@withgauge/cli 0.4.0 → 0.5.0

package/dist/index.js

@@ -21,7 +21,6 @@ __export(batteries_exports, {
   BATTERY_AGENTS: () => BATTERY_AGENTS,
   BATTERY_CADENCES: () => BATTERY_CADENCES,
   BATTERY_MAX_LIMITS: () => BATTERY_MAX_LIMITS,
-  BATTERY_SCENARIOS: () => BATTERY_SCENARIOS,
   MAX_SAMPLES_PER_CYCLE: () => MAX_SAMPLES_PER_CYCLE,
   batchDetailSchema: () => batchDetailSchema,
   batchListQuerySchema: () => batchListQuerySchema,
@@ -82,7 +81,6 @@ var BATTERY_CADENCES = [
   "MONTHLY",
   "DAYS_PER_WEEK"
 ];
-var BATTERY_SCENARIOS = ["GREENFIELD", "MIGRATION"];
 var batteryAgentSchema = z2.enum(BATTERY_AGENTS);
 var BATTERY_MAX_LIMITS = {
   maxTurns: 30,
@@ -109,7 +107,6 @@ var batteryScheduleSpecSchema = z2.object({
   limits: batteryLimitsSchema.optional()
 });
 var batteryDefaultsSchema = z2.object({
-  scenario: z2.enum(BATTERY_SCENARIOS).optional(),
   isBranded: z2.boolean().optional(),
   topic: z2.string().optional(),
   tags: z2.array(z2.string()).optional(),
@@ -123,7 +120,6 @@ var batteryPromptSpecSchema = z2.object({
   /** Idempotency key, unique per org (→ Prompt.externalKey). */
   key: z2.string().min(1),
   text: z2.string().min(1),
-  scenario: z2.enum(BATTERY_SCENARIOS).optional(),
   isBranded: z2.boolean().optional(),
   topic: z2.string().optional(),
   tags: z2.array(z2.string()).optional(),
@@ -342,54 +338,657 @@ var listBrandsQuerySchema = listQuerySchema.extend({
 });
 var brandListResponseSchema = listResponseSchema(brandSchema);
 
