wirl 0.2.2 → 0.2.4

package/bin.js

@@ -486,6 +486,27 @@ var init_broker_token = __esm({
   }
 });
 
+// packages/core/src/broker-status.ts
+function restoreStatus(response) {
+  const carried = response.headers.get(CARRIED_STATUS_HEADER);
+  if (carried === null) return response;
+  const headers = new Headers(response.headers);
+  headers.delete(CARRIED_STATUS_HEADER);
+  const named = Number(carried);
+  const status = response.status === CARRIER && CARRIED.has(named) ? named : response.status;
+  return new Response(response.body, { status, statusText: status === response.status ? response.statusText : STATUS_TEXT[status] ?? "", headers });
+}
+var CARRIED_STATUS_HEADER, CARRIED, CARRIER, STATUS_TEXT;
+var init_broker_status = __esm({
+  "packages/core/src/broker-status.ts"() {
+    "use strict";
+    CARRIED_STATUS_HEADER = "x-wirl-status";
+    CARRIED = /* @__PURE__ */ new Set([502, 504]);
+    CARRIER = 500;
+    STATUS_TEXT = { 502: "Bad Gateway", 504: "Gateway Timeout" };
+  }
+});
+
 // packages/core/src/egress.ts
 function hostMatches(host, pattern) {
   const target = host.trim().toLowerCase();
@@ -2977,6 +2998,9 @@ function parseManifest(input) {
     }
     accent = rawAccent;
   }
+  const rawVisibility = raw["visibility"];
+  if (rawVisibility !== void 0 && rawVisibility !== "private") return refuse(VISIBILITY_REFUSED);
+  const visibility = rawVisibility === "private" ? { visibility: "private" } : {};
   const flowResult = parseFlows(raw);
   if (!flowResult.ok) return refuse(flowResult.message);
   const flows = flowResult.flows;
@@ -2995,7 +3019,7 @@ function parseManifest(input) {
     if (!publicPathsResult2.ok) return refuse(publicPathsResult2.message);
     return {
       ok: true,
-      manifest: { runtime, connections: [], description, accent, schedules, flows, publicPaths: publicPathsResult2.publicPaths, static: staticFiles, migrations },
+      manifest: { runtime, connections: [], description, accent, schedules, flows, publicPaths: publicPathsResult2.publicPaths, static: staticFiles, migrations, ...visibility },
       warnings
     };
   }
@@ -3054,11 +3078,11 @@ function parseManifest(input) {
   if (!publicPathsResult.ok) return refuse(publicPathsResult.message);
   return {
     ok: true,
-    manifest: { runtime, connections, description, accent, schedules, flows, publicPaths: publicPathsResult.publicPaths, static: staticFiles, migrations },
+    manifest: { runtime, connections, description, accent, schedules, flows, publicPaths: publicPathsResult.publicPaths, static: staticFiles, migrations, ...visibility },
     warnings
   };
 }
-var CONNECTION_KINDS, UNDELIVERED_KINDS, CREATABLE_CONNECTION_KINDS, needsNoKey, ACCENTS, SCHEDULE_LIMITS, MANIFEST_KEYS, QUIET_KEYS, UNKNOWN_KEYS_NAMED, KEY_SHOWN, squash, ONE_EDIT_MIN_LETTERS, pluralOf, SLUG, LABEL, HOST_PATTERN, refuse, asHint, SCHEDULE_NAME, TIMEOUT_PATTERN, TIMEOUT_MESSAGE, FLOW_KEYS, MIGRATIONS_KEYS;
+var CONNECTION_KINDS, UNDELIVERED_KINDS, CREATABLE_CONNECTION_KINDS, needsNoKey, ACCENTS, SCHEDULE_LIMITS, MANIFEST_KEYS, QUIET_KEYS, UNKNOWN_KEYS_NAMED, KEY_SHOWN, squash, ONE_EDIT_MIN_LETTERS, pluralOf, SLUG, LABEL, HOST_PATTERN, refuse, asHint, SCHEDULE_NAME, TIMEOUT_PATTERN, TIMEOUT_MESSAGE, FLOW_KEYS, MIGRATIONS_KEYS, VISIBILITY_REFUSED;
 var init_manifest = __esm({
   "packages/core/src/manifest.ts"() {
     "use strict";
@@ -3074,7 +3098,7 @@ var init_manifest = __esm({
     };
     CREATABLE_CONNECTION_KINDS = CONNECTION_KINDS.filter((kind) => !(kind in UNDELIVERED_KINDS));
