 });
 
-// ../core/src/schema/social.ts
-import { z as z17 } from "zod";
-var SOCIAL_PLATFORMS = [
-  "bluesky",
-  "facebook",
-  "instagram",
-  "linkedin",
-  "mastodon",
-  "pinterest",
-  "reddit",
-  "threads",
-  "tiktok",
-  "x",
-  "youtube"
-];
-var SOCIAL_TEXT_PLATFORMS = [
-  "bluesky",
-  "facebook",
-  "linkedin",
-  "mastodon",
-  "threads",
-  "x"
-];
-var SOCIAL_MEDIA_PLATFORMS = ["instagram", "tiktok", "youtube"];
-var SOCIAL_VISIBILITIES = ["public", "unlisted", "private"];
-var SOCIAL_VISIBILITY_PLATFORMS = ["mastodon", "youtube"];
-var SocialVisibilitySchema = z17.enum(SOCIAL_VISIBILITIES);
-var SOCIAL_VISIBILITY_RULE = `visibility is ${SOCIAL_VISIBILITIES.join(", ")} and only ${SOCIAL_VISIBILITY_PLATFORMS.join(" and ")} accept it; omit it and the post publishes at the account's own default, which on a video channel is normally public`;
-var SocialPlatformSchema = z17.enum(SOCIAL_PLATFORMS);
-var SocialTextPlatformSchema = z17.enum(SOCIAL_TEXT_PLATFORMS);
-var isText = (platform) => SOCIAL_TEXT_PLATFORMS.includes(platform);
-var isMedia = (platform) => SOCIAL_MEDIA_PLATFORMS.includes(platform);
-var SOCIAL_PLATFORM_RULE = `${SOCIAL_TEXT_PLATFORMS.join(", ")} take a text-only post; ${SOCIAL_MEDIA_PLATFORMS.join(", ")} may be named only when the post carries media_urls or file_ids; ${SOCIAL_PLATFORMS.filter((platform) => !isText(platform) && !isMedia(platform)).join(", ")} cannot be posted to`;
-var SocialAccountSchema = z17.object({
-  id: z17.string().min(1),
-  object: z17.literal("social_account"),
-  identity_id: idOf("idn"),
-  platform: SocialPlatformSchema,
-  username: z17.string().nullable(),
-  display_name: z17.string().nullable(),
-  avatar_url: z17.url().nullable(),
-  connected_at: Timestamp.nullable()
-});
-var SocialPostStatusSchema = z17.enum([
-  "draft",
-  "scheduled",
-  "processing",
-  "posted",
-  "failed",
-  "deleted"
-]);
-var SocialPostSchema = z17.object({
-  id: z17.string().min(1),
-  object: z17.literal("social_post"),
-  identity_id: idOf("idn"),
-  title: z17.string(),
-  platforms: z17.array(SocialPlatformSchema),
-  status: SocialPostStatusSchema,
-  scheduled_at: Timestamp.nullable(),
-  posted_at: Timestamp.nullable(),
-  error: z17.string().nullable()
-});
-var SocialUploadSchema = z17.object({
-  id: z17.string().min(1),
-  object: z17.literal("social_upload"),
-  identity_id: idOf("idn"),
-  type: z17.enum(["image", "video", "document"]),
-  url: z17.url().nullable()
-});
-var SocialAnalyticsSchema = z17.object({
-  object: z17.literal("social_analytics"),
-  identity_id: idOf("idn"),
-  resource_id: z17.string().min(1),
-  platform: SocialPlatformSchema.nullable(),
-  data: z17.unknown()
-});
-var SocialCommentSchema = z17.object({
-  id: z17.string().min(1),
-  object: z17.literal("social_comment"),
-  identity_id: idOf("idn"),
-  post_id: z17.string().min(1),
-  platforms: z17.array(SocialPlatformSchema),
-  status: SocialPostStatusSchema,
-  posted_at: Timestamp.nullable(),
-  data: z17.unknown()
+// ../core/src/schema/handoff.ts
+import { z as z18 } from "zod";
+var MAX_HANDOFF_TARGETS = 6;
+var HandoffRequestSchema = z18.object({
+  agent: z18.string().min(1),
+  message: z18.string().min(1),
+  handoff_key: z18.string().min(1).max(128).optional(),
+  budget_micro_usd: z18.number().int().positive().optional()
+});
+var HandoffSchema = z18.object({
+  object: z18.literal("handoff"),
+  session_id: idOf("ses"),
+  status: z18.enum(["queued", "already_running"]),
+  handoff_key: z18.string().nullable()
+});
+var SessionHandoffRequestSchema = z18.object({
+  agents: z18.array(z18.string().min(1)).min(1).max(MAX_HANDOFF_TARGETS),
+  message: z18.string().min(1),
+  handoff_key: z18.string().min(1).max(128).optional(),
+  budget_micro_usd: z18.number().int().positive().optional()
+});
+var HandoffRefusalSchema = z18.object({
+  object: z18.literal("handoff_refusal"),
+  agent: z18.string(),
+  code: z18.string(),
+  message: z18.string()
+});
+var HandoffBatchSchema = z18.object({
+  object: z18.literal("handoff_batch"),
+  handoffs: z18.array(HandoffSchema.extend({ agent_id: idOf("agt") })),
+  refusals: z18.array(HandoffRefusalSchema)
+});
+var SessionHandoffSchema = z18.object({
+  from_session: idOf("ses"),
+  from_agent: idOf("agt"),
+  key: z18.string().nullable(),
+  depth: z18.number().int().positive()
+});
+var ChannelBriefSchema = z18.object({
+  root_session_id: idOf("ses"),
+  name: z18.string().min(1),
+  members: z18.array(z18.string().min(1))
+});
+var ChannelPostRequestSchema = z18.object({
+  message: z18.string().min(1).max(2e4)
+});
+var ChannelPostSchema = z18.object({
+  object: z18.literal("channel_post"),
+  root_session_id: idOf("ses"),
+  queued: z18.boolean()
 });
 
 // ../core/src/schema/media.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var MEDIA_JOB_KINDS = ["video", "clip", "transcription"];
-var MediaJobKindSchema = z18.enum(MEDIA_JOB_KINDS);
-var MediaJobStatusSchema = z18.enum(["queued", "processing", "completed", "failed"]);
-var PublicUrl = z18.string().url().startsWith("http");
-var Score = z18.number().int().min(0).max(100);
-var Seconds = z18.number().nonnegative();
-var VideoResultSchema = z18.object({
-  files: z18.array(
-    z18.object({
+var MediaJobKindSchema = z19.enum(MEDIA_JOB_KINDS);
+var MediaJobStatusSchema = z19.enum(["queued", "processing", "completed", "failed"]);
+var PublicUrl = z19.string().url().startsWith("http");
+var Score = z19.number().int().min(0).max(100);
+var Seconds = z19.number().nonnegative();
+var VideoResultSchema = z19.object({
+  files: z19.array(
+    z19.object({
       file_id: idOf("fil"),
-      content_type: z18.string(),
-      width: z18.number().int().positive().nullable(),
-      height: z18.number().int().positive().nullable(),
+      content_type: z19.string(),
+      width: z19.number().int().positive().nullable(),
+      height: z19.number().int().positive().nullable(),
       duration_seconds: Seconds.nullable()
     })
   )
 });
-var ViralityScoreSchema = z18.object({
+var ViralityScoreSchema = z19.object({
   total: Score,
   shareability: Score,
   hook_strength: Score,
   story_quality: Score,
   emotional_impact: Score
 });
-var ClipResultSchema = z18.object({
-  clips: z18.array(
-    z18.object({
+var ClipResultSchema = z19.object({
+  clips: z19.array(
+    z19.object({
       file_id: idOf("fil"),
-      title: z18.string(),
+      title: z19.string(),
       start_seconds: Seconds,
       end_seconds: Seconds,
       duration_seconds: Seconds,
@@ -1624,189 +1739,189 @@ var ClipResultSchema = z18.object({
     })
   )
 });
-var TranscriptSchema = z18.object({
-  text: z18.string(),
-  language: z18.string().nullable(),
+var TranscriptSchema = z19.object({
+  text: z19.string(),
+  language: z19.string().nullable(),
   duration_seconds: Seconds.nullable(),
-  segments: z18.array(z18.object({ start_seconds: Seconds, end_seconds: Seconds, text: z18.string() }))
+  segments: z19.array(z19.object({ start_seconds: Seconds, end_seconds: Seconds, text: z19.string() }))
 });
-var MediaJobResultSchema = z18.union([VideoResultSchema, ClipResultSchema, TranscriptSchema]);
-var MediaJobSchema = z18.object({
+var MediaJobResultSchema = z19.union([VideoResultSchema, ClipResultSchema, TranscriptSchema]);
+var MediaJobSchema = z19.object({
   id: idOf("med"),
-  object: z18.literal("media_job"),
+  object: z19.literal("media_job"),
   kind: MediaJobKindSchema,
   status: MediaJobStatusSchema,
-  model: z18.string().nullable(),
-  input: z18.record(z18.string(), z18.unknown()),
+  model: z19.string().nullable(),
+  input: z19.record(z19.string(), z19.unknown()),
   result: MediaJobResultSchema.nullable(),
-  error: z18.object({ code: z18.string(), message: z18.string() }).nullable(),
+  error: z19.object({ code: z19.string(), message: z19.string() }).nullable(),
   cost_micro_usd: MicroUsdField.nullable(),
   session_id: idOf("ses").nullable(),
   created_at: Timestamp,
   completed_at: Timestamp.nullable()
 });
-var ImageRequestSchema = z18.object({
-  model: z18.string().min(1).optional(),
-  prompt: z18.string().min(1),
-  image_urls: z18.array(PublicUrl).max(4).optional(),
-  aspect_ratio: z18.string().optional(),
-  seed: z18.number().int().optional(),
-  n: z18.number().int().min(1).max(4).default(1)
-});
-var VideoRequestSchema = z18.object({
-  model: z18.string().min(1),
-  prompt: z18.string().min(1),
-  image_urls: z18.array(PublicUrl).max(1).optional(),
-  aspect_ratio: z18.string().optional(),
-  seed: z18.number().int().optional(),
-  seconds: z18.number().int().min(1).max(60).optional()
-});
-var ImageGenerationSchema = z18.object({
-  object: z18.literal("image_generation"),
-  model: z18.string(),
-  files: z18.array(FileSchema),
+var ImageRequestSchema = z19.object({
+  model: z19.string().min(1).optional(),
+  prompt: z19.string().min(1),
+  image_urls: z19.array(PublicUrl).max(4).optional(),
+  aspect_ratio: z19.string().optional(),
+  seed: z19.number().int().optional(),
+  n: z19.number().int().min(1).max(4).default(1)
+});
+var VideoRequestSchema = z19.object({
+  model: z19.string().min(1),
+  prompt: z19.string().min(1),
+  image_urls: z19.array(PublicUrl).max(1).optional(),
+  aspect_ratio: z19.string().optional(),
+  seed: z19.number().int().optional(),
+  seconds: z19.number().int().min(1).max(60).optional()
+});
+var ImageGenerationSchema = z19.object({