-// ../packages/api-schemas/src/device.ts
+// ../packages/api-schemas/src/checkpoints.ts
 import { z as z5 } from "zod";
-var deviceAuthorizeRequestSchema = z5.object({
+var CHECKPOINT_STORE_VERSION = 2;
+var ALIGNED_CHECKPOINT_SUPERVISOR_ARTIFACT = "0.0.76-byok-ha-26071639";
+var ALIGNED_RUNSC_VERSION = "release-20260112.0";
+var ALIGNED_RUNSC_PLATFORM = "systrap";
+var SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/;
+var CHECKPOINT_ARTIFACT_PATTERN = /^alg-checkpoint:v2:sha256:[0-9a-f]{64}$/;
+var sha256DigestSchema = z5.custom(
+  (value) => typeof value === "string" && SHA256_PATTERN.test(value),
+  "expected a sha256:<64 lowercase hex> digest"
+);
+var checkpointArtifactRefSchema = z5.custom(
+  (value) => typeof value === "string" && CHECKPOINT_ARTIFACT_PATTERN.test(value),
+  "expected an alg-checkpoint:v2 artifact reference"
+);
+var publicArtifactScopeSchema = z5.object({ kind: z5.literal("public") });
+var orgArtifactScopeSchema = z5.object({
+  kind: z5.literal("org"),
+  organizationId: z5.string().min(1)
+});
+var artifactScopeSchema = z5.discriminatedUnion("kind", [
+  publicArtifactScopeSchema,
+  orgArtifactScopeSchema
+]);
+function scopesMatch(left, right) {
+  return left.kind === right.kind && (left.kind === "public" || right.kind === "org" && left.organizationId === right.organizationId);
+}
+function manifestScopeReferenceViolation(manifestScope, referenced) {
+  if (referenced === void 0) return null;
+  if (referenced.kind === "public") return null;
+  if (scopesMatch(manifestScope, referenced)) return null;
+  if (manifestScope.kind === "public") {
+    return "a public manifest must not reference an org-scoped object";
+  }
+  return "a manifest must not reference another organization's object";
+}
+var checkpointStorePrincipalSchema = z5.discriminatedUnion("kind", [
+  z5.object({ kind: z5.literal("system") }),
+  z5.object({
+    kind: z5.literal("organization"),
+    organizationId: z5.string().min(1)
+  })
+]);
+var checkpointChunkSchema = z5.object({
+  ordinal: z5.number().int().nonnegative(),
+  digest: sha256DigestSchema,
+  rawDigest: sha256DigestSchema,
+  rawBytes: z5.number().int().positive(),
+  storedBytes: z5.number().int().positive()
+});
+var chunkedPayloadSchema = z5.object({
+  format: z5.enum([
+    "canonical-workspace-chunked-zstd-v1",
+    "runsc-checkpoint-chunked-zstd-v1",
+    "overlay-upper-chunked-zstd-v1"
+  ]),
+  chunks: z5.array(checkpointChunkSchema).min(1).superRefine((chunks, context) => {
+    for (const [index, chunk] of chunks.entries()) {
+      if (chunk.ordinal !== index) {
+        context.addIssue({
+          code: "custom",
+          message: `chunk ordinal ${chunk.ordinal} must equal position ${index}`,
+          path: [index, "ordinal"]
+        });
+      }
+    }
+  })
+});
+var canonicalBaselinePayloadSchema = chunkedPayloadSchema.extend({
+  format: z5.literal("canonical-workspace-chunked-zstd-v1")
+});
+var nydusBaselineBlobSchema = z5.object({
+  nydusBlobId: z5.string().regex(/^[0-9a-f]{64}$/),
+  object: checkpointChunkSchema,
+  /**
+   * CAS scope this blob's object actually lives in, when it is NOT the manifest's own
+   * (ALG-197 S0). A `--chunk-dict` build inherits its dict's blobs by reference, and the
+   * dict is usually a PUBLIC baseline while the built artifact is an ORG conversation
+   * checkpoint — without this the manifest can only name `cas/v2/org/<id>/…`, where the
+   * inherited object was never stored.
+   *
+   * ORG→PUBLIC only; the direction is enforced by
+   * `workspaceBaselineManifestV2Schema`'s refinement, not by convention.
+   *
+   * Emitted ONLY when it differs from the manifest scope: manifests are content-addressed
+   * over canonical JSON, so an always-present field would change every existing digest
+   * and churn every `artifactRef`. Absent ⇒ the manifest's own scope.
+   */
+  scope: artifactScopeSchema.optional()
+});
+var nydusBaselinePayloadSchema = z5.object({
+  format: z5.literal("nydus-rafs-v6"),
+  fsVersion: z5.literal(6),
+  /** Always the manifest's own scope: a build always produces its own bootstrap, so
+   *  only inherited BLOBS can be foreign. Confining the override to where a foreign
+   *  scope is possible is what keeps the invariant checkable. */
+  bootstrap: checkpointChunkSchema,
+  blobs: z5.array(nydusBaselineBlobSchema)
+});
+var workspaceBaselinePayloadSchema = z5.discriminatedUnion("format", [
+  canonicalBaselinePayloadSchema,
+  nydusBaselinePayloadSchema
+]);
+var workspaceBaselineManifestV2Schema = z5.object({
+  schemaVersion: z5.literal(CHECKPOINT_STORE_VERSION),
+  kind: z5.literal("workspace-baseline"),
+  scope: artifactScopeSchema,
+  workspaceRoot: sha256DigestSchema,
+  payload: workspaceBaselinePayloadSchema,
+  repo: z5.object({
+    canonicalUrl: z5.string().url(),
+    requestedRef: z5.string().min(1),
+    resolvedCommit: z5.string().regex(/^[0-9a-f]{40,64}$/)
+  }),
+  recipe: z5.object({
+    digest: sha256DigestSchema,
+    sandboxImageDigest: sha256DigestSchema,
+    architecture: z5.string().min(1)
+  })
+}).superRefine((manifest, context) => {
+  if (manifest.payload.format !== "nydus-rafs-v6") return;
+  for (const [index, blob] of manifest.payload.blobs.entries()) {
+    const violation = manifestScopeReferenceViolation(
+      manifest.scope,
+      blob.scope
+    );
+    if (violation) {
+      context.addIssue({
+        code: "custom",
+        message: violation,
+        path: ["payload", "blobs", index, "scope"]
+      });
+    }
+  }
+});
+var checkpointBoundaryV2Schema = z5.object({
+  kind: z5.enum(["tool_call", "assistant_message", "user_message"]),
+  turn: z5.number().int().nonnegative(),
+  ordinal: z5.number().int().nonnegative(),
+  toolName: z5.string().optional(),
+  url: z5.string().url().optional()
+});
+var memoryDiskManifestV2Schema = z5.object({
+  schemaVersion: z5.literal(CHECKPOINT_STORE_VERSION),
+  kind: z5.literal("runsc-memory-disk"),
+  scope: orgArtifactScopeSchema,
+  boundary: checkpointBoundaryV2Schema,
+  memory: chunkedPayloadSchema.extend({
+    format: z5.literal("runsc-checkpoint-chunked-zstd-v1")
+  }),
+  disk: z5.object({
+    baselineArtifact: checkpointArtifactRefSchema,
+    baselineScope: artifactScopeSchema,
+    baselineWorkspaceRoot: sha256DigestSchema,
+    delta: chunkedPayloadSchema.extend({
+      format: z5.literal("overlay-upper-chunked-zstd-v1")
+    })
+  }),
+  runtime: z5.object({
+    runscVersion: z5.string().min(1),
+    platform: z5.string().min(1),
+    configDigest: sha256DigestSchema,
+    supervisorArtifact: z5.string().min(1),
+    architecture: z5.string().min(1)
+  }),
+  memorySharing: z5.literal("none")
+});
+var workspaceSourceSchema = z5.discriminatedUnion("kind", [
+  z5.object({
+    kind: z5.literal("nvme-baseline"),
+    artifact: checkpointArtifactRefSchema,
+    workspaceRoot: sha256DigestSchema,
+    scope: artifactScopeSchema
+  }),
+  z5.object({
+    kind: z5.literal("memory-disk"),
+    artifact: checkpointArtifactRefSchema,
+    boundary: checkpointBoundaryV2Schema
+  }),
+  z5.object({
+    kind: z5.literal("legacy-ebs"),
+    volumeSnapshot: z5.string().min(1),
+    resumeSessionId: z5.string().min(1).optional()
+  })
+]);
+var baselinePayloadFormatSchema = z5.enum([
+  "canonical-workspace-chunked-zstd-v1",
+  "runsc-checkpoint-chunked-zstd-v1",
+  "overlay-upper-chunked-zstd-v1",
+  "nydus-rafs-v6"
+]);
+var checkpointStoreCapabilitiesSchema = z5.object({
+  storeVersion: z5.literal(CHECKPOINT_STORE_VERSION),
+  manifestSchemas: z5.array(z5.literal(CHECKPOINT_STORE_VERSION)).min(1),
+  payloadFormats: z5.array(baselinePayloadFormatSchema),
+  runtime: z5.object({
+    runscVersion: z5.literal(ALIGNED_RUNSC_VERSION),
+    platform: z5.literal(ALIGNED_RUNSC_PLATFORM),
+    supervisorArtifact: z5.literal(ALIGNED_CHECKPOINT_SUPERVISOR_ARTIFACT)
+  })
+});
+
+// ../packages/api-schemas/src/cli-auth.ts
+import { z as z6 } from "zod";
+var PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+var cliAuthorizationTokenRequestSchema = z6.object({
+  code: z6.string().min(1).max(512),
+  codeVerifier: z6.string().regex(PKCE_VERIFIER_PATTERN)
+});
+var cliAuthorizationTokenResponseSchema = z6.object({
+  accessToken: z6.string(),
+  tokenType: z6.literal("bearer"),
+  expiresAt: z6.string().nullable()
+});
+
+// ../packages/api-schemas/src/dashboards.ts
+import { z as z9 } from "zod";
+
+// ../packages/api-schemas/src/query.ts
+import { z as z8 } from "zod";
+
+// ../packages/api-schemas/src/stats.ts
+import { z as z7 } from "zod";
+var BRAND_KINDS2 = ["OWNED", "COMPETITOR", "OTHER"];
+var brandKindSchema2 = z7.enum(BRAND_KINDS2);
+var brandRankingSchema = z7.object({
+  rank: z7.number().int(),
+  brandId: z7.string(),
+  brandName: z7.string(),
+  kind: brandKindSchema2,
+  installs: z7.number().int(),
+  installRate: z7.number(),
+  mentionRate: z7.number(),
+  /** Movement between the two most recent batch windows; null if not ranked in both. */
+  deltaRank: z7.number().int().nullable()
+});
+var packageRateSchema = z7.object({
+  ecosystem: z7.string(),
+  name: z7.string(),
+  brandName: z7.string().optional(),
+  kind: brandKindSchema2.optional(),
+  installs: z7.number().int(),
+  rate: z7.number()
+});
+var brandRateSchema = z7.object({
+  brandId: z7.string(),
+  brandName: z7.string(),
+  kind: brandKindSchema2,
+  installs: z7.number().int(),
+  rate: z7.number()
+});
+var brandFunnelRowSchema = z7.object({
+  brandId: z7.string(),
+  brandName: z7.string(),
+  kind: brandKindSchema2,
+  mentionRate: z7.number(),
+  installRate: z7.number()
+});
+var domainRateSchema = z7.object({
+  domain: z7.string(),
+  runs: z7.number().int(),
+  rate: z7.number(),
+  requests: z7.number().int(),
+  brandName: z7.string().optional(),
+  owned: z7.boolean().optional()
+});
+var statsFreshnessSchema = z7.object({
+  /** Newest run-ingest time across the org (ISO), or null if nothing ingested. */
+  watermark: z7.string().nullable(),
+  /** Runs that succeeded recently but haven't landed in the warehouse yet. */
+  pending: z7.number().int(),
+  /** False when the freshness read itself failed (distinguish from genuine zero). */
+  available: z7.boolean()
+});
+var statsResponseSchema = (item) => z7.object({ items: z7.array(item), freshness: statsFreshnessSchema });
+var rankingsResponseSchema = statsResponseSchema(brandRankingSchema);
+var installsResponseSchema = statsResponseSchema(packageRateSchema);
+var brandsResponseSchema = statsResponseSchema(brandRateSchema);
+var funnelResponseSchema = statsResponseSchema(brandFunnelRowSchema);
+var domainsResponseSchema = statsResponseSchema(domainRateSchema);
+
+// ../packages/api-schemas/src/query.ts
+var DATASETS = [
+  "runs",
+  "installs",
+  "mentions",
+  "web",
+  "citations",
+  "network",
+  "files",
+  "tokens",
+  "brand_rollup"
+];
+var datasetSchema = z8.enum(DATASETS);
+var WHERE_OPS = [
+  "eq",
+  "neq",
+  "in",
+  "notIn",
+  "contains",
+  "gt",
+  "gte",
+  "lt",
+  "lte"
+];
+var whereOpSchema = z8.enum(WHERE_OPS);
+var GRANULARITIES = ["day", "week", "month"];
+var granularitySchema = z8.enum(GRANULARITIES);
+var DEFAULT_QUERY_LIMIT = 50;
+var MAX_QUERY_LIMIT = 1e3;
+var scalar = z8.union([z8.string(), z8.number(), z8.boolean()]);
+var whereClauseSchema = z8.object({
+  dimension: z8.string().min(1),
+  op: whereOpSchema,
+  value: z8.union([scalar, z8.array(scalar)])
+});
+var queryFiltersSchema = z8.object({
+  prompt: z8.string(),
+  topic: z8.array(z8.string()),
+  tag: z8.array(z8.string()),
+  repo: z8.array(z8.string()),
+  language: z8.array(z8.string()),
+  framework: z8.array(z8.string()),
+  size: z8.array(z8.string()),
+  agent: z8.array(z8.string()),
+  /** Persona UserProfile ids; the NO_PERSONA sentinel = default judge. */
+  persona: z8.array(z8.string()),
+  model: z8.array(z8.string()),
+  scenario: z8.array(z8.string()),
+  experiment: z8.array(z8.string()),
+  branded: z8.boolean()
+}).partial();
+var dateRangeSchema = z8.object({
+  since: z8.string(),
+  until: z8.string(),
+  lastDays: z8.number().int().positive()
+}).partial();
+var orderBySchema = z8.object({
+  /** A selected dimension or metric name. */
+  key: z8.string().min(1),
+  dir: z8.enum(["asc", "desc"]).default("desc")
+});
+var querySpecSchema = z8.object({
+  dataset: datasetSchema.default("runs"),
+  dimensions: z8.array(z8.string()).default([]),
+  metrics: z8.array(z8.string()).min(1, "at least one metric is required"),
+  filters: queryFiltersSchema.default({}),
+  where: z8.array(whereClauseSchema).default([]),
+  dateRange: dateRangeSchema.optional(),
+  orderBy: z8.array(orderBySchema).default([]),
+  limit: z8.number().int().min(1).max(MAX_QUERY_LIMIT).default(DEFAULT_QUERY_LIMIT),
+  granularity: granularitySchema.default("day"),
+  /** When true, the response echoes the compiled SQL (params bound, not inlined). */
+  explain: z8.boolean().default(false)
+});
+var columnKindSchema = z8.enum(["dimension", "metric"]);
+var queryColumnSchema = z8.object({
+  key: z8.string(),
+  kind: columnKindSchema
+});
+var queryRowSchema = z8.record(
+  z8.string(),
+  z8.union([z8.string(), z8.number(), z8.boolean(), z8.null()])
+);
+var queryResponseSchema = z8.object({
+  columns: z8.array(queryColumnSchema),
+  rows: z8.array(queryRowSchema),
+  /** Present only when the request set explain=true. */
+  sql: z8.string().optional(),
+  freshness: statsFreshnessSchema
+});
+var fieldTypeSchema = z8.enum([
+  "string",
+  "number",
+  "rate",
+  "date",
+  "boolean"
+]);
+var fieldSchema = z8.object({
+  name: z8.string(),
+  type: fieldTypeSchema,
+  /** One-line human/agent hint. */
+  description: z8.string().optional()
+});
+var datasetMetaSchema = z8.object({
+  name: datasetSchema,
+  grain: z8.string(),
+  dimensions: z8.array(fieldSchema),
+  metrics: z8.array(fieldSchema)
+});
+var metadataResponseSchema = z8.object({
+  datasets: z8.array(datasetMetaSchema)
+});
+
+// ../packages/api-schemas/src/dashboards.ts
+var VIZ_TYPES = ["line", "bar", "table", "kpi"];
+var vizTypeSchema = z9.enum(VIZ_TYPES);
+var widgetEncodingSchema = z9.object({
+  x: z9.string(),
+  // dimension key for the x axis (line)
+  series: z9.string(),
+  // dimension key split into one series per value (line)
+  y: z9.array(z9.string())
+  // metric keys for the value axis
+}).partial();
+var widgetFields = {
+  id: z9.string().min(1),
+  title: z9.string(),
+  viz: vizTypeSchema,
+  spec: querySpecSchema,
+  // 12-col grid placement.
+  x: z9.number().int().min(0).max(11),
+  y: z9.number().int().min(0),
+  w: z9.number().int().min(1).max(12),
+  h: z9.number().int().min(1),
+  encoding: widgetEncodingSchema.optional()
+};
+var widgetSchema = z9.object(widgetFields).refine((w) => w.x + w.w <= 12, {
+  message: "widget spills past the 12-column grid (x + w must be \u2264 12)"
+});
+var widgetPatchSchema = z9.object(widgetFields).partial();
+var dashboardFiltersSchema = z9.object({
+  filters: queryFiltersSchema,
+  dateRange: dateRangeSchema
+}).partial();
+var overlayPatchSchema = z9.object({
+  name: z9.string(),
+  defaultFilters: dashboardFiltersSchema,
+  widgets: z9.record(z9.string(), widgetPatchSchema.nullable()),
+  // Explicit widget-id ordering (for reordering and from-scratch widgets).
+  order: z9.array(z9.string())
+}).partial();
+var resolvedDashboardSchema = z9.object({
+  key: z9.string(),
+  name: z9.string(),
+  widgets: z9.array(widgetSchema),
+  defaultFilters: dashboardFiltersSchema,
+  hasOrgOverlay: z9.boolean(),
+  hasUserOverlay: z9.boolean()
+});
+var dashboardTemplateSchema = z9.object({
+  key: z9.string().min(1),
+  name: z9.string(),
+  description: z9.string().optional(),
+  widgets: z9.array(widgetSchema),
+  defaultFilters: dashboardFiltersSchema.optional()
+});
+var dashboardSummarySchema = z9.object({
+  key: z9.string(),
+  name: z9.string(),
+  source: z9.enum(["template", "org", "user"]),
+  isUserDefault: z9.boolean(),
+  isOrgDefault: z9.boolean()
+});
+
+// ../packages/api-schemas/src/device.ts
+import { z as z10 } from "zod";
+var deviceAuthorizeRequestSchema = z10.object({
   /** Device label (the CLI's hostname) for display + token naming. */
-  deviceName: z5.string().trim().max(64).optional(),
+  deviceName: z10.string().trim().max(64).optional(),
   /** Optional: email a magic-link that lands on the approval page pre-scoped
    *  to this device (best-effort — the printed URL always works regardless). */
-  email: z5.string().trim().email().max(320).optional()
+  email: z10.string().trim().email().max(320).optional()
 });
-var deviceAuthorizeResponseSchema = z5.object({
+var deviceAuthorizeResponseSchema = z10.object({
   /** The one-time secret the CLI polls with (never shown again). */
-  deviceCode: z5.string(),
+  deviceCode: z10.string(),
   /** Short human-typed code the user confirms in the browser (e.g. WXYZ-1234). */
-  userCode: z5.string(),
+  userCode: z10.string(),
   /** Where the user approves (e.g. https://…/cli/authorize). */
-  verificationUri: z5.string(),
+  verificationUri: z10.string(),
   /** verificationUri with the code pre-filled, for one-click / QR. */
-  verificationUriComplete: z5.string(),
+  verificationUriComplete: z10.string(),
   /** Minimum seconds between polls. */
-  interval: z5.number().int().positive(),
+  interval: z10.number().int().positive(),
   /** Seconds until the device code expires. */
-  expiresIn: z5.number().int().positive(),
+  expiresIn: z10.number().int().positive(),
   /** Whether a magic-link email was dispatched (best-effort). */
-  emailSent: z5.boolean()
+  emailSent: z10.boolean()
 });
-var deviceTokenRequestSchema = z5.object({
-  deviceCode: z5.string().min(1)
+var deviceTokenRequestSchema = z10.object({
+  deviceCode: z10.string().min(1)
 });
-var deviceTokenApprovedSchema = z5.object({
-  status: z5.literal("approved"),
+var deviceTokenApprovedSchema = z10.object({
+  status: z10.literal("approved"),
   /** The `gauge_…` bearer secret. Store it now — never returned again. */
-  accessToken: z5.string(),
-  tokenType: z5.literal("bearer"),
+  accessToken: z10.string(),
+  tokenType: z10.literal("bearer"),
   /** ISO-8601 expiry, or null for no expiry. */
-  expiresAt: z5.string().nullable()
+  expiresAt: z10.string().nullable()
 });
-var deviceTokenResultSchema = z5.discriminatedUnion("status", [
+var deviceTokenResultSchema = z10.discriminatedUnion("status", [
   // Not yet approved — keep polling at `interval`.
-  z5.object({ status: z5.literal("pending") }),
+  z10.object({ status: z10.literal("pending") }),
   // Polled faster than `interval` — back off by `interval` seconds.
-  z5.object({ status: z5.literal("slow_down"), interval: z5.number().int() }),
+  z10.object({ status: z10.literal("slow_down"), interval: z10.number().int() }),
   // The user explicitly denied the request. Stop.
-  z5.object({ status: z5.literal("denied") }),
+  z10.object({ status: z10.literal("denied") }),
   // The device code expired or is unknown/already-redeemed. Stop and restart.
-  z5.object({ status: z5.literal("expired") }),
+  z10.object({ status: z10.literal("expired") }),
   deviceTokenApprovedSchema
 ]);
 