     needsNoKey = (kind) => kind === "none";
-    ACCENTS = ["blue", "green", "sun", "purple", "red", "sky", "orange", "lime"];
+    ACCENTS = ["blue", "green", "sun", "purple", "red", "sky", "orange", "lime", "mint", "butter", "blush", "lilac"];
     SCHEDULE_LIMITS = {
       perApp: 10,
       minTimeoutMs: 3e4,
@@ -3098,7 +3122,8 @@ var init_manifest = __esm({
       "server",
       "spa",
       "start",
-      "static"
+      "static",
+      "visibility"
     ]);
     QUIET_KEYS = Object.freeze(["$schema"]);
     UNKNOWN_KEYS_NAMED = 10;
@@ -3120,6 +3145,7 @@ var init_manifest = __esm({
     TIMEOUT_MESSAGE = (name) => `timeout for ${name} must be between 30s and 15m; a run longer than that should be split into resumable chunks.`;
     FLOW_KEYS = ["name", "step_timeout", "retries"];
     MIGRATIONS_KEYS = ["destructive"];
+    VISIBILITY_REFUSED = `visibility can only be "private": it sets who can open a new app when a deploy creates it. Change an existing app's visibility with wirl visibility.`;
   }
 });
 
@@ -3339,6 +3365,29 @@ var init_runtime = __esm({
   }
 });
 
+// packages/core/src/ai-vendors.ts
+function aiRefusal(status, code, message, extra = {}) {
+  const error = { type: "wirl", code, message };
+  if (extra.scope !== void 0) error.scope = extra.scope;
+  if (extra.resets !== void 0) error.resets = extra.resets;
+  const headers = new Headers({ "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+  if (extra.retryAfterSeconds !== void 0) headers.set("retry-after", String(extra.retryAfterSeconds));
+  return new Response(JSON.stringify({ error }, null, 2), { status, headers });
+}
+var AI_HOST, AI_VENDOR_SPECS;
+var init_ai_vendors = __esm({
+  "packages/core/src/ai-vendors.ts"() {
+    "use strict";
+    AI_HOST = "ai.wirl";
+    AI_VENDOR_SPECS = {
+      openrouter: { host: "openrouter.ai", prefix: "/api", keyHeader: "authorization", label: "OpenRouter" },
+      openai: { host: "api.openai.com", prefix: "", keyHeader: "authorization", label: "OpenAI" },
+      anthropic: { host: "api.anthropic.com", prefix: "", keyHeader: "x-api-key", label: "Anthropic" },
+      google: { host: "generativelanguage.googleapis.com", prefix: "", keyHeader: "x-goog-api-key", label: "Google" }
+    };
+  }
+});
+
 // packages/core/src/broker-stream.ts
 function mediaTypeOf(headers) {
   const declared = headers.get("content-type");
@@ -3779,9 +3828,14 @@ var init_broker_bodies = __esm({
 
 // packages/core/src/broker.ts
 async function handleBrokerRequest(request, deps) {
-  const holding = { body: null, answer: null };
+  const holding = { body: null, answer: null, tap: null, vendorStatus: null };
   try {
-    return await brokerCall(request, deps, holding);
+    const response = await brokerCall(request, deps, holding);
+    holding.tap?.end("error", holding.vendorStatus ?? response.status);
+    return response;
+  } catch (error) {
+    holding.tap?.end("error", holding.vendorStatus ?? 500);
+    throw error;
   } finally {
     holding.body?.release();
     holding.answer?.release();
@@ -3881,34 +3935,46 @@ async function brokerCall(request, deps, holding) {
     }
     requestBody = bodyRead.bytes;
   }
-  const connections = await deps.connectionsFor(appId, deploymentId);
   let connection;
-  if (route.slug === RESOLVE_BY_HOST) {
-    const target2 = request.headers.get("x-wirl-target");
-    if (!target2) {
-      await record("no_target", 400, "");