+  object: z19.literal("image_generation"),
+  model: z19.string(),
+  files: z19.array(FileSchema),
   cost_micro_usd: MicroUsdField
 });
-var ClipLength = z18.number().int().min(5).max(180);
-var ClipRequestSchema = z18.object({
+var ClipLength = z19.number().int().min(5).max(180);
+var ClipRequestSchema = z19.object({
   video_url: PublicUrl,
-  aspect_ratio: z18.enum(["9:16", "16:9"]).default("9:16"),
-  remove_silence: z18.boolean().default(false),
-  caption_preset: z18.enum(["none", "clean", "bold", "karaoke"]).default("none"),
-  language: z18.string().min(2).optional(),
+  aspect_ratio: z19.enum(["9:16", "16:9"]).default("9:16"),
+  remove_silence: z19.boolean().default(false),
+  caption_preset: z19.enum(["none", "clean", "bold", "karaoke"]).default("none"),
+  language: z19.string().min(2).optional(),
   min_seconds: ClipLength.default(15),
   max_seconds: ClipLength.default(60),
-  title: z18.string().min(1).optional()
+  title: z19.string().min(1).optional()
 });
-var AudioFormatSchema = z18.enum(["mp3", "wav", "ogg"]);
-var TranscriptionRequestSchema = z18.object({
-  model: z18.string().min(1).optional(),
+var AudioFormatSchema = z19.enum(["mp3", "wav", "ogg"]);
+var TranscriptionRequestSchema = z19.object({
+  model: z19.string().min(1).optional(),
   file_id: idOf("fil").optional(),
   url: PublicUrl.optional(),
-  language: z18.string().min(2).optional(),
-  timestamps: z18.boolean().default(true)
+  language: z19.string().min(2).optional(),
+  timestamps: z19.boolean().default(true)
 }).refine((request) => request.file_id === void 0 !== (request.url === void 0), {
   error: "exactly one of file_id or url",
   path: ["file_id"]
 });
-var SpeechRequestSchema = z18.object({
-  model: z18.string().min(1).optional(),
-  text: z18.string().min(1).max(4096),
-  voice: z18.string().min(1).optional(),
+var SpeechRequestSchema = z19.object({
+  model: z19.string().min(1).optional(),
+  text: z19.string().min(1).max(4096),
+  voice: z19.string().min(1).optional(),
   format: AudioFormatSchema.default("mp3"),
-  speed: z18.number().min(0.5).max(2).optional()
+  speed: z19.number().min(0.5).max(2).optional()
 });
-var SpeechToSpeechRequestSchema = z18.object({
-  model: z18.string().min(1).optional(),
+var SpeechToSpeechRequestSchema = z19.object({
+  model: z19.string().min(1).optional(),
   file_id: idOf("fil"),
-  voice: z18.string().min(1).optional(),
+  voice: z19.string().min(1).optional(),
   format: AudioFormatSchema.default("mp3")
 });
-var SpeechGenerationSchema = z18.object({
-  object: z18.literal("speech_generation"),
-  model: z18.string(),
+var SpeechGenerationSchema = z19.object({
+  object: z19.literal("speech_generation"),
+  model: z19.string(),
   file: FileSchema,
   duration_seconds: Seconds.nullable(),
   cost_micro_usd: MicroUsdField
 });
 
 // ../core/src/schema/app-data.ts
-import { z as z19 } from "zod";
-var DbTableSchema = z19.object({
-  object: z19.literal("db_table"),
-  name: z19.string(),
-  schema: z19.string().default("public"),
-  rows: z19.number().int().nonnegative().nullable(),
-  size_bytes: z19.number().int().nonnegative().nullable()
-});
-var DbMigrationSchema = z19.object({
+import { z as z20 } from "zod";
+var DbTableSchema = z20.object({
+  object: z20.literal("db_table"),
+  name: z20.string(),
+  schema: z20.string().default("public"),
+  rows: z20.number().int().nonnegative().nullable(),
+  size_bytes: z20.number().int().nonnegative().nullable()
+});
+var DbMigrationSchema = z20.object({
   id: idOf("dbm"),
-  object: z19.literal("db_migration"),
-  name: z19.string(),
-  sha256: z19.string().regex(/^[0-9a-f]{64}$/),
+  object: z20.literal("db_migration"),
+  name: z20.string(),
+  sha256: z20.string().regex(/^[0-9a-f]{64}$/),
   applied_at: Timestamp,
-  statements: z19.number().int().nonnegative()
+  statements: z20.number().int().nonnegative()
 });
-var ApplyDbMigrationSchema = z19.object({
-  name: z19.string().min(1).max(128).regex(/^[a-z0-9][a-z0-9_-]*$/),
-  sql: z19.string().min(1)
+var ApplyDbMigrationSchema = z20.object({
+  name: z20.string().min(1).max(128).regex(/^[a-z0-9][a-z0-9_-]*$/),
+  sql: z20.string().min(1)
 });
 var DB_REST_METHODS = ["GET", "POST", "PATCH", "PUT", "DELETE", "HEAD"];
-var DbRestMethodSchema = z19.enum(DB_REST_METHODS);
+var DbRestMethodSchema = z20.enum(DB_REST_METHODS);
 var BUCKET_NAME = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
-var BucketSchema = z19.object({
-  object: z19.literal("bucket"),
-  name: z19.string().regex(BUCKET_NAME),
-  public: z19.boolean(),
+var BucketSchema = z20.object({
+  object: z20.literal("bucket"),
+  name: z20.string().regex(BUCKET_NAME),
+  public: z20.boolean(),
   created_at: Timestamp
 });
-var CreateBucketSchema = z19.object({
-  name: z19.string().regex(BUCKET_NAME, { error: "3\u201363 lowercase letters, digits and hyphens" }),
-  public: z19.boolean().default(false)
-});
-var StorageObjectSchema = z19.object({
-  object: z19.literal("storage_object"),
-  bucket: z19.string(),
-  key: z19.string().min(1),
-  size_bytes: z19.number().int().nonnegative(),
-  content_type: z19.string(),
-  etag: z19.string().nullable(),
+var CreateBucketSchema = z20.object({
+  name: z20.string().regex(BUCKET_NAME, { error: "3\u201363 lowercase letters, digits and hyphens" }),
+  public: z20.boolean().default(false)
+});
+var StorageObjectSchema = z20.object({
+  object: z20.literal("storage_object"),
+  bucket: z20.string(),
+  key: z20.string().min(1),
+  size_bytes: z20.number().int().nonnegative(),
+  content_type: z20.string(),
+  etag: z20.string().nullable(),
   updated_at: Timestamp
 });
-var SignedUrlMethodSchema = z19.enum(["PUT", "GET"]);
-var SignedUrlSchema = z19.object({
-  object: z19.literal("signed_url"),
-  url: z19.string().url(),
+var SignedUrlMethodSchema = z20.enum(["PUT", "GET"]);
+var SignedUrlSchema = z20.object({
+  object: z20.literal("signed_url"),
+  url: z20.string().url(),
   method: SignedUrlMethodSchema,
   expires_at: Timestamp
 });
-var CreateUploadUrlSchema = z19.object({
-  content_type: z19.string().min(1),
-  expires_seconds: z19.number().int().min(60).max(3600).default(900)
+var CreateUploadUrlSchema = z20.object({
+  content_type: z20.string().min(1),
+  expires_seconds: z20.number().int().min(60).max(3600).default(900)
 });
 
 // ../core/src/schema/stock-photo.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var STOCK_PHOTO_ORIENTATIONS = ["landscape", "portrait", "square"];
 var STOCK_PHOTO_SIZES = ["small", "medium", "large"];
-var StockPhotoQuerySchema = z20.object({
-  query: z20.string().min(1).max(200),
-  count: z20.coerce.number().int().min(1).max(30).default(10),
-  orientation: z20.enum(STOCK_PHOTO_ORIENTATIONS).optional(),
-  color: z20.string().min(1).max(32).optional(),
-  size: z20.enum(STOCK_PHOTO_SIZES).optional()
-});
-var StockPhotoSchema = z20.object({
-  object: z20.literal("stock_photo"),
-  id: z20.string().min(1),
-  width: z20.number().int().positive(),
-  height: z20.number().int().positive(),
-  url: z20.string().url(),
-  preview_url: z20.string().url(),
-  alt: z20.string().nullable(),
-  photographer: z20.string().nullable(),
-  attribution_url: z20.string().url().nullable(),
-  dominant_color: z20.string().nullable()
+var StockPhotoQuerySchema = z21.object({
+  query: z21.string().min(1).max(200),
+  count: z21.coerce.number().int().min(1).max(30).default(10),
+  orientation: z21.enum(STOCK_PHOTO_ORIENTATIONS).optional(),
+  color: z21.string().min(1).max(32).optional(),
+  size: z21.enum(STOCK_PHOTO_SIZES).optional()
+});
+var StockPhotoSchema = z21.object({
+  object: z21.literal("stock_photo"),
+  id: z21.string().min(1),
+  width: z21.number().int().positive(),
+  height: z21.number().int().positive(),
+  url: z21.string().url(),
+  preview_url: z21.string().url(),
+  alt: z21.string().nullable(),
+  photographer: z21.string().nullable(),
+  attribution_url: z21.string().url().nullable(),
+  dominant_color: z21.string().nullable()
 });
 
 // ../core/src/schema/creator.ts
-import { z as z21 } from "zod";
-var CreatorCodeSchema = z21.string().regex(/^[a-z0-9]{3,24}$/, "3 to 24 lowercase letters or digits");
-var PayoutMethodSchema = z21.enum(["wise", "paypal"]);
-var PayoutDetailsSchema = z21.object({
+import { z as z22 } from "zod";
+var CreatorCodeSchema = z22.string().regex(/^[a-z0-9]{3,24}$/, "3 to 24 lowercase letters or digits");
+var PayoutMethodSchema = z22.enum(["wise", "paypal"]);
+var PayoutDetailsSchema = z22.object({
   method: PayoutMethodSchema,
-  account: z21.string().min(1).max(320)
+  account: z22.string().min(1).max(320)
 });
-var CreatorStatusSchema = z21.enum(["active", "suspended"]);
-var CreatorSchema = z21.object({
+var CreatorStatusSchema = z22.enum(["active", "suspended"]);
+var CreatorSchema = z22.object({
   id: idOf("crt"),
-  object: z21.literal("creator"),
-  email: z21.email(),
-  display_name: z21.string().min(1).max(80),
+  object: z22.literal("creator"),
+  email: z22.email(),
+  display_name: z22.string().min(1).max(80),
   code: CreatorCodeSchema,
   status: CreatorStatusSchema,
   payout: PayoutDetailsSchema.nullable(),
-  clicks: z21.number().int().nonnegative(),
+  clicks: z22.number().int().nonnegative(),
   created_at: Timestamp,
   updated_at: Timestamp
 });
@@ -1814,28 +1929,28 @@ var IdentityCreatorSchema = CreatorSchema.pick({
   id: true,
   status: true
