@withgauge/cli 0.3.0 → 0.5.0

package/dist/index.js

@@ -21,7 +21,6 @@ __export(batteries_exports, {
   BATTERY_AGENTS: () => BATTERY_AGENTS,
   BATTERY_CADENCES: () => BATTERY_CADENCES,
   BATTERY_MAX_LIMITS: () => BATTERY_MAX_LIMITS,
-  BATTERY_SCENARIOS: () => BATTERY_SCENARIOS,
   MAX_SAMPLES_PER_CYCLE: () => MAX_SAMPLES_PER_CYCLE,
   batchDetailSchema: () => batchDetailSchema,
   batchListQuerySchema: () => batchListQuerySchema,
@@ -82,7 +81,6 @@ var BATTERY_CADENCES = [
   "MONTHLY",
   "DAYS_PER_WEEK"
 ];
-var BATTERY_SCENARIOS = ["GREENFIELD", "MIGRATION"];
 var batteryAgentSchema = z2.enum(BATTERY_AGENTS);
 var BATTERY_MAX_LIMITS = {
   maxTurns: 30,
@@ -109,7 +107,6 @@ var batteryScheduleSpecSchema = z2.object({
   limits: batteryLimitsSchema.optional()
 });
 var batteryDefaultsSchema = z2.object({
-  scenario: z2.enum(BATTERY_SCENARIOS).optional(),
   isBranded: z2.boolean().optional(),
   topic: z2.string().optional(),
   tags: z2.array(z2.string()).optional(),
@@ -123,7 +120,6 @@ var batteryPromptSpecSchema = z2.object({
   /** Idempotency key, unique per org (→ Prompt.externalKey). */
   key: z2.string().min(1),
   text: z2.string().min(1),
-  scenario: z2.enum(BATTERY_SCENARIOS).optional(),
   isBranded: z2.boolean().optional(),
   topic: z2.string().optional(),
   tags: z2.array(z2.string()).optional(),
@@ -141,10 +137,10 @@ var batterySpecSchema = z2.object({
   prompts: z2.array(batteryPromptSpecSchema).min(1)
 });
 var batteryPlanScheduleSchema = z2.object({
-  action: z2.enum(["create", "update"]),
+  action: z2.enum(["create", "update", "none"]),
   repoUrl: z2.string().nullable(),
   repoRef: z2.string().nullable(),
-  /** Runs this schedule would enqueue (agents × samples; 0 unless `expand`). */
+  /** Runs this target would enqueue (agents × samples; 0 unless `expand`). */
   runs: z2.number().int()
 });
 var batteryPlanPromptSchema = z2.object({
@@ -342,249 +338,282 @@ var listBrandsQuerySchema = listQuerySchema.extend({
 });
 var brandListResponseSchema = listResponseSchema(brandSchema);
 
-// ../packages/api-schemas/src/keys.ts
-var keys_exports = {};
-__export(keys_exports, {
-  PROVIDER_TYPES: () => PROVIDER_TYPES,
-  providerKeyListResponseSchema: () => providerKeyListResponseSchema,
-  providerKeySchema: () => providerKeySchema,
-  providerTypeSchema: () => providerTypeSchema,
-  setProviderKeyBodySchema: () => setProviderKeyBodySchema,
-  setProviderKeyResponseSchema: () => setProviderKeyResponseSchema
-});
+// ../packages/api-schemas/src/checkpoints.ts
 import { z as z5 } from "zod";
-var PROVIDER_TYPES = ["anthropic", "openai"];
-var providerTypeSchema = z5.enum(PROVIDER_TYPES);
-var setProviderKeyBodySchema = z5.object({
-  /** The raw provider API key. Verified + stored server-side (AWS Secrets
-   *  Manager); never persisted in the app DB and never echoed back. */
-  key: z5.string().min(1)
+var CHECKPOINT_STORE_VERSION = 2;
+var ALIGNED_CHECKPOINT_SUPERVISOR_ARTIFACT = "0.0.76-byok-ha-26071639";
+var ALIGNED_RUNSC_VERSION = "release-20260112.0";
+var ALIGNED_RUNSC_PLATFORM = "systrap";
+var SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/;
+var CHECKPOINT_ARTIFACT_PATTERN = /^alg-checkpoint:v2:sha256:[0-9a-f]{64}$/;
+var sha256DigestSchema = z5.custom(
+  (value) => typeof value === "string" && SHA256_PATTERN.test(value),
+  "expected a sha256:<64 lowercase hex> digest"
+);
+var checkpointArtifactRefSchema = z5.custom(
+  (value) => typeof value === "string" && CHECKPOINT_ARTIFACT_PATTERN.test(value),
+  "expected an alg-checkpoint:v2 artifact reference"
+);
+var publicArtifactScopeSchema = z5.object({ kind: z5.literal("public") });
+var orgArtifactScopeSchema = z5.object({
+  kind: z5.literal("org"),
+  organizationId: z5.string().min(1)
 });
-var setProviderKeyResponseSchema = z5.object({
-  providerType: providerTypeSchema,
-  last4: z5.string()
+var artifactScopeSchema = z5.discriminatedUnion("kind", [
+  publicArtifactScopeSchema,
+  orgArtifactScopeSchema
+]);
+function scopesMatch(left, right) {
+  return left.kind === right.kind && (left.kind === "public" || right.kind === "org" && left.organizationId === right.organizationId);
+}
+function manifestScopeReferenceViolation(manifestScope, referenced) {
+  if (referenced === void 0) return null;
+  if (referenced.kind === "public") return null;
+  if (scopesMatch(manifestScope, referenced)) return null;
+  if (manifestScope.kind === "public") {
+    return "a public manifest must not reference an org-scoped object";
+  }
+  return "a manifest must not reference another organization's object";
+}
+var checkpointStorePrincipalSchema = z5.discriminatedUnion("kind", [
+  z5.object({ kind: z5.literal("system") }),
+  z5.object({
+    kind: z5.literal("organization"),
+    organizationId: z5.string().min(1)
+  })
+]);
+var checkpointChunkSchema = z5.object({
+  ordinal: z5.number().int().nonnegative(),
+  digest: sha256DigestSchema,
+  rawDigest: sha256DigestSchema,
+  rawBytes: z5.number().int().positive(),
+  storedBytes: z5.number().int().positive()
 });
-var providerKeySchema = z5.object({
-  providerType: providerTypeSchema,
-  last4: z5.string(),
-  createdAt: z5.string(),
-  /** When the key was last saved/rotated. */
-  updatedAt: z5.string()
+var chunkedPayloadSchema = z5.object({
+  format: z5.enum([
+    "canonical-workspace-chunked-zstd-v1",
+    "runsc-checkpoint-chunked-zstd-v1",
+    "overlay-upper-chunked-zstd-v1"
+  ]),
+  chunks: z5.array(checkpointChunkSchema).min(1).superRefine((chunks, context) => {
+    for (const [index, chunk] of chunks.entries()) {
+      if (chunk.ordinal !== index) {
+        context.addIssue({
+          code: "custom",
+          message: `chunk ordinal ${chunk.ordinal} must equal position ${index}`,
+          path: [index, "ordinal"]
+        });
+      }
+    }
+  })
 });
-var providerKeyListResponseSchema = listResponseSchema(providerKeySchema);
-
-// ../packages/api-schemas/src/me.ts
-import { z as z6 } from "zod";
-var meUserSchema = z6.object({
-  id: z6.string(),
-  email: z6.string().nullable(),
-  isSuperuser: z6.boolean()
+var canonicalBaselinePayloadSchema = chunkedPayloadSchema.extend({
+  format: z5.literal("canonical-workspace-chunked-zstd-v1")
 });
-var meOrgSchema = z6.object({
-  slug: z6.string(),
-  // Gauge's immutable Organization.public_id; null for LOCAL orgs.
-  publicId: z6.string().nullable(),
-  name: z6.string()
+var nydusBaselineBlobSchema = z5.object({
+  nydusBlobId: z5.string().regex(/^[0-9a-f]{64}$/),
+  object: checkpointChunkSchema,
+  /**
+   * CAS scope this blob's object actually lives in, when it is NOT the manifest's own
+   * (ALG-197 S0). A `--chunk-dict` build inherits its dict's blobs by reference, and the
+   * dict is usually a PUBLIC baseline while the built artifact is an ORG conversation
+   * checkpoint — without this the manifest can only name `cas/v2/org/<id>/…`, where the
+   * inherited object was never stored.
+   *
+   * ORG→PUBLIC only; the direction is enforced by
+   * `workspaceBaselineManifestV2Schema`'s refinement, not by convention.
+   *
+   * Emitted ONLY when it differs from the manifest scope: manifests are content-addressed
+   * over canonical JSON, so an always-present field would change every existing digest
+   * and churn every `artifactRef`. Absent ⇒ the manifest's own scope.
+   */
+  scope: artifactScopeSchema.optional()
 });
-var meResponseSchema = z6.object({
-  user: meUserSchema,
-  // Membership-scoped for normal users; superusers see every org (mirrors the
-  // web tier's userOrgs).
-  orgs: z6.array(meOrgSchema)
+var nydusBaselinePayloadSchema = z5.object({
+  format: z5.literal("nydus-rafs-v6"),
+  fsVersion: z5.literal(6),
+  /** Always the manifest's own scope: a build always produces its own bootstrap, so
+   *  only inherited BLOBS can be foreign. Confining the override to where a foreign
+   *  scope is possible is what keeps the invariant checkable. */
+  bootstrap: checkpointChunkSchema,
+  blobs: z5.array(nydusBaselineBlobSchema)
 });
-
-// ../packages/api-schemas/src/prompts.ts
-import { z as z10 } from "zod";
-
-// ../packages/api-schemas/src/schedules.ts
-import { z as z7 } from "zod";
-var AGENTS = ["CLAUDE_CODE", "CODEX_CLI", "CURSOR"];
-var agentSchema = z7.enum(AGENTS);
-var CADENCES = [
-  "NONE",
-  "DAILY",
-  "WEEKLY",
-  "MONTHLY",
-  "DAYS_PER_WEEK"
-];
-var cadenceSchema = z7.enum(CADENCES);
-var daysPerWeekSchema = z7.number().int().min(1).max(7);
-var scheduleSchema = z7.object({
-  id: z7.string(),
-  promptId: z7.string(),
-  /** Base repo to run against; null = the default scaffold. */
-  repoUrl: z7.string().nullable(),
-  /** Branch/ref; null = the repo's default branch. */
-  repoRef: z7.string().nullable(),
-  cadence: cadenceSchema,
-  /** Only set when cadence is DAYS_PER_WEEK (1–7). */
-  daysPerWeek: z7.number().int().nullable(),
-  samplesPerCycle: z7.number().int(),
-  agents: z7.array(agentSchema),
-  /** Pinned model id; null = the agent's default. */
-  model: z7.string().nullable(),
-  /** Cohort label for experiment analysis; null for ad-hoc schedules. */
-  experiment: z7.string().nullable(),
-  createdAt: z7.string(),
-  updatedAt: z7.string()
+var workspaceBaselinePayloadSchema = z5.discriminatedUnion("format", [
+  canonicalBaselinePayloadSchema,
+  nydusBaselinePayloadSchema
+]);
+var workspaceBaselineManifestV2Schema = z5.object({
+  schemaVersion: z5.literal(CHECKPOINT_STORE_VERSION),
+  kind: z5.literal("workspace-baseline"),
+  scope: artifactScopeSchema,
+  workspaceRoot: sha256DigestSchema,
+  payload: workspaceBaselinePayloadSchema,
+  repo: z5.object({
+    canonicalUrl: z5.string().url(),
+    requestedRef: z5.string().min(1),
+    resolvedCommit: z5.string().regex(/^[0-9a-f]{40,64}$/)
+  }),
+  recipe: z5.object({
+    digest: sha256DigestSchema,
+    sandboxImageDigest: sha256DigestSchema,
+    architecture: z5.string().min(1)
+  })
+}).superRefine((manifest, context) => {
+  if (manifest.payload.format !== "nydus-rafs-v6") return;
+  for (const [index, blob] of manifest.payload.blobs.entries()) {
+    const violation = manifestScopeReferenceViolation(
+      manifest.scope,
+      blob.scope
+    );
+    if (violation) {
+      context.addIssue({
+        code: "custom",
+        message: violation,
+        path: ["payload", "blobs", index, "scope"]
+      });
+    }
+  }
 });
-var scheduleListResponseSchema = listResponseSchema(scheduleSchema);
-var createScheduleBodySchema = z7.object({
-  repoUrl: z7.string().min(1).nullish(),
-  repoRef: z7.string().min(1).nullish(),
-  cadence: cadenceSchema.default("NONE"),
-  daysPerWeek: daysPerWeekSchema.optional(),
-  agents: z7.array(agentSchema).min(1, "Select at least one agent")
+var checkpointBoundaryV2Schema = z5.object({
+  kind: z5.enum(["tool_call", "assistant_message", "user_message"]),
+  turn: z5.number().int().nonnegative(),
+  ordinal: z5.number().int().nonnegative(),
+  toolName: z5.string().optional(),
+  url: z5.string().url().optional()
 });
-var updateScheduleBodySchema = z7.object({
-  repoUrl: z7.string().min(1).nullish(),
-  repoRef: z7.string().min(1).nullish(),
-  cadence: cadenceSchema.optional(),
-  daysPerWeek: daysPerWeekSchema.optional(),
-  agents: z7.array(agentSchema).min(1, "Select at least one agent").optional()
+var memoryDiskManifestV2Schema = z5.object({
+  schemaVersion: z5.literal(CHECKPOINT_STORE_VERSION),
+  kind: z5.literal("runsc-memory-disk"),
+  scope: orgArtifactScopeSchema,
+  boundary: checkpointBoundaryV2Schema,
+  memory: chunkedPayloadSchema.extend({
+    format: z5.literal("runsc-checkpoint-chunked-zstd-v1")
+  }),
+  disk: z5.object({
+    baselineArtifact: checkpointArtifactRefSchema,
+    baselineScope: artifactScopeSchema,
+    baselineWorkspaceRoot: sha256DigestSchema,
+    delta: chunkedPayloadSchema.extend({
+      format: z5.literal("overlay-upper-chunked-zstd-v1")
+    })
+  }),
+  runtime: z5.object({
+    runscVersion: z5.string().min(1),
+    platform: z5.string().min(1),
+    configDigest: sha256DigestSchema,
+    supervisorArtifact: z5.string().min(1),
+    architecture: z5.string().min(1)
+  }),
+  memorySharing: z5.literal("none")
 });
-
-// ../packages/api-schemas/src/tags.ts
-import { z as z8 } from "zod";
-var tagSchema = z8.object({
-  id: z8.string(),
-  name: z8.string(),
-  /** A Mantine palette name (e.g. "blue", "grape"); unknown values are
-   *  normalized server-side to the default ("gray"). */
-  color: z8.string()
-});
-var createTagBodySchema = z8.object({
-  name: z8.string().min(1),
-  color: z8.string().optional()
-});
-var updateTagBodySchema = z8.object({
-  name: z8.string().min(1).optional(),
-  color: z8.string().optional()
+var workspaceSourceSchema = z5.discriminatedUnion("kind", [
+  z5.object({
+    kind: z5.literal("nvme-baseline"),
+    artifact: checkpointArtifactRefSchema,
+    workspaceRoot: sha256DigestSchema,
+    scope: artifactScopeSchema
+  }),
+  z5.object({
+    kind: z5.literal("memory-disk"),
+    artifact: checkpointArtifactRefSchema,
+    boundary: checkpointBoundaryV2Schema
+  }),
+  z5.object({
+    kind: z5.literal("legacy-ebs"),
+    volumeSnapshot: z5.string().min(1),
+    resumeSessionId: z5.string().min(1).optional()
+  })
+]);
+var baselinePayloadFormatSchema = z5.enum([
+  "canonical-workspace-chunked-zstd-v1",
+  "runsc-checkpoint-chunked-zstd-v1",
+  "overlay-upper-chunked-zstd-v1",
+  "nydus-rafs-v6"
+]);
+var checkpointStoreCapabilitiesSchema = z5.object({
+  storeVersion: z5.literal(CHECKPOINT_STORE_VERSION),
+  manifestSchemas: z5.array(z5.literal(CHECKPOINT_STORE_VERSION)).min(1),
+  payloadFormats: z5.array(baselinePayloadFormatSchema),
+  runtime: z5.object({
+    runscVersion: z5.literal(ALIGNED_RUNSC_VERSION),
+    platform: z5.literal(ALIGNED_RUNSC_PLATFORM),
+    supervisorArtifact: z5.literal(ALIGNED_CHECKPOINT_SUPERVISOR_ARTIFACT)
+  })
 });
-var tagListResponseSchema = listResponseSchema(tagSchema);
 