+// ../packages/api-schemas/src/experiments.ts
+import { z as z11 } from "zod";
+var contentExperimentIntentSchema = z11.object({
+  sourceRunId: z11.string().min(1),
+  problemText: z11.string().trim().min(1)
+});
+var EXPERIMENT_STATUSES = [
+  "DRAFT",
+  "GENERATING",
+  "RUNNING",
+  "SYNTHESIZING",
+  "COMPLETE",
+  "PARTIAL",
+  "FAILED",
+  "CANCELED"
+];
+var experimentStatusSchema = z11.enum(EXPERIMENT_STATUSES);
+var EXPERIMENT_ORIGINS = ["USER_NAMED", "DETECTED"];
+var experimentOriginSchema = z11.enum(EXPERIMENT_ORIGINS);
+var VARIANT_KINDS = ["CANDIDATE"];
+var variantKindSchema = z11.enum(VARIANT_KINDS);
+var SUPPORT_CLASSES = [
+  "RECOMMENDED",
+  "PROMISING",
+  "NOT_SUPPORTED",
+  "NOT_EVALUABLE"
+];
+var supportClassSchema = z11.enum(SUPPORT_CLASSES);
+var createExperimentBodySchema = contentExperimentIntentSchema.extend({
+  candidates: z11.number().int().optional(),
+  samples: z11.number().int().optional()
+});
+var launchExperimentBodySchema = z11.object({
+  samples: z11.number().int().optional()
+});
+var experimentListQuerySchema = z11.object({
+  status: experimentStatusSchema.optional(),
+  since: z11.string().optional(),
+  limit: z11.coerce.number().int().min(1).max(100).default(50)
+});
+var experimentSummarySchema = z11.object({
+  id: z11.string(),
+  status: experimentStatusSchema,
+  sourceRunId: z11.string(),
+  problemText: z11.string(),
+  origin: experimentOriginSchema,
+  cohortLabel: z11.string(),
+  createdAt: z11.string()
+});
+var experimentListResponseSchema = listResponseSchema(
+  experimentSummarySchema
+);
+var variantSummarySchema = z11.object({
+  id: z11.string(),
+  key: z11.string(),
+  kind: variantKindSchema,
+  title: z11.string(),
+  hypothesis: z11.string(),
+  supportClass: supportClassSchema.nullable(),
+  effect: z11.number().nullable(),
+  invalidReason: z11.string().nullable(),
+  batchId: z11.string().nullable()
+});
+var variantRefSchema = z11.object({
+  key: z11.string(),
+  title: z11.string(),
+  effect: z11.number().nullable(),
+  consistency: z11.string().nullable(),
+  note: z11.string().nullable()
+});
+var recommendationSchema = z11.object({
+  evaluatorVersion: z11.string(),
+  summary: z11.string(),
+  groups: z11.object({
+    recommended: z11.array(variantRefSchema),
+    promising: z11.array(variantRefSchema),
+    notSupported: z11.array(variantRefSchema),
+    notEvaluable: z11.array(variantRefSchema)
+  }),
+  tradeoffs: z11.array(z11.string())
+});
+var jsonValue = z11.unknown();
+var experimentDetailSchema = z11.object({
+  id: z11.string(),
+  status: experimentStatusSchema,
+  sourceRunId: z11.string(),
+  problemText: z11.string(),
+  origin: experimentOriginSchema,
+  evaluationContract: jsonValue,
+  recommendation: recommendationSchema.nullable(),
+  cohortLabel: z11.string(),
+  createdAt: z11.string(),
+  variants: z11.array(variantSummarySchema)
+});
+var createdExperimentSchema = z11.object({
+  id: z11.string(),
+  status: experimentStatusSchema,
+  cohortLabel: z11.string(),
+  sourceCheckpointId: z11.string().nullable(),
+  checkpointTurn: z11.number().int().nullable(),
+  contract: jsonValue,
+  variants: z11.array(
+    z11.object({
+      id: z11.string(),
+      key: z11.string(),
+      kind: variantKindSchema,
+      invalidReason: z11.string().nullable()
+    })
+  )
+});
+var plannedVariantSchema = z11.object({
+  key: z11.string(),
+  kind: variantKindSchema,
+  title: z11.string(),
+  hypothesis: z11.string(),
+  webFixtureSha256: z11.string(),
+  invalidReason: z11.string().nullable()
+});
+var experimentPlanSchema = z11.object({
+  sourceRunId: z11.string(),
+  organizationId: z11.string(),
+  problemText: z11.string(),
+  origin: experimentOriginSchema,
+  contract: jsonValue,
+  variants: z11.array(plannedVariantSchema),
+  samples: z11.number().int(),
+  estimatedForks: z11.number().int()
+});
+var launchResultSchema = z11.object({
+  experimentId: z11.string(),
+  forks: z11.array(
+    z11.object({
+      variantId: z11.string(),
+      key: z11.string(),
+      batchId: z11.string(),
+      runIds: z11.array(z11.string())
+    })
+  ),
+  skipped: z11.array(
+    z11.object({
+      variantId: z11.string(),
+      key: z11.string(),
+      reason: z11.string()
+    })
+  )
+});
+
 // ../packages/api-schemas/src/keys.ts
 var keys_exports = {};
 __export(keys_exports, {
@@ -400,69 +999,69 @@ __export(keys_exports, {
   setProviderKeyBodySchema: () => setProviderKeyBodySchema,
   setProviderKeyResponseSchema: () => setProviderKeyResponseSchema
 });
-import { z as z6 } from "zod";
+import { z as z12 } from "zod";
 var PROVIDER_TYPES = ["anthropic", "openai"];
-var providerTypeSchema = z6.enum(PROVIDER_TYPES);
-var setProviderKeyBodySchema = z6.object({
+var providerTypeSchema = z12.enum(PROVIDER_TYPES);
+var setProviderKeyBodySchema = z12.object({
   /** The raw provider API key. Verified + stored server-side (AWS Secrets
    *  Manager); never persisted in the app DB and never echoed back. */
-  key: z6.string().min(1)
+  key: z12.string().min(1)
 });
-var setProviderKeyResponseSchema = z6.object({
+var setProviderKeyResponseSchema = z12.object({
   providerType: providerTypeSchema,
-  last4: z6.string()
+  last4: z12.string()
 });
-var providerKeySchema = z6.object({
+var providerKeySchema = z12.object({
   providerType: providerTypeSchema,
-  last4: z6.string(),
-  createdAt: z6.string(),
+  last4: z12.string(),
+  createdAt: z12.string(),
   /** When the key was last saved/rotated. */
-  updatedAt: z6.string()
+  updatedAt: z12.string()
 });
 var providerKeyListResponseSchema = listResponseSchema(providerKeySchema);
 
 // ../packages/api-schemas/src/me.ts
-import { z as z7 } from "zod";
-var meUserSchema = z7.object({
-  id: z7.string(),
-  email: z7.string().nullable(),
-  isSuperuser: z7.boolean()
+import { z as z13 } from "zod";
+var meUserSchema = z13.object({
+  id: z13.string(),
+  email: z13.string().nullable(),
+  isSuperuser: z13.boolean()
 });
-var meOrgSchema = z7.object({
-  slug: z7.string(),
+var meOrgSchema = z13.object({
+  slug: z13.string(),
   // Gauge's immutable Organization.public_id; null for LOCAL orgs.
-  publicId: z7.string().nullable(),
-  name: z7.string()
+  publicId: z13.string().nullable(),
+  name: z13.string()
 });
-var meResponseSchema = z7.object({
+var meResponseSchema = z13.object({
   user: meUserSchema,
   // Membership-scoped for normal users; superusers see every org (mirrors the
   // web tier's userOrgs).
-  orgs: z7.array(meOrgSchema)
+  orgs: z13.array(meOrgSchema)
 });
 
 // ../packages/api-schemas/src/orgs.ts
-import { z as z8 } from "zod";
-var createOrgRequestSchema = z8.object({
+import { z as z14 } from "zod";
+var createOrgRequestSchema = z14.object({
   /** Workspace display name; the slug is derived server-side. */
-  name: z8.string().trim().min(1).max(200),
+  name: z14.string().trim().min(1).max(200),
   /** Optional company site (logo source; stamped onto the org). */
-  website: z8.string().trim().max(300).optional()
+  website: z14.string().trim().max(300).optional()
 });
-var createOrgResponseSchema = z8.object({
-  slug: z8.string(),
-  name: z8.string(),
+var createOrgResponseSchema = z14.object({
+  slug: z14.string(),
+  name: z14.string(),
   // LOCAL orgs never have a Gauge publicId.
-  publicId: z8.string().nullable()
+  publicId: z14.string().nullable()
 });
 
 // ../packages/api-schemas/src/prompts.ts
-import { z as z13 } from "zod";
+import { z as z19 } from "zod";
 