 });
-var CreatorApplicationStatusSchema = z21.enum([
+var CreatorApplicationStatusSchema = z22.enum([
   "pending",
   "approved",
   "rejected"
 ]);
-var CreatorApplicationSchema = z21.object({
+var CreatorApplicationSchema = z22.object({
   id: idOf("cra"),
-  object: z21.literal("creator_application"),
-  email: z21.email(),
-  display_name: z21.string().min(1).max(80),
-  pitch: z21.string().min(1).max(2e3),
-  links: z21.array(z21.url({ protocol: /^https$/ })).max(5),
+  object: z22.literal("creator_application"),
+  email: z22.email(),
+  display_name: z22.string().min(1).max(80),
+  pitch: z22.string().min(1).max(2e3),
+  links: z22.array(z22.url({ protocol: /^https$/ })).max(5),
   status: CreatorApplicationStatusSchema,
-  note: z21.string().nullable(),
+  note: z22.string().nullable(),
   creator_id: idOf("crt").nullable(),
   created_at: Timestamp,
   decided_at: Timestamp.nullable()
 });
-var ReferralStatusSchema = z21.enum(["pending", "active", "expired"]);
-var ReferralSchema = z21.object({
+var ReferralStatusSchema = z22.enum(["pending", "active", "expired"]);
+var ReferralSchema = z22.object({
   id: idOf("crf"),
-  object: z21.literal("referral"),
+  object: z22.literal("referral"),
   creator_id: idOf("crt"),
   organization_id: idOf("org"),
   status: ReferralStatusSchema,
@@ -1843,16 +1958,16 @@ var ReferralSchema = z21.object({
   first_paid_at: Timestamp.nullable(),
   commission_until: Timestamp.nullable()
 });
-var CommissionKindSchema = z21.enum(["referral", "template"]);
-var CommissionStatusSchema = z21.enum([
+var CommissionKindSchema = z22.enum(["referral", "template"]);
+var CommissionStatusSchema = z22.enum([
   "pending",
   "available",
   "claimed",
   "paid"
 ]);
-var CommissionSchema = z21.object({
+var CommissionSchema = z22.object({
   id: idOf("crc"),
-  object: z21.literal("commission"),
+  object: z22.literal("commission"),
   creator_id: idOf("crt"),
   kind: CommissionKindSchema,
   referral_id: idOf("crf").nullable(),
@@ -1865,18 +1980,18 @@ var CommissionSchema = z21.object({
   available_at: Timestamp,
   payout_id: idOf("crp").nullable()
 });
-var PayoutStatusSchema = z21.enum(["requested", "paid", "rejected"]);
-var PayoutSchema = z21.object({
+var PayoutStatusSchema = z22.enum(["requested", "paid", "rejected"]);
+var PayoutSchema = z22.object({
   id: idOf("crp"),
-  object: z21.literal("payout"),
+  object: z22.literal("payout"),
   creator_id: idOf("crt"),
   amount_micro_usd: MicroUsdField.positive(),
-  currency: z21.literal("USD"),
+  currency: z22.literal("USD"),
   method: PayoutMethodSchema,
-  account: z21.string().min(1),
+  account: z22.string().min(1),
   status: PayoutStatusSchema,
-  reference: z21.string().nullable(),
-  note: z21.string().nullable(),
+  reference: z22.string().nullable(),
+  note: z22.string().nullable(),
   requested_at: Timestamp,
   decided_at: Timestamp.nullable()
 });
@@ -1888,100 +2003,100 @@ var CREATOR_PROGRAM = {
   attribution_days: 30,
   minimum_payout_micro_usd: 2e7
 };
-var CreatorTemplateSlugSchema = z21.string().max(32).regex(
+var CreatorTemplateSlugSchema = z22.string().max(32).regex(
   /^[a-z0-9]+(-[a-z0-9]+)*$/,
   "lowercase letters, digits and single dashes"
 );
-var CreatorSkillSchema = z21.object({
-  slug: z21.string().regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits and dashes"),
-  body: z21.string().min(1).max(64 * 1024)
+var CreatorSkillSchema = z22.object({
+  slug: z22.string().regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits and dashes"),
+  body: z22.string().min(1).max(64 * 1024)
 });
-var CreatorDeclarationSchema = z21.object({
-  agents: z21.array(z21.unknown()),
-  questions: z21.array(z21.unknown()),
-  skills: z21.array(CreatorSkillSchema).max(16)
+var CreatorDeclarationSchema = z22.object({
+  agents: z22.array(z22.unknown()),
+  questions: z22.array(z22.unknown()),
+  skills: z22.array(CreatorSkillSchema).max(16)
 });
-var CreatorTemplateVersionStatusSchema = z21.enum([
+var CreatorTemplateVersionStatusSchema = z22.enum([
   "in_review",
   "approved",
   "changes_requested"
 ]);
-var VersionNumber = z21.number().int().positive();
-var CreatorTemplateSchema = z21.object({
+var VersionNumber = z22.number().int().positive();
+var CreatorTemplateSchema = z22.object({
   id: idOf("ctp"),
-  object: z21.literal("creator_template"),
+  object: z22.literal("creator_template"),
   creator_id: idOf("crt"),
-  blueprint: z21.string().min(1),
-  base_template: z21.string().min(1),
+  blueprint: z22.string().min(1),
+  base_template: z22.string().min(1),
   slug: CreatorTemplateSlugSchema,
-  template: z21.string().min(1).max(64),
-  name: z21.string().min(1).max(80),
-  description: z21.string().max(2e3),
+  template: z22.string().min(1).max(64),
+  name: z22.string().min(1).max(80),
+  description: z22.string().max(2e3),
   declaration: CreatorDeclarationSchema,
   published_version: VersionNumber.nullable(),
-  latest_version: z21.object({
+  latest_version: z22.object({
     version: VersionNumber,
     status: CreatorTemplateVersionStatusSchema
   }).nullable(),
   created_at: Timestamp,
   updated_at: Timestamp
 });
-var CreatorTemplateVersionSchema = z21.object({
-  object: z21.literal("creator_template_version"),
+var CreatorTemplateVersionSchema = z22.object({
+  object: z22.literal("creator_template_version"),
   template_id: idOf("ctp"),
   version: VersionNumber,
   declaration: CreatorDeclarationSchema,
   status: CreatorTemplateVersionStatusSchema,
-  note: z21.string().nullable(),
+  note: z22.string().nullable(),
   artifact_id: idOf("bpa").nullable(),
   submitted_at: Timestamp,
   decided_at: Timestamp.nullable()
 });
-var CreatorBalanceSchema = z21.object({
-  object: z21.literal("creator_balance"),
+var CreatorBalanceSchema = z22.object({
+  object: z22.literal("creator_balance"),
   pending_micro_usd: MicroUsdField.nonnegative(),
   available_micro_usd: MicroUsdField.nonnegative(),
   claimed_micro_usd: MicroUsdField.nonnegative(),
   paid_micro_usd: MicroUsdField.nonnegative(),
-  minimum_payout_micro_usd: z21.literal(CREATOR_PROGRAM.minimum_payout_micro_usd)
+  minimum_payout_micro_usd: z22.literal(CREATOR_PROGRAM.minimum_payout_micro_usd)
 });
-var ReferralClickSchema = z21.object({
-  object: z21.literal("referral_click"),
+var ReferralClickSchema = z22.object({
+  object: z22.literal("referral_click"),
   code: CreatorCodeSchema,
-  creator: z21.object({ display_name: z21.string().min(1) }),
+  creator: z22.object({ display_name: z22.string().min(1) }),
   expires_at: Timestamp
 });
-var Day = z21.iso.date();
-var CreatorAnalyticsSchema = z21.object({
-  object: z21.literal("creator_analytics"),
-  days: z21.number().int().min(1).max(90),
+var Day = z22.iso.date();
+var CreatorAnalyticsSchema = z22.object({
+  object: z22.literal("creator_analytics"),
+  days: z22.number().int().min(1).max(90),
   from: Day,
   to: Day,
-  clicks: z21.number().int().nonnegative(),
-  referrals: z21.number().int().nonnegative(),
-  installs: z21.number().int().nonnegative(),
-  active_installs: z21.number().int().nonnegative(),
-  usage_by_day: z21.array(
-    z21.object({ day: Day, debit_micro_usd: MicroUsdField.nonnegative() })
+  clicks: z22.number().int().nonnegative(),
+  referrals: z22.number().int().nonnegative(),
+  installs: z22.number().int().nonnegative(),
+  active_installs: z22.number().int().nonnegative(),
+  usage_by_day: z22.array(
+    z22.object({ day: Day, debit_micro_usd: MicroUsdField.nonnegative() })
   ),
-  commission_micro_usd: z21.object({
+  commission_micro_usd: z22.object({
     pending: MicroUsdField.nonnegative(),
     available: MicroUsdField.nonnegative(),
     claimed: MicroUsdField.nonnegative(),
     paid: MicroUsdField.nonnegative()
   }),
-  commissions_by_template: z21.array(
-    z21.object({
+  commissions_by_template: z22.array(
+    z22.object({
       creator_template_id: idOf("ctp"),
       amount_micro_usd: MicroUsdField.nonnegative()
     })
   ),
   /** Every install covered, newest first: the day it was created and the day its twelve months end. */
-  install_windows: z21.array(z21.object({ install_id: idOf("bpi"), from: Day, until: Day }))
+  install_windows: z22.array(z22.object({ install_id: idOf("bpi"), from: Day, until: Day }))
 });
 
 // ../core/src/schema/legal.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var LEGAL_MEMBER_STATUSES = [
   "pending",
   "link_ready",
@@ -1991,16 +2106,16 @@ var LEGAL_MEMBER_STATUSES = [
   "verified",
   "failed"
 ];
-var LegalMemberStatusSchema = z22.enum(LEGAL_MEMBER_STATUSES);
+var LegalMemberStatusSchema = z23.enum(LEGAL_MEMBER_STATUSES);
 var LEGAL_VERIFICATION_STATUSES = ["in_progress", "pending_review", "verified", "failed"];
-var LegalVerificationStatusSchema = z22.enum(LEGAL_VERIFICATION_STATUSES);
+var LegalVerificationStatusSchema = z23.enum(LEGAL_VERIFICATION_STATUSES);
 var LEGAL_COMPANY_STATUSES = ["awaiting_payment", "paid", "submitted", "formed", "failed"];
-var LegalCompanyStatusSchema = z22.enum(LEGAL_COMPANY_STATUSES);
+var LegalCompanyStatusSchema = z23.enum(LEGAL_COMPANY_STATUSES);
 var LEGAL_DOCUMENT_KINDS = ["articles", "ein_letter", "operating_agreement", "other"];
-var LegalDocumentKindSchema = z22.enum(LEGAL_DOCUMENT_KINDS);
-var LegalMemberRoleSchema = z22.enum(["primary", "secondary"]);
-var LegalEinStatusSchema = z22.enum(["none", "pending", "issued"]);