-      return refuse2(400, "no_target", "Resolving a connection by host needs X-Wirl-Target.");
-    }
-    path = egressAuditPath(target2);
-    const host2 = safeHost(target2);
-    const matches = connections.filter(
-      (candidate) => isHttpKind(candidate.kind) && host2.length > 0 && isHostAllowed(host2, candidate.allowedHosts)
-    );
-    if (matches.length === 0) {
-      await record("no_grant", 403, host2);
-      return refuse2(403, "no_grant", `No granted connection covers ${host2 || target2}.`);
-    }
-    if (matches.length > 1) {
-      await record("ambiguous", 403, host2);
-      return refuse2(
-        403,
-        "ambiguous",
-        `More than one granted connection covers ${host2}: ${matches.map((m) => m.slug).join(", ")}. Call /e/<connection>/ to say which.`
+  let aiUpstream = null;
+  const aiTarget = aiTargetOf(request);
+  if (aiTarget !== null) {
+    if (!deps.ai) return noAiAnswer();
+    const got = await deps.ai(request, { appId, deploymentId, origin }, aiTarget, requestBody);
+    if (got instanceof Response) return got;
+    holding.tap = onceTap(got.tap);
+    connection = got.connection;
+    aiUpstream = got.upstream;
+    if (got.body !== null) requestBody = got.body.buffer instanceof ArrayBuffer ? got.body : new Uint8Array(got.body);
+  } else {
+    const connections = await deps.connectionsFor(appId, deploymentId);
+    if (route.slug === RESOLVE_BY_HOST) {
+      const target2 = request.headers.get("x-wirl-target");
+      if (!target2) {
+        await record("no_target", 400, "");
+        return refuse2(400, "no_target", "Resolving a connection by host needs X-Wirl-Target.");
+      }
+      path = egressAuditPath(target2);
+      const host2 = safeHost(target2);
+      const matches = connections.filter(
+        (candidate) => isHttpKind(candidate.kind) && host2.length > 0 && isHostAllowed(host2, candidate.allowedHosts)
       );
+      if (matches.length === 0) {
+        await record("no_grant", 403, host2);
+        return refuse2(403, "no_grant", `No granted connection covers ${host2 || target2}.`);
+      }
+      if (matches.length > 1) {
+        await record("ambiguous", 403, host2);
+        return refuse2(
+          403,
+          "ambiguous",
+          `More than one granted connection covers ${host2}: ${matches.map((m) => m.slug).join(", ")}. Call /e/<connection>/ to say which.`
+        );
+      }
+      connection = matches[0];
+    } else {
+      connection = connections.find((candidate) => candidate.slug === route.slug);
     }
-    connection = matches[0];
-  } else {
-    connection = connections.find((candidate) => candidate.slug === route.slug);
   }
   if (!connection) {
     await record("no_grant", 403, "");
@@ -3944,7 +4010,7 @@ async function brokerCall(request, deps, holding) {
       `The "${connection.slug}" connection is a ${connection.kind} credential and is not reachable over http.`
     );
   }
-  const target = buildTarget(connection.baseUrl, route.rest, url.search, request);
+  const target = aiUpstream !== null ? aiUpstream.href : buildTarget(connection.baseUrl, route.rest, url.search, request);
   path = egressAuditPath(target);
   const host = safeHost(target);
   if (host.length === 0 || !isHostAllowed(host, connection.allowedHosts)) {
@@ -3966,6 +4032,7 @@ async function brokerCall(request, deps, holding) {
     if (STRIPPED.has(lower)) return;
     if (STRIPPED_PREFIXES.some((prefix) => lower.startsWith(prefix))) return;
     if (isHopHeader(lower)) return;