 // ../packages/api-schemas/src/schedules.ts
-import { z as z9 } from "zod";
+import { z as z15 } from "zod";
 var AGENTS = ["CLAUDE_CODE", "CODEX_CLI", "CURSOR"];
-var agentSchema = z9.enum(AGENTS);
+var agentSchema = z15.enum(AGENTS);
 var CADENCES = [
   "NONE",
   "DAILY",
@@ -470,104 +1069,152 @@ var CADENCES = [
   "MONTHLY",
   "DAYS_PER_WEEK"
 ];
-var cadenceSchema = z9.enum(CADENCES);
-var daysPerWeekSchema = z9.number().int().min(1).max(7);
-var scheduleRepoSchema = z9.object({
-  repoUrl: z9.string(),
-  /** Branch/ref; null = the repo's default branch. */
-  repoRef: z9.string().nullable()
-});
-var scheduleSchema = z9.object({
-  id: z9.string(),
-  name: z9.string(),
+var cadenceSchema = z15.enum(CADENCES);
+var daysPerWeekSchema = z15.number().int().min(1).max(7);
+var scheduleRepoSchema = z15.object({
+  repoUrl: z15.string().nullable(),
+  /** Branch/ref; null = the repo's default branch (always null for greenfield). */
+  repoRef: z15.string().nullable()
+});
+var scheduleAgentConfigSchema = z15.object({
+  agent: agentSchema,
+  models: z15.array(z15.string().min(1)).default([])
+});
+var scheduleAgentConfigInputSchema = z15.object({
+  agent: agentSchema,
+  models: z15.array(z15.string().min(1)).optional(),
+  model: z15.string().min(1).nullish()
+}).transform(({ agent, models, model }) => ({
+  agent,
+  models: models ?? (model ? [model] : [])
+}));
+var scheduleSchema = z15.object({
+  id: z15.string(),
+  name: z15.string(),
   cadence: cadenceSchema,
   /** Only set when cadence is DAYS_PER_WEEK (1–7). */
-  daysPerWeek: z9.number().int().nullable(),
-  samplesPerCycle: z9.number().int(),
-  agents: z9.array(agentSchema),
-  /** Pinned model id; null = the agent's default. */
-  model: z9.string().nullable(),
-  /** Repo targets in stable expansion order; empty = the default scaffold. */
-  repos: z9.array(scheduleRepoSchema),
+  daysPerWeek: z15.number().int().nullable(),
+  samplesPerCycle: z15.number().int(),
+  /** Authoritative per-agent configuration. */
+  agentConfigs: z15.array(scheduleAgentConfigSchema),
+  /** Deprecated compatibility projection of agentConfigs. */
+  agents: z15.array(agentSchema),
+  /** Deprecated: null for schedules with per-agent pins. */
+  model: z15.string().nullable(),
+  /** Repo targets in stable expansion order; empty = the default scaffold. A
+   *  null-repoUrl entry is greenfield alongside named repos. */
+  repos: z15.array(scheduleRepoSchema),
   /** Cohort label for experiment analysis; null outside labeled experiments. */
-  experiment: z9.string().nullable(),
-  enabled: z9.boolean(),
-  lastExpandedAt: z9.string().nullable(),
-  /** Member prompt ids, in stable expansion order. */
-  promptIds: z9.array(z9.string()),
-  promptCount: z9.number().int(),
-  createdAt: z9.string(),
-  updatedAt: z9.string()
+  experiment: z15.string().nullable(),
+  enabled: z15.boolean(),
+  lastExpandedAt: z15.string().nullable(),
+  /** Membership tag ids — the schedule runs the live union of these tags'
+   *  prompts (resolved at dispatch, not stored). */
+  tagIds: z15.array(z15.string()),
+  tagCount: z15.number().int(),
+  /** Persona matrix (ALG-155): member UserProfile ids, in stable expansion
+   *  order. Empty = the default, unconfigured HaikuJudge (no persona). */
+  profileIds: z15.array(z15.string()),
+  /** ALG-155.1: when profileIds is non-empty, also expand once per (prompt ×
+   *  repo) with no persona alongside the persona batches. Ignored when
+   *  profileIds is empty (always the implicit default judge). */
+  includeDefaultPersona: z15.boolean(),
+  createdAt: z15.string(),
+  updatedAt: z15.string()
 });
 var scheduleListResponseSchema = listResponseSchema(scheduleSchema);
-var scheduleRepoInputSchema = z9.object({
-  repoUrl: z9.string().min(1),
-  repoRef: z9.string().min(1).nullish()
+var scheduleRepoInputSchema = z15.object({
+  /** null/omitted = the greenfield scaffold as an explicit target. */
+  repoUrl: z15.string().min(1).nullish(),
+  repoRef: z15.string().min(1).nullish()
 });
-var createScheduleBodySchema = z9.object({
-  name: z9.string().min(1, "name is required"),
+var createScheduleBodyObject = z15.object({
+  name: z15.string().min(1, "name is required"),
   cadence: cadenceSchema.default("NONE"),
   daysPerWeek: daysPerWeekSchema.optional(),
-  samplesPerCycle: z9.number().int().min(1).default(1),
-  agents: z9.array(agentSchema).min(1, "Select at least one agent"),
-  model: z9.string().min(1).nullish(),
-  /** Repo targets; empty = the default scaffold (greenfield). */
-  repos: z9.array(scheduleRepoInputSchema).default([]),
-  /** Member prompt ids (resolved by the caller — tag→prompt resolution is a
-   *  UI-side authoring convenience, never stored). */
-  promptIds: z9.array(z9.string().min(1)).default([]),
-  enabled: z9.boolean().default(true)
-});
-var updateScheduleBodySchema = z9.object({
-  name: z9.string().min(1).optional(),
+  samplesPerCycle: z15.number().int().min(1).default(1),
+  /** Preferred paired representation (per-agent model tiers). */
+  agentConfigs: z15.array(scheduleAgentConfigInputSchema).min(1).optional(),
+  /** Legacy shared-model input, accepted during the API transition. */
+  agents: z15.array(agentSchema).min(1, "Select at least one agent").optional(),
+  model: z15.string().min(1).nullish(),
+  /** Repo targets; empty = the default scaffold (greenfield). Add a
+   *  null-repoUrl entry to run greenfield alongside named repos. */
+  repos: z15.array(scheduleRepoInputSchema).default([]),
+  /** Membership tag ids — the schedule runs the live union of these tags'
+   *  prompts (specs/schedules-tags-migration.md). Must belong to the org. */
+  tagIds: z15.array(z15.string().min(1)).default([]),
+  /** Persona matrix (ALG-155): member UserProfile ids. Empty/omitted = the
+   *  default, unconfigured HaikuJudge (no persona). */
+  profileIds: z15.array(z15.string().min(1)).default([]),
+  /** ALG-155.1: also expand once per (prompt × repo) with no persona
+   *  alongside the persona batches, when profileIds is non-empty. Ignored
+   *  when profileIds is empty. */
+  includeDefaultPersona: z15.boolean().default(false),
+  enabled: z15.boolean().default(true)
+});
+var createScheduleBodySchema = createScheduleBodyObject.refine(
+  (body) => body.agentConfigs !== void 0 || body.agents !== void 0,
+  {
+    message: "Select at least one agent (agentConfigs or agents)",
+    path: ["agentConfigs"]
+  }
+);
+var updateScheduleBodySchema = z15.object({
+  name: z15.string().min(1).optional(),
   cadence: cadenceSchema.optional(),
   daysPerWeek: daysPerWeekSchema.optional(),
-  samplesPerCycle: z9.number().int().min(1).optional(),
-  agents: z9.array(agentSchema).min(1, "Select at least one agent").optional(),
-  model: z9.string().min(1).nullish(),
-  repos: z9.array(scheduleRepoInputSchema).optional(),
-  promptIds: z9.array(z9.string().min(1)).optional(),
-  enabled: z9.boolean().optional()
-});
-var runScheduleResponseSchema = z9.object({
-  batchIds: z9.array(z9.string()),
-  runIds: z9.array(z9.string()),
-  blocked: z9.enum(["insufficient_credits", "needs_provider_key"]).optional(),
-  notReady: z9.array(
-    z9.object({
-      repoUrl: z9.string(),
-      status: z9.enum(["building", "failed", "none"])
+  samplesPerCycle: z15.number().int().min(1).optional(),
+  /** Full replacement of the enabled agent/model set (per-agent model tiers). */
+  agentConfigs: z15.array(scheduleAgentConfigInputSchema).min(1).optional(),
+  /** Legacy shared-model input, accepted during the API transition. */
+  agents: z15.array(agentSchema).min(1, "Select at least one agent").optional(),
+  model: z15.string().min(1).nullish(),
+  repos: z15.array(scheduleRepoInputSchema).optional(),
+  tagIds: z15.array(z15.string().min(1)).optional(),
+  profileIds: z15.array(z15.string().min(1)).optional(),
+  includeDefaultPersona: z15.boolean().optional(),
+  enabled: z15.boolean().optional()
+});
+var runScheduleResponseSchema = z15.object({
+  batchIds: z15.array(z15.string()),
+  runIds: z15.array(z15.string()),
+  blocked: z15.enum(["insufficient_credits", "needs_provider_key"]).optional(),
+  notReady: z15.array(
+    z15.object({
+      repoUrl: z15.string(),
+      status: z15.enum(["building", "failed", "none"])
     })
   ).optional()
 });
 
 // ../packages/api-schemas/src/tags.ts
-import { z as z10 } from "zod";
-var tagSchema = z10.object({
-  id: z10.string(),
-  name: z10.string(),
+import { z as z16 } from "zod";
+var tagSchema = z16.object({
+  id: z16.string(),
+  name: z16.string(),
   /** A Mantine palette name (e.g. "blue", "grape"); unknown values are
    *  normalized server-side to the default ("gray"). */
-  color: z10.string()
+  color: z16.string()
 });
-var createTagBodySchema = z10.object({
-  name: z10.string().min(1),
-  color: z10.string().optional()
+var createTagBodySchema = z16.object({
+  name: z16.string().min(1),
+  color: z16.string().optional()
 });
-var updateTagBodySchema = z10.object({
-  name: z10.string().min(1).optional(),
-  color: z10.string().optional()
+var updateTagBodySchema = z16.object({
+  name: z16.string().min(1).optional(),
+  color: z16.string().optional()
 });
 var tagListResponseSchema = listResponseSchema(tagSchema);
 
 // ../packages/api-schemas/src/topics.ts
-import { z as z11 } from "zod";
-var topicSchema = z11.object({
-  id: z11.string(),
-  name: z11.string()
+import { z as z17 } from "zod";
+var topicSchema = z17.object({
+  id: z17.string(),
+  name: z17.string()
 });
-var createTopicBodySchema = z11.object({
-  name: z11.string().min(1, "name is required")
+var createTopicBodySchema = z17.object({
+  name: z17.string().min(1, "name is required")
 });
 var topicListResponseSchema = listResponseSchema(topicSchema);
 
@@ -577,31 +1224,31 @@ __export(web_fixtures_exports, {
   MAX_WEB_FIXTURE_BYTES: () => MAX_WEB_FIXTURE_BYTES,
   webFixtureSchema: () => webFixtureSchema
 });
-import { z as z12 } from "zod";
+import { z as z18 } from "zod";
 var MAX_WEB_FIXTURE_BYTES = 1e6;
 function withoutFragment(raw) {
   const fragment = raw.indexOf("#");
   return fragment === -1 ? raw : raw.slice(0, fragment);
 }
-var searchResultSchema = z12.object({
-  title: z12.string().min(1),
-  url: z12.url().transform(withoutFragment),
-  snippet: z12.string()
-});
-var searchFixtureSchema = z12.object({
-  query: z12.string().trim().min(1),
-  results: z12.array(searchResultSchema)
-});
-var pageFixtureSchema = z12.object({
-  url: z12.url().transform(withoutFragment),
-  status: z12.int().min(100).max(599).default(200),
-  contentType: z12.string().trim().min(1).default("text/html"),
-  body: z12.string()
-});
-var webFixtureSchema = z12.object({
-  version: z12.literal(1),
-  searches: z12.array(searchFixtureSchema).default([]),
-  pages: z12.array(pageFixtureSchema).default([])
+var searchResultSchema = z18.object({
+  title: z18.string().min(1),
+  url: z18.url().transform(withoutFragment),
+  snippet: z18.string()
+});
+var searchFixtureSchema = z18.object({
+  query: z18.string().trim().min(1),
+  results: z18.array(searchResultSchema)
+});
+var pageFixtureSchema = z18.object({
+  url: z18.url().transform(withoutFragment),
+  status: z18.int().min(100).max(599).default(200),
+  contentType: z18.string().trim().min(1).default("text/html"),
+  body: z18.string()
+});
+var webFixtureSchema = z18.object({
+  version: z18.literal(1),
+  searches: z18.array(searchFixtureSchema).default([]),
+  pages: z18.array(pageFixtureSchema).default([])
 }).superRefine((fixture, ctx) => {
   const queries = /* @__PURE__ */ new Set();
   fixture.searches.forEach((entry, index) => {
@@ -635,290 +1282,118 @@ var webFixtureSchema = z12.object({
 });
 