-// ../packages/api-schemas/src/topics.ts
-import { z as z9 } from "zod";
-var topicSchema = z9.object({
-  id: z9.string(),
-  name: z9.string()
+// ../packages/api-schemas/src/cli-auth.ts
+import { z as z6 } from "zod";
+var PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+var cliAuthorizationTokenRequestSchema = z6.object({
+  code: z6.string().min(1).max(512),
+  codeVerifier: z6.string().regex(PKCE_VERIFIER_PATTERN)
 });
-var createTopicBodySchema = z9.object({
-  name: z9.string().min(1, "name is required")
+var cliAuthorizationTokenResponseSchema = z6.object({
+  accessToken: z6.string(),
+  tokenType: z6.literal("bearer"),
+  expiresAt: z6.string().nullable()
 });
-var topicListResponseSchema = listResponseSchema(topicSchema);
 
-// ../packages/api-schemas/src/prompts.ts
-var SCENARIOS = ["GREENFIELD", "MIGRATION"];
-var scenarioSchema = z10.enum(SCENARIOS);
-var promptSummarySchema = z10.object({
-  id: z10.string(),
-  text: z10.string(),
-  scenario: scenarioSchema,
-  isBranded: z10.boolean(),
-  /** Battery-spec identity (idempotent applies); null for UI/CLI-created prompts. */
-  externalKey: z10.string().nullable(),
-  topic: topicSchema.nullable(),
-  tags: z10.array(tagSchema),
-  scheduleCount: z10.number().int(),
-  createdAt: z10.string()
-});
-var promptDetailSchema = promptSummarySchema.extend({
-  schedules: z10.array(scheduleSchema)
-});
-var promptListResponseSchema = listResponseSchema(promptSummarySchema);
-var listPromptsQuerySchema = listQuerySchema.extend({
-  topic: z10.string().min(1).optional(),
-  tag: z10.string().min(1).optional(),
-  q: z10.string().min(1).optional()
-});
-var createPromptBodySchema = z10.object({
-  text: z10.string().min(1, "text is required"),
-  scenario: scenarioSchema.default("GREENFIELD"),
-  isBranded: z10.boolean().default(false),
-  topic: z10.string().min(1).optional(),
-  tags: z10.array(z10.string().min(1)).default([]),
-  schedules: z10.array(createScheduleBodySchema).default([])
-});
-var createPromptResponseSchema = promptDetailSchema.extend({
-  firstRunBlocked: z10.enum(["insufficient_credits", "needs_provider_key"]).optional()
-});
-var updatePromptBodySchema = z10.object({
-  text: z10.string().min(1).optional(),
-  isBranded: z10.boolean().optional(),
-  topicId: z10.string().min(1).nullish(),
-  tags: z10.array(z10.string().min(1)).optional()
-});
-var runPromptBodySchema = z10.object({
-  agents: z10.array(agentSchema).min(1).optional(),
-  scheduleIds: z10.array(z10.string().min(1)).min(1).optional()
-});
-var runPromptResponseSchema = z10.object({
-  batchIds: z10.array(z10.string()),
-  runIds: z10.array(z10.string()),
-  /** Present when SOME schedules hit a billing gate but at least one run was
-   *  enqueued (mirrors the battery apply response; an all-blocked run is a
-   *  402 error instead). */
-  blocked: z10.enum(["insufficient_credits", "needs_provider_key"]).optional()
-});
+// ../packages/api-schemas/src/dashboards.ts
+import { z as z9 } from "zod";
 
 // ../packages/api-schemas/src/query.ts
-import { z as z12 } from "zod";
+import { z as z8 } from "zod";
 
 // ../packages/api-schemas/src/stats.ts
-import { z as z11 } from "zod";
+import { z as z7 } from "zod";
 var BRAND_KINDS2 = ["OWNED", "COMPETITOR", "OTHER"];
-var brandKindSchema2 = z11.enum(BRAND_KINDS2);
-var brandRankingSchema = z11.object({
-  rank: z11.number().int(),
-  brandId: z11.string(),
-  brandName: z11.string(),
+var brandKindSchema2 = z7.enum(BRAND_KINDS2);
+var brandRankingSchema = z7.object({
+  rank: z7.number().int(),
+  brandId: z7.string(),
+  brandName: z7.string(),
   kind: brandKindSchema2,
-  installs: z11.number().int(),
-  installRate: z11.number(),
-  mentionRate: z11.number(),
+  installs: z7.number().int(),
+  installRate: z7.number(),
+  mentionRate: z7.number(),
   /** Movement between the two most recent batch windows; null if not ranked in both. */
-  deltaRank: z11.number().int().nullable()
+  deltaRank: z7.number().int().nullable()
 });
-var packageRateSchema = z11.object({
-  ecosystem: z11.string(),
-  name: z11.string(),
-  brandName: z11.string().optional(),
+var packageRateSchema = z7.object({
+  ecosystem: z7.string(),
+  name: z7.string(),
+  brandName: z7.string().optional(),
   kind: brandKindSchema2.optional(),
-  installs: z11.number().int(),
-  rate: z11.number()
+  installs: z7.number().int(),
+  rate: z7.number()
 });
-var brandRateSchema = z11.object({
-  brandId: z11.string(),
-  brandName: z11.string(),
+var brandRateSchema = z7.object({
+  brandId: z7.string(),
+  brandName: z7.string(),
   kind: brandKindSchema2,
-  installs: z11.number().int(),
-  rate: z11.number()
+  installs: z7.number().int(),
+  rate: z7.number()
 });
-var brandFunnelRowSchema = z11.object({
-  brandId: z11.string(),
-  brandName: z11.string(),
+var brandFunnelRowSchema = z7.object({
+  brandId: z7.string(),
+  brandName: z7.string(),
   kind: brandKindSchema2,
-  mentionRate: z11.number(),
-  installRate: z11.number()
-});
-var domainRateSchema = z11.object({
-  domain: z11.string(),
-  runs: z11.number().int(),
-  rate: z11.number(),
-  requests: z11.number().int(),
-  brandName: z11.string().optional(),
-  owned: z11.boolean().optional()
-});
-var statsFreshnessSchema = z11.object({
+  mentionRate: z7.number(),
+  installRate: z7.number()
+});
+var domainRateSchema = z7.object({
+  domain: z7.string(),
+  runs: z7.number().int(),
+  rate: z7.number(),
+  requests: z7.number().int(),
+  brandName: z7.string().optional(),
+  owned: z7.boolean().optional()
+});
+var statsFreshnessSchema = z7.object({
   /** Newest run-ingest time across the org (ISO), or null if nothing ingested. */
-  watermark: z11.string().nullable(),
+  watermark: z7.string().nullable(),
   /** Runs that succeeded recently but haven't landed in the warehouse yet. */
-  pending: z11.number().int(),
+  pending: z7.number().int(),
   /** False when the freshness read itself failed (distinguish from genuine zero). */
-  available: z11.boolean()
+  available: z7.boolean()
 });
-var statsResponseSchema = (item) => z11.object({ items: z11.array(item), freshness: statsFreshnessSchema });
+var statsResponseSchema = (item) => z7.object({ items: z7.array(item), freshness: statsFreshnessSchema });
 var rankingsResponseSchema = statsResponseSchema(brandRankingSchema);
 var installsResponseSchema = statsResponseSchema(packageRateSchema);
 var brandsResponseSchema = statsResponseSchema(brandRateSchema);
@@ -597,11 +626,13 @@ var DATASETS = [
   "installs",
   "mentions",
   "web",
+  "citations",
   "network",
   "files",
-  "tokens"
+  "tokens",
+  "brand_rollup"
 ];
-var datasetSchema = z12.enum(DATASETS);
+var datasetSchema = z8.enum(DATASETS);
 var WHERE_OPS = [
   "eq",
   "neq",
@@ -613,150 +644,756 @@ var WHERE_OPS = [
   "lt",
   "lte"
 ];
-var whereOpSchema = z12.enum(WHERE_OPS);
+var whereOpSchema = z8.enum(WHERE_OPS);
 var GRANULARITIES = ["day", "week", "month"];
-var granularitySchema = z12.enum(GRANULARITIES);
+var granularitySchema = z8.enum(GRANULARITIES);
 var DEFAULT_QUERY_LIMIT = 50;
 var MAX_QUERY_LIMIT = 1e3;
-var scalar = z12.union([z12.string(), z12.number(), z12.boolean()]);
-var whereClauseSchema = z12.object({
-  dimension: z12.string().min(1),
+var scalar = z8.union([z8.string(), z8.number(), z8.boolean()]);
+var whereClauseSchema = z8.object({
+  dimension: z8.string().min(1),
   op: whereOpSchema,
-  value: z12.union([scalar, z12.array(scalar)])
-});
-var queryFiltersSchema = z12.object({
-  prompt: z12.string(),
-  topic: z12.array(z12.string()),
-  tag: z12.array(z12.string()),
-  repo: z12.array(z12.string()),
-  language: z12.array(z12.string()),
-  framework: z12.array(z12.string()),
-  size: z12.array(z12.string()),
-  agent: z12.array(z12.string()),
-  model: z12.array(z12.string()),
-  scenario: z12.array(z12.string()),
-  experiment: z12.array(z12.string()),
-  branded: z12.boolean()
+  value: z8.union([scalar, z8.array(scalar)])
+});
+var queryFiltersSchema = z8.object({
+  prompt: z8.string(),
+  topic: z8.array(z8.string()),
+  tag: z8.array(z8.string()),
+  repo: z8.array(z8.string()),
+  language: z8.array(z8.string()),
+  framework: z8.array(z8.string()),
+  size: z8.array(z8.string()),
+  agent: z8.array(z8.string()),
+  /** Persona UserProfile ids; the NO_PERSONA sentinel = default judge. */
+  persona: z8.array(z8.string()),
+  model: z8.array(z8.string()),
+  scenario: z8.array(z8.string()),
+  experiment: z8.array(z8.string()),
+  branded: z8.boolean()
 }).partial();
-var dateRangeSchema = z12.object({
-  since: z12.string(),
-  until: z12.string(),
-  lastDays: z12.number().int().positive()
+var dateRangeSchema = z8.object({
+  since: z8.string(),
+  until: z8.string(),
+  lastDays: z8.number().int().positive()
 }).partial();
-var orderBySchema = z12.object({
+var orderBySchema = z8.object({
   /** A selected dimension or metric name. */
-  key: z12.string().min(1),
-  dir: z12.enum(["asc", "desc"]).default("desc")
+  key: z8.string().min(1),
+  dir: z8.enum(["asc", "desc"]).default("desc")
 });
-var querySpecSchema = z12.object({
+var querySpecSchema = z8.object({
   dataset: datasetSchema.default("runs"),
-  dimensions: z12.array(z12.string()).default([]),
-  metrics: z12.array(z12.string()).min(1, "at least one metric is required"),
+  dimensions: z8.array(z8.string()).default([]),
+  metrics: z8.array(z8.string()).min(1, "at least one metric is required"),
   filters: queryFiltersSchema.default({}),
-  where: z12.array(whereClauseSchema).default([]),
+  where: z8.array(whereClauseSchema).default([]),
   dateRange: dateRangeSchema.optional(),
-  orderBy: z12.array(orderBySchema).default([]),
-  limit: z12.number().int().min(1).max(MAX_QUERY_LIMIT).default(DEFAULT_QUERY_LIMIT),
+  orderBy: z8.array(orderBySchema).default([]),
+  limit: z8.number().int().min(1).max(MAX_QUERY_LIMIT).default(DEFAULT_QUERY_LIMIT),
   granularity: granularitySchema.default("day"),
   /** When true, the response echoes the compiled SQL (params bound, not inlined). */
-  explain: z12.boolean().default(false)
+  explain: z8.boolean().default(false)
 });
-var columnKindSchema = z12.enum(["dimension", "metric"]);
-var queryColumnSchema = z12.object({
-  key: z12.string(),
+var columnKindSchema = z8.enum(["dimension", "metric"]);
+var queryColumnSchema = z8.object({
+  key: z8.string(),
   kind: columnKindSchema
 });
-var queryRowSchema = z12.record(
-  z12.string(),
-  z12.union([z12.string(), z12.number(), z12.boolean(), z12.null()])
+var queryRowSchema = z8.record(
+  z8.string(),
+  z8.union([z8.string(), z8.number(), z8.boolean(), z8.null()])
 );
-var queryResponseSchema = z12.object({
-  columns: z12.array(queryColumnSchema),
-  rows: z12.array(queryRowSchema),
+var queryResponseSchema = z8.object({
+  columns: z8.array(queryColumnSchema),
+  rows: z8.array(queryRowSchema),
   /** Present only when the request set explain=true. */
-  sql: z12.string().optional(),
+  sql: z8.string().optional(),
   freshness: statsFreshnessSchema
 });
-var fieldTypeSchema = z12.enum([
+var fieldTypeSchema = z8.enum([
   "string",
   "number",
   "rate",
   "date",
   "boolean"
 ]);
-var fieldSchema = z12.object({
-  name: z12.string(),
+var fieldSchema = z8.object({
+  name: z8.string(),
   type: fieldTypeSchema,
   /** One-line human/agent hint. */
-  description: z12.string().optional()
+  description: z8.string().optional()
 });
-var datasetMetaSchema = z12.object({
+var datasetMetaSchema = z8.object({
   name: datasetSchema,
-  grain: z12.string(),
-  dimensions: z12.array(fieldSchema),
-  metrics: z12.array(fieldSchema)
+  grain: z8.string(),
+  dimensions: z8.array(fieldSchema),
+  metrics: z8.array(fieldSchema)
 });
-var metadataResponseSchema = z12.object({
-  datasets: z12.array(datasetMetaSchema)
+var metadataResponseSchema = z8.object({
+  datasets: z8.array(datasetMetaSchema)
 });
 