-var LegalRequiredActionKindSchema = z22.enum(["signature", "information", "payment", "other"]);
+var LegalDocumentKindSchema = z23.enum(LEGAL_DOCUMENT_KINDS);
+var LegalMemberRoleSchema = z23.enum(["primary", "secondary"]);
+var LegalEinStatusSchema = z23.enum(["none", "pending", "issued"]);
+var LegalRequiredActionKindSchema = z23.enum(["signature", "information", "payment", "other"]);
 var US_STATES = [
   "AL",
   "AK",
@@ -2054,105 +2169,105 @@ var US_STATES = [
   "WI",
   "WY"
 ];
-var UsStateSchema = z22.enum(US_STATES);
-var LegalMemberInputSchema = z22.object({
-  first_name: z22.string().min(1).max(128),
-  last_name: z22.string().min(1).max(128),
-  email: z22.string().min(1).max(320),
+var UsStateSchema = z23.enum(US_STATES);
+var LegalMemberInputSchema = z23.object({
+  first_name: z23.string().min(1).max(128),
+  last_name: z23.string().min(1).max(128),
+  email: z23.string().min(1).max(320),
   role: LegalMemberRoleSchema,
-  is_responsible_party: z22.boolean(),
-  ownership_percent: z22.number().int()
+  is_responsible_party: z23.boolean(),
+  ownership_percent: z23.number().int()
 });
 var LegalMemberSchema = LegalMemberInputSchema.extend({
   id: idOf("lgm"),
-  object: z22.literal("legal_member"),
+  object: z23.literal("legal_member"),
   verification_id: idOf("lgv"),
   status: LegalMemberStatusSchema,
-  link_url: z22.url().nullable(),
+  link_url: z23.url().nullable(),
   link_expires_at: Timestamp.nullable(),
   completed_at: Timestamp.nullable()
 });
-var LegalVerificationSchema = z22.object({
+var LegalVerificationSchema = z23.object({
   id: idOf("lgv"),
-  object: z22.literal("legal_verification"),
+  object: z23.literal("legal_verification"),
   identity_id: idOf("idn"),
   status: LegalVerificationStatusSchema,
-  members: z22.array(LegalMemberSchema),
-  ready_for_formation: z22.boolean(),
+  members: z23.array(LegalMemberSchema),
+  ready_for_formation: z23.boolean(),
   started_at: Timestamp,
   completed_at: Timestamp.nullable(),
   created_at: Timestamp,
   updated_at: Timestamp
 });
-var StartLegalVerificationSchema = z22.object({ members: z22.array(LegalMemberInputSchema) });
-var CompleteLegalMemberSchema = z22.object({ token: z22.string().min(1) });
-var LegalNameOptionSchema = z22.object({ name: z22.string().min(1).max(200), ending: z22.literal("LLC") });
-var LegalMailingAddressSchema = z22.object({
-  line1: z22.string().min(1).max(200),
-  line2: z22.string().max(200).nullable(),
-  city: z22.string().min(1).max(100),
+var StartLegalVerificationSchema = z23.object({ members: z23.array(LegalMemberInputSchema) });
+var CompleteLegalMemberSchema = z23.object({ token: z23.string().min(1) });
+var LegalNameOptionSchema = z23.object({ name: z23.string().min(1).max(200), ending: z23.literal("LLC") });
+var LegalMailingAddressSchema = z23.object({
+  line1: z23.string().min(1).max(200),
+  line2: z23.string().max(200).nullable(),
+  city: z23.string().min(1).max(100),
   state: UsStateSchema,
-  postal_code: z22.string().min(1).max(16),
-  country: z22.literal("US")
+  postal_code: z23.string().min(1).max(16),
+  country: z23.literal("US")
 });
-var LegalRequiredActionSchema = z22.object({
+var LegalRequiredActionSchema = z23.object({
   kind: LegalRequiredActionKindSchema,
-  description: z22.string(),
-  url: z22.url().nullable()
+  description: z23.string(),
+  url: z23.url().nullable()
 });
 var LEGAL_DESCRIPTION_MAX = 50;
-var CreateLegalCompanySchema = z22.object({
+var CreateLegalCompanySchema = z23.object({
   verification_id: idOf("lgv"),
   state: UsStateSchema,
-  name_options: z22.array(z22.string().min(1).max(200)).min(1).max(3),
-  naics_code: z22.string().regex(/^\d{2,6}$/),
-  description: z22.string().min(1).max(LEGAL_DESCRIPTION_MAX),
+  name_options: z23.array(z23.string().min(1).max(200)).min(1).max(3),
+  naics_code: z23.string().regex(/^\d{2,6}$/),
+  description: z23.string().min(1).max(LEGAL_DESCRIPTION_MAX),
   mailing_address: LegalMailingAddressSchema
 });
 var LegalCompanySchema = CreateLegalCompanySchema.omit({ name_options: true }).extend({
   id: idOf("lgc"),
-  object: z22.literal("legal_company"),
+  object: z23.literal("legal_company"),
   identity_id: idOf("idn"),
   status: LegalCompanyStatusSchema,
-  entity_type: z22.literal("llc"),
-  name_options: z22.array(LegalNameOptionSchema),
-  legal_name: z22.string().nullable(),
+  entity_type: z23.literal("llc"),
+  name_options: z23.array(LegalNameOptionSchema),
+  legal_name: z23.string().nullable(),
   ein_status: LegalEinStatusSchema,
   price_micro_usd: MicroUsdField,
-  required_actions: z22.array(LegalRequiredActionSchema),
-  failure_reason: z22.string().max(256).nullable(),
+  required_actions: z23.array(LegalRequiredActionSchema),
+  failure_reason: z23.string().max(256).nullable(),
   submitted_at: Timestamp.nullable(),
   formed_at: Timestamp.nullable(),
   created_at: Timestamp,
   updated_at: Timestamp
 });
-var LegalDocumentSchema = z22.object({
+var LegalDocumentSchema = z23.object({
   id: idOf("lgd"),
-  object: z22.literal("legal_document"),
+  object: z23.literal("legal_document"),
   company_id: idOf("lgc"),
   kind: LegalDocumentKindSchema,
-  name: z22.string(),
+  name: z23.string(),
   created_at: Timestamp
 });
-var LegalDocumentLinkSchema = z22.object({
-  object: z22.literal("legal_document_link"),
-  url: z22.url(),
+var LegalDocumentLinkSchema = z23.object({
+  object: z23.literal("legal_document_link"),
+  url: z23.url(),
   expires_at: Timestamp
 });
-var NaicsCodeSchema = z22.object({
-  object: z22.literal("naics_code"),
-  code: z22.string().regex(/^\d{2,6}$/),
-  title: z22.string()
+var NaicsCodeSchema = z23.object({
+  object: z23.literal("naics_code"),
+  code: z23.string().regex(/^\d{2,6}$/),
+  title: z23.string()
 });
-var LegalStateSchema = z22.object({
-  object: z22.literal("legal_state"),
+var LegalStateSchema = z23.object({
+  object: z23.literal("legal_state"),
   code: UsStateSchema,
-  name: z22.string(),
+  name: z23.string(),
   formation_fee_micro_usd: MicroUsdField
 });
-var LegalWebhookEventSchema = z22.object({
-  provider_session_ref: z22.string().min(1),
-  status: z22.enum(["verified", "failed", "pending_review"]),
+var LegalWebhookEventSchema = z23.object({
+  provider_session_ref: z23.string().min(1),
+  status: z23.enum(["verified", "failed", "pending_review"]),
   metadata: Metadata
 });
 var LLC_ENDING = /\s*(?:,\s*)?(?:l\.?l\.?c\.?|limited\s+liability\s+company)\s*$/i;
@@ -2163,178 +2278,178 @@ function canonicalName(raw) {
 }
 
 // ../core/src/schema/wallet.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var WALLET_NETWORKS = ["eip155:84532", "eip155:8453"];
-var WalletNetworkSchema = z23.enum(WALLET_NETWORKS);
+var WalletNetworkSchema = z24.enum(WALLET_NETWORKS);
 var DEFAULT_WALLET_NETWORK = "eip155:84532";
-var WalletSelectSchema = z23.object({ network: WalletNetworkSchema.optional() });
+var WalletSelectSchema = z24.object({ network: WalletNetworkSchema.optional() });
 var WALLET_STATUSES = ["active", "frozen", "swept"];
-var WalletStatusSchema = z23.enum(WALLET_STATUSES);
+var WalletStatusSchema = z24.enum(WALLET_STATUSES);
 var WALLET_TRANSACTION_KINDS = ["fund", "transfer", "pay", "sweep"];
-var WalletTransactionKindSchema = z23.enum(WALLET_TRANSACTION_KINDS);
+var WalletTransactionKindSchema = z24.enum(WALLET_TRANSACTION_KINDS);
 var WALLET_TRANSACTION_STATUSES = ["pending", "confirmed", "failed"];
-var WalletTransactionStatusSchema = z23.enum(WALLET_TRANSACTION_STATUSES);
-var WalletDirectionSchema = z23.enum(["in", "out"]);
-var WalletFundSourceSchema = z23.enum(["faucet", "treasury"]);
-var EvmAddressSchema = z23.string().regex(/^0x[0-9a-fA-F]{40}$/, "expected a 0x address");
-var TxHashSchema = z23.string().regex(/^0x[0-9a-fA-F]{64}$/, "expected a 0x transaction hash");
-var WalletPolicySchema = z23.object({
+var WalletTransactionStatusSchema = z24.enum(WALLET_TRANSACTION_STATUSES);
+var WalletDirectionSchema = z24.enum(["in", "out"]);
+var WalletFundSourceSchema = z24.enum(["faucet", "treasury"]);
+var EvmAddressSchema = z24.string().regex(/^0x[0-9a-fA-F]{40}$/, "expected a 0x address");
+var TxHashSchema = z24.string().regex(/^0x[0-9a-fA-F]{64}$/, "expected a 0x transaction hash");
+var WalletPolicySchema = z24.object({
   per_tx_cap_micro_usd: MicroUsdField.nonnegative(),
   daily_cap_micro_usd: MicroUsdField.positive().nullable(),
   low_balance_micro_usd: MicroUsdField.nonnegative().nullable()
 });
-var WalletSchema = z23.object({
+var WalletSchema = z24.object({
   id: idOf("wlt"),
-  object: z23.literal("wallet"),
+  object: z24.literal("wallet"),
   identity_id: idOf("idn"),
   status: WalletStatusSchema,
   network: WalletNetworkSchema,
   address: EvmAddressSchema,
-  asset: z23.literal("usdc"),
+  asset: z24.literal("usdc"),
   balance_micro_usd: MicroUsdField,
   policy: WalletPolicySchema,
   spent_today_micro_usd: MicroUsdField,
   created_at: Timestamp,
   updated_at: Timestamp
 });
-var CreateWalletSchema = z23.object({
+var CreateWalletSchema = z24.object({
   network: WalletNetworkSchema.optional(),
   policy: WalletPolicySchema.partial().optional()
 });
 var UpdateWalletPolicySchema = WalletPolicySchema.partial();
-var FundWalletSchema = z23.object({
+var FundWalletSchema = z24.object({
   amount_micro_usd: MicroUsdField.positive(),
   source: WalletFundSourceSchema
 });