 // ../packages/api-schemas/src/prompts.ts
-var SCENARIOS = ["GREENFIELD", "MIGRATION"];
-var scenarioSchema = z13.enum(SCENARIOS);
-var promptSummarySchema = z13.object({
-  id: z13.string(),
-  text: z13.string(),
-  scenario: scenarioSchema,
-  isBranded: z13.boolean(),
+var promptSummarySchema = z19.object({
+  id: z19.string(),
+  text: z19.string(),
+  isBranded: z19.boolean(),
   /** Battery-spec identity (idempotent applies); null for UI/CLI-created prompts. */
-  externalKey: z13.string().nullable(),
+  externalKey: z19.string().nullable(),
   topic: topicSchema.nullable(),
-  tags: z13.array(tagSchema),
-  scheduleCount: z13.number().int(),
-  createdAt: z13.string()
+  tags: z19.array(tagSchema),
+  scheduleCount: z19.number().int(),
+  createdAt: z19.string()
 });
-var promptScheduleRefSchema = z13.object({
-  id: z13.string(),
-  name: z13.string(),
+var promptScheduleRefSchema = z19.object({
+  id: z19.string(),
+  name: z19.string(),
   cadence: cadenceSchema,
-  daysPerWeek: z13.number().int().nullable(),
-  enabled: z13.boolean()
+  daysPerWeek: z19.number().int().nullable(),
+  enabled: z19.boolean()
 });
 var promptDetailSchema = promptSummarySchema.extend({
-  schedules: z13.array(promptScheduleRefSchema)
+  schedules: z19.array(promptScheduleRefSchema)
 });
 var promptListResponseSchema = listResponseSchema(promptSummarySchema);
 var listPromptsQuerySchema = listQuerySchema.extend({
-  topic: z13.string().min(1).optional(),
-  tag: z13.string().min(1).optional(),
-  q: z13.string().min(1).optional()
-});
-var createPromptBodySchema = z13.object({
-  text: z13.string().min(1, "text is required"),
-  scenario: scenarioSchema.default("GREENFIELD"),
-  isBranded: z13.boolean().default(false),
-  topic: z13.string().min(1).optional(),
-  tags: z13.array(z13.string().min(1)).default([])
-});
-var updatePromptBodySchema = z13.object({
-  text: z13.string().min(1).optional(),
-  isBranded: z13.boolean().optional(),
-  topicId: z13.string().min(1).nullish(),
-  tags: z13.array(z13.string().min(1)).optional()
-});
-var runPromptBodySchema = z13.object({
-  agents: z13.array(agentSchema).min(1, "Select at least one agent").default(["CLAUDE_CODE", "CODEX_CLI"]),
-  repoUrl: z13.string().min(1).nullish(),
-  repoRef: z13.string().min(1).nullish(),
-  samplesPerCycle: z13.number().int().min(1).max(10).default(1),
-  webFixture: webFixtureSchema.optional()
-});
-var runPromptResponseSchema = z13.object({
-  batchIds: z13.array(z13.string()),
-  runIds: z13.array(z13.string())
-});
-
-// ../packages/api-schemas/src/query.ts
-import { z as z15 } from "zod";
-
-// ../packages/api-schemas/src/stats.ts
-import { z as z14 } from "zod";
-var BRAND_KINDS2 = ["OWNED", "COMPETITOR", "OTHER"];
-var brandKindSchema2 = z14.enum(BRAND_KINDS2);
-var brandRankingSchema = z14.object({
-  rank: z14.number().int(),
-  brandId: z14.string(),
-  brandName: z14.string(),
-  kind: brandKindSchema2,
-  installs: z14.number().int(),
-  installRate: z14.number(),
-  mentionRate: z14.number(),
-  /** Movement between the two most recent batch windows; null if not ranked in both. */
-  deltaRank: z14.number().int().nullable()
-});
-var packageRateSchema = z14.object({
-  ecosystem: z14.string(),
-  name: z14.string(),
-  brandName: z14.string().optional(),
-  kind: brandKindSchema2.optional(),
-  installs: z14.number().int(),
-  rate: z14.number()
-});
-var brandRateSchema = z14.object({
-  brandId: z14.string(),
-  brandName: z14.string(),
-  kind: brandKindSchema2,
-  installs: z14.number().int(),
-  rate: z14.number()
-});
-var brandFunnelRowSchema = z14.object({
-  brandId: z14.string(),
-  brandName: z14.string(),
-  kind: brandKindSchema2,
-  mentionRate: z14.number(),
-  installRate: z14.number()
-});
-var domainRateSchema = z14.object({
-  domain: z14.string(),
-  runs: z14.number().int(),
-  rate: z14.number(),
-  requests: z14.number().int(),
-  brandName: z14.string().optional(),
-  owned: z14.boolean().optional()
-});
-var statsFreshnessSchema = z14.object({
-  /** Newest run-ingest time across the org (ISO), or null if nothing ingested. */
-  watermark: z14.string().nullable(),
-  /** Runs that succeeded recently but haven't landed in the warehouse yet. */
-  pending: z14.number().int(),
-  /** False when the freshness read itself failed (distinguish from genuine zero). */
-  available: z14.boolean()
-});
-var statsResponseSchema = (item) => z14.object({ items: z14.array(item), freshness: statsFreshnessSchema });
-var rankingsResponseSchema = statsResponseSchema(brandRankingSchema);
-var installsResponseSchema = statsResponseSchema(packageRateSchema);
-var brandsResponseSchema = statsResponseSchema(brandRateSchema);
-var funnelResponseSchema = statsResponseSchema(brandFunnelRowSchema);
-var domainsResponseSchema = statsResponseSchema(domainRateSchema);
-
-// ../packages/api-schemas/src/query.ts
-var DATASETS = [
-  "runs",
-  "installs",
-  "mentions",
-  "web",
-  "network",
-  "files",
-  "tokens"
-];
-var datasetSchema = z15.enum(DATASETS);
-var WHERE_OPS = [
-  "eq",
-  "neq",
-  "in",
-  "notIn",
-  "contains",
-  "gt",
-  "gte",
-  "lt",
-  "lte"
-];
-var whereOpSchema = z15.enum(WHERE_OPS);
-var GRANULARITIES = ["day", "week", "month"];
-var granularitySchema = z15.enum(GRANULARITIES);
-var DEFAULT_QUERY_LIMIT = 50;
-var MAX_QUERY_LIMIT = 1e3;
-var scalar = z15.union([z15.string(), z15.number(), z15.boolean()]);
-var whereClauseSchema = z15.object({
-  dimension: z15.string().min(1),
-  op: whereOpSchema,
-  value: z15.union([scalar, z15.array(scalar)])
-});
-var queryFiltersSchema = z15.object({
-  prompt: z15.string(),
-  topic: z15.array(z15.string()),
-  tag: z15.array(z15.string()),
-  repo: z15.array(z15.string()),
-  language: z15.array(z15.string()),
-  framework: z15.array(z15.string()),
-  size: z15.array(z15.string()),
-  agent: z15.array(z15.string()),
-  model: z15.array(z15.string()),
-  scenario: z15.array(z15.string()),
-  experiment: z15.array(z15.string()),
-  branded: z15.boolean()
-}).partial();
-var dateRangeSchema = z15.object({
-  since: z15.string(),
-  until: z15.string(),
-  lastDays: z15.number().int().positive()
-}).partial();
-var orderBySchema = z15.object({
-  /** A selected dimension or metric name. */
-  key: z15.string().min(1),
-  dir: z15.enum(["asc", "desc"]).default("desc")
+  topic: z19.string().min(1).optional(),
+  tag: z19.string().min(1).optional(),
+  q: z19.string().min(1).optional()
 });
-var querySpecSchema = z15.object({
-  dataset: datasetSchema.default("runs"),
-  dimensions: z15.array(z15.string()).default([]),
-  metrics: z15.array(z15.string()).min(1, "at least one metric is required"),
-  filters: queryFiltersSchema.default({}),
-  where: z15.array(whereClauseSchema).default([]),
-  dateRange: dateRangeSchema.optional(),
-  orderBy: z15.array(orderBySchema).default([]),
-  limit: z15.number().int().min(1).max(MAX_QUERY_LIMIT).default(DEFAULT_QUERY_LIMIT),
-  granularity: granularitySchema.default("day"),
-  /** When true, the response echoes the compiled SQL (params bound, not inlined). */
-  explain: z15.boolean().default(false)
-});
-var columnKindSchema = z15.enum(["dimension", "metric"]);
-var queryColumnSchema = z15.object({
-  key: z15.string(),
-  kind: columnKindSchema
-});
-var queryRowSchema = z15.record(
-  z15.string(),
-  z15.union([z15.string(), z15.number(), z15.boolean(), z15.null()])
-);
-var queryResponseSchema = z15.object({
-  columns: z15.array(queryColumnSchema),
-  rows: z15.array(queryRowSchema),
-  /** Present only when the request set explain=true. */
-  sql: z15.string().optional(),
-  freshness: statsFreshnessSchema
+var createPromptBodySchema = z19.object({
+  text: z19.string().min(1, "text is required"),
+  isBranded: z19.boolean().default(false),
+  topic: z19.string().min(1).optional(),
+  tags: z19.array(z19.string().min(1)).default([])
 });
-var fieldTypeSchema = z15.enum([
-  "string",
-  "number",
-  "rate",
-  "date",
-  "boolean"
-]);
-var fieldSchema = z15.object({
-  name: z15.string(),
-  type: fieldTypeSchema,
-  /** One-line human/agent hint. */
-  description: z15.string().optional()
+var updatePromptBodySchema = z19.object({
+  text: z19.string().min(1).optional(),
+  isBranded: z19.boolean().optional(),
+  topicId: z19.string().min(1).nullish(),
+  tags: z19.array(z19.string().min(1)).optional()
 });
-var datasetMetaSchema = z15.object({
-  name: datasetSchema,
-  grain: z15.string(),
-  dimensions: z15.array(fieldSchema),
-  metrics: z15.array(fieldSchema)
+var runPromptBodySchema = z19.object({
+  /** Preferred paired representation; each agent may pin its own model tiers. */
+  agentConfigs: z19.array(scheduleAgentConfigInputSchema).min(1).optional(),
+  /** Legacy agent set (no per-agent pins), kept during the API transition. */
+  agents: z19.array(agentSchema).min(1, "Select at least one agent").default(["CLAUDE_CODE", "CODEX_CLI"]),
+  repoUrl: z19.string().min(1).nullish(),
+  repoRef: z19.string().min(1).nullish(),
+  samplesPerCycle: z19.number().int().min(1).max(10).default(1),
+  webFixture: webFixtureSchema.optional()
 });
-var metadataResponseSchema = z15.object({
-  datasets: z15.array(datasetMetaSchema)
+var runPromptResponseSchema = z19.object({
+  batchIds: z19.array(z19.string()),
+  runIds: z19.array(z19.string()),
+  blocked: z19.enum(["insufficient_credits", "needs_provider_key"]).optional()
 });
 