-// ../packages/api-schemas/src/repos.ts
+// ../packages/api-schemas/src/dashboards.ts
+var VIZ_TYPES = ["line", "bar", "table", "kpi"];
+var vizTypeSchema = z9.enum(VIZ_TYPES);
+var widgetEncodingSchema = z9.object({
+  x: z9.string(),
+  // dimension key for the x axis (line)
+  series: z9.string(),
+  // dimension key split into one series per value (line)
+  y: z9.array(z9.string())
+  // metric keys for the value axis
+}).partial();
+var widgetFields = {
+  id: z9.string().min(1),
+  title: z9.string(),
+  viz: vizTypeSchema,
+  spec: querySpecSchema,
+  // 12-col grid placement.
+  x: z9.number().int().min(0).max(11),
+  y: z9.number().int().min(0),
+  w: z9.number().int().min(1).max(12),
+  h: z9.number().int().min(1),
+  encoding: widgetEncodingSchema.optional()
+};
+var widgetSchema = z9.object(widgetFields).refine((w) => w.x + w.w <= 12, {
+  message: "widget spills past the 12-column grid (x + w must be \u2264 12)"
+});
+var widgetPatchSchema = z9.object(widgetFields).partial();
+var dashboardFiltersSchema = z9.object({
+  filters: queryFiltersSchema,
+  dateRange: dateRangeSchema
+}).partial();
+var overlayPatchSchema = z9.object({
+  name: z9.string(),
+  defaultFilters: dashboardFiltersSchema,
+  widgets: z9.record(z9.string(), widgetPatchSchema.nullable()),
+  // Explicit widget-id ordering (for reordering and from-scratch widgets).
+  order: z9.array(z9.string())
+}).partial();
+var resolvedDashboardSchema = z9.object({
+  key: z9.string(),
+  name: z9.string(),
+  widgets: z9.array(widgetSchema),
+  defaultFilters: dashboardFiltersSchema,
+  hasOrgOverlay: z9.boolean(),
+  hasUserOverlay: z9.boolean()
+});
+var dashboardTemplateSchema = z9.object({
+  key: z9.string().min(1),
+  name: z9.string(),
+  description: z9.string().optional(),
+  widgets: z9.array(widgetSchema),
+  defaultFilters: dashboardFiltersSchema.optional()
+});
+var dashboardSummarySchema = z9.object({
+  key: z9.string(),
+  name: z9.string(),
+  source: z9.enum(["template", "org", "user"]),
+  isUserDefault: z9.boolean(),
+  isOrgDefault: z9.boolean()
+});
+
+// ../packages/api-schemas/src/device.ts
+import { z as z10 } from "zod";
+var deviceAuthorizeRequestSchema = z10.object({
+  /** Device label (the CLI's hostname) for display + token naming. */
+  deviceName: z10.string().trim().max(64).optional(),
+  /** Optional: email a magic-link that lands on the approval page pre-scoped
+   *  to this device (best-effort — the printed URL always works regardless). */
+  email: z10.string().trim().email().max(320).optional()
+});
+var deviceAuthorizeResponseSchema = z10.object({
+  /** The one-time secret the CLI polls with (never shown again). */
+  deviceCode: z10.string(),
+  /** Short human-typed code the user confirms in the browser (e.g. WXYZ-1234). */
+  userCode: z10.string(),
+  /** Where the user approves (e.g. https://…/cli/authorize). */
+  verificationUri: z10.string(),
+  /** verificationUri with the code pre-filled, for one-click / QR. */
+  verificationUriComplete: z10.string(),
+  /** Minimum seconds between polls. */
+  interval: z10.number().int().positive(),
+  /** Seconds until the device code expires. */
+  expiresIn: z10.number().int().positive(),
+  /** Whether a magic-link email was dispatched (best-effort). */
+  emailSent: z10.boolean()
+});
+var deviceTokenRequestSchema = z10.object({
+  deviceCode: z10.string().min(1)
+});
+var deviceTokenApprovedSchema = z10.object({
+  status: z10.literal("approved"),
+  /** The `gauge_…` bearer secret. Store it now — never returned again. */
+  accessToken: z10.string(),
+  tokenType: z10.literal("bearer"),
+  /** ISO-8601 expiry, or null for no expiry. */
+  expiresAt: z10.string().nullable()
+});
+var deviceTokenResultSchema = z10.discriminatedUnion("status", [
+  // Not yet approved — keep polling at `interval`.
+  z10.object({ status: z10.literal("pending") }),
+  // Polled faster than `interval` — back off by `interval` seconds.
+  z10.object({ status: z10.literal("slow_down"), interval: z10.number().int() }),
+  // The user explicitly denied the request. Stop.
+  z10.object({ status: z10.literal("denied") }),
+  // The device code expired or is unknown/already-redeemed. Stop and restart.
+  z10.object({ status: z10.literal("expired") }),
+  deviceTokenApprovedSchema
+]);
+
+// ../packages/api-schemas/src/experiments.ts
+import { z as z11 } from "zod";
+var contentExperimentIntentSchema = z11.object({
+  sourceRunId: z11.string().min(1),
+  problemText: z11.string().trim().min(1)
+});
+var EXPERIMENT_STATUSES = [
+  "DRAFT",
+  "GENERATING",
+  "RUNNING",
+  "SYNTHESIZING",
+  "COMPLETE",
+  "PARTIAL",
+  "FAILED",
+  "CANCELED"
+];
+var experimentStatusSchema = z11.enum(EXPERIMENT_STATUSES);
+var EXPERIMENT_ORIGINS = ["USER_NAMED", "DETECTED"];
+var experimentOriginSchema = z11.enum(EXPERIMENT_ORIGINS);
+var VARIANT_KINDS = ["CANDIDATE"];
+var variantKindSchema = z11.enum(VARIANT_KINDS);
+var SUPPORT_CLASSES = [
+  "RECOMMENDED",
+  "PROMISING",
+  "NOT_SUPPORTED",
+  "NOT_EVALUABLE"
+];
+var supportClassSchema = z11.enum(SUPPORT_CLASSES);
+var createExperimentBodySchema = contentExperimentIntentSchema.extend({
+  candidates: z11.number().int().optional(),
+  samples: z11.number().int().optional()
+});
+var launchExperimentBodySchema = z11.object({
+  samples: z11.number().int().optional()
+});
+var experimentListQuerySchema = z11.object({
+  status: experimentStatusSchema.optional(),
+  since: z11.string().optional(),
+  limit: z11.coerce.number().int().min(1).max(100).default(50)
+});
+var experimentSummarySchema = z11.object({
+  id: z11.string(),
+  status: experimentStatusSchema,
+  sourceRunId: z11.string(),
+  problemText: z11.string(),
+  origin: experimentOriginSchema,
+  cohortLabel: z11.string(),
+  createdAt: z11.string()
+});
+var experimentListResponseSchema = listResponseSchema(
+  experimentSummarySchema
+);
+var variantSummarySchema = z11.object({
+  id: z11.string(),
+  key: z11.string(),
+  kind: variantKindSchema,
+  title: z11.string(),
+  hypothesis: z11.string(),
+  supportClass: supportClassSchema.nullable(),
+  effect: z11.number().nullable(),
+  invalidReason: z11.string().nullable(),
+  batchId: z11.string().nullable()
+});
+var variantRefSchema = z11.object({
+  key: z11.string(),
+  title: z11.string(),
+  effect: z11.number().nullable(),
+  consistency: z11.string().nullable(),
+  note: z11.string().nullable()
+});
+var recommendationSchema = z11.object({
+  evaluatorVersion: z11.string(),
+  summary: z11.string(),
+  groups: z11.object({
+    recommended: z11.array(variantRefSchema),
+    promising: z11.array(variantRefSchema),
+    notSupported: z11.array(variantRefSchema),
+    notEvaluable: z11.array(variantRefSchema)
+  }),
+  tradeoffs: z11.array(z11.string())
+});
+var jsonValue = z11.unknown();
+var experimentDetailSchema = z11.object({
+  id: z11.string(),
+  status: experimentStatusSchema,
+  sourceRunId: z11.string(),
+  problemText: z11.string(),
+  origin: experimentOriginSchema,
+  evaluationContract: jsonValue,
+  recommendation: recommendationSchema.nullable(),
+  cohortLabel: z11.string(),
+  createdAt: z11.string(),
+  variants: z11.array(variantSummarySchema)
+});
+var createdExperimentSchema = z11.object({
+  id: z11.string(),
+  status: experimentStatusSchema,
+  cohortLabel: z11.string(),
+  sourceCheckpointId: z11.string().nullable(),
+  checkpointTurn: z11.number().int().nullable(),
+  contract: jsonValue,
+  variants: z11.array(
+    z11.object({
+      id: z11.string(),
+      key: z11.string(),
+      kind: variantKindSchema,
+      invalidReason: z11.string().nullable()
+    })
+  )
+});
+var plannedVariantSchema = z11.object({
+  key: z11.string(),
+  kind: variantKindSchema,
+  title: z11.string(),
+  hypothesis: z11.string(),
+  webFixtureSha256: z11.string(),
+  invalidReason: z11.string().nullable()
+});
+var experimentPlanSchema = z11.object({
+  sourceRunId: z11.string(),
+  organizationId: z11.string(),
+  problemText: z11.string(),
+  origin: experimentOriginSchema,
+  contract: jsonValue,
+  variants: z11.array(plannedVariantSchema),
+  samples: z11.number().int(),
+  estimatedForks: z11.number().int()
+});
+var launchResultSchema = z11.object({
+  experimentId: z11.string(),
+  forks: z11.array(
+    z11.object({
+      variantId: z11.string(),
+      key: z11.string(),
+      batchId: z11.string(),
+      runIds: z11.array(z11.string())
+    })
+  ),
+  skipped: z11.array(
+    z11.object({
+      variantId: z11.string(),
+      key: z11.string(),
+      reason: z11.string()
+    })
+  )
+});
+
+// ../packages/api-schemas/src/keys.ts
+var keys_exports = {};
+__export(keys_exports, {
+  PROVIDER_TYPES: () => PROVIDER_TYPES,
+  providerKeyListResponseSchema: () => providerKeyListResponseSchema,
+  providerKeySchema: () => providerKeySchema,
+  providerTypeSchema: () => providerTypeSchema,
+  setProviderKeyBodySchema: () => setProviderKeyBodySchema,
+  setProviderKeyResponseSchema: () => setProviderKeyResponseSchema
+});
+import { z as z12 } from "zod";
+var PROVIDER_TYPES = ["anthropic", "openai"];
+var providerTypeSchema = z12.enum(PROVIDER_TYPES);
+var setProviderKeyBodySchema = z12.object({
+  /** The raw provider API key. Verified + stored server-side (AWS Secrets
+   *  Manager); never persisted in the app DB and never echoed back. */
+  key: z12.string().min(1)
+});
+var setProviderKeyResponseSchema = z12.object({
+  providerType: providerTypeSchema,
+  last4: z12.string()
+});
+var providerKeySchema = z12.object({
+  providerType: providerTypeSchema,
+  last4: z12.string(),
+  createdAt: z12.string(),
+  /** When the key was last saved/rotated. */
+  updatedAt: z12.string()
+});
+var providerKeyListResponseSchema = listResponseSchema(providerKeySchema);
+
+// ../packages/api-schemas/src/me.ts
 import { z as z13 } from "zod";
+var meUserSchema = z13.object({
+  id: z13.string(),
+  email: z13.string().nullable(),
+  isSuperuser: z13.boolean()
+});
+var meOrgSchema = z13.object({
+  slug: z13.string(),
+  // Gauge's immutable Organization.public_id; null for LOCAL orgs.
+  publicId: z13.string().nullable(),
+  name: z13.string()
+});
+var meResponseSchema = z13.object({
+  user: meUserSchema,
+  // Membership-scoped for normal users; superusers see every org (mirrors the
+  // web tier's userOrgs).
+  orgs: z13.array(meOrgSchema)
+});
+
+// ../packages/api-schemas/src/orgs.ts
+import { z as z14 } from "zod";
+var createOrgRequestSchema = z14.object({
+  /** Workspace display name; the slug is derived server-side. */
+  name: z14.string().trim().min(1).max(200),
+  /** Optional company site (logo source; stamped onto the org). */
+  website: z14.string().trim().max(300).optional()
+});
+var createOrgResponseSchema = z14.object({
+  slug: z14.string(),
+  name: z14.string(),
+  // LOCAL orgs never have a Gauge publicId.
+  publicId: z14.string().nullable()
+});
+
+// ../packages/api-schemas/src/prompts.ts
+import { z as z19 } from "zod";
+
+// ../packages/api-schemas/src/schedules.ts
+import { z as z15 } from "zod";
+var AGENTS = ["CLAUDE_CODE", "CODEX_CLI", "CURSOR"];
+var agentSchema = z15.enum(AGENTS);
+var CADENCES = [
+  "NONE",
+  "DAILY",
+  "WEEKLY",
+  "MONTHLY",
+  "DAYS_PER_WEEK"
+];
+var cadenceSchema = z15.enum(CADENCES);
+var daysPerWeekSchema = z15.number().int().min(1).max(7);
+var scheduleRepoSchema = z15.object({
+  repoUrl: z15.string().nullable(),
+  /** Branch/ref; null = the repo's default branch (always null for greenfield). */
+  repoRef: z15.string().nullable()
+});
+var scheduleAgentConfigSchema = z15.object({
+  agent: agentSchema,
+  models: z15.array(z15.string().min(1)).default([])
+});
+var scheduleAgentConfigInputSchema = z15.object({
+  agent: agentSchema,
+  models: z15.array(z15.string().min(1)).optional(),
+  model: z15.string().min(1).nullish()
+}).transform(({ agent, models, model }) => ({
+  agent,
+  models: models ?? (model ? [model] : [])
+}));
+var scheduleSchema = z15.object({
+  id: z15.string(),
+  name: z15.string(),
+  cadence: cadenceSchema,
+  /** Only set when cadence is DAYS_PER_WEEK (1–7). */
+  daysPerWeek: z15.number().int().nullable(),
+  samplesPerCycle: z15.number().int(),
+  /** Authoritative per-agent configuration. */
+  agentConfigs: z15.array(scheduleAgentConfigSchema),
+  /** Deprecated compatibility projection of agentConfigs. */
+  agents: z15.array(agentSchema),
+  /** Deprecated: null for schedules with per-agent pins. */
+  model: z15.string().nullable(),
+  /** Repo targets in stable expansion order; empty = the default scaffold. A
+   *  null-repoUrl entry is greenfield alongside named repos. */
+  repos: z15.array(scheduleRepoSchema),
+  /** Cohort label for experiment analysis; null outside labeled experiments. */
+  experiment: z15.string().nullable(),
+  enabled: z15.boolean(),
+  lastExpandedAt: z15.string().nullable(),
+  /** Membership tag ids — the schedule runs the live union of these tags'
+   *  prompts (resolved at dispatch, not stored). */
+  tagIds: z15.array(z15.string()),
+  tagCount: z15.number().int(),
+  /** Persona matrix (ALG-155): member UserProfile ids, in stable expansion
+   *  order. Empty = the default, unconfigured HaikuJudge (no persona). */
+  profileIds: z15.array(z15.string()),
+  /** ALG-155.1: when profileIds is non-empty, also expand once per (prompt ×
+   *  repo) with no persona alongside the persona batches. Ignored when
+   *  profileIds is empty (always the implicit default judge). */
+  includeDefaultPersona: z15.boolean(),
+  createdAt: z15.string(),
+  updatedAt: z15.string()
+});
+var scheduleListResponseSchema = listResponseSchema(scheduleSchema);
+var scheduleRepoInputSchema = z15.object({
+  /** null/omitted = the greenfield scaffold as an explicit target. */
+  repoUrl: z15.string().min(1).nullish(),
+  repoRef: z15.string().min(1).nullish()
+});
+var createScheduleBodyObject = z15.object({
+  name: z15.string().min(1, "name is required"),
+  cadence: cadenceSchema.default("NONE"),
+  daysPerWeek: daysPerWeekSchema.optional(),
+  samplesPerCycle: z15.number().int().min(1).default(1),
+  /** Preferred paired representation (per-agent model tiers). */
+  agentConfigs: z15.array(scheduleAgentConfigInputSchema).min(1).optional(),
+  /** Legacy shared-model input, accepted during the API transition. */
+  agents: z15.array(agentSchema).min(1, "Select at least one agent").optional(),
+  model: z15.string().min(1).nullish(),
+  /** Repo targets; empty = the default scaffold (greenfield). Add a
+   *  null-repoUrl entry to run greenfield alongside named repos. */
+  repos: z15.array(scheduleRepoInputSchema).default([]),
+  /** Membership tag ids — the schedule runs the live union of these tags'
+   *  prompts (specs/schedules-tags-migration.md). Must belong to the org. */
+  tagIds: z15.array(z15.string().min(1)).default([]),
+  /** Persona matrix (ALG-155): member UserProfile ids. Empty/omitted = the
+   *  default, unconfigured HaikuJudge (no persona). */
+  profileIds: z15.array(z15.string().min(1)).default([]),
+  /** ALG-155.1: also expand once per (prompt × repo) with no persona
+   *  alongside the persona batches, when profileIds is non-empty. Ignored
+   *  when profileIds is empty. */
+  includeDefaultPersona: z15.boolean().default(false),
+  enabled: z15.boolean().default(true)
+});
+var createScheduleBodySchema = createScheduleBodyObject.refine(
+  (body) => body.agentConfigs !== void 0 || body.agents !== void 0,
+  {
+    message: "Select at least one agent (agentConfigs or agents)",
+    path: ["agentConfigs"]
+  }
+);
+var updateScheduleBodySchema = z15.object({
+  name: z15.string().min(1).optional(),
+  cadence: cadenceSchema.optional(),
+  daysPerWeek: daysPerWeekSchema.optional(),
+  samplesPerCycle: z15.number().int().min(1).optional(),
+  /** Full replacement of the enabled agent/model set (per-agent model tiers). */
+  agentConfigs: z15.array(scheduleAgentConfigInputSchema).min(1).optional(),
+  /** Legacy shared-model input, accepted during the API transition. */
+  agents: z15.array(agentSchema).min(1, "Select at least one agent").optional(),
+  model: z15.string().min(1).nullish(),
+  repos: z15.array(scheduleRepoInputSchema).optional(),
+  tagIds: z15.array(z15.string().min(1)).optional(),
+  profileIds: z15.array(z15.string().min(1)).optional(),
+  includeDefaultPersona: z15.boolean().optional(),
+  enabled: z15.boolean().optional()
+});
+var runScheduleResponseSchema = z15.object({
+  batchIds: z15.array(z15.string()),
+  runIds: z15.array(z15.string()),
+  blocked: z15.enum(["insufficient_credits", "needs_provider_key"]).optional(),
+  notReady: z15.array(
+    z15.object({
+      repoUrl: z15.string(),
+      status: z15.enum(["building", "failed", "none"])
+    })
+  ).optional()
+});
+
+// ../packages/api-schemas/src/tags.ts
+import { z as z16 } from "zod";
+var tagSchema = z16.object({
+  id: z16.string(),
+  name: z16.string(),
+  /** A Mantine palette name (e.g. "blue", "grape"); unknown values are
+   *  normalized server-side to the default ("gray"). */
+  color: z16.string()
+});
+var createTagBodySchema = z16.object({
+  name: z16.string().min(1),
+  color: z16.string().optional()
+});
+var updateTagBodySchema = z16.object({
+  name: z16.string().min(1).optional(),
+  color: z16.string().optional()
+});
+var tagListResponseSchema = listResponseSchema(tagSchema);
+
+// ../packages/api-schemas/src/topics.ts
+import { z as z17 } from "zod";
+var topicSchema = z17.object({
+  id: z17.string(),
+  name: z17.string()
+});
+var createTopicBodySchema = z17.object({
+  name: z17.string().min(1, "name is required")
+});
+var topicListResponseSchema = listResponseSchema(topicSchema);
+
+// ../packages/api-schemas/src/web-fixtures.ts
+var web_fixtures_exports = {};
+__export(web_fixtures_exports, {
+  MAX_WEB_FIXTURE_BYTES: () => MAX_WEB_FIXTURE_BYTES,
+  webFixtureSchema: () => webFixtureSchema
+});
+import { z as z18 } from "zod";
+var MAX_WEB_FIXTURE_BYTES = 1e6;
+function withoutFragment(raw) {
+  const fragment = raw.indexOf("#");
+  return fragment === -1 ? raw : raw.slice(0, fragment);
+}
+var searchResultSchema = z18.object({
+  title: z18.string().min(1),
+  url: z18.url().transform(withoutFragment),
+  snippet: z18.string()
+});
+var searchFixtureSchema = z18.object({
+  query: z18.string().trim().min(1),
+  results: z18.array(searchResultSchema)
+});
+var pageFixtureSchema = z18.object({
+  url: z18.url().transform(withoutFragment),
+  status: z18.int().min(100).max(599).default(200),
+  contentType: z18.string().trim().min(1).default("text/html"),
+  body: z18.string()
+});
+var webFixtureSchema = z18.object({
+  version: z18.literal(1),
+  searches: z18.array(searchFixtureSchema).default([]),
+  pages: z18.array(pageFixtureSchema).default([])
+}).superRefine((fixture, ctx) => {
+  const queries = /* @__PURE__ */ new Set();
+  fixture.searches.forEach((entry, index) => {
+    if (queries.has(entry.query)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["searches", index, "query"],
+        message: `duplicate normalized query: ${entry.query}`
+      });
+    }
+    queries.add(entry.query);
+  });
+  const urls = /* @__PURE__ */ new Set();
+  fixture.pages.forEach((entry, index) => {
+    if (urls.has(entry.url)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["pages", index, "url"],
+        message: `duplicate normalized URL: ${entry.url}`
+      });
+    }
+    urls.add(entry.url);
+  });
+  const bytes = new TextEncoder().encode(JSON.stringify(fixture)).byteLength;
+  if (bytes > MAX_WEB_FIXTURE_BYTES) {
+    ctx.addIssue({
+      code: "custom",
+      message: `serialized fixture is ${bytes} bytes; maximum is ${MAX_WEB_FIXTURE_BYTES}`
+    });
+  }
+});
+
+// ../packages/api-schemas/src/prompts.ts
+var promptSummarySchema = z19.object({
+  id: z19.string(),
+  text: z19.string(),
+  isBranded: z19.boolean(),
+  /** Battery-spec identity (idempotent applies); null for UI/CLI-created prompts. */
+  externalKey: z19.string().nullable(),
+  topic: topicSchema.nullable(),
+  tags: z19.array(tagSchema),
+  scheduleCount: z19.number().int(),
+  createdAt: z19.string()
+});
+var promptScheduleRefSchema = z19.object({
+  id: z19.string(),
+  name: z19.string(),
+  cadence: cadenceSchema,
+  daysPerWeek: z19.number().int().nullable(),
+  enabled: z19.boolean()
+});
+var promptDetailSchema = promptSummarySchema.extend({
+  schedules: z19.array(promptScheduleRefSchema)
+});
+var promptListResponseSchema = listResponseSchema(promptSummarySchema);
+var listPromptsQuerySchema = listQuerySchema.extend({
+  topic: z19.string().min(1).optional(),
+  tag: z19.string().min(1).optional(),
+  q: z19.string().min(1).optional()
+});
+var createPromptBodySchema = z19.object({
+  text: z19.string().min(1, "text is required"),
+  isBranded: z19.boolean().default(false),
+  topic: z19.string().min(1).optional(),
+  tags: z19.array(z19.string().min(1)).default([])
+});
+var updatePromptBodySchema = z19.object({
+  text: z19.string().min(1).optional(),
+  isBranded: z19.boolean().optional(),
+  topicId: z19.string().min(1).nullish(),
+  tags: z19.array(z19.string().min(1)).optional()
+});
+var runPromptBodySchema = z19.object({
+  /** Preferred paired representation; each agent may pin its own model tiers. */
+  agentConfigs: z19.array(scheduleAgentConfigInputSchema).min(1).optional(),
+  /** Legacy agent set (no per-agent pins), kept during the API transition. */
+  agents: z19.array(agentSchema).min(1, "Select at least one agent").default(["CLAUDE_CODE", "CODEX_CLI"]),
+  repoUrl: z19.string().min(1).nullish(),
+  repoRef: z19.string().min(1).nullish(),
+  samplesPerCycle: z19.number().int().min(1).max(10).default(1),
+  webFixture: webFixtureSchema.optional()
+});
+var runPromptResponseSchema = z19.object({
+  batchIds: z19.array(z19.string()),
+  runIds: z19.array(z19.string()),
+  blocked: z19.enum(["insufficient_credits", "needs_provider_key"]).optional()
+});
+
+// ../packages/api-schemas/src/repos.ts
+import { z as z20 } from "zod";
 var REPO_SIZE_BUCKETS = [
   "small",
   "medium",
   "large",
   "xlarge"
 ];
-var repoSizeBucketSchema = z13.enum(REPO_SIZE_BUCKETS);
-var repoSchema = z13.object({
-  url: z13.string(),
-  name: z13.string(),
-  isSystem: z13.boolean(),
-  languages: z13.array(z13.string()),
-  frameworks: z13.array(z13.string()),
+var repoSizeBucketSchema = z20.enum(REPO_SIZE_BUCKETS);
+var repoSchema = z20.object({
+  url: z20.string(),
+  name: z20.string(),
+  isSystem: z20.boolean(),
+  languages: z20.array(z20.string()),
+  frameworks: z20.array(z20.string()),
   /** Faceted labels (complexity:L2, buildable:yes, stack:nextjs, …). */
-  tags: z13.array(z13.string()),
-  primaryLanguage: z13.string(),
-  sizeKb: z13.number(),
+  tags: z20.array(z20.string()),
+  primaryLanguage: z20.string(),
+  sizeKb: z20.number(),
   sizeBucket: repoSizeBucketSchema.nullable(),
-  stars: z13.number()
+  stars: z20.number()
 });
 var repoListResponseSchema = listResponseSchema(repoSchema);
-var addRepoBodySchema = z13.object({
-  url: z13.string().min(1, "url is required"),
+var addRepoBodySchema = z20.object({
+  url: z20.string().min(1, "url is required"),
   /**
    * Reserved (accepted, not yet persisted): the catalog keys repos by URL only
    * — `fact_repo` has no ref column and metadata sync always reads the default
    * branch. Kept in the wire format so `gauge repos add --ref` is stable once
    * the catalog learns refs.
    */
-  ref: z13.string().min(1).optional(),
+  ref: z20.string().min(1).optional(),
   /** Display name; defaults to the `owner/repo` label of the URL. */
-  name: z13.string().min(1).optional(),
+  name: z20.string().min(1).optional(),
   /** Manual override; defaults to frameworks detected from the repo's manifests. */
-  frameworks: z13.array(z13.string()).optional(),
-  tags: z13.array(z13.string()).optional()
+  frameworks: z20.array(z20.string()).optional(),
+  tags: z20.array(z20.string()).optional()
 });
-var updateRepoBodySchema = z13.object({
-  url: z13.string().min(1, "url is required"),
-  name: z13.string().min(1).optional(),
-  frameworks: z13.array(z13.string()).optional(),
-  tags: z13.array(z13.string()).optional()
+var updateRepoBodySchema = z20.object({
+  url: z20.string().min(1, "url is required"),
+  name: z20.string().min(1).optional(),
+  frameworks: z20.array(z20.string()).optional(),
+  tags: z20.array(z20.string()).optional()
 });
-var resyncRepoBodySchema = z13.object({
-  url: z13.string().min(1, "url is required")
+var resyncRepoBodySchema = z20.object({
+  url: z20.string().min(1, "url is required")
 });
-var deleteRepoQuerySchema = z13.object({
-  url: z13.string().min(1, "url is required")
+var deleteRepoQuerySchema = z20.object({
+  url: z20.string().min(1, "url is required")
 });
-var repoSyncResultSchema = z13.object({
+var repoSyncResultSchema = z20.object({
   repo: repoSchema,
-  synced: z13.boolean()
+  synced: z20.boolean()
 });
 