-var TransferWalletSchema = z23.object({
-  to: z23.union([EvmAddressSchema, idOf("idn")]),
+var TransferWalletSchema = z24.object({
+  to: z24.union([EvmAddressSchema, idOf("idn")]),
   amount_micro_usd: MicroUsdField.positive(),
-  purpose: z23.string().min(1).max(256)
+  purpose: z24.string().min(1).max(256)
 });
-var SweepWalletSchema = z23.object({ to: EvmAddressSchema.optional() });
-var WalletTransactionSchema = z23.object({
+var SweepWalletSchema = z24.object({ to: EvmAddressSchema.optional() });
+var WalletTransactionSchema = z24.object({
   id: idOf("wtx"),
-  object: z23.literal("wallet_transaction"),
+  object: z24.literal("wallet_transaction"),
   wallet_id: idOf("wlt"),
   kind: WalletTransactionKindSchema,
   direction: WalletDirectionSchema,
   amount_micro_usd: MicroUsdField,
-  counterparty: z23.string().nullable(),
-  origin: z23.string().nullable(),
-  purpose: z23.string().nullable(),
+  counterparty: z24.string().nullable(),
+  origin: z24.string().nullable(),
+  purpose: z24.string().nullable(),
   tx_hash: TxHashSchema.nullable(),
   session_id: idOf("ses").nullable(),
   status: WalletTransactionStatusSchema,
   created_at: Timestamp
 });
-var ListWalletTransactionsSchema = z23.object({
+var ListWalletTransactionsSchema = z24.object({
   kind: WalletTransactionKindSchema.optional(),
   direction: WalletDirectionSchema.optional(),
-  origin: z23.string().optional(),
+  origin: z24.string().optional(),
   since: Timestamp.optional()
 });
-var HttpMethodSchema = z23.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
-var WalletQuoteRequestSchema = z23.object({ url: z23.url(), method: HttpMethodSchema.optional() });
-var WalletQuoteSchema = z23.object({
-  object: z23.literal("wallet_quote"),
-  url: z23.url(),
-  payable: z23.boolean(),
+var HttpMethodSchema = z24.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+var WalletQuoteRequestSchema = z24.object({ url: z24.url(), method: HttpMethodSchema.optional() });
+var WalletQuoteSchema = z24.object({
+  object: z24.literal("wallet_quote"),
+  url: z24.url(),
+  payable: z24.boolean(),
   network: WalletNetworkSchema.nullable(),
-  asset: z23.literal("usdc").nullable(),
+  asset: z24.literal("usdc").nullable(),
   amount_micro_usd: MicroUsdField.nullable(),
   pay_to: EvmAddressSchema.nullable(),
-  description: z23.string().nullable(),
-  max_timeout_seconds: z23.number().int().nullable()
+  description: z24.string().nullable(),
+  max_timeout_seconds: z24.number().int().nullable()
 });
 var WalletPayRequestSchema = WalletQuoteRequestSchema.extend({
   max_amount_micro_usd: MicroUsdField.positive().optional()
 });
 var WALLET_RESPONSE_BODY_MAX = 64 * 1024;
-var WalletPaymentSchema = z23.object({
-  object: z23.literal("wallet_payment"),
-  paid: z23.boolean(),
+var WalletPaymentSchema = z24.object({
+  object: z24.literal("wallet_payment"),
+  paid: z24.boolean(),
   transaction_id: idOf("wtx").nullable(),
   amount_micro_usd: MicroUsdField.nullable(),
-  response_status: z23.number().int(),
-  response_body: z23.string().max(WALLET_RESPONSE_BODY_MAX)
+  response_status: z24.number().int(),
+  response_body: z24.string().max(WALLET_RESPONSE_BODY_MAX)
 });
 
 // ../core/src/schema/cards.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var CARD_STATUSES = ["pending_payment", "issuing", "active", "failed", "cancelled", "refunded"];
-var CardStatusSchema = z24.enum(CARD_STATUSES);
+var CardStatusSchema = z25.enum(CARD_STATUSES);
 var CARD_MIN_LOAD_MICRO_USD = 1e6;
 var CARD_MAX_LOAD_MICRO_USD = 15e7;
 var CARD_LOAD_GRANULARITY_MICRO_USD = 1e4;
-var CardSchema = z24.object({
+var CardSchema = z25.object({
   id: idOf("vcd"),
-  object: z24.literal("card"),
+  object: z25.literal("card"),
   identity_id: idOf("idn"),
-  kind: z24.literal("prepaid"),
+  kind: z25.literal("prepaid"),
   status: CardStatusSchema,
-  label: z24.string().min(1).max(128),
-  brand: z24.string().nullable(),
-  last4: z24.string().regex(/^\d{4}$/).nullable(),
+  label: z25.string().min(1).max(128),
+  brand: z25.string().nullable(),
+  last4: z25.string().regex(/^\d{4}$/).nullable(),
   load_micro_usd: MicroUsdField,
   spent_micro_usd: MicroUsdField,
-  currency: z24.literal("usd"),
+  currency: z25.literal("usd"),
   expires_at: Timestamp.nullable(),
-  failure_reason: z24.string().max(256).nullable(),
+  failure_reason: z25.string().max(256).nullable(),
   created_at: Timestamp,
   updated_at: Timestamp
 });
-var IssueCardSchema = z24.object({
+var IssueCardSchema = z25.object({
   label: CardSchema.shape.label,
   load_micro_usd: MicroUsdField.min(CARD_MIN_LOAD_MICRO_USD).max(CARD_MAX_LOAD_MICRO_USD).multipleOf(CARD_LOAD_GRANULARITY_MICRO_USD)
 });
 var CardQuoteRequestSchema = IssueCardSchema.pick({ load_micro_usd: true });
-var CardQuoteSchema = z24.object({
-  object: z24.literal("card_quote"),
+var CardQuoteSchema = z25.object({
+  object: z25.literal("card_quote"),
   load_micro_usd: MicroUsdField,
   price_micro_usd: MicroUsdField,
-  brand: z24.string().nullable(),
+  brand: z25.string().nullable(),
   min_load_micro_usd: MicroUsdField,
   max_load_micro_usd: MicroUsdField
 });
-var CardCredentialsSchema = z24.object({
-  object: z24.literal("card_credentials"),
+var CardCredentialsSchema = z25.object({
+  object: z25.literal("card_credentials"),
   card_id: idOf("vcd"),
-  number: z24.string().min(1),
-  pin: z24.string().nullable(),
-  cvv: z24.string().nullable(),
-  expiry: z24.string().nullable(),
-  url: z24.url().nullable(),
-  instructions: z24.string().nullable(),
+  number: z25.string().min(1),
+  pin: z25.string().nullable(),
+  cvv: z25.string().nullable(),
+  expiry: z25.string().nullable(),
+  url: z25.url().nullable(),
+  instructions: z25.string().nullable(),
   revealed_at: Timestamp
 });
-var CardTransactionSchema = z24.object({
+var CardTransactionSchema = z25.object({
   id: idOf("vct"),
-  object: z24.literal("card_transaction"),
+  object: z25.literal("card_transaction"),
   card_id: idOf("vcd"),
   amount_micro_usd: MicroUsdField,
-  merchant: z24.string().nullable(),
-  description: z24.string().nullable(),
+  merchant: z25.string().nullable(),
+  description: z25.string().nullable(),
   session_id: idOf("ses").nullable(),
   metadata: Metadata,
   created_at: Timestamp
 });
-var LogCardTransactionSchema = z24.object({
+var LogCardTransactionSchema = z25.object({
   amount_micro_usd: MicroUsdField.positive(),
-  merchant: z24.string().max(256).optional(),
-  description: z24.string().max(1024).optional(),
+  merchant: z25.string().max(256).optional(),
+  description: z25.string().max(1024).optional(),
   metadata: Metadata.optional()
 });
-var ListCardsSchema = z24.object({ status: CardStatusSchema.optional() });
+var ListCardsSchema = z25.object({ status: CardStatusSchema.optional() });
 
 // src/define.ts
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 
 // src/roster.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 
 // src/report.ts
 import { ApiError, send } from "@usenaive-sdk/vetta";
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 function message(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -2374,10 +2489,10 @@ async function absent(work) {
     throw error;
   }
 }
-var PageShape = z25.object({
-  data: z25.array(z25.unknown()),
-  has_more: z25.boolean(),
-  next_cursor: z25.string().nullable()
+var PageShape = z26.object({
+  data: z26.array(z26.unknown()),
+  has_more: z26.boolean(),
+  next_cursor: z26.string().nullable()
 });
 function rowLabel(row) {
   const { object, id } = row ?? {};
@@ -2409,17 +2524,17 @@ async function tombstone(name, current, remove, dryRun) {
 }
 
 // src/roster.ts
-var NAME = z26.string().min(1);
-var RosterNameSchema = z26.union([
+var NAME = z27.string().min(1);
+var RosterNameSchema = z27.union([
   NAME.transform((name) => ({ type: "agent", name })),
-  z26.object({ type: z26.literal("agent"), name: NAME, version: z26.number().int().positive().optional() }),
-  z26.object({ type: z26.literal("self") }),
-  z26.object({ type: z26.literal("advisor"), model: z26.string().min(1) })
+  z27.object({ type: z27.literal("agent"), name: NAME, version: z27.number().int().positive().optional() }),
+  z27.object({ type: z27.literal("self") }),
+  z27.object({ type: z27.literal("advisor"), model: z27.string().min(1) })
 ]);
-var DeclMultiagentField = z26.union([
-  z26.boolean(),
-  z26.object({ ...MultiagentSchema.shape, agents: z26.array(RosterNameSchema).min(1).max(20) }),
-  z26.null()
+var DeclMultiagentField = z27.union([
+  z27.boolean(),
+  z27.object({ ...MultiagentSchema.shape, agents: z27.array(RosterNameSchema).min(1).max(20) }),
+  z27.null()
 ]);
 var hasRoster = (value) => typeof value === "object" && value !== null;
 var rosterNames = (roster) => roster.agents.flatMap((entry) => entry.type === "agent" ? [entry.name] : []);
@@ -2507,67 +2622,73 @@ function chooseTemplate(blueprint, template) {
 var BlueprintRefusal = class extends Error {
   name = "BlueprintRefusal";
 };
-var EnvValueSchema = z27.union([
-  z27.string(),
-  z27.object({ from_env: z27.string().min(1) }),
-  z27.object({ generate: z27.literal(true) })
+var EnvValueSchema = z28.union([
+  z28.string(),
+  z28.object({ from_env: z28.string().min(1) }),
+  z28.object({ generate: z28.literal(true) })
 ]);
-var AppDeclSchema = z27.object({
+var AppDeclSchema = z28.object({