+    if (aiUpstream !== null && AI_KEY_HEADERS.has(lower)) return;
     headers.set(name, value);
   });
   attachCredential(headers, connection);
@@ -4000,10 +4067,21 @@ async function brokerCall(request, deps, holding) {
       await record("private_address", 403, safeHost(target));
       return refuse2(403, "private_address", error.message);
     }
-    if (request.signal.aborted) return callerLeft(record, safeHost(target));
+    if (request.signal.aborted) {
+      holding.tap?.end("cut", 499);
+      return callerLeft(record, safeHost(target));
+    }
     await record("upstream_error", 502, safeHost(target));
+    if (holding.tap !== null) {
+      holding.tap.end("error", 502);
+      return aiRefusal(502, "ai_vendor_unreachable", `${aiVendorLabel(slug)} could not be reached.`);
+    }
     return refuse2(502, "upstream_error", error instanceof Error ? error.message : String(error));
   }
+  if (holding.tap !== null) {
+    holding.vendorStatus = upstream.status;
+    holding.tap.answered?.(upstream.status);
+  }
   let upstreamBody;
   try {
     upstreamBody = upstream.body;
@@ -4022,6 +4100,8 @@ async function brokerCall(request, deps, holding) {
   if (upstreamBody !== null && isStreamedAnswer(upstream.status, upstream.headers)) {
     const body2 = holding.body;
     holding.body = null;
+    const tap = holding.tap;
+    holding.tap = null;
     return streamAnswer(upstream, upstreamBody, {
       appId,
       limit,
@@ -4032,7 +4112,8 @@ async function brokerCall(request, deps, holding) {
       sentMs: deps.streamSentMs ?? BROKER_LIMITS.cutEventSentMs,
       signal: request.signal,
       record: (outcome, status) => record(outcome, status, safeHost(target)),
-      held: body2
+      held: body2,
+      tap
     });
   }
   const heldAnswer = answers?.open(appId, ownerId) ?? null;
@@ -4045,7 +4126,10 @@ async function brokerCall(request, deps, holding) {
     return refuse2(502, refusal.error, refusal.message);
   }
   if (read.outcome === "error") {
-    if (request.signal.aborted) return callerLeft(record, safeHost(target));
+    if (request.signal.aborted) {
+      holding.tap?.end("cut", upstream.status);
+      return callerLeft(record, safeHost(target));
+    }
     await record("upstream_error", 502, safeHost(target));
     return refuse2(502, "upstream_error", read.error instanceof Error ? read.error.message : String(read.error));
   }
@@ -4054,6 +4138,11 @@ async function brokerCall(request, deps, holding) {
     return refuse2(502, "too_large", `The upstream returned more than ${limit} bytes.`);
   }
   const body = read.bytes;
+  if (holding.tap !== null) {
+    if (body.byteLength > 0) holding.tap.feed(body);
+    holding.tap.end("complete", upstream.status);
+    holding.tap = null;
+  }
   await record("allowed", upstream.status, safeHost(target));
   const out2 = answerHeaders(upstream.headers);
   const empty = upstream.status === 204 || upstream.status === 304;
@@ -4160,6 +4249,53 @@ function flowsTargetOf(request) {
 function noFlowsAnswer() {
   return refuse2(404, "no_flows", "Flows run in a preview: wirl preview, then wirl flows start <flow> --preview <name> --fast.");
 }
+function aiTargetOf(request) {
+  const target = request.headers.get("x-wirl-target");
+  if (target === null) return null;
+  let url;
+  try {
+    url = new URL(target);
+  } catch {
+    return null;
+  }
+  return url.hostname.toLowerCase().replace(/\.$/, "") === AI_HOST ? url : null;
+}
+function noAiAnswer() {