 // ../packages/api-schemas/src/runs.ts
-import { z as z14 } from "zod";
+import { z as z21 } from "zod";
 var RUN_STATUSES = [
   "QUEUED",
   "CLAIMED",
@@ -767,102 +1404,178 @@ var RUN_STATUSES = [
   "TIMED_OUT",
   "CANCELED"
 ];
-var runStatusSchema = z14.enum(RUN_STATUSES);
+var runStatusSchema = z21.enum(RUN_STATUSES);
 var AGENTS2 = ["CLAUDE_CODE", "CODEX_CLI", "CURSOR"];
-var agentSchema2 = z14.enum(AGENTS2);
-var runStatusFilterSchema = z14.string().transform(
+var agentSchema2 = z21.enum(AGENTS2);
+var runStatusFilterSchema = z21.string().transform(
   (raw) => raw.split(",").map((s) => s.trim().toUpperCase()).filter(Boolean)
-).pipe(z14.array(runStatusSchema).min(1));
+).pipe(z21.array(runStatusSchema).min(1));
 var runListQuerySchema = listQuerySchema.extend({
   status: runStatusFilterSchema.optional(),
-  batch: z14.string().optional(),
-  prompt: z14.string().optional(),
-  experiment: z14.string().optional(),
-  since: z14.string().optional()
+  batch: z21.string().optional(),
+  prompt: z21.string().optional(),
+  experiment: z21.string().optional(),
+  since: z21.string().optional()
 });
-var runListItemSchema = z14.object({
-  id: z14.string(),
+var runListItemSchema = z21.object({
+  id: z21.string(),
   status: runStatusSchema,
   agent: agentSchema2,
-  model: z14.string(),
-  promptId: z14.string(),
+  model: z21.string(),
+  promptId: z21.string(),
   /** First ~80 chars of the batch's prompt snapshot, whitespace-collapsed. */
-  promptSnippet: z14.string(),
-  batchId: z14.string(),
-  experiment: z14.string().nullable(),
-  turns: z14.number().int().nullable(),
-  usdCost: z14.number().nullable(),
-  durationMs: z14.number().int().nullable(),
-  exitReason: z14.string().nullable(),
-  createdAt: z14.string(),
-  startedAt: z14.string().nullable(),
-  finishedAt: z14.string().nullable()
+  promptSnippet: z21.string(),
+  batchId: z21.string(),
+  experiment: z21.string().nullable(),
+  turns: z21.number().int().nullable(),
+  usdCost: z21.number().nullable(),
+  durationMs: z21.number().int().nullable(),
+  exitReason: z21.string().nullable(),
+  createdAt: z21.string(),
+  startedAt: z21.string().nullable(),
+  finishedAt: z21.string().nullable(),
+  /** Fork lineage (fork-simulations WS1): the source run this was forked from,
+   *  or null for an organic run. Forks are excluded from aggregate analytics but
+   *  kept visible; consumers badge on these fields. */
+  parentRunId: z21.string().nullable(),
+  /** Set when this run is a fetch-fork simulation variant (injected web
+   *  content); null otherwise. Distinguishes a "Simulation" badge from a plain
+   *  conversation fork. */
+  fetchForkPlanId: z21.string().nullable()
 });
 var runListResponseSchema = listResponseSchema(runListItemSchema);
 var runDetailSchema = runListItemSchema.omit({ promptSnippet: true }).extend({
-  promptText: z14.string(),
-  attempt: z14.number().int(),
-  cancelRequested: z14.boolean(),
-  failureReason: z14.string().nullable(),
-  repoUrl: z14.string().nullable(),
-  repoRef: z14.string().nullable(),
-  scenario: z14.string(),
-  funding: z14.string(),
+  promptText: z21.string(),
+  attempt: z21.number().int(),
+  cancelRequested: z21.boolean(),
+  failureReason: z21.string().nullable(),
+  repoUrl: z21.string().nullable(),
+  repoRef: z21.string().nullable(),
+  scenario: z21.string(),
+  funding: z21.string(),
   /** Raw harness usage write-back (token counts etc.); shape may evolve. */
-  usage: z14.unknown().nullable(),
+  usage: z21.unknown().nullable(),
   /** Artifact pointer: a working-tree diff exists at GET /runs/{id}/diff. */
-  hasDiff: z14.boolean(),
-  claimedAt: z14.string().nullable()
+  hasDiff: z21.boolean(),
+  claimedAt: z21.string().nullable()
 });
-var cancelRunResponseSchema = z14.object({
-  id: z14.string(),
+var cancelRunResponseSchema = z21.object({
+  id: z21.string(),
   status: runStatusSchema,
-  cancelRequested: z14.boolean(),
-  note: z14.string().optional()
-});
-var forkRunBodySchema = z14.object({
-  prompt: z14.string().trim().min(1).max(2e4),
-  turn: z14.number().int().min(0).optional()
-});
-var forkRunResponseSchema = z14.object({
-  runId: z14.string(),
-  batchId: z14.string(),
-  parentRunId: z14.string(),
-  checkpointId: z14.string(),
-  turn: z14.number().int().min(0)
-});
-var runEventSchema = z14.looseObject({
-  run_id: z14.string(),
-  seq: z14.number(),
-  turn: z14.number(),
-  ts: z14.string(),
-  type: z14.string()
+  cancelRequested: z21.boolean(),
+  note: z21.string().optional()
+});
+var forkRunBodySchema = z21.object({
+  prompt: z21.string().trim().min(1).max(2e4),
+  turn: z21.number().int().min(0).optional(),
+  webFixture: webFixtureSchema.optional()
+});
+var forkRunResponseSchema = z21.object({
+  runId: z21.string(),
+  batchId: z21.string(),
+  parentRunId: z21.string(),
+  checkpointId: z21.string(),
+  turn: z21.number().int().min(0)
+});
+var fetchForkAtFetchBodySchema = z21.object({
+  boundarySeq: z21.string().min(1),
+  injectedContent: z21.string(),
+  prompts: z21.array(z21.string()).min(1)
+});
+var fetchForkAtFetchResponseSchema = z21.object({
+  planId: z21.string()
+});
+var fetchForkPlanStatusSchema = z21.enum([
+  "DRAFT",
+  "SURGERY_RUNNING",
+  "SURGERY_READY",
+  "FORKED",
+  "FAILED"
+]);
+var fetchForkPlanResponseSchema = z21.object({
+  id: z21.string(),
+  status: fetchForkPlanStatusSchema,
+  boundaryUrl: z21.string(),
+  boundaryTurn: z21.number().int(),
+  prompts: z21.array(z21.string()),
+  surgicalCheckpointId: z21.string().nullable(),
+  forkBatchId: z21.string().nullable(),
+  errorText: z21.string().nullable(),
+  forkedRunIds: z21.array(z21.string())
+});
+var RUN_INSIGHT_STATUSES = [
+  "PENDING",
+  "RUNNING",
+  "COMPLETE",
+  "FAILED",
+  "SKIPPED"
+];
+var runInsightStatusSchema = z21.enum(RUN_INSIGHT_STATUSES);
+var insightPassSchema = z21.object({
+  status: runInsightStatusSchema,
+  model: z21.string().nullable(),
+  inputTokens: z21.number().int().nullable(),
+  outputTokens: z21.number().int().nullable(),
+  usdCost: z21.number().nullable(),
+  error: z21.string().nullable()
+});
+var runDecisionSchema = z21.object({
+  index: z21.number().int(),
+  category: z21.string(),
+  categoryRaw: z21.string().nullable(),
+  chosenName: z21.string(),
+  chosenEcosystem: z21.string().nullable(),
+  chosenPackage: z21.string().nullable(),
+  reversed: z21.boolean(),
+  detail: z21.unknown()
+});
+var runImplementationSchema = z21.object({
+  brandName: z21.string(),
+  ecosystem: z21.string().nullable(),
+  package: z21.string().nullable(),
+  verdict: z21.string(),
+  docConsulted: z21.boolean(),
+  detail: z21.unknown()
+});
+var runInsightResponseSchema = z21.object({
+  runId: z21.string(),
+  decision: insightPassSchema,
+  implementation: insightPassSchema,
+  decisions: z21.array(runDecisionSchema),
+  implementations: z21.array(runImplementationSchema)
+});
+var runEventSchema = z21.looseObject({
+  run_id: z21.string(),
+  seq: z21.number(),
+  turn: z21.number(),
+  ts: z21.string(),
+  type: z21.string()
 });
 