   /** Becomes a hostname, so the grammar is the platform's `APP_NAME` (a DNS label). */
-  name: z27.string().regex(APP_NAME, "a lowercase DNS label, 63 characters or fewer"),
+  name: z28.string().regex(APP_NAME, "a lowercase DNS label, 63 characters or fewer"),
   type: AppTypeSchema,
-  description: z27.string().optional(),
+  description: z28.string().optional(),
   /** A directory whose files are collected and shipped as the app's file-map deployment. */
-  deploy_dir: z27.string().min(1).optional(),
+  deploy_dir: z28.string().min(1).optional(),
   /** The path the app itself serves MCP on (§29.5); `fullstack` only. Absent means none. */
   mcp: AppMcpPathSchema.optional(),
   /** Written as the app's write-only secrets (§29.2) on every apply; names follow the platform's `ENV_NAME`. */
-  env: z27.record(z27.string().regex(ENV_NAME), EnvValueSchema, { error: "keyed by environment variable name (A-Z, 0-9, _)" }).optional(),
+  env: z28.record(z28.string().regex(ENV_NAME), EnvValueSchema, { error: "keyed by environment variable name (A-Z, 0-9, _)" }).optional(),
   /** An install may not leave this app out of its `selection` (§31.2). Absent means it may. */
-  required: z27.boolean().optional(),
+  required: z28.boolean().optional(),
   // core-gaps: U8-database
   /** SQL files applied in order to the app's database after it is provisioned (§37); `fullstack` only. */
-  migrations: z27.array(z27.string().min(1)).optional(),
+  migrations: z28.array(z28.string().min(1)).optional(),
   // core-gaps: storage-stock
   /** Buckets the app's object store must hold (§38.2); `fullstack` only. `public` defaults to false. */
-  buckets: z27.array(CreateBucketSchema).optional()
+  buckets: z28.array(CreateBucketSchema).optional()
 });
-var ScheduleDeclSchema = z27.object({
-  cron: z27.string().min(1),
-  timezone: z27.string().min(1).optional(),
+var ScheduleDeclSchema = z28.object({
+  cron: z28.string().min(1),
+  timezone: z28.string().min(1).optional(),
   /** The message every fire opens its session with (`input_template` on the wire). */
-  input: z27.string().min(1),
+  input: z28.string().min(1),
   budget_micro_usd: MicroUsdField.nonnegative(),
-  identity: z27.string().min(1).optional(),
-  enabled: z27.boolean().optional()
+  identity: z28.string().min(1).optional(),
+  enabled: z28.boolean().optional()
 });
 var ToolsDeclSchema = ToolsetSchema;
-var AgentDeclSchema = z27.object({
-  name: z27.string().min(1),
-  model: z27.string().min(1),
+var AgentDeclSchema = z28.object({
+  name: z28.string().min(1),
+  model: z28.string().min(1),
   budget: BudgetSchema,
-  description: z27.string().optional(),
+  description: z28.string().optional(),
   /** Two or three words the studio prints beside the name (§31.5) — "Head of content", not a sentence. */
-  role: z27.string().min(1).optional(),
+  role: z28.string().min(1).optional(),
   /** An install may not leave this agent out of its `selection` (§31.2). Absent means it may. */
-  required: z27.boolean().optional(),
-  system: z27.string().optional(),
+  required: z28.boolean().optional(),
+  system: z28.string().optional(),
   tools: ToolsDeclSchema.optional(),
-  skills: z27.array(SkillRefSchema).optional(),
-  mcp_servers: z27.array(McpServerSchema).optional(),
+  skills: z28.array(SkillRefSchema).optional(),
+  mcp_servers: z28.array(McpServerSchema).optional(),
   /** The rest of the runtime's agent config (§31.6), each the core schema; absent means the route's default and never drift. */
   window: WindowSchema.optional(),
   /** A roster names crew members by declared *name*; `up` resolves them to `agt_` ids in a second pass (`roster.ts`). */
   multiagent: DeclMultiagentField.optional(),
   output_schema: JsonSchemaDocument.nullable().optional(),
-  structured_output_required: z27.boolean().optional(),
+  structured_output_required: z28.boolean().optional(),
   metadata: Metadata.optional(),
   /** Declared app *names*; `up` resolves them to `app_` ids in `tools.configs.apps` (§29.3). */
-  allowed_apps: z27.array(z27.string()).optional(),
+  allowed_apps: z28.array(z28.string()).optional(),
   /** A declared identity *name*; `up` attaches it after the agent upsert (§22). */
-  identity: z27.string().min(1).optional(),
+  identity: z28.string().min(1).optional(),
+  /**
+   * Who this agent may `send_to_agent` (§31.7, §28.12): `true` (anyone in the organization),
+   * `false` (nobody), `"team"` (its `multiagent` roster), or declared agent *names*, checked
+   * against the roster here. Absent means the route's default, `true`, and is never drift.
+   */
+  handoffs: HandoffsField.optional(),
   /** The agent's deployments as a complete set: declared → owned, and the rest are pruned (ADR-0355). */
-  schedules: z27.array(ScheduleDeclSchema).optional(),
+  schedules: z28.array(ScheduleDeclSchema).optional(),
   /**
    * The first thing this agent reads, once, on the apply that **creates** it (`canonical-spec
    * §31.4`). It is what turns a provisioned crew into a crew that has started working.
@@ -2580,58 +2701,66 @@ var AgentDeclSchema = z27.object({
    * repeatedly and unattended while an intake spends once, at an apply a person is watching. Absent
    * means the agent's own `budget` governs.
    */
-  intake: z27.object({ message: z27.string().min(1), budget_micro_usd: MicroUsdField.nonnegative().optional() }).optional()
+  intake: z28.object({ message: z28.string().min(1), budget_micro_usd: MicroUsdField.nonnegative().optional() }).optional()
 });
-var CredentialDeclSchema = z27.object({
+var CredentialDeclSchema = z28.object({
   kind: VaultCredentialKindSchema,
-  key: z27.string().min(1).max(128),
+  key: z28.string().min(1).max(128),
   /** The one exact destination host an `env_var` is bound to. */
-  host: z27.string().min(1).optional(),
+  host: z28.string().min(1).optional(),
   /** The MCP server URL a `static_bearer` / `mcp_oauth` token is matched to. */
-  mcp_server_url: z27.url().optional(),
-  value: z27.object({ from_env: z27.string().min(1) })
+  mcp_server_url: z28.url().optional(),
+  value: z28.object({ from_env: z28.string().min(1) })
 });
-var VaultDeclSchema = z27.object({
+var VaultDeclSchema = z28.object({
   name: VaultSchema.shape.display_name,
-  identity: z27.string().min(1).optional(),
-  credentials: z27.array(CredentialDeclSchema)
+  identity: z28.string().min(1).optional(),
+  credentials: z28.array(CredentialDeclSchema)
 });
-var SkillDeclSchema = z27.object({
-  slug: z27.string().regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits and dashes"),
-  file: z27.string().min(1)
+var SkillDeclSchema = z28.object({
+  slug: z28.string().regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits and dashes"),
+  file: z28.string().min(1)
 });
 var LegalDeclSchema = CreateLegalCompanySchema.pick({
   state: true,
   name_options: true,
   naics_code: true,
   description: true
-}).extend({ label: z27.string().min(1).max(128) });
+}).extend({ label: z28.string().min(1).max(128) });
 var WalletDeclSchema = CreateWalletSchema.or(
-  z27.array(CreateWalletSchema).refine(
+  z28.array(CreateWalletSchema).refine(
     (list2) => new Set(list2.map((w) => w.network ?? DEFAULT_WALLET_NETWORK)).size === list2.length,
     { message: "one wallet per network" }
   )
 );
 var CardDeclSchema = IssueCardSchema;
 var IdentityDeclSchema = IdentitySchema.pick({ name: true, description: true }).partial({ description: true }).extend({
-  legal: z27.array(LegalDeclSchema).optional(),
+  connections: BlueprintIdentityConnectionsSchema.optional(),
+  legal: z28.array(LegalDeclSchema).optional(),
   wallet: WalletDeclSchema.optional(),
-  cards: z27.array(CardDeclSchema).optional()
-});
-var RemovedSchema = z27.object({
-  apps: z27.array(z27.string().min(1)).default([]),
-  agents: z27.array(z27.string().min(1)).default([]),
-  skills: z27.array(z27.string().min(1)).default([]),
-  identities: z27.array(z27.string().min(1)).default([]),
-  vaults: z27.array(z27.string().min(1)).default([])
-});
-var KeptSchema = z27.object({ agents: z27.array(z27.string().min(1)).default([]) });
-var ProjectSchema = z27.object({
-  name: z27.string().min(1),
+  cards: z28.array(CardDeclSchema).optional()
+});
+var RemovedSchema = z28.object({
+  apps: z28.array(z28.string().min(1)).default([]),
+  agents: z28.array(z28.string().min(1)).default([]),
+  skills: z28.array(z28.string().min(1)).default([]),
+  identities: z28.array(z28.string().min(1)).default([]),
+  vaults: z28.array(z28.string().min(1)).default([])
+});
+var KeptSchema = z28.object({ agents: z28.array(z28.string().min(1)).default([]) });
+var TaskDeclSchema = z28.object({
+  key: z28.string().min(1),
+  title: z28.string().min(1).max(200),
+  body: z28.string().max(8192).optional(),
+  assignee: z28.string().min(1).optional(),
+  blocked_by: z28.array(z28.string().min(1)).optional()
+});
+var ProjectSchema = z28.object({
+  name: z28.string().min(1),
   /** The machine this project runs: its repo, its screens, its `/api/*` (`template.ts`). */
-  blueprint: z27.string().min(1).optional(),
+  blueprint: z28.string().min(1).optional(),
   /** Which of that blueprint's templates provides the crew; a blueprint with a default may omit it. */
-  template: z27.string().min(1).optional(),
+  template: z28.string().min(1).optional(),
   /**
    * What a person is asked BEFORE the crew is provisioned (`canonical-spec §31.2`).