 // ../packages/api-schemas/src/repos.ts
-import { z as z16 } from "zod";
+import { z as z20 } from "zod";
 var REPO_SIZE_BUCKETS = [
   "small",
   "medium",
   "large",
   "xlarge"
 ];
-var repoSizeBucketSchema = z16.enum(REPO_SIZE_BUCKETS);
-var repoSchema = z16.object({
-  url: z16.string(),
-  name: z16.string(),
-  isSystem: z16.boolean(),
-  languages: z16.array(z16.string()),
-  frameworks: z16.array(z16.string()),
+var repoSizeBucketSchema = z20.enum(REPO_SIZE_BUCKETS);
+var repoSchema = z20.object({
+  url: z20.string(),
+  name: z20.string(),
+  isSystem: z20.boolean(),
+  languages: z20.array(z20.string()),
+  frameworks: z20.array(z20.string()),
   /** Faceted labels (complexity:L2, buildable:yes, stack:nextjs, …). */
-  tags: z16.array(z16.string()),
-  primaryLanguage: z16.string(),
-  sizeKb: z16.number(),
+  tags: z20.array(z20.string()),
+  primaryLanguage: z20.string(),
+  sizeKb: z20.number(),
   sizeBucket: repoSizeBucketSchema.nullable(),
-  stars: z16.number()
+  stars: z20.number()
 });
 var repoListResponseSchema = listResponseSchema(repoSchema);
-var addRepoBodySchema = z16.object({
-  url: z16.string().min(1, "url is required"),
+var addRepoBodySchema = z20.object({
+  url: z20.string().min(1, "url is required"),
   /**
    * Reserved (accepted, not yet persisted): the catalog keys repos by URL only
    * — `fact_repo` has no ref column and metadata sync always reads the default
    * branch. Kept in the wire format so `gauge repos add --ref` is stable once
    * the catalog learns refs.
    */
-  ref: z16.string().min(1).optional(),
+  ref: z20.string().min(1).optional(),
   /** Display name; defaults to the `owner/repo` label of the URL. */
-  name: z16.string().min(1).optional(),
+  name: z20.string().min(1).optional(),
   /** Manual override; defaults to frameworks detected from the repo's manifests. */
-  frameworks: z16.array(z16.string()).optional(),
-  tags: z16.array(z16.string()).optional()
+  frameworks: z20.array(z20.string()).optional(),
+  tags: z20.array(z20.string()).optional()
 });
-var updateRepoBodySchema = z16.object({
-  url: z16.string().min(1, "url is required"),
-  name: z16.string().min(1).optional(),
-  frameworks: z16.array(z16.string()).optional(),
-  tags: z16.array(z16.string()).optional()
+var updateRepoBodySchema = z20.object({
+  url: z20.string().min(1, "url is required"),
+  name: z20.string().min(1).optional(),
+  frameworks: z20.array(z20.string()).optional(),
+  tags: z20.array(z20.string()).optional()
 });
-var resyncRepoBodySchema = z16.object({
-  url: z16.string().min(1, "url is required")
+var resyncRepoBodySchema = z20.object({
+  url: z20.string().min(1, "url is required")
 });
-var deleteRepoQuerySchema = z16.object({
-  url: z16.string().min(1, "url is required")
+var deleteRepoQuerySchema = z20.object({
+  url: z20.string().min(1, "url is required")
 });
-var repoSyncResultSchema = z16.object({
+var repoSyncResultSchema = z20.object({
   repo: repoSchema,
-  synced: z16.boolean()
+  synced: z20.boolean()
 });
 
 // ../packages/api-schemas/src/runs.ts
-import { z as z17 } from "zod";
+import { z as z21 } from "zod";
 var RUN_STATUSES = [
   "QUEUED",
   "CLAIMED",
@@ -929,69 +1404,104 @@ var RUN_STATUSES = [
   "TIMED_OUT",
   "CANCELED"
 ];
-var runStatusSchema = z17.enum(RUN_STATUSES);
+var runStatusSchema = z21.enum(RUN_STATUSES);
 var AGENTS2 = ["CLAUDE_CODE", "CODEX_CLI", "CURSOR"];
-var agentSchema2 = z17.enum(AGENTS2);
-var runStatusFilterSchema = z17.string().transform(
+var agentSchema2 = z21.enum(AGENTS2);
+var runStatusFilterSchema = z21.string().transform(
   (raw) => raw.split(",").map((s) => s.trim().toUpperCase()).filter(Boolean)
-).pipe(z17.array(runStatusSchema).min(1));
+).pipe(z21.array(runStatusSchema).min(1));
 var runListQuerySchema = listQuerySchema.extend({
   status: runStatusFilterSchema.optional(),
-  batch: z17.string().optional(),
-  prompt: z17.string().optional(),
-  experiment: z17.string().optional(),
-  since: z17.string().optional()
+  batch: z21.string().optional(),
+  prompt: z21.string().optional(),
+  experiment: z21.string().optional(),
+  since: z21.string().optional()
 });
-var runListItemSchema = z17.object({
-  id: z17.string(),
+var runListItemSchema = z21.object({
+  id: z21.string(),
   status: runStatusSchema,
   agent: agentSchema2,
-  model: z17.string(),
-  promptId: z17.string(),
+  model: z21.string(),
+  promptId: z21.string(),
   /** First ~80 chars of the batch's prompt snapshot, whitespace-collapsed. */
-  promptSnippet: z17.string(),
-  batchId: z17.string(),
-  experiment: z17.string().nullable(),
-  turns: z17.number().int().nullable(),
-  usdCost: z17.number().nullable(),
-  durationMs: z17.number().int().nullable(),
-  exitReason: z17.string().nullable(),
-  createdAt: z17.string(),
-  startedAt: z17.string().nullable(),
-  finishedAt: z17.string().nullable()
+  promptSnippet: z21.string(),
+  batchId: z21.string(),
+  experiment: z21.string().nullable(),
+  turns: z21.number().int().nullable(),
+  usdCost: z21.number().nullable(),
+  durationMs: z21.number().int().nullable(),
+  exitReason: z21.string().nullable(),
+  createdAt: z21.string(),
+  startedAt: z21.string().nullable(),
+  finishedAt: z21.string().nullable(),
+  /** Fork lineage (fork-simulations WS1): the source run this was forked from,
+   *  or null for an organic run. Forks are excluded from aggregate analytics but
+   *  kept visible; consumers badge on these fields. */
+  parentRunId: z21.string().nullable(),
+  /** Set when this run is a fetch-fork simulation variant (injected web
+   *  content); null otherwise. Distinguishes a "Simulation" badge from a plain
+   *  conversation fork. */
+  fetchForkPlanId: z21.string().nullable()
 });
 var runListResponseSchema = listResponseSchema(runListItemSchema);
 var runDetailSchema = runListItemSchema.omit({ promptSnippet: true }).extend({
-  promptText: z17.string(),
-  attempt: z17.number().int(),
-  cancelRequested: z17.boolean(),
-  failureReason: z17.string().nullable(),
-  repoUrl: z17.string().nullable(),
-  repoRef: z17.string().nullable(),
-  scenario: z17.string(),
-  funding: z17.string(),
+  promptText: z21.string(),
+  attempt: z21.number().int(),
+  cancelRequested: z21.boolean(),
+  failureReason: z21.string().nullable(),
+  repoUrl: z21.string().nullable(),
+  repoRef: z21.string().nullable(),
+  scenario: z21.string(),
+  funding: z21.string(),
   /** Raw harness usage write-back (token counts etc.); shape may evolve. */
-  usage: z17.unknown().nullable(),
+  usage: z21.unknown().nullable(),
   /** Artifact pointer: a working-tree diff exists at GET /runs/{id}/diff. */
-  hasDiff: z17.boolean(),
-  claimedAt: z17.string().nullable()
+  hasDiff: z21.boolean(),
+  claimedAt: z21.string().nullable()
 });
-var cancelRunResponseSchema = z17.object({
-  id: z17.string(),
+var cancelRunResponseSchema = z21.object({
+  id: z21.string(),
   status: runStatusSchema,
-  cancelRequested: z17.boolean(),
-  note: z17.string().optional()
+  cancelRequested: z21.boolean(),
+  note: z21.string().optional()
+});
+var forkRunBodySchema = z21.object({
+  prompt: z21.string().trim().min(1).max(2e4),
+  turn: z21.number().int().min(0).optional(),
+  webFixture: webFixtureSchema.optional()
 });
-var forkRunBodySchema = z17.object({
-  prompt: z17.string().trim().min(1).max(2e4),
-  turn: z17.number().int().min(0).optional()
+var forkRunResponseSchema = z21.object({
+  runId: z21.string(),
+  batchId: z21.string(),
+  parentRunId: z21.string(),
+  checkpointId: z21.string(),
+  turn: z21.number().int().min(0)
 });
-var forkRunResponseSchema = z17.object({
-  runId: z17.string(),
-  batchId: z17.string(),
-  parentRunId: z17.string(),
-  checkpointId: z17.string(),
-  turn: z17.number().int().min(0)
+var fetchForkAtFetchBodySchema = z21.object({
+  boundarySeq: z21.string().min(1),
+  injectedContent: z21.string(),
+  prompts: z21.array(z21.string()).min(1)
+});
+var fetchForkAtFetchResponseSchema = z21.object({
+  planId: z21.string()
+});
+var fetchForkPlanStatusSchema = z21.enum([
+  "DRAFT",
+  "SURGERY_RUNNING",
+  "SURGERY_READY",
+  "FORKED",
+  "FAILED"
+]);
+var fetchForkPlanResponseSchema = z21.object({
+  id: z21.string(),
+  status: fetchForkPlanStatusSchema,
+  boundaryUrl: z21.string(),
+  boundaryTurn: z21.number().int(),
+  prompts: z21.array(z21.string()),
+  surgicalCheckpointId: z21.string().nullable(),
+  forkBatchId: z21.string().nullable(),
+  errorText: z21.string().nullable(),
+  forkedRunIds: z21.array(z21.string())
 });
 var RUN_INSIGHT_STATUSES = [
   "PENDING",
@@ -1000,72 +1510,72 @@ var RUN_INSIGHT_STATUSES = [
   "FAILED",
   "SKIPPED"
 ];
-var runInsightStatusSchema = z17.enum(RUN_INSIGHT_STATUSES);
-var insightPassSchema = z17.object({
+var runInsightStatusSchema = z21.enum(RUN_INSIGHT_STATUSES);
+var insightPassSchema = z21.object({
   status: runInsightStatusSchema,
-  model: z17.string().nullable(),
-  inputTokens: z17.number().int().nullable(),
-  outputTokens: z17.number().int().nullable(),
-  usdCost: z17.number().nullable(),
-  error: z17.string().nullable()
-});
-var runDecisionSchema = z17.object({
-  index: z17.number().int(),
-  category: z17.string(),
-  categoryRaw: z17.string().nullable(),
-  chosenName: z17.string(),
-  chosenEcosystem: z17.string().nullable(),
-  chosenPackage: z17.string().nullable(),
-  reversed: z17.boolean(),
-  detail: z17.unknown()
-});
-var runImplementationSchema = z17.object({
-  brandName: z17.string(),
-  ecosystem: z17.string().nullable(),
-  package: z17.string().nullable(),
-  verdict: z17.string(),
-  docConsulted: z17.boolean(),
-  detail: z17.unknown()
-});
-var runInsightResponseSchema = z17.object({
-  runId: z17.string(),
+  model: z21.string().nullable(),
+  inputTokens: z21.number().int().nullable(),
+  outputTokens: z21.number().int().nullable(),
+  usdCost: z21.number().nullable(),
+  error: z21.string().nullable()
+});
+var runDecisionSchema = z21.object({
+  index: z21.number().int(),
+  category: z21.string(),
+  categoryRaw: z21.string().nullable(),
+  chosenName: z21.string(),
+  chosenEcosystem: z21.string().nullable(),
+  chosenPackage: z21.string().nullable(),
+  reversed: z21.boolean(),
+  detail: z21.unknown()
+});
+var runImplementationSchema = z21.object({
+  brandName: z21.string(),
+  ecosystem: z21.string().nullable(),
+  package: z21.string().nullable(),
+  verdict: z21.string(),
+  docConsulted: z21.boolean(),
+  detail: z21.unknown()
+});
+var runInsightResponseSchema = z21.object({
+  runId: z21.string(),
   decision: insightPassSchema,
   implementation: insightPassSchema,
-  decisions: z17.array(runDecisionSchema),
-  implementations: z17.array(runImplementationSchema)
+  decisions: z21.array(runDecisionSchema),
+  implementations: z21.array(runImplementationSchema)
 });
-var runEventSchema = z17.looseObject({
-  run_id: z17.string(),
-  seq: z17.number(),
-  turn: z17.number(),
-  ts: z17.string(),
-  type: z17.string()
+var runEventSchema = z21.looseObject({
+  run_id: z21.string(),
+  seq: z21.number(),
+  turn: z21.number(),
+  ts: z21.string(),
+  type: z21.string()
 });
 