-// ../packages/api-schemas/src/tokens.ts
-import { z as z15 } from "zod";
-var apiTokenSchema = z15.object({
-  id: z15.string(),
-  name: z15.string(),
+// ../packages/api-schemas/src/tokens.ts
+import { z as z22 } from "zod";
+var apiTokenSchema = z22.object({
+  id: z22.string(),
+  name: z22.string(),
   /** Last 4 chars of the plaintext, for recognizability (non-secret). */
-  last4: z15.string(),
-  expiresAt: z15.iso.datetime().nullable(),
-  lastUsedAt: z15.iso.datetime().nullable(),
-  createdAt: z15.iso.datetime(),
-  revokedAt: z15.iso.datetime().nullable()
-});
-var createTokenRequestSchema = z15.object({
-  name: z15.string().min(1).max(100),
+  last4: z22.string(),
+  expiresAt: z22.iso.datetime().nullable(),
+  lastUsedAt: z22.iso.datetime().nullable(),
+  createdAt: z22.iso.datetime(),
+  revokedAt: z22.iso.datetime().nullable()
+});
+var createTokenRequestSchema = z22.object({
+  name: z22.string().min(1).max(100),
   /** ISO-8601 datetime; omit for no expiry. */
-  expiresAt: z15.iso.datetime({ offset: true }).optional()
+  expiresAt: z22.iso.datetime({ offset: true }).optional()
 });
 var createTokenResponseSchema = apiTokenSchema.extend({
-  token: z15.string()
+  token: z22.string()
 });
 var listTokensResponseSchema = listResponseSchema(apiTokenSchema);
 
 // src/commands/apply.ts
-import { z as z16 } from "zod";
+import { z as z23 } from "zod";
 
 // src/version.ts
 import { createRequire } from "module";
@@ -1197,13 +1910,11 @@ var EXAMPLE_SPEC = {
   prompts: [
     {
       key: "add-healthcheck",
-      text: "Add a /health endpoint that returns 200 OK.",
-      scenario: "GREENFIELD"
+      text: "Add a /health endpoint that returns 200 OK."
     },
     {
       key: "migrate-to-vitest",
       text: "Migrate the test suite from Jest to Vitest.",
-      scenario: "MIGRATION",
       schedules: [
         {
           repoUrl: "https://github.com/acme/api",
@@ -1312,7 +2023,7 @@ function register(program2) {
   ).option("-f, --file <path>", "battery spec JSON file").option("--dry-run", "print the plan without applying").option("--schema", "print the battery spec JSON Schema and exit").option("--example", "print a minimal example battery spec and exit").action(
     async (opts, command) => {
       if (opts.schema) {
-        printJson(z16.toJSONSchema(batteries_exports.batterySpecSchema));
+        printJson(z23.toJSONSchema(batteries_exports.batterySpecSchema));
         return;
       }
       if (opts.example) {
@@ -1349,12 +2060,17 @@ function register(program2) {
 // src/commands/auth.ts
 var auth_exports = {};
 __export(auth_exports, {
+  deviceLogin: () => deviceLogin,
+  parseLoopbackCallback: () => parseLoopbackCallback,
+  readStdin: () => readStdin,
   register: () => register2
 });
 import { spawn } from "child_process";
-import { randomBytes } from "crypto";
+import { createHash, randomBytes } from "crypto";
 import { createServer } from "http";
 import { hostname } from "os";
+import { createInterface } from "readline";
+import { setTimeout as sleep } from "timers/promises";
 