    *
@@ -2643,19 +2772,21 @@ var ProjectSchema = z27.object({
    *
    * **Configuration only.** A secret is a vault credential or an app secret; neither is an answer.
    */
-  questions: z27.array(QuestionFieldSchema).default([]),
-  skills: z27.array(SkillDeclSchema).default([]),
-  identities: z27.array(IdentityDeclSchema).default([]),
-  vaults: z27.array(VaultDeclSchema).default([]),
-  apps: z27.array(AppDeclSchema).default([]),
-  agents: z27.array(AgentDeclSchema).default([]),
+  questions: z28.array(QuestionFieldSchema).default([]),
+  skills: z28.array(SkillDeclSchema).default([]),
+  identities: z28.array(IdentityDeclSchema).default([]),
+  vaults: z28.array(VaultDeclSchema).default([]),
+  apps: z28.array(AppDeclSchema).default([]),
+  agents: z28.array(AgentDeclSchema).default([]),
   /**
    * The agents this template creates PER CLIENT the operator signs (`canonical-spec §31.1`) —
    * printed on the artifact so a person sees the whole company, never provisioned by an apply,
    * because the apply does not know the clients yet. Names only: a model and a budget are the
    * crew's business at the moment a client is signed, not the declaration's.
    */
-  crew_per_client: z27.array(z27.object({ name: z27.string().min(1), role: z27.string().min(1).optional(), description: z27.string().optional() })).optional(),
+  crew_per_client: z28.array(z28.object({ name: z28.string().min(1), role: z28.string().min(1).optional(), description: z28.string().optional() })).optional(),
+  /** The crew's first work, as cards on the organization's board rather than N private intakes (§31.11). */
+  tasks: z28.array(TaskDeclSchema).default([]),
   removed: RemovedSchema.default({ apps: [], agents: [], skills: [], identities: [], vaults: [] }),
   kept: KeptSchema.default({ agents: [] })
 });
@@ -2671,6 +2802,20 @@ function assertUniqueNames(kind, names) {
     seen.add(name);
   }
 }
+function inDependencyOrder(tasks) {
+  const placed = /* @__PURE__ */ new Set();
+  const out = [];
+  while (out.length < tasks.length) {
+    const next = tasks.find((task) => !placed.has(task.key) && (task.blocked_by ?? []).every((key) => placed.has(key)));
+    if (next === void 0) {
+      const stuck = tasks.filter((task) => !placed.has(task.key)).map((task) => `"${task.key}"`);
+      refuse(`tasks ${stuck.join(", ")}: blocked_by forms a cycle \u2014 a card cannot wait on a card that waits on it`);
+    }
+    placed.add(next.key);
+    out.push(next);
+  }
+  return out;
+}
 function deepFreeze(value) {
   if (value !== null && typeof value === "object") {
     for (const child of Object.values(value)) deepFreeze(child);
@@ -2718,6 +2863,20 @@ function parseProject(input) {
     assertUniqueNames("bucket", (app.buckets ?? []).map((bucket) => bucket.name));
   }
   const identityNames = new Set(config.identities.map((i) => i.name));
+  const connectable = config.identities.filter((i) => i.connections !== void 0).map((i) => i.name);
+  if (connectable.length > 1) {
+    refuse(`identities ${connectable.map((n) => `"${n}"`).join(", ")} each declare connections, but the studio's Add connections step connects one persona \u2014 declare connections on the one the crew publishes through`);
+  }
+  for (const identity of config.identities) {
+    const social = identity.connections?.social;
+    if (social === void 0) continue;
+    const question = config.questions.find((q) => q.key === social.from);
+    if (question === void 0) refuse(`identity "${identity.name}": connections.social.from names "${social.from}", but no question with that key is declared in this project`);
+    if (question.type !== "choice") refuse(`identity "${identity.name}": connections.social.from names "${social.from}", which is a ${question.type} question \u2014 the map is keyed by a choice question's options`);
+    for (const label of Object.keys(social.map)) {
+      if (!question.options.includes(label)) refuse(`identity "${identity.name}": connections.social.map names "${label}", which is not one of question "${social.from}"'s options \u2014 a key no answer can equal is a row nobody can reach`);
+    }
+  }
   for (const vault of config.vaults) {
     if (vault.identity !== void 0 && !identityNames.has(vault.identity)) {
       refuse(`vault "${vault.name}": identity names "${vault.identity}", but no identity with that name is declared in this project`);
@@ -2754,6 +2913,17 @@ function parseProject(input) {
     if (agent.identity !== void 0 && !identityNames.has(agent.identity)) {
       refuse(`agent "${agent.name}": identity names "${agent.identity}", but no identity with that name is declared in this project`);
     }
+    if (agent.handoffs === "team" && !hasRoster(agent.multiagent)) {
+      refuse(`agent "${agent.name}": handoffs is "team", but the agent declares no multiagent roster \u2014 there is no team to hand to`);
+    }
+    const handoffs = /* @__PURE__ */ new Set();
+    for (const name of Array.isArray(agent.handoffs) ? agent.handoffs : []) {
+      if (name === agent.name) refuse(`agent "${agent.name}": handoffs names itself \u2014 an agent cannot send_to_agent its own seat`);
+      if (config.removed.agents.includes(name)) refuse(`agent "${agent.name}": handoffs names "${name}", which this config removes \u2014 drop it from handoffs or keep the agent`);
+      if (!agentNames.has(name)) refuse(`agent "${agent.name}": handoffs names "${name}", but no agent with that name is declared in this project`);
+      if (handoffs.has(name)) refuse(`agent "${agent.name}": handoffs names "${name}" twice`);
+      handoffs.add(name);
+    }
     const crons = /* @__PURE__ */ new Set();
     for (const schedule of agent.schedules ?? []) {
       if (crons.has(schedule.cron)) {
@@ -2765,6 +2935,21 @@ function parseProject(input) {
       }
     }
   }
+  assertUniqueNames("task", config.tasks.map((task) => task.key));
+  const taskKeys = new Set(config.tasks.map((task) => task.key));
+  for (const task of config.tasks) {
+    if (`${config.name}:${task.key}`.length > 128) {
+      refuse(`task "${task.key}": "${config.name}:${task.key}" is longer than the 128 characters a card key holds \u2014 shorten the key`);
+    }
+    if (task.assignee !== void 0 && !agentNames.has(task.assignee)) {
+      refuse(`task "${task.key}": assignee names "${task.assignee}", but no agent with that name is declared in this project`);
+    }
+    for (const key of task.blocked_by ?? []) {
+      if (key === task.key) refuse(`task "${task.key}": blocked_by names itself \u2014 a card cannot wait on itself`);
+      if (!taskKeys.has(key)) refuse(`task "${task.key}": blocked_by names "${key}", but no task with that key is declared in this project`);
+    }
+  }
+  inDependencyOrder(config.tasks);
   return deepFreeze(config);
 }
 function withTemplate(input, templates) {
@@ -2922,14 +3107,17 @@ function desiredSystem(decl, of) {
 ${decl.system}`;
 }
 function desiredTools(decl, current, ids) {
-  if (ids === void 0) return decl.tools;
+  const handoff = decl.handoffs !== void 0 && handoffsEnabled(decl.handoffs);
+  if (ids === void 0 && !handoff) return decl.tools;
   const base = decl.tools ?? current?.tools ?? { default_config: { permission: "allow" }, configs: {} };
   const appsTool = base.configs["apps"] ?? { enabled: true, permission: base.default_config.permission };
+  const allowed = { enabled: true, permission: "allow" };
   return {
     default_config: base.default_config,
     configs: {
       ...base.configs,
-      apps: { ...appsTool, config: { ...appsTool.config, allowed_apps: ids } }
+      ...ids !== void 0 ? { apps: { ...appsTool, config: { ...appsTool.config, allowed_apps: ids } } } : {},
+      ...handoff ? { send_to_agent: allowed, list_agents: allowed } : {}
     }
   };
 }
@@ -2945,6 +3133,7 @@ async function createAgent(client, decl, tools, team, identityId, system, metada
     ...tools !== void 0 ? { tools } : {},
     ...decl.window !== void 0 ? { window: decl.window } : {},
     ...team !== void 0 ? { multiagent: team } : {},
+    ...decl.handoffs !== void 0 ? { handoffs: decl.handoffs } : {},
     ...decl.output_schema !== void 0 ? { output_schema: decl.output_schema } : {},
     ...decl.structured_output_required !== void 0 ? { structured_output_required: decl.structured_output_required } : {},
     ...metadata !== void 0 ? { metadata } : {}
@@ -2990,6 +3179,7 @@ function drift(decl, current, tools, team, system, metadata) {
   if (changed(tools, current.tools)) patch.tools = tools;
   if (changed(decl.window, current.window)) patch.window = decl.window;
   if (team !== void 0 && changed(normaliseMultiagent(team), normaliseMultiagent(current.multiagent))) patch.multiagent = team;
+  if (changed(decl.handoffs, handoffsOf(current))) patch.handoffs = decl.handoffs;
   if (changed(decl.output_schema, current.output_schema)) patch.output_schema = decl.output_schema;
   if (changed(decl.structured_output_required, current.structured_output_required)) patch.structured_output_required = decl.structured_output_required;
   if (changed(metadata, current.metadata)) patch.metadata = metadata;
@@ -3122,9 +3312,14 @@ var PLATFORM_ENV = {
   identity_id: "NAIVE_IDENTITY_ID",
   /** The install's `project` — the row the app's own context lookup lands on (§31.8). */
   project: "NAIVE_PROJECT",
+  /** The base URL of the Studio that installed the app, so it can send a signed-out visitor back. */
+  studio_url: "NAIVE_STUDIO_URL",
+  /** The app's own `app_…` id — the one known value learnt from the row, not from the apply. */
+  app_id: "NAIVE_APP_ID",
   /** A scoped organization API key minted for the app that asks for it. */
   api_key: "NAIVE_API_KEY"
 };
+var DASHBOARD_PASSWORD = "DASHBOARD_PASSWORD";
 function planEnv(decl, opts) {
   if (decl.env === void 0) return [];
   const plan = /* @__PURE__ */ new Map();
@@ -3134,7 +3329,7 @@ function planEnv(decl, opts) {
       continue;
     }
     if ("generate" in value) {
-      plan.set(name, { name, invent: async () => generated() });
+      plan.set(name, { name, invent: async () => name === DASHBOARD_PASSWORD ? generatedPassword() : generatedSecret() });
       continue;
     }
     const known = opts.platform?.known[value.from_env];