 // ../packages/api-schemas/src/tokens.ts
-import { z as z18 } from "zod";
-var apiTokenSchema = z18.object({
-  id: z18.string(),
-  name: z18.string(),
+import { z as z22 } from "zod";
+var apiTokenSchema = z22.object({
+  id: z22.string(),
+  name: z22.string(),
   /** Last 4 chars of the plaintext, for recognizability (non-secret). */
-  last4: z18.string(),
-  expiresAt: z18.iso.datetime().nullable(),
-  lastUsedAt: z18.iso.datetime().nullable(),
-  createdAt: z18.iso.datetime(),
-  revokedAt: z18.iso.datetime().nullable()
-});
-var createTokenRequestSchema = z18.object({
-  name: z18.string().min(1).max(100),
+  last4: z22.string(),
+  expiresAt: z22.iso.datetime().nullable(),
+  lastUsedAt: z22.iso.datetime().nullable(),
+  createdAt: z22.iso.datetime(),
+  revokedAt: z22.iso.datetime().nullable()
+});
+var createTokenRequestSchema = z22.object({
+  name: z22.string().min(1).max(100),
   /** ISO-8601 datetime; omit for no expiry. */
-  expiresAt: z18.iso.datetime({ offset: true }).optional()
+  expiresAt: z22.iso.datetime({ offset: true }).optional()
 });
 var createTokenResponseSchema = apiTokenSchema.extend({
-  token: z18.string()
+  token: z22.string()
 });
 var listTokensResponseSchema = listResponseSchema(apiTokenSchema);
 
 // src/commands/apply.ts
-import { z as z19 } from "zod";
+import { z as z23 } from "zod";
 
 // src/version.ts
 import { createRequire } from "module";
@@ -1400,13 +1910,11 @@ var EXAMPLE_SPEC = {
   prompts: [
     {
       key: "add-healthcheck",
-      text: "Add a /health endpoint that returns 200 OK.",
-      scenario: "GREENFIELD"
+      text: "Add a /health endpoint that returns 200 OK."
     },
     {
       key: "migrate-to-vitest",
       text: "Migrate the test suite from Jest to Vitest.",
-      scenario: "MIGRATION",
       schedules: [
         {
           repoUrl: "https://github.com/acme/api",
@@ -1515,7 +2023,7 @@ function register(program2) {
   ).option("-f, --file <path>", "battery spec JSON file").option("--dry-run", "print the plan without applying").option("--schema", "print the battery spec JSON Schema and exit").option("--example", "print a minimal example battery spec and exit").action(
     async (opts, command) => {
       if (opts.schema) {
-        printJson(z19.toJSONSchema(batteries_exports.batterySpecSchema));
+        printJson(z23.toJSONSchema(batteries_exports.batterySpecSchema));
         return;
       }
       if (opts.example) {
@@ -1553,12 +2061,15 @@ function register(program2) {
 var auth_exports = {};
 __export(auth_exports, {
   deviceLogin: () => deviceLogin,
+  parseLoopbackCallback: () => parseLoopbackCallback,
+  readStdin: () => readStdin,
   register: () => register2
 });
 import { spawn } from "child_process";
-import { randomBytes } from "crypto";
+import { createHash, randomBytes } from "crypto";
 import { createServer } from "http";
 import { hostname } from "os";
+import { createInterface } from "readline";
 import { setTimeout as sleep } from "timers/promises";
 
 // src/lib/paginate.ts
@@ -1580,7 +2091,6 @@ async function fetchAllPages(client, path, query = {}) {
 // src/commands/auth.ts
 var LOGIN_TIMEOUT_MS = 2 * 60 * 1e3;
 var TOKEN_PREFIX = "gauge_";
-var MAX_CALLBACK_BODY_BYTES = 16 * 1024;
 function tokenSource() {
   if (process.env.GAUGE_API_TOKEN?.trim()) return "env";
   return resolveToken() ? "file" : "none";
@@ -1588,6 +2098,13 @@ function tokenSource() {
 async function fetchMe(client) {
   return client.get("/api/v1/me");
 }
+function parseLoopbackCallback(rawUrl, expectedState) {
+  const url = new URL(rawUrl ?? "/", "http://127.0.0.1");
+  if (url.pathname !== "/callback") return null;
+  const code = url.searchParams.get("code");
+  if (url.searchParams.get("state") !== expectedState || !code) return null;
+  return code;
+}
 function printIdentity(me) {
   const orgs = me.orgs.map((o) => o.slug).join(", ") || "(none)";
   const su = me.user.isSuperuser ? " (superuser)" : "";
@@ -1609,63 +2126,33 @@ function openBrowser(url) {
 }
 async function browserLogin() {
   const state = randomBytes(16).toString("base64url");
+  const codeVerifier = randomBytes(32).toString("base64url");
+  const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
   const server = createServer();
-  const tokenPromise = new Promise((resolve, reject) => {
+  const codePromise = new Promise((resolve, reject) => {
     server.on("request", (req, res) => {
       const url = new URL(req.url ?? "/", "http://127.0.0.1");
       if (url.pathname !== "/callback") {
         res.writeHead(404).end();
         return;
       }
-      if (req.method === "OPTIONS") {
-        res.writeHead(204, {
-          "access-control-allow-origin": "*",
-          "access-control-allow-methods": "POST",
-          "access-control-allow-headers": "content-type",
-          "access-control-allow-private-network": "true"
-        }).end();
+      if (req.method !== "GET") {
+        res.writeHead(405, { allow: "GET" }).end();
         return;
       }
-      if (req.method !== "POST") {
-        res.writeHead(405, { allow: "POST" }).end();
+      const code = parseLoopbackCallback(req.url, state);
+      if (!code) {
+        res.writeHead(400, {
+          "content-type": "text/plain; charset=utf-8"
+        });
+        res.end("Invalid callback. Retry gauge auth login.");
         return;
       }
-      let body = "";
-      let overflowed = false;
-      req.on("data", (chunk) => {
-        if (overflowed) return;
-        body += chunk;
-        if (body.length > MAX_CALLBACK_BODY_BYTES) {
-          overflowed = true;
-          body = "";
-          res.writeHead(413, {
-            "content-type": "text/plain; charset=utf-8",
-            "access-control-allow-origin": "*"
-          });
-          res.end("Callback body too large.");
-        }
-      });
-      req.on("end", () => {
-        if (overflowed) return;
-        const params = new URLSearchParams(body);
-        const token = params.get("token");
-        if (params.get("state") !== state || !token) {
-          res.writeHead(400, {
-            "content-type": "text/plain; charset=utf-8",
-            "access-control-allow-origin": "*"
-          });
-          res.end(
-            "Invalid callback (state mismatch). Retry `gauge auth login`."
-          );
-          return;
-        }
-        res.writeHead(200, {
-          "content-type": "text/plain; charset=utf-8",
-          "access-control-allow-origin": "*"
-        });
-        res.end("Authorized \u2014 return to your terminal.");
-        resolve(token);
+      res.writeHead(200, {
+        "content-type": "text/plain; charset=utf-8"
       });
+      res.end("Authorized. Return to your terminal.");
+      resolve(code);
     });
     server.on(
       "error",
@@ -1685,27 +2172,46 @@ async function browserLogin() {
   authorizeUrl.searchParams.set("port", String(address.port));
   authorizeUrl.searchParams.set("state", state);
   authorizeUrl.searchParams.set("name", hostname() || "this device");
+  authorizeUrl.searchParams.set("code_challenge", codeChallenge);
+  authorizeUrl.searchParams.set("code_challenge_method", "S256");
   console.log("Opening your browser to authorize the Gauge CLI\u2026");
   console.log(`If it doesn't open, visit:
 