+  return aiRefusal(503, "ai_unavailable", "Models are not available here.");
+}
+function aiVendorLabel(slug) {
+  const vendor = slug.startsWith("ai:") ? slug.slice(3) : slug;
+  return Object.hasOwn(AI_VENDOR_SPECS, vendor) ? AI_VENDOR_SPECS[vendor].label : slug;
+}
+function onceTap(tap) {
+  let ended2 = false;
+  let answered = false;
+  return {
+    answered(status) {
+      if (ended2 || answered) return;
+      answered = true;
+      try {
+        tap.answered?.(status);
+      } catch {
+      }
+    },
+    feed(chunk) {
+      if (ended2) return;
+      try {
+        tap.feed(chunk);
+      } catch {
+      }
+    },
+    end(how, status) {
+      if (ended2) return;
+      ended2 = true;
+      try {
+        tap.end(how, status);
+      } catch {
+      }
+    }
+  };
+}
 function answerHeaders(upstream) {
   const out2 = new Headers();
   upstream.forEach((value, name) => {
@@ -4182,6 +4318,7 @@ function declaredLength(headers) {
 }
 async function streamAnswer(upstream, body, context) {
   const giveBack = () => context.held?.release();
+  const tap = context.tap ?? null;
   let release = giveBack;
   if (context.slots !== null) {
     const slot = context.slots.acquire(context.appId);
@@ -4189,6 +4326,7 @@ async function streamAnswer(upstream, body, context) {
       await body.cancel().catch(() => {
       });
       giveBack();
+      tap?.end("error", upstream.status);
       await context.record("busy", 429);
       return refuse2(
         429,
@@ -4207,17 +4345,19 @@ async function streamAnswer(upstream, body, context) {
     await body.cancel().catch(() => {
     });
     release();
+    tap?.end("error", upstream.status);
     throw error;
   }
   try {
-    return new Response(passOn(body, context.limit, release, context.safetyMs, context.signal, context.closing, context.sent, context.sentMs), {
-      status: upstream.status,
-      headers: answerHeaders(upstream.headers)
-    });
+    return new Response(
+      passOn(body, context.limit, release, context.safetyMs, context.signal, context.closing, context.sent, context.sentMs, tap, upstream.status),
+      { status: upstream.status, headers: answerHeaders(upstream.headers) }
+    );
   } catch (error) {
     await body.cancel().catch(() => {
     });
     release();
+    tap?.end("error", upstream.status);
     throw error;
   }
 }
@@ -4242,7 +4382,7 @@ async function eventSent(sent, ms) {
     stop.abort();
   }
 }
-function passOn(body, limit, release, safetyMs, signal, closing, sent, sentMs) {
+function passOn(body, limit, release, safetyMs, signal, closing, sent, sentMs, tap = null, status = 200) {
   const reader = body.getReader();
   const says = closing && limit > CUT_EVENT_RESERVE_BYTES;
   const room = says ? limit - CUT_EVENT_RESERVE_BYTES : limit;
@@ -4253,16 +4393,17 @@ function passOn(body, limit, release, safetyMs, signal, closing, sent, sentMs) {
   let safety;
   let appLeft = () => {
   };
-  const finish = () => {
+  const finish = (how) => {
     if (over) return false;
     over = true;
     clearTimeout(safety);
     signal.removeEventListener("abort", appLeft);
     release();
+    tap?.end(how, status);
     return true;
   };
   const cut2 = (controller, error, why) => {
-    if (!finish()) return;
+    if (!finish("cut")) return;
     reader.cancel(error).catch(() => {
     });
     if (!says) {
@@ -4299,7 +4440,7 @@ function passOn(body, limit, release, safetyMs, signal, closing, sent, sentMs) {
         timer.unref?.();
         safety = timer;