@@ -3170,7 +3365,31 @@ async function invent(one) {
     );
   }
 }
-var generated = () => randomBytes(32).toString("base64url");
+var generatedSecret = () => randomBytes(32).toString("base64url");
+var PASSWORD_ALPHABET = "abcdefghjkmnpqrstuvwxyz23456789";
+var PASSWORD_GROUPS = 4;
+var PASSWORD_GROUP_LENGTH = 4;
+function generatedPassword() {
+  const limit = 256 - 256 % PASSWORD_ALPHABET.length;
+  const groups = [];
+  let group = "";
+  while (groups.length < PASSWORD_GROUPS) {
+    for (const byte of randomBytes(PASSWORD_GROUPS * PASSWORD_GROUP_LENGTH * 2)) {
+      if (byte >= limit) continue;
+      group += PASSWORD_ALPHABET[byte % PASSWORD_ALPHABET.length];
+      if (group.length === PASSWORD_GROUP_LENGTH) {
+        groups.push(group);
+        group = "";
+        if (groups.length === PASSWORD_GROUPS) break;
+      }
+    }
+  }
+  return groups.join("-");
+}
+function withAppId(env, decl, opts, id) {
+  if (decl.env === void 0 || opts.platform === void 0) return env;
+  return { ...env, [PLATFORM_ENV.app_id]: id };
+}
 var EMPTY = /* @__PURE__ */ new Set();
 function secretHash(name, value) {
   return createHash2("sha256").update(`${name}\0`).update(value).digest("hex");
@@ -3214,7 +3433,7 @@ async function createApp(client, decl, env, tree, migrations, opts, appIds) {
     ...decl.mcp !== void 0 ? { mcp: decl.mcp } : {}
   });
   appIds.set(decl.name, created.id);
-  await writeApp(client, created.id, env, tree);
+  await writeApp(client, created.id, withAppId(env, decl, opts, created.id), tree);
   const notes = [];
   if (migrations.length > 0) notes.push((await applyMigrations(client, created.id, migrations)).note);
   if (decl.buckets !== void 0) notes.push((await applyBuckets(client, created.id, decl.buckets)).note);
@@ -3228,7 +3447,8 @@ async function createApp(client, decl, env, tree, migrations, opts, appIds) {
 }
 async function upsertApp(client, decl, opts, appIds) {
   const declared = planEnv(decl, opts);
-  const names = declared.map((one) => one.name);
+  const writesAppId = decl.env !== void 0 && opts.platform !== void 0;
+  const names = [...declared.map((one) => one.name), ...writesAppId ? [PLATFORM_ENV.app_id] : []];
   const note = (notes) => notes.length > 0 ? { reason: notes.join("; ") } : {};
   const mcpPlan = decl.mcp !== void 0 ? [`will set mcp ${decl.mcp}`] : [];
   const migrationPlan = decl.migrations !== void 0 ? [`will apply migrations ${decl.migrations.join(", ")}`] : [];
@@ -3243,8 +3463,8 @@ async function upsertApp(client, decl, opts, appIds) {
         ...note([...willSet, ...mcpPlan, ...decl.deploy_dir ? [`will deploy ${decl.deploy_dir}`] : [], ...migrationPlan, ...bucketPlan])
       };
     }
-    const { values } = await materialize(declared, EMPTY, false);
-    return createApp(client, decl, values, builtTree(decl, opts), declaredMigrations(decl, opts), opts, appIds);
+    const { values: values2 } = await materialize(declared, EMPTY, false);
+    return createApp(client, decl, values2, builtTree(decl, opts), declaredMigrations(decl, opts), opts, appIds);
   }
   const owned = current.project === opts.project;
   if (!owned && !opts.adopt) {
@@ -3273,7 +3493,8 @@ async function upsertApp(client, decl, opts, appIds) {
   const managed = new Set(names);
   const unmanaged = live.map((secret) => secret.name).filter((name) => !managed.has(name));
   const held = new Map(live.map((secret) => [secret.name, secret.value_hash]));
-  const { values: env, unmade } = await materialize(declared, new Set(held.keys()), opts.dryRun);
+  const { values, unmade } = await materialize(declared, new Set(held.keys()), opts.dryRun);
+  const env = withAppId(values, decl, opts, current.id);
   const staleEnv = Object.fromEntries(
     Object.entries(env).filter(([name, value]) => held.get(name) !== secretHash(name, value))
   );
@@ -3419,6 +3640,75 @@ async function reportLegal(client, decls, identityId, skipped) {
   );
 }
 
+// src/tasks.ts
+var ORCHESTRATOR_MARKER = "orchestrator";
+var CEO_LABEL = "CEO";
+var CEO_DETAIL = "Hires and directs the crew";
+var CEO_BUDGET = { cap_micro_usd: 5e7, max_task_micro_usd: 5e6, period: "month" };
+var isOrchestrator = (agent) => agent.metadata["role"] === ORCHESTRATOR_MARKER;
+function seated(live, members) {
+  const roster = live?.agents ?? [];
+  const already = new Set(roster.flatMap((entry) => entry.type === "agent" ? [entry.id] : []));
+  const joining = members.filter((id) => !already.has(id)).map((id) => ({ type: "agent", id }));
+  return { type: "coordinator", board: true, agents: [...roster, ...joining] };
+}
+async function ensureOrchestrator(client, existing, members, dryRun) {
+  const current = existing.find(isOrchestrator);
+  const live = current === void 0 ? null : normaliseMultiagent(current.multiagent);
+  const team = seated(live, members);
+  if (current === void 0) {
+    if (dryRun) return { name: CEO_LABEL, action: "created" };
+    const model = (await client.models.list({ window: "immediate", limit: 1 })).data[0];
+    if (model === void 0) throw new BlueprintRefusal("no model is served, so the board's owner cannot be created");
+    const made = await client.agents.create({
+      name: CEO_LABEL,
+      harness: "pi",
+      model: model.id,
+      description: CEO_DETAIL,
+      budget: CEO_BUDGET,
+      metadata: { role: ORCHESTRATOR_MARKER },
+      multiagent: team
+    });
+    return { name: CEO_LABEL, action: "created", id: made.id };
+  }
+  if (live !== null && !changed(team, live)) return { name: current.name, action: "unchanged", id: current.id };
+  if (!dryRun) await client.agents.update(current.id, { multiagent: team });
+  return { name: current.name, action: "updated", id: current.id };
+}
+async function seedTasks(client, config, existing, agents, dryRun, into, skipped) {
+  const members = agents.flatMap((one) => one.id === void 0 ? [] : [one.id]);
+  const owner = await line(CEO_LABEL, () => ensureOrchestrator(client, existing, members, dryRun));
+  agents.push(owner);
+  const board = owner.action === "refused" || dryRun || owner.id === void 0 ? null : await client.board.create(owner.id);
+  const before = board === null ? [] : await listAll(client.config, `/v1/boards/${board.id}/cards`, BoardCardSchema, skipped);
+  const known = new Set(before.map((card) => card.id));
+  const ids = /* @__PURE__ */ new Map();
+  for (const task of inDependencyOrder(config.tasks)) {
+    into.push(
+      await line(task.key, async () => {
+        if (owner.action === "refused") return { name: task.key, action: "refused", reason: `board owner "${owner.name}" was refused: ${owner.reason}` };
+        const assignee = task.assignee;
+        if (assignee !== void 0 && !agents.some((one) => one.name === assignee && one.action !== "refused")) {
+          return { name: task.key, action: "refused", reason: `assignee "${assignee}" was not provisioned in this run` };
+        }
+        if (board === null) return { name: task.key, action: "created" };
+        const blockers = task.blocked_by ?? [];
+        const unmet = blockers.find((key) => !ids.has(key));
+        if (unmet !== void 0) return { name: task.key, action: "refused", reason: `blocked_by "${unmet}" was not seeded in this run` };
+        const card = await client.board.cards.create(board.id, {
+          key: `${config.name}:${task.key}`,
+          title: task.title,
+          body: task.body,
+          assignee,
+          blocked_by: blockers.map((key) => ids.get(key))
+        });
+        ids.set(task.key, card.id);
+        return { name: task.key, action: known.has(card.id) ? "unchanged" : "created", id: card.id };
+      })
+    );
+  }
+}
+
 // src/vaults.ts
 async function upsertVault(client, decl, existing, identityIds, dryRun) {
   const identityId = decl.identity === void 0 ? void 0 : identityIds.get(decl.identity);
@@ -3629,7 +3919,7 @@ async function up(config, client, opts = {}) {
   const dir = opts.dir ?? process.cwd();
   const ids = { apps: /* @__PURE__ */ new Map(), identities: /* @__PURE__ */ new Map() };
   const taken = selectCrew(config, opts.select);
-  const report2 = { dry_run: dryRun, ...applied(config), skills: [], identities: [], vaults: [], apps: [], agents: [], schedules: [], intake: [], skipped: [], deselected: taken.deselected };
+  const report2 = { dry_run: dryRun, ...applied(config), skills: [], identities: [], vaults: [], apps: [], agents: [], schedules: [], intake: [], tasks: [], skipped: [], deselected: taken.deselected };
   const owner = { project: config.name, adopt: opts.adopt ?? false, skipped: report2.skipped };
   const hosted = opts.trees !== void 0;
   for (const decl of config.skills) {
@@ -3692,7 +3982,7 @@ async function up(config, client, opts = {}) {
       )
     )
   );
-  const existing = taken.agents.length > 0 || config.removed.agents.length > 0 || config.kept.agents.length > 0 ? await listAll(client.config, "/v1/agents", AgentSchema, report2.skipped) : [];
+  const existing = taken.agents.length > 0 || config.removed.agents.length > 0 || config.kept.agents.length > 0 || config.tasks.length > 0 ? await listAll(client.config, "/v1/agents", AgentSchema, report2.skipped) : [];
   const deployments = taken.agents.some((decl) => decl.schedules !== void 0) ? await listAll(client.config, "/v1/deployments", DeploymentSchema, report2.skipped) : [];
   const scoped = config.apps.length > 0 ? [...ids.apps.values()] : void 0;
   const crew = await eachInFlight(taken.agents, async (decl) => {
@@ -3719,6 +4009,7 @@ async function up(config, client, opts = {}) {
     if (hasRoster(decl.multiagent)) await patchRoster(client, decl, decl.multiagent, existing, agentIds, dryRun, report2.agents);
   }
   reportKept(config, existing, report2.agents);
+  if (config.tasks.length > 0) await seedTasks(client, config, existing, report2.agents, dryRun, report2.tasks, report2.skipped);
   await applyRemoved(client, config.removed, { agents: existing, vaults }, owner, report2);
   if (briefed.length > 0 && !dryRun) {
     const serving = taken.apps.flatMap((decl) => {
@@ -3742,6 +4033,8 @@ export {
   collectFiles,
   contentHash,
   defineProject,
+  generatedPassword,
+  generatedSecret,
   hasRoster,
   loadConfig,
   migrationFiles,