 // src/lib/paginate.ts
 async function fetchAllPages(client, path, query = {}) {
@@ -1375,7 +2091,6 @@ async function fetchAllPages(client, path, query = {}) {
 // src/commands/auth.ts
 var LOGIN_TIMEOUT_MS = 2 * 60 * 1e3;
 var TOKEN_PREFIX = "gauge_";
-var MAX_CALLBACK_BODY_BYTES = 16 * 1024;
 function tokenSource() {
   if (process.env.GAUGE_API_TOKEN?.trim()) return "env";
   return resolveToken() ? "file" : "none";
@@ -1383,6 +2098,13 @@ function tokenSource() {
 async function fetchMe(client) {
   return client.get("/api/v1/me");
 }
+function parseLoopbackCallback(rawUrl, expectedState) {
+  const url = new URL(rawUrl ?? "/", "http://127.0.0.1");
+  if (url.pathname !== "/callback") return null;
+  const code = url.searchParams.get("code");
+  if (url.searchParams.get("state") !== expectedState || !code) return null;
+  return code;
+}
 function printIdentity(me) {
   const orgs = me.orgs.map((o) => o.slug).join(", ") || "(none)";
   const su = me.user.isSuperuser ? " (superuser)" : "";
@@ -1404,63 +2126,33 @@ function openBrowser(url) {
 }
 async function browserLogin() {
   const state = randomBytes(16).toString("base64url");
+  const codeVerifier = randomBytes(32).toString("base64url");
+  const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
   const server = createServer();
-  const tokenPromise = new Promise((resolve, reject) => {
+  const codePromise = new Promise((resolve, reject) => {
     server.on("request", (req, res) => {
       const url = new URL(req.url ?? "/", "http://127.0.0.1");
       if (url.pathname !== "/callback") {
         res.writeHead(404).end();
         return;
       }
-      if (req.method === "OPTIONS") {
-        res.writeHead(204, {
-          "access-control-allow-origin": "*",
-          "access-control-allow-methods": "POST",
-          "access-control-allow-headers": "content-type",
-          "access-control-allow-private-network": "true"
-        }).end();
+      if (req.method !== "GET") {
+        res.writeHead(405, { allow: "GET" }).end();
         return;
       }
-      if (req.method !== "POST") {
-        res.writeHead(405, { allow: "POST" }).end();
+      const code = parseLoopbackCallback(req.url, state);
+      if (!code) {
+        res.writeHead(400, {
+          "content-type": "text/plain; charset=utf-8"
+        });
+        res.end("Invalid callback. Retry gauge auth login.");
         return;
       }
-      let body = "";
-      let overflowed = false;
-      req.on("data", (chunk) => {
-        if (overflowed) return;
-        body += chunk;
-        if (body.length > MAX_CALLBACK_BODY_BYTES) {
-          overflowed = true;
-          body = "";
-          res.writeHead(413, {
-            "content-type": "text/plain; charset=utf-8",
-            "access-control-allow-origin": "*"
-          });
-          res.end("Callback body too large.");
-        }
-      });
-      req.on("end", () => {
-        if (overflowed) return;
-        const params = new URLSearchParams(body);
-        const token = params.get("token");
-        if (params.get("state") !== state || !token) {
-          res.writeHead(400, {
-            "content-type": "text/plain; charset=utf-8",
-            "access-control-allow-origin": "*"
-          });
-          res.end(
-            "Invalid callback (state mismatch). Retry `gauge auth login`."
-          );
-          return;
-        }
-        res.writeHead(200, {
-          "content-type": "text/plain; charset=utf-8",
-          "access-control-allow-origin": "*"
-        });
-        res.end("Authorized \u2014 return to your terminal.");
-        resolve(token);
+      res.writeHead(200, {
+        "content-type": "text/plain; charset=utf-8"
       });
+      res.end("Authorized. Return to your terminal.");
+      resolve(code);
     });
     server.on(
       "error",
@@ -1480,27 +2172,46 @@ async function browserLogin() {
   authorizeUrl.searchParams.set("port", String(address.port));
   authorizeUrl.searchParams.set("state", state);
   authorizeUrl.searchParams.set("name", hostname() || "this device");
+  authorizeUrl.searchParams.set("code_challenge", codeChallenge);
+  authorizeUrl.searchParams.set("code_challenge_method", "S256");
   console.log("Opening your browser to authorize the Gauge CLI\u2026");
   console.log(`If it doesn't open, visit:
 
   ${authorizeUrl}
 `);
+  console.log("Waiting for browser authorization\u2026");
+  console.log(
+    "No local network access or using SSH? Re-run with gauge auth login --device."
+  );
   openBrowser(authorizeUrl.toString());
   let timer;
   try {
-    const token = await Promise.race([
-      tokenPromise,
+    const code = await Promise.race([
+      codePromise,
       new Promise((_, reject) => {
         timer = setTimeout(() => {
           reject(
             new CliError(
               "network",
-              "Timed out waiting for browser authorization (2 minutes). Retry, or use `gauge auth login --with-token`."
+              "Timed out waiting for browser authorization (2 minutes). Retry, or use gauge auth login --device."
             )
           );
         }, LOGIN_TIMEOUT_MS);
       })
     ]);
+    const raw = await bootstrapPost("/api/v1/cli/token", {
+      code,
+      codeVerifier
+    });
+    const parsed = cliAuthorizationTokenResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        "internal",
+        "Unexpected response from the CLI token endpoint."
+      );
+    }
+    const exchange = parsed.data;
+    const token = exchange.accessToken;
     const me = await fetchMe(new ApiClient({ token }));
     saveToken(token);
     console.log(`Token saved to ${credentialsPath()}`);
@@ -1511,14 +2222,140 @@ async function browserLogin() {
     server.closeAllConnections();
   }
 }
-async function readStdin() {
+var DEVICE_ENDPOINT = "/api/v1/device";
+async function bootstrapPost(path, body) {
+  const base = resolveBaseUrl().replace(/\/+$/, "");
+  let res;
+  try {
+    res = await fetch(`${base}${path}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": USER_AGENT
+      },
+      body: JSON.stringify(body)
+    });
+  } catch (e) {
+    throw new CliError(
+      "network",
+      `Request to ${base} failed: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  const text = await res.text();
+  if (!res.ok) {
+    try {
+      const parsed = errorEnvelopeSchema.safeParse(JSON.parse(text));
+      if (parsed.success) {
+        throw new CliError(parsed.data.error.code, parsed.data.error.message);
+      }
+    } catch (e) {
+      if (e instanceof CliError) throw e;
+    }
+    throw new CliError(
+      "internal",
+      `Authentication request failed: HTTP ${res.status} ${res.statusText}`.trim()
+    );
+  }
+  return JSON.parse(text);
+}
+async function deviceLogin(opts) {
+  const start = await bootstrapPost(
+    `${DEVICE_ENDPOINT}/authorize`,
+    { deviceName: hostname() || "this device", email: opts.email }
+  );
+  console.log("To sign in, open this URL in a browser:\n");
+  console.log(`  ${start.verificationUriComplete}
+`);
+  console.log(`and confirm this code:  ${start.userCode}
+`);
+  if (start.emailSent && opts.email) {
+    console.log(`We also emailed a sign-in link to ${opts.email}.`);
+  }
+  console.log("Waiting for you to approve in the browser\u2026");
+  openBrowser(start.verificationUriComplete);
+  const deadline = Date.now() + start.expiresIn * 1e3;
+  const MAX_TRANSIENT = 5;
+  let interval = start.interval;
+  let transient = 0;
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    let raw;
+    try {
+      raw = await bootstrapPost(`${DEVICE_ENDPOINT}/token`, {
+        deviceCode: start.deviceCode
+      });
+    } catch (e) {
+      if (e instanceof CliError && (e.code === "network" || e.code === "internal") && ++transient <= MAX_TRANSIENT) {
+        continue;
+      }
+      throw e;
+    }
+    transient = 0;
+    const parsed = deviceTokenResultSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        "internal",
+        "Unexpected response from the device token endpoint."
+      );
+    }
+    const result = parsed.data;
+    switch (result.status) {
+      case "pending":
+        continue;
+      case "slow_down":
+        interval = result.interval;
+        continue;
+      case "denied":
+        throw new CliError(
+          "unauthorized",
+          "Authorization was denied in the browser."
+        );
+      case "expired":
+        throw new CliError(
+          "unauthorized",
+          "The sign-in request expired before it was approved. Re-run it to try again."
+        );
+      case "approved": {
+        const token = result.accessToken;
+        try {
+          const me = await fetchMe(new ApiClient({ token }));
+          return { token, me };
+        } catch (e) {
+          throw new CliError(
+            "network",
+            `Authorization succeeded, but the issued token could not be verified (${e instanceof Error ? e.message : String(e)}). Re-run to try again; existing credentials were not changed.`
+          );
+        }
+      }
+      default:
+        throw new CliError(
+          "internal",
+          `Unexpected device authorization status: ${result.status}`
+        );
+    }
+  }
+  throw new CliError(
+    "network",
+    "Timed out waiting for browser approval. Re-run to try again."
+  );
+}
+async function readStdin(input = process.stdin) {
+  if (input.isTTY) {
+    const lines = createInterface({ input, crlfDelay: Infinity });
+    for await (const line of lines) {
+      lines.close();
+      return line;
+    }
+    return "";
+  }
   let data = "";
-  for await (const chunk of process.stdin) data += chunk;
+  for await (const chunk of input) data += chunk;
   return data;
 }
 async function withTokenLogin() {
   if (process.stdin.isTTY) {
-    console.error("Paste your API token, then press Enter and Ctrl-D:");
+    console.error("Paste your API token, then press Enter:");
   }
   const token = (await readStdin()).trim();
   if (!token.startsWith(TOKEN_PREFIX)) {
@@ -1578,10 +2415,35 @@ async function whoami(output) {
 }
 function register2(program2) {
   const auth = program2.command("auth").description("Authenticate the CLI (personal access tokens)");
-  auth.command("login").description("Log in via the browser (localhost callback flow)").option("--with-token", "read a token from stdin (headless machines)").action(async (opts) => {
-    if (opts.withToken) await withTokenLogin();
-    else await browserLogin();
-  });
+  auth.command("login").description("Log in via your browser (localhost callback flow)").option("--with-token", "read a token from stdin (headless machines)").option(
+    "--device",
+    "use a device code instead (no local network access required)"
+  ).option(
+    "--email <email>",
+    "with --device: also email a sign-in link to this address"
+  ).action(
+    async (opts) => {
+      if (opts.withToken && opts.device) {
+        throw new CliError(
+          "usage",
+          "Choose only one of --with-token or --device."
+        );
+      }
+      if (opts.email && !opts.device) {
+        throw new CliError("usage", "--email requires --device.");
+      }
+      if (opts.device) {
+        const { token, me } = await deviceLogin({ email: opts.email });
+        saveToken(token);
+        console.log(`Token saved to ${credentialsPath()}`);
+        printIdentity(me);
+      } else if (opts.withToken) {
+        await withTokenLogin();
+      } else {
+        await browserLogin();
+      }
+    }
+  );
   auth.command("logout").description("Remove the stored token").action(() => {
     clearToken();
     console.log(`Removed ${credentialsPath()}`);
@@ -2057,15 +2919,95 @@ function register7(program2) {
   });
 }
 