         appLeft = () => {
-          if (!finish()) return;
+          if (!finish("cut")) return;
           reader.cancel(signal.reason).catch(() => {
           });
           controller.close();
@@ -4322,12 +4463,12 @@ function passOn(body, limit, release, safetyMs, signal, closing, sent, sentMs) {
         } catch (error) {
           const bound = error instanceof PinnedFetchError ? error.streamBound : void 0;
           if (bound !== void 0) cut2(controller, error, { cause: bound.kind, ms: bound.ms });
-          else if (finish()) controller.error(error);
+          else if (finish("error")) controller.error(error);
           return;
         }
         if (over) return;
         if (next.done) {
-          finish();
+          finish("complete");
           controller.close();
           return;
         }
@@ -4342,10 +4483,11 @@ function passOn(body, limit, release, safetyMs, signal, closing, sent, sentMs) {
           );
           return;
         }
+        tap?.feed(next.value);
         controller.enqueue(next.value);
       },
       cancel(reason) {
-        finish();
+        finish("cut");
         clearTimeout(unread);
         return reader.cancel(reason).catch(() => {
         });
@@ -4470,10 +4612,11 @@ function refuse2(status, reason, message, extra = {}) {
     })
   });
 }
-var RESOLVE_BY_HOST, STRIPPED_PREFIXES, STRIPPED, HOP_PREFIXES, HOP_HEADERS, isHopHeader, HAND_OUT_BYTES, AUDIT_PATH_CHARS, STALLED, SLOW, FIRST_HOLD_BYTES, CREDENTIAL_SHAPES, isHttpKind, safeHost;
+var RESOLVE_BY_HOST, STRIPPED_PREFIXES, AI_KEY_HEADERS, STRIPPED, HOP_PREFIXES, HOP_HEADERS, isHopHeader, HAND_OUT_BYTES, AUDIT_PATH_CHARS, STALLED, SLOW, FIRST_HOLD_BYTES, CREDENTIAL_SHAPES, isHttpKind, safeHost;
 var init_broker = __esm({
   "packages/core/src/broker.ts"() {
     "use strict";
+    init_ai_vendors();
     init_broker_bodies();
     init_broker_stream();
     init_broker_token();
@@ -4483,6 +4626,7 @@ var init_broker = __esm({
     init_token();
     RESOLVE_BY_HOST = "_";
     STRIPPED_PREFIXES = ["x-wirl-"];
+    AI_KEY_HEADERS = /* @__PURE__ */ new Set([...Object.values(AI_VENDOR_SPECS).map((spec) => spec.keyHeader), "api-key"]);
     STRIPPED = /* @__PURE__ */ new Set([
       "authorization",
       "proxy-authorization",
@@ -4603,7 +4747,11 @@ var init_retention = __esm({
        * The counts settle a "why was my app paused" question and the claims
        * ration the mail; neither is worth anything two months on.
        */
-      flowDayRowsDays: 60
+      flowDayRowsDays: 60,
+      /** A row of the AI call ledger is kept this long, then removed. */
+      aiCallDays: 90,
+      /** An AI monthly total (the rows the caps read) is kept this long, 24 months. */
+      aiMonthDays: 730
     };
     DELETED_SHARE_MARK = "deleted; a restore brings this share back; its data is kept until";
   }
@@ -4661,6 +4809,7 @@ own live deploy and a person's yes. Declare a host under \`connections\`, then \
 wirl attaches the key. An undeclared host is refused; a public API needing no key uses \`"kind": "none"\`.
 Declaring one deploys before anyone approves it; the deploy says per connection whether it is usable now or
 waiting on an admin. A vendor has 60 seconds to answer, whole, unless it streams: ask a model for a stream.
+Models: \`https://ai.wirl/<vendor>/\u2026\` (openrouter, openai, anthropic, google) with the vendor's own API and no key; OpenRouter works out of the box on wirl's allowance, an org's own key lifts it. See Models.