   ${authorizeUrl}
 `);
+  console.log("Waiting for browser authorization\u2026");
+  console.log(
+    "No local network access or using SSH? Re-run with gauge auth login --device."
+  );
   openBrowser(authorizeUrl.toString());
   let timer;
   try {
-    const token = await Promise.race([
-      tokenPromise,
+    const code = await Promise.race([
+      codePromise,
       new Promise((_, reject) => {
         timer = setTimeout(() => {
           reject(
             new CliError(
               "network",
-              "Timed out waiting for browser authorization (2 minutes). Retry, or use `gauge auth login --with-token`."
+              "Timed out waiting for browser authorization (2 minutes). Retry, or use gauge auth login --device."
             )
           );
         }, LOGIN_TIMEOUT_MS);
       })
     ]);
+    const raw = await bootstrapPost("/api/v1/cli/token", {
+      code,
+      codeVerifier
+    });
+    const parsed = cliAuthorizationTokenResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        "internal",
+        "Unexpected response from the CLI token endpoint."
+      );
+    }
+    const exchange = parsed.data;
+    const token = exchange.accessToken;
     const me = await fetchMe(new ApiClient({ token }));
     saveToken(token);
     console.log(`Token saved to ${credentialsPath()}`);
@@ -1717,7 +2223,7 @@ async function browserLogin() {
   }
 }
 var DEVICE_ENDPOINT = "/api/v1/device";
-async function devicePost(path, body) {
+async function bootstrapPost(path, body) {
   const base = resolveBaseUrl().replace(/\/+$/, "");
   let res;
   try {
@@ -1748,13 +2254,13 @@ async function devicePost(path, body) {
     }
     throw new CliError(
       "internal",
-      `Device request failed: HTTP ${res.status} ${res.statusText}`.trim()
+      `Authentication request failed: HTTP ${res.status} ${res.statusText}`.trim()
     );
   }
   return JSON.parse(text);
 }
 async function deviceLogin(opts) {
-  const start = await devicePost(
+  const start = await bootstrapPost(
     `${DEVICE_ENDPOINT}/authorize`,
     { deviceName: hostname() || "this device", email: opts.email }
   );
@@ -1776,7 +2282,7 @@ async function deviceLogin(opts) {
     await sleep(interval * 1e3);
     let raw;
     try {
-      raw = await devicePost(`${DEVICE_ENDPOINT}/token`, {
+      raw = await bootstrapPost(`${DEVICE_ENDPOINT}/token`, {
         deviceCode: start.deviceCode
       });
     } catch (e) {
@@ -1812,14 +2318,13 @@ async function deviceLogin(opts) {
         );
       case "approved": {
         const token = result.accessToken;
-        saveToken(token);
         try {
           const me = await fetchMe(new ApiClient({ token }));
           return { token, me };
         } catch (e) {
           throw new CliError(
             "network",
-            `Signed in and token saved to ${credentialsPath()}, but couldn't load your profile (${e instanceof Error ? e.message : String(e)}). Run \`gauge whoami\` to retry.`
+            `Authorization succeeded, but the issued token could not be verified (${e instanceof Error ? e.message : String(e)}). Re-run to try again; existing credentials were not changed.`
           );
         }
       }
@@ -1835,14 +2340,22 @@ async function deviceLogin(opts) {
     "Timed out waiting for browser approval. Re-run to try again."
   );
 }
-async function readStdin() {
+async function readStdin(input = process.stdin) {
+  if (input.isTTY) {
+    const lines = createInterface({ input, crlfDelay: Infinity });
+    for await (const line of lines) {
+      lines.close();
+      return line;
+    }
+    return "";
+  }
   let data = "";
-  for await (const chunk of process.stdin) data += chunk;
+  for await (const chunk of input) data += chunk;
   return data;
 }
 async function withTokenLogin() {
   if (process.stdin.isTTY) {
-    console.error("Paste your API token, then press Enter and Ctrl-D:");
+    console.error("Paste your API token, then press Enter:");
   }
   const token = (await readStdin()).trim();
   if (!token.startsWith(TOKEN_PREFIX)) {
@@ -1902,14 +2415,23 @@ async function whoami(output) {
 }
 function register2(program2) {
   const auth = program2.command("auth").description("Authenticate the CLI (personal access tokens)");
-  auth.command("login").description("Log in via the browser (localhost callback flow)").option("--with-token", "read a token from stdin (headless machines)").option(
+  auth.command("login").description("Log in via your browser (localhost callback flow)").option("--with-token", "read a token from stdin (headless machines)").option(
     "--device",
-    "device-authorization flow: print a URL + code to approve elsewhere (no loopback listener; agent/remote-friendly)"
+    "use a device code instead (no local network access required)"
   ).option(
     "--email <email>",
     "with --device: also email a sign-in link to this address"
   ).action(
     async (opts) => {
+      if (opts.withToken && opts.device) {
+        throw new CliError(
+          "usage",
+          "Choose only one of --with-token or --device."
+        );
+      }
+      if (opts.email && !opts.device) {
+        throw new CliError("usage", "--email requires --device.");
+      }
       if (opts.device) {
         const { token, me } = await deviceLogin({ email: opts.email });
         saveToken(token);
@@ -2668,8 +3190,7 @@ function toRow2(p) {
     topic: p.topic?.name ?? "",
     tags: p.tags.map((t) => t.name).join(", "),
     schedules: p.scheduleCount,
-    branded: p.isBranded ? "yes" : "",
-    scenario: p.scenario
+    branded: p.isBranded ? "yes" : ""
   };
 }
 var DEFAULT_RUN_AGENTS = ["CLAUDE_CODE", "CODEX_CLI"];
@@ -2706,7 +3227,6 @@ function register10(program2) {
       return;
     }
     console.log(`id:       ${prompt.id}`);
-    console.log(`scenario: ${prompt.scenario}`);
     console.log(`branded:  ${prompt.isBranded}`);
     console.log(`topic:    ${prompt.topic?.name ?? "-"}`);
     console.log(
@@ -2730,7 +3250,7 @@ function register10(program2) {
       console.log("scheduled via: (none)");
     }
   });
-  group.command("create").description("Create a prompt").option("--text <text>", "prompt text").option("--file <path>", 'read prompt text from a file ("-" for stdin)').option("--scenario <scenario>", "greenfield | migration", "greenfield").option("--branded", "mark as a branded prompt").option("--topic <name>", "topic (created if new)").option(
+  group.command("create").description("Create a prompt").option("--text <text>", "prompt text").option("--file <path>", 'read prompt text from a file ("-" for stdin)').option("--branded", "mark as a branded prompt").option("--topic <name>", "topic (created if new)").option(
     "--tag <name>",
     "tag name (repeatable; created if new)",
     collect2,
@@ -2738,18 +3258,10 @@ function register10(program2) {
   ).action(
     async (opts, cmd) => {
       const org = resolveOrg(cmd);
-      const scenario = opts.scenario.trim().toUpperCase();
-      if (scenario !== "GREENFIELD" && scenario !== "MIGRATION") {
-        throw new CliError(
-          "usage",
-          `invalid --scenario "${opts.scenario}" (expected: greenfield | migration)`
-        );
-      }
       const created = await createClient().post(
         promptsPath(org),
         {
           text: readPromptText(opts),
-          scenario,
           isBranded: opts.branded ?? false,
           topic: opts.topic,
           tags: opts.tag
@@ -2758,8 +3270,9 @@ function register10(program2) {
       if (resolveOutput(cmd) === "json") printJson(created);
       else {
         console.log(`Created prompt ${created.id}`);
+        const firstTag = created.tags[0];
         console.log(
-          `Run it now with \`gauge prompts run ${created.id}\`, or add it to a schedule set with \`gauge schedules create --name <name> --prompt ${created.id} --agent claude-code\``
+          `Run it now with \`gauge prompts run ${created.id}\`, or schedule it via its tags with ` + (firstTag ? `\`gauge schedules create --name <name> --tag ${firstTag.id} --agent claude-code\`` : `\`gauge schedules create --name <name> --tag <tag-id> --agent claude-code\` (tag the prompt first: \`gauge prompts edit ${created.id} --tag <name>\`)`)
         );
       }
     }
@@ -3240,8 +3753,10 @@ function passLine(label, pass) {
   if (pass.error) bits.push(`error: ${compact(pass.error, 60)}`);
   return `${label.padEnd(20)} ${bits.join("  ")}`;
 }
-function influencesVia(detail) {
-  const raw = detail?.influences;
+function decisionVia(detail) {
+  const d = detail;
+  if (typeof d?.source === "string") return d.source;
+  const raw = d?.influences;
   if (!Array.isArray(raw)) return "";
   const types = [];
   for (const inf of raw) {
@@ -3264,7 +3779,7 @@ Decisions (${insight.decisions.length})`);
         arena: d.category === "other" && d.categoryRaw ? d.categoryRaw : d.category,
         chosen: d.chosenPackage ?? d.chosenName,
         reversed: d.reversed ? "yes" : "",
-        via: influencesVia(d.detail)
+        via: decisionVia(d.detail)
       })),
       "table"
     );
@@ -3547,6 +4062,7 @@ function reposLabel(repos) {
   if (repos.length === 0) return "(default scaffold)";
   if (repos.length === 1) {
     const r = repos[0];
+    if (r.repoUrl === null) return "(default scaffold)";
     return r.repoRef ? `${r.repoUrl}@${r.repoRef}` : r.repoUrl;
   }
   return `${repos.length} repos`;
@@ -3562,7 +4078,7 @@ function toRow5(s) {
     days: s.daysPerWeek ?? "",
     agents: s.agents.join(", "),
     repos: reposLabel(s.repos),
-    prompts: s.promptCount,
+    tags: s.tagCount,
     enabled: s.enabled ? "yes" : "no",
     experiment: s.experiment ?? ""
   };
@@ -3603,13 +4119,13 @@ function register14(program2) {
     else printItems(res.items.map(toRow5), "table");
   });
   group.command("create").description(
-    "Create an org schedule: a named prompt set + agents + cadence + repo"
+    "Create an org schedule: a named tag set + agents + cadence + repo"
   ).requiredOption("--name <name>", "schedule name").requiredOption(
     "--agent <agents>",
     "comma-separated agents, e.g. claude-code,codex"
   ).option(
-    "--prompt <id>",
-    "member prompt id (repeatable)",
+    "--tag <id>",
+    "membership tag id \u2014 the schedule runs the union of its tags (repeatable)",
     collect4,
     []
   ).option("--repo <url>", "repository URL (default: the Gauge scaffold)").option("--ref <ref>", "branch, tag, or commit (with --repo)").option("--cadence <cadence>", CADENCE_CHOICES.join(" | "), "none").option("--days-per-week <n>", "1-7 (with --cadence days-per-week)").option("--samples <n>", "samples per cycle (default: 1)").option("--model <id>", "pin a model id (default: the agent's default)").option("--disabled", "create the schedule disabled").action(
@@ -3623,7 +4139,7 @@ function register14(program2) {
         cadence: parseCadence(opts.cadence),
         samplesPerCycle: opts.samples !== void 0 ? parseSamples(opts.samples) : 1,
         repos: opts.repo !== void 0 ? reposFromOpts(opts.repo, opts.ref) : [],
-        promptIds: opts.prompt,
+        tagIds: opts.tag,
         enabled: !opts.disabled
       };
       if (opts.daysPerWeek !== void 0)
@@ -3637,12 +4153,12 @@ function register14(program2) {
       else console.log(`Created schedule ${schedule.id}`);
     }
   );
-  group.command("edit <id>").description("Update a schedule (repos and prompts are full replacements)").option("--name <name>", "rename the schedule").option("--agent <agents>", "comma-separated agents").option(
-    "--prompt <id>",
-    "member prompt id \u2014 replaces the whole set (repeatable)",
+  group.command("edit <id>").description("Update a schedule (repos and tags are full replacements)").option("--name <name>", "rename the schedule").option("--agent <agents>", "comma-separated agents").option(
+    "--tag <id>",
+    "membership tag id \u2014 replaces the whole set (repeatable)",
     collect4,
     []
-  ).option("--clear-prompts", "remove all member prompts").option("--repo <url>", "set a single repo target").option("--ref <ref>", "branch, tag, or commit (with --repo)").option("--clear-repos", "reset to the default scaffold (no repos)").option("--cadence <cadence>", CADENCE_CHOICES.join(" | ")).option("--days-per-week <n>", "1-7 (with cadence days-per-week)").option("--samples <n>", "samples per cycle").option("--model <id>", "pin a model id").option("--clear-model", "use the agent's default model").option("--enable", "enable the schedule").option("--disable", "disable the schedule").action(
+  ).option("--clear-tags", "remove all membership tags").option("--repo <url>", "set a single repo target").option("--ref <ref>", "branch, tag, or commit (with --repo)").option("--clear-repos", "reset to the default scaffold (no repos)").option("--cadence <cadence>", CADENCE_CHOICES.join(" | ")).option("--days-per-week <n>", "1-7 (with cadence days-per-week)").option("--samples <n>", "samples per cycle").option("--model <id>", "pin a model id").option("--clear-model", "use the agent's default model").option("--enable", "enable the schedule").option("--disable", "disable the schedule").action(
     async (id, opts, cmd) => {
       const body = {};
       if (opts.name !== void 0) body.name = opts.name;
@@ -3664,10 +4180,10 @@ function register14(program2) {
       if (opts.clearRepos) body.repos = [];
       else if (opts.repo !== void 0)
         body.repos = reposFromOpts(opts.repo, opts.ref);
-      if (opts.prompt.length > 0 && opts.clearPrompts)
-        throw new CliError("usage", "--prompt and --clear-prompts conflict");
-      if (opts.clearPrompts) body.promptIds = [];
-      else if (opts.prompt.length > 0) body.promptIds = opts.prompt;
+      if (opts.tag.length > 0 && opts.clearTags)
+        throw new CliError("usage", "--tag and --clear-tags conflict");
+      if (opts.clearTags) body.tagIds = [];
+      else if (opts.tag.length > 0) body.tagIds = opts.tag;
       if (opts.enable && opts.disable)
         throw new CliError("usage", "--enable and --disable conflict");
       if (opts.enable) body.enabled = true;
@@ -3694,7 +4210,9 @@ function register14(program2) {
       return;
     }
     if (result.runIds.length === 0) {
-      console.log("No runs enqueued (the schedule has no member prompts)");
+      console.log(
+        "No runs enqueued (the schedule's tags resolve to no prompts)"
+      );
       return;
     }
     console.log(