-// src/commands/orgs.ts
-var orgs_exports = {};
-__export(orgs_exports, {
+// src/commands/onboard.ts
+var onboard_exports = {};
+__export(onboard_exports, {
   register: () => register8
 });
+function orgNameFromEmail(email) {
+  const domain = email?.split("@")[1] ?? "";
+  const base = domain.split(".")[0] ?? "";
+  if (!base) return "My Workspace";
+  return base.charAt(0).toUpperCase() + base.slice(1);
+}
+function register8(program2) {
+  program2.command("onboard").description(
+    "Self-serve onboarding: sign in (device flow) and create your first workspace"
+  ).option("--email <email>", "email a sign-in link (device-flow convenience)").option("--org-name <name>", "workspace name (default: from your email)").option("--website <url>", "company site (logo source)").option("--new", "create a new workspace even if you already belong to one").action(
+    async (opts, command) => {
+      const output = resolveOutput(command);
+      let client;
+      let me;
+      if (resolveToken()) {
+        client = new ApiClient();
+        me = await client.get("/api/v1/me");
+        if (output !== "json") {
+          console.log(`Already signed in as ${me.user.email ?? me.user.id}.`);
+        }
+      } else {
+        const login = await deviceLogin({ email: opts.email });
+        saveToken(login.token);
+        me = login.me;
+        client = new ApiClient({ token: login.token });
+        if (output !== "json") {
+          console.log(
+            `
+Signed in as ${me.user.email ?? me.user.id} \u2014 token saved to ${credentialsPath()}.`
+          );
+        }
+      }
+      const wantNewOrg = opts.new === true || opts.orgName !== void 0 || me.orgs.length === 0;
+      let orgSlug;
+      let createdOrg = null;
+      if (wantNewOrg) {
+        const name = opts.orgName?.trim() || orgNameFromEmail(me.user.email);
+        createdOrg = await client.post("/api/v1/orgs", {
+          name,
+          website: opts.website
+        });
+        orgSlug = createdOrg.slug;
+      } else {
+        orgSlug = readConfig().defaultOrg ?? me.orgs[0]?.slug ?? "";
+        if (!orgSlug) {
+          throw new CliError(
+            "internal",
+            "No workspace available; re-run with --org-name to create one."
+          );
+        }
+      }
+      updateConfig({ defaultOrg: orgSlug });
+      if (output === "json") {
+        printJson({
+          user: me.user,
+          org: createdOrg ?? { slug: orgSlug },
+          defaultOrg: orgSlug
+        });
+        return;
+      }
+      console.log(
+        createdOrg ? `
+Created workspace ${createdOrg.name} (${orgSlug}).` : `
+Using workspace ${orgSlug}.`
+      );
+      console.log(`Default org set to ${orgSlug}. You're ready:`);
+      console.log(
+        "  gauge apply --example > battery.json   # scaffold a run"
+      );
+      console.log("  gauge apply -f battery.json            # launch it");
+      console.log("  gauge runs list                        # watch results");
+    }
+  );
+}
+
+// src/commands/orgs.ts
+var orgs_exports2 = {};
+__export(orgs_exports2, {
+  register: () => register9
+});
 function isDefault(org, defaultOrg) {
   return defaultOrg !== void 0 && (org.slug === defaultOrg || org.publicId === defaultOrg);
 }
-function register8(program2) {
+function register9(program2) {
   const orgs = program2.command("orgs").description("Organizations");
   orgs.command("list").description("List orgs you belong to").action(async (_opts, command) => {
     const output = resolveOutput(command);
@@ -2090,6 +3032,23 @@ function register8(program2) {
       "table"
     );
   });
+  orgs.command("create <name>").description("Create a new LOCAL workspace and set it as the default org").option("--website <url>", "company site (used as the logo source)").option("--no-use", "don't set the new org as the default").action(
+    async (name, opts, command) => {
+      const created = await createClient().post(
+        "/api/v1/orgs",
+        { name, website: opts.website }
+      );
+      if (opts.use !== false) updateConfig({ defaultOrg: created.slug });
+      if (resolveOutput(command) === "json") {
+        printJson(created);
+        return;
+      }
+      console.log(`Created workspace ${created.name} (${created.slug})`);
+      if (opts.use !== false) {
+        console.log(`Default org set to ${created.slug}`);
+      }
+    }
+  );
   orgs.command("use <org>").description("Set the default org (slug or public id) in local config").action(async (org, _opts, command) => {
     const me = await createClient().get("/api/v1/me");
     const match = me.orgs.find((o) => o.slug === org || o.publicId === org);
@@ -2120,9 +3079,11 @@ function register8(program2) {
 var prompts_exports2 = {};
 __export(prompts_exports2, {
   parseAgents: () => parseAgents,
+  parseSamples: () => parseSamples,
   promptsPath: () => promptsPath,
   readPromptText: () => readPromptText,
-  register: () => register9,
+  readWebFixture: () => readWebFixture,
+  register: () => register10,
   resolveOrCreateTopicId: () => resolveOrCreateTopicId
 });
 import { readFileSync as readFileSync4 } from "fs";
@@ -2167,6 +3128,38 @@ function readPromptText(opts) {
   if (!text) throw new CliError("usage", "prompt file is empty");
   return text;
 }
+function readWebFixture(path) {
+  let raw;
+  try {
+    raw = readFileSync4(path, "utf8");
+  } catch (error) {
+    throw new CliError(
+      "usage",
+      "cannot read web fixture " + path + ": " + (error instanceof Error ? error.message : String(error))
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new CliError(
+      "invalid_request",
+      "web fixture is not valid JSON: " + (error instanceof Error ? error.message : String(error))
+    );
+  }
+  const result = web_fixtures_exports.webFixtureSchema.safeParse(parsed);
+  if (!result.success) {
+    const details = result.error.issues.map(
+      (issue) => `  ${issue.path.join(".") || "(fixture)"}: ${issue.message}`
+    ).join("\n");
+    throw new CliError(
+      "invalid_request",
+      `not a valid web fixture:
+${details}`
+    );
+  }
+  return result.data;
+}
 async function resolveOrCreateTopicId(client, org, name) {
   const path = `/api/v1/orgs/${encodeURIComponent(org)}/topics`;
   let cursor;
@@ -2197,19 +3190,20 @@ function toRow2(p) {
     topic: p.topic?.name ?? "",
     tags: p.tags.map((t) => t.name).join(", "),
     schedules: p.scheduleCount,
-    branded: p.isBranded ? "yes" : "",
-    scenario: p.scenario
+    branded: p.isBranded ? "yes" : ""
   };
 }
-var BLOCK_WARNINGS = {
-  insufficient_credits: "warning: prompt created, but the first run was blocked: out of credits",
-  needs_provider_key: "warning: prompt created, but the first run was blocked: no provider key for the selected agents"
-};
-var RUN_BLOCK_WARNINGS = {
-  insufficient_credits: "warning: some schedules were skipped or truncated: out of credits",
-  needs_provider_key: "warning: some schedules were skipped: no provider key for the selected agents"
-};
-function register9(program2) {
+var DEFAULT_RUN_AGENTS = ["CLAUDE_CODE", "CODEX_CLI"];
+function parseSamples(raw, max) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1 || max !== void 0 && n > max)
+    throw new CliError(
+      "usage",
+      max === void 0 ? "--samples must be an integer >= 1" : `--samples must be an integer 1-${max}`
+    );
+  return n;
+}
+function register10(program2) {
   const group = program2.command("prompts").description("Manage prompts");
   group.command("list").description("List prompts").option("--topic <topic>", "filter by topic (id or name)").option("--tag <tag>", "filter by tag (id or name)").option("-q, --query <text>", "text search").action(
     async (opts, cmd) => {
@@ -2223,7 +3217,7 @@ function register9(program2) {
       else printItems(items.map(toRow2), "table");
     }
   );
-  group.command("get <id>").description("Show a prompt (schedules, topic, tags)").action(async (id, _opts, cmd) => {
+  group.command("get <id>").description("Show a prompt (scheduled-via, topic, tags)").action(async (id, _opts, cmd) => {
     const org = resolveOrg(cmd);
     const prompt = await createClient().get(
       `${promptsPath(org)}/${encodeURIComponent(id)}`
@@ -2233,7 +3227,6 @@ function register9(program2) {
       return;
     }
     console.log(`id:       ${prompt.id}`);
-    console.log(`scenario: ${prompt.scenario}`);
     console.log(`branded:  ${prompt.isBranded}`);
     console.log(`topic:    ${prompt.topic?.name ?? "-"}`);
     console.log(
@@ -2242,23 +3235,22 @@ function register9(program2) {
     console.log(`created:  ${prompt.createdAt}`);
     console.log(`text:     ${prompt.text}`);
     if (prompt.schedules.length) {
-      console.log("schedules:");
+      console.log("scheduled via:");
       printItems(
         prompt.schedules.map((s) => ({
           id: s.id,
-          repo: s.repoUrl ?? "(default scaffold)",
-          ref: s.repoRef ?? "",
+          name: s.name,
           cadence: s.cadence,
           days: s.daysPerWeek ?? "",
-          agents: s.agents.join(", ")
+          enabled: s.enabled ? "yes" : "no"
         })),
         "table"
       );
     } else {
-      console.log("schedules: (none)");
+      console.log("scheduled via: (none)");
     }
   });
-  group.command("create").description("Create a prompt").option("--text <text>", "prompt text").option("--file <path>", 'read prompt text from a file ("-" for stdin)').option("--scenario <scenario>", "greenfield | migration", "greenfield").option("--branded", "mark as a branded prompt").option("--topic <name>", "topic (created if new)").option(
+  group.command("create").description("Create a prompt").option("--text <text>", "prompt text").option("--file <path>", 'read prompt text from a file ("-" for stdin)').option("--branded", "mark as a branded prompt").option("--topic <name>", "topic (created if new)").option(
     "--tag <name>",
     "tag name (repeatable; created if new)",
     collect2,
@@ -2266,18 +3258,10 @@ function register9(program2) {
   ).action(
     async (opts, cmd) => {
       const org = resolveOrg(cmd);
-      const scenario = opts.scenario.trim().toUpperCase();
-      if (scenario !== "GREENFIELD" && scenario !== "MIGRATION") {
-        throw new CliError(
-          "usage",
-          `invalid --scenario "${opts.scenario}" (expected: greenfield | migration)`
-        );
-      }
       const created = await createClient().post(
         promptsPath(org),
         {
           text: readPromptText(opts),
-          scenario,
           isBranded: opts.branded ?? false,
           topic: opts.topic,
           tags: opts.tag
@@ -2286,12 +3270,11 @@ function register9(program2) {
       if (resolveOutput(cmd) === "json") printJson(created);
       else {
         console.log(`Created prompt ${created.id}`);
+        const firstTag = created.tags[0];
         console.log(
-          `No schedules yet \u2014 add one with \`gauge schedules add --prompt ${created.id} --agent claude-code\``
+          `Run it now with \`gauge prompts run ${created.id}\`, or schedule it via its tags with ` + (firstTag ? `\`gauge schedules create --name <name> --tag ${firstTag.id} --agent claude-code\`` : `\`gauge schedules create --name <name> --tag <tag-id> --agent claude-code\` (tag the prompt first: \`gauge prompts edit ${created.id} --tag <name>\`)`)
         );
       }
-      if (created.firstRunBlocked)
-        console.error(BLOCK_WARNINGS[created.firstRunBlocked]);
     }
   );
   group.command("edit <id>").description("Update a prompt").option("--text <text>", "new prompt text").option("--file <path>", 'read new text from a file ("-" for stdin)').option("--branded <bool>", "true | false").option("--topic <name>", "set the topic (created if new)").option("--clear-topic", "clear the topic").option(
@@ -2337,19 +3320,27 @@ function register9(program2) {
     );
     if (resolveOutput(cmd) !== "json") console.log(`Deleted prompt ${id}`);
   });
-  group.command("run <id>").description("Run a prompt now (ORG funding, credit-gated)").option(
+  group.command("run <id>").description(
+    "Run a prompt now \u2014 an ad-hoc agents x repo x samples spec (ORG funding, credit-gated)"
+  ).option(
     "--agent <agents>",
-    "comma-separated agents, e.g. claude-code,codex"
-  ).option("--schedule <ids>", "comma-separated schedule ids").action(
+    "comma-separated agents, e.g. claude-code,codex (default: claude-code,codex)"
+  ).option("--repo <url>", "base repo to run against (default: the scaffold)").option("--ref <ref>", "branch, tag, or commit (with --repo)").option("--samples <n>", "samples per agent, 1-10 (default: 1)").option(
+    "--web-fixture <path>",
+    "web fixture JSON; pages are injected transparently into native WebFetch (misses pass through live)"
+  ).action(
     async (id, opts, cmd) => {
       const org = resolveOrg(cmd);
-      const body = {};
-      if (opts.agent !== void 0) body.agents = parseAgents(opts.agent);
-      if (opts.schedule !== void 0) {
-        const ids = opts.schedule.split(",").map((s) => s.trim()).filter(Boolean);
-        if (ids.length === 0)
-          throw new CliError("usage", "no schedule ids given");
-        body.scheduleIds = ids;
+      if (opts.ref !== void 0 && opts.repo === void 0)
+        throw new CliError("usage", "--ref requires --repo");
+      const body = {
+        agents: opts.agent !== void 0 ? parseAgents(opts.agent) : DEFAULT_RUN_AGENTS,
+        samplesPerCycle: opts.samples !== void 0 ? parseSamples(opts.samples, 10) : 1
+      };
+      if (opts.repo !== void 0) body.repoUrl = opts.repo;
+      if (opts.ref !== void 0) body.repoRef = opts.ref;
+      if (opts.webFixture !== void 0) {
+        body.webFixture = readWebFixture(opts.webFixture);
       }
       const result = await createClient().post(
         `${promptsPath(org)}/${encodeURIComponent(id)}/run`,
@@ -2360,16 +3351,13 @@ function register9(program2) {
         return;
       }
       if (result.runIds.length === 0) {
-        console.log(
-          "No runs enqueued (the prompt has no matching schedules)"
-        );
+        console.log("No runs enqueued");
         return;
       }
       console.log(
         `Enqueued ${result.runIds.length} run(s) in ${result.batchIds.length} batch(es)`
       );
       for (const runId of result.runIds) console.log(runId);
-      if (result.blocked) console.error(RUN_BLOCK_WARNINGS[result.blocked]);
       console.error("Tip: `gauge runs watch <id>` streams a run live");
     }
   );
@@ -2378,7 +3366,7 @@ function register9(program2) {
 // src/commands/query.ts
 var query_exports2 = {};
 __export(query_exports2, {
-  register: () => register10
+  register: () => register11
 });
 var collect3 = (value, prev = []) => [
   ...prev,
@@ -2571,7 +3559,7 @@ async function showMetadata(command, mode, dataset) {
   console.error(`dataset: ${ds.name} \u2014 ${ds.grain}`);
   printItems(rows, "table");
 }
-function register10(program2) {
+function register11(program2) {
   const group = program2.command("query").description(
     "Flexible reports over your event warehouse (run a report, or discover the catalog)"
   );
@@ -2607,7 +3595,7 @@ function register10(program2) {
 // src/commands/repos.ts
 var repos_exports2 = {};
 __export(repos_exports2, {
-  register: () => register11
+  register: () => register12
 });
 function reposPath(org) {
   return `/api/v1/orgs/${encodeURIComponent(org)}/repos`;
@@ -2630,7 +3618,7 @@ function toRow3(repo) {
 function syncWarning(repo) {
   return `warning: GitHub metadata sync failed; retry with \`gauge repos resync ${repo.url}\``;
 }
-function register11(program2) {
+function register12(program2) {
   const repos = program2.command("repos").description("Manage repositories");
   repos.command("list").description("List repositories (yours + read-only Gauge-provided ones)").action(async (_opts, command) => {
     const org = resolveOrg(command);
@@ -2694,7 +3682,7 @@ function register11(program2) {
 // src/commands/runs.ts
 var runs_exports2 = {};
 __export(runs_exports2, {
-  register: () => register12
+  register: () => register13
 });
 function runPath(id) {
   return `/api/v1/runs/${encodeURIComponent(id)}`;
@@ -2757,6 +3745,66 @@ function detailLines(run) {
     ["Finished", run.finishedAt ?? "\u2014"]
   ];
 }
+function passLine(label, pass) {
+  const bits = [pass.status];
+  if (pass.model) bits.push(pass.model);
+  const cost = fmtUsd(pass.usdCost);
+  if (cost) bits.push(cost);
+  if (pass.error) bits.push(`error: ${compact(pass.error, 60)}`);
+  return `${label.padEnd(20)} ${bits.join("  ")}`;
+}
+function decisionVia(detail) {
+  const d = detail;
+  if (typeof d?.source === "string") return d.source;
+  const raw = d?.influences;
+  if (!Array.isArray(raw)) return "";
+  const types = [];
+  for (const inf of raw) {
+    const type = inf?.type;
+    if (typeof type === "string" && !types.includes(type)) types.push(type);
+  }
+  return types.join(", ");
+}
+function printInsight(insight) {
+  console.log(passLine("Decision pass", insight.decision));
+  console.log(passLine("Implementation pass", insight.implementation));
+  console.log(`
+Decisions (${insight.decisions.length})`);
+  if (insight.decisions.length === 0) {
+    console.log(insight.decision.status === "SKIPPED" ? "(skipped)" : "(none)");
+  } else {
+    printItems(
+      insight.decisions.map((d) => ({
+        "#": d.index,
+        arena: d.category === "other" && d.categoryRaw ? d.categoryRaw : d.category,
+        chosen: d.chosenPackage ?? d.chosenName,
+        reversed: d.reversed ? "yes" : "",
+        via: decisionVia(d.detail)
+      })),
+      "table"
+    );
+  }
+  console.log(`
+Implementation quality (${insight.implementations.length})`);
+  if (insight.implementations.length === 0) {
+    console.log(
+      insight.implementation.status === "SKIPPED" ? "(skipped)" : "(none)"
+    );
+  } else {
+    printItems(
+      insight.implementations.map((it) => ({
+        verdict: it.verdict,
+        brand: it.brandName,
+        package: it.package ?? "",
+        docs: it.docConsulted ? "docs consulted" : ""
+      })),
+      "table"
+    );
+  }
+  if (insight.decisions.length > 0 || insight.implementations.length > 0) {
+    console.error("\n(full detail: rerun with -o json)");
+  }
+}
 function parseEvent(data) {
   try {
     const parsed = runEventSchema.safeParse(JSON.parse(data));
@@ -2872,7 +3920,7 @@ async function streamRun(id, json, opts) {
     if (drainTimer) clearTimeout(drainTimer);
   }
 }
-function register12(program2) {
+function register13(program2) {
   const runs = program2.command("runs").description("Inspect and manage runs");
   runs.command("list").description("List runs (newest first)").option("--status <status>", "filter by status, e.g. running,queued").option("--batch <id>", "filter by batch").option("--prompt <id>", "filter by prompt").option("--experiment <experiment>", "filter by experiment label").option("--since <window>", "e.g. 24h, 7d, or an ISO date").option("--limit <n>", "page size (1-200)", "50").option("--cursor <cursor>", "resume from a previous page's nextCursor").action(
     async (opts, command) => {
@@ -2914,6 +3962,18 @@ function register12(program2) {
       console.log(`${label.padEnd(width)}  ${value}`);
     }
   });
+  runs.command("insight <id>").description(
+    "Show the run's LLM analysis (decisions + implementation quality)"
+  ).action(async (id, _opts, command) => {
+    const insight = await createClient().get(
+      `${runPath(id)}/insight`
+    );
+    if (resolveOutput(command) === "json") {
+      printJson(insight);
+      return;
+    }
+    printInsight(insight);
+  });
   runs.command("watch <id>").description(
     "Stream normalized trace events live (SSE; exits when the run finishes)"
   ).action(async (id, _opts, command) => {
@@ -2932,6 +3992,10 @@ function register12(program2) {
   });
   runs.command("diff <id>").description("Print the run's working-tree diff to stdout").action(async (id) => {
     const diff = await createClient().get(`${runPath(id)}/diff`);
+    if (!diff) {
+      console.error("(no diff)");
+      return;
+    }
     process.stdout.write(diff);
   });
   runs.command("fork <id>").description("Fork a finished run from its latest conversation checkpoint").requiredOption("--prompt <text>", "continuation prompt for the child run").action(async (id, opts, command) => {
@@ -2966,7 +4030,7 @@ function register12(program2) {
 // src/commands/schedules.ts
 var schedules_exports2 = {};
 __export(schedules_exports2, {
-  register: () => register13
+  register: () => register14
 });
 var CADENCE_CHOICES = [
   "none",
@@ -2991,67 +4055,139 @@ function parseDays(raw) {
     throw new CliError("usage", "--days-per-week must be an integer 1-7");
   return n;
 }
+function collect4(value, previous) {
+  return [...previous, value];
+}
+function reposLabel(repos) {
+  if (repos.length === 0) return "(default scaffold)";
+  if (repos.length === 1) {
+    const r = repos[0];
+    if (r.repoUrl === null) return "(default scaffold)";
+    return r.repoRef ? `${r.repoUrl}@${r.repoRef}` : r.repoUrl;
+  }
+  return `${repos.length} repos`;
+}
+function reposFromOpts(repo, ref) {
+  return [{ repoUrl: repo, repoRef: ref ?? null }];
+}
 function toRow5(s) {
   return {
     id: s.id,
-    repo: s.repoUrl ?? "(default scaffold)",
-    ref: s.repoRef ?? "",
+    name: s.name,
     cadence: s.cadence,
     days: s.daysPerWeek ?? "",
     agents: s.agents.join(", "),
+    repos: reposLabel(s.repos),
+    tags: s.tagCount,
+    enabled: s.enabled ? "yes" : "no",
     experiment: s.experiment ?? ""
   };
 }
-function register13(program2) {
-  const group = program2.command("schedules").description("Manage prompt schedules");
-  group.command("list").description("List schedules for a prompt").requiredOption("--prompt <id>", "prompt id").action(async (opts, cmd) => {
+function toRefRow(s) {
+  return {
+    id: s.id,
+    name: s.name,
+    cadence: s.cadence,
+    days: s.daysPerWeek ?? "",
+    enabled: s.enabled ? "yes" : "no"
+  };
+}
+var RUN_BLOCK_WARNINGS = {
+  insufficient_credits: "warning: some targets were skipped or truncated: out of credits",
+  needs_provider_key: "warning: some targets were skipped: no provider key for the selected agents"
+};
+function register14(program2) {
+  const group = program2.command("schedules").description("Manage org schedules (named prompt sets on a cadence)");
+  group.command("list").description(
+    "List schedules for the org, or (with --prompt) the schedules a prompt is in"
+  ).option("--prompt <id>", "only schedules that contain this prompt").action(async (opts, cmd) => {
     const org = resolveOrg(cmd);
-    const res = await createClient().get(
-      `${promptsPath(org)}/${encodeURIComponent(opts.prompt)}/schedules`
+    const client = createClient();
+    const json = resolveOutput(cmd) === "json";
+    if (opts.prompt !== void 0) {
+      const res2 = await client.get(
+        `${promptsPath(org)}/${encodeURIComponent(opts.prompt)}/schedules`
+      );
+      if (json) printJson(res2.items);
+      else printItems(res2.items.map(toRefRow), "table");
+      return;
+    }
+    const res = await client.get(
+      `/api/v1/orgs/${encodeURIComponent(org)}/schedules`
     );
-    if (resolveOutput(cmd) === "json") printJson(res.items);
+    if (json) printJson(res.items);
     else printItems(res.items.map(toRow5), "table");
   });
-  group.command("add").description(
-    "Add a schedule (a repo target + cadence + agents) to a prompt"
-  ).requiredOption("--prompt <id>", "prompt id").requiredOption(
+  group.command("create").description(
+    "Create an org schedule: a named tag set + agents + cadence + repo"
+  ).requiredOption("--name <name>", "schedule name").requiredOption(
     "--agent <agents>",
     "comma-separated agents, e.g. claude-code,codex"
-  ).option("--repo <url>", "repository URL (default: the Gauge scaffold)").option("--ref <ref>", "branch, tag, or commit").option("--cadence <cadence>", CADENCE_CHOICES.join(" | "), "none").option("--days-per-week <n>", "1-7 (with --cadence days-per-week)").action(
+  ).option(
+    "--tag <id>",
+    "membership tag id \u2014 the schedule runs the union of its tags (repeatable)",
+    collect4,
+    []
+  ).option("--repo <url>", "repository URL (default: the Gauge scaffold)").option("--ref <ref>", "branch, tag, or commit (with --repo)").option("--cadence <cadence>", CADENCE_CHOICES.join(" | "), "none").option("--days-per-week <n>", "1-7 (with --cadence days-per-week)").option("--samples <n>", "samples per cycle (default: 1)").option("--model <id>", "pin a model id (default: the agent's default)").option("--disabled", "create the schedule disabled").action(
     async (opts, cmd) => {
       const org = resolveOrg(cmd);
+      if (opts.ref !== void 0 && opts.repo === void 0)
+        throw new CliError("usage", "--ref requires --repo");
       const body = {
+        name: opts.name,
         agents: parseAgents(opts.agent),
         cadence: parseCadence(opts.cadence),
-        repoUrl: opts.repo,
-        repoRef: opts.ref
+        samplesPerCycle: opts.samples !== void 0 ? parseSamples(opts.samples) : 1,
+        repos: opts.repo !== void 0 ? reposFromOpts(opts.repo, opts.ref) : [],
+        tagIds: opts.tag,
+        enabled: !opts.disabled
       };
       if (opts.daysPerWeek !== void 0)
         body.daysPerWeek = parseDays(opts.daysPerWeek);
+      if (opts.model !== void 0) body.model = opts.model;
       const schedule = await createClient().post(
-        `${promptsPath(org)}/${encodeURIComponent(opts.prompt)}/schedules`,
+        `/api/v1/orgs/${encodeURIComponent(org)}/schedules`,
         body
       );
       if (resolveOutput(cmd) === "json") printJson(schedule);
-      else console.log(`Added schedule ${schedule.id}`);
+      else console.log(`Created schedule ${schedule.id}`);
     }
   );
-  group.command("edit <id>").description("Update a schedule").option("--agent <agents>", "comma-separated agents").option("--repo <url>", "repository URL").option("--clear-repo", "reset to the default scaffold").option("--ref <ref>", "branch, tag, or commit").option("--clear-ref", "reset to the repo's default branch").option("--cadence <cadence>", CADENCE_CHOICES.join(" | ")).option("--days-per-week <n>", "1-7 (with cadence days-per-week)").action(
+  group.command("edit <id>").description("Update a schedule (repos and tags are full replacements)").option("--name <name>", "rename the schedule").option("--agent <agents>", "comma-separated agents").option(
+    "--tag <id>",
+    "membership tag id \u2014 replaces the whole set (repeatable)",
+    collect4,
+    []
+  ).option("--clear-tags", "remove all membership tags").option("--repo <url>", "set a single repo target").option("--ref <ref>", "branch, tag, or commit (with --repo)").option("--clear-repos", "reset to the default scaffold (no repos)").option("--cadence <cadence>", CADENCE_CHOICES.join(" | ")).option("--days-per-week <n>", "1-7 (with cadence days-per-week)").option("--samples <n>", "samples per cycle").option("--model <id>", "pin a model id").option("--clear-model", "use the agent's default model").option("--enable", "enable the schedule").option("--disable", "disable the schedule").action(
     async (id, opts, cmd) => {
       const body = {};
+      if (opts.name !== void 0) body.name = opts.name;
       if (opts.agent !== void 0) body.agents = parseAgents(opts.agent);
-      if (opts.repo !== void 0 && opts.clearRepo)
-        throw new CliError("usage", "--repo and --clear-repo conflict");
-      if (opts.clearRepo) body.repoUrl = null;
-      else if (opts.repo !== void 0) body.repoUrl = opts.repo;
-      if (opts.ref !== void 0 && opts.clearRef)
-        throw new CliError("usage", "--ref and --clear-ref conflict");
-      if (opts.clearRef) body.repoRef = null;
-      else if (opts.ref !== void 0) body.repoRef = opts.ref;
       if (opts.cadence !== void 0)
         body.cadence = parseCadence(opts.cadence);
       if (opts.daysPerWeek !== void 0)
         body.daysPerWeek = parseDays(opts.daysPerWeek);
+      if (opts.samples !== void 0)
+        body.samplesPerCycle = parseSamples(opts.samples);
+      if (opts.model !== void 0 && opts.clearModel)
+        throw new CliError("usage", "--model and --clear-model conflict");
+      if (opts.clearModel) body.model = null;
+      else if (opts.model !== void 0) body.model = opts.model;
+      if (opts.ref !== void 0 && opts.repo === void 0)
+        throw new CliError("usage", "--ref requires --repo");
+      if (opts.repo !== void 0 && opts.clearRepos)
+        throw new CliError("usage", "--repo and --clear-repos conflict");
+      if (opts.clearRepos) body.repos = [];
+      else if (opts.repo !== void 0)
+        body.repos = reposFromOpts(opts.repo, opts.ref);
+      if (opts.tag.length > 0 && opts.clearTags)
+        throw new CliError("usage", "--tag and --clear-tags conflict");
+      if (opts.clearTags) body.tagIds = [];
+      else if (opts.tag.length > 0) body.tagIds = opts.tag;
+      if (opts.enable && opts.disable)
+        throw new CliError("usage", "--enable and --disable conflict");
+      if (opts.enable) body.enabled = true;
+      else if (opts.disable) body.enabled = false;
       if (Object.keys(body).length === 0)
         throw new CliError("usage", "nothing to change");
       const schedule = await createClient().patch(
@@ -3062,6 +4198,34 @@ function register13(program2) {
       else console.log(`Updated schedule ${schedule.id}`);
     }
   );
+  group.command("run <id>").description(
+    "Run a schedule now \u2014 forced expansion of its whole member set (ORG funding, credit-gated)"
+  ).action(async (id, _opts, cmd) => {
+    const result = await createClient().post(
+      `/api/v1/schedules/${encodeURIComponent(id)}/run`,
+      {}
+    );
+    if (resolveOutput(cmd) === "json") {
+      printJson(result);
+      return;
+    }
+    if (result.runIds.length === 0) {
+      console.log(
+        "No runs enqueued (the schedule's tags resolve to no prompts)"
+      );
+      return;
+    }
+    console.log(
+      `Enqueued ${result.runIds.length} run(s) in ${result.batchIds.length} batch(es)`
+    );
+    for (const runId of result.runIds) console.log(runId);
+    if (result.blocked) console.error(RUN_BLOCK_WARNINGS[result.blocked]);
+    for (const nr of result.notReady ?? [])
+      console.error(
+        `warning: skipped ${nr.repoUrl} \u2014 baseline snapshot ${nr.status}`
+      );
+    console.error("Tip: `gauge runs watch <id>` streams a run live");
+  });
   group.command("rm <id>").description("Delete a schedule").action(async (id, _opts, cmd) => {
     await createClient().delete(
       `/api/v1/schedules/${encodeURIComponent(id)}`
@@ -3073,7 +4237,7 @@ function register13(program2) {
 // src/commands/stats.ts
 var stats_exports2 = {};
 __export(stats_exports2, {
-  register: () => register14
+  register: () => register15
 });
 function addFilterOptions(cmd) {
   return cmd.option("--prompt <id>", "filter to a single prompt").option("--topic <ids>", "comma-separated topic ids").option("--tag <ids>", "comma-separated tag ids").option("--repo <urls>", "comma-separated base repo urls").option("--language <langs>", "comma-separated repo languages").option("--framework <names>", "comma-separated repo frameworks").option("--size <buckets>", "comma-separated codebase-size buckets").option("--branded", "only branded prompts").option("--unbranded", "only non-branded prompts").option("--limit <n>", "max rows (default 50)").option("--full", "return all rows (up to 1000)");
@@ -3157,7 +4321,7 @@ var domainRow = (r) => ({
   rate: pct2(r.rate),
   requests: r.requests
 });
-function register14(program2) {
+function register15(program2) {
   const group = program2.command("stats").description("Read-only analytics over your runs");
   addFilterOptions(
     group.command("rankings").description("Brands ranked by install rate")
@@ -3189,12 +4353,12 @@ function register14(program2) {
 // src/commands/tags.ts
 var tags_exports2 = {};
 __export(tags_exports2, {
-  register: () => register15
+  register: () => register16
 });
 function tagsPath(org) {
   return `/api/v1/orgs/${encodeURIComponent(org)}/tags`;
 }
-function register15(program2) {
+function register16(program2) {
   const group = program2.command("tags").description("Manage org tags");
   group.command("list").description("List tags").action(async (_opts, cmd) => {
     const org = resolveOrg(cmd);
@@ -3237,12 +4401,12 @@ function register15(program2) {
 // src/commands/topics.ts
 var topics_exports2 = {};
 __export(topics_exports2, {
-  register: () => register16
+  register: () => register17
 });
 function topicsPath(org) {
   return `/api/v1/orgs/${encodeURIComponent(org)}/topics`;
 }
-function register16(program2) {
+function register17(program2) {
   const group = program2.command("topics").description("Manage org topics");
   group.command("list").description("List topics").action(async (_opts, cmd) => {
     const org = resolveOrg(cmd);
@@ -3263,9 +4427,9 @@ function register16(program2) {
 // src/commands/usage.ts
 var usage_exports = {};
 __export(usage_exports, {
-  register: () => register17
+  register: () => register18
 });
-function register17(program2) {
+function register18(program2) {
   program2.command("usage").description("List credit ledger entries").option("--since <window>", 'e.g. "30d", "24h", or an ISO date').option("--limit <n>", "page size (1-200)", parseLimit, 50).option("--cursor <cursor>", "resume from a previous page's nextCursor").action(
     async (opts, cmd) => {
       const org = resolveOrg(cmd);
@@ -3321,7 +4485,8 @@ program.name("gauge").description(
 );
 for (const group of [
   auth_exports,
-  orgs_exports,
+  onboard_exports,
+  orgs_exports2,
   prompts_exports2,
   schedules_exports2,
   repos_exports2,