 
 Six headers say who is asking: \`x-wirl-user-id\`, \`x-wirl-user-email\`, \`x-wirl-user-name\`,
 \`x-wirl-role\`, \`x-wirl-app-id\`, \`x-wirl-org\`. Read the name with
@@ -4713,7 +4862,7 @@ var init_version = __esm({
   "packages/core/src/version.ts"() {
     "use strict";
     WORKSPACE_VERSION = "0.0.0";
-    BUILT_VERSION = true ? "0.2.2" : null;
+    BUILT_VERSION = true ? "0.2.4" : null;
   }
 });
 
@@ -4767,6 +4916,22 @@ var init_connect = __esm({
   }
 });
 
+// packages/core/src/setup-prompt.ts
+function starterName(email) {
+  const handle = (email ?? "").split("@")[0] ?? "";
+  const slug = handle.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const cut2 = slug.slice(0, SLUG_MAX - STARTER_SUFFIX.length).replace(/-+$/, "");
+  return cut2 === "" ? "starter" : `${cut2}${STARTER_SUFFIX}`;
+}
+var STARTER_SUFFIX;
+var init_setup_prompt = __esm({
+  "packages/core/src/setup-prompt.ts"() {
+    "use strict";
+    init_slug();
+    STARTER_SUFFIX = "-starter";
+  }
+});
+
 // packages/core/src/porting.ts
 function dependencyNames(packageJson) {
   if (packageJson === void 0) return [];
@@ -5099,6 +5264,7 @@ var init_src = __esm({
     init_slug();
     init_token();
     init_broker_token();
+    init_broker_status();
     init_egress();
     init_manifest();
     init_sql_lex();
@@ -5119,12 +5285,14 @@ var init_src = __esm({
     init_install();
     init_share_role();
     init_connect();
+    init_setup_prompt();
     init_porting();
     init_throttle_report();
     init_supplied_bundle();
     init_manifest_transport();
     init_preview();
     init_visit_token();
+    init_ai_vendors();
   }
 });
 
@@ -6384,7 +6552,7 @@ function searchGroup(text) {
       ]
     }
   ];
-  if (STATUS_TEXT.test(text)) filters.push({ key: "$workers.event.response.status", type: "number", operation: "eq", value: Number(text) });
+  if (STATUS_TEXT2.test(text)) filters.push({ key: "$workers.event.response.status", type: "number", operation: "eq", value: Number(text) });
   return { kind: "group", filterCombination: "or", filters };
 }
 function kindFilters(kind) {
@@ -6405,7 +6573,7 @@ function kindFilters(kind) {
       return [];
   }
 }
-var LogSourceError, DEFAULTS3, DATASET, MAX_EVENTS, RUN_HEADER, PUBLIC_HEADER, FLOW_HEADER, NOT_A_FLOW_STEP, serviceFilter, failedGroup, STATUS_TEXT, WorkersLogSource;
+var LogSourceError, DEFAULTS3, DATASET, MAX_EVENTS, RUN_HEADER, PUBLIC_HEADER, FLOW_HEADER, NOT_A_FLOW_STEP, serviceFilter, failedGroup, STATUS_TEXT2, WorkersLogSource;
 var init_workers_logs = __esm({
   "packages/runtime/src/workers-logs.ts"() {
     "use strict";
@@ -6434,7 +6602,7 @@ var init_workers_logs = __esm({
         { key: "$workers.outcome", type: "string", operation: "neq", value: "ok" }
       ]
     });
-    STATUS_TEXT = /^\d{3}$/;
+    STATUS_TEXT2 = /^\d{3}$/;
     WorkersLogSource = class {
       #opts;
       constructor(options) {
@@ -7240,11 +7408,12 @@ company email domain; in any other org, including a personal one or one
 made with \`wirl orgs create\`, it starts private. Deploys are one
 command; sharing is by email; a third-party API is declared, never pasted.`;
 var SKILL_DOCS_LINE = "Before you build, fetch https://docs.wirl.dev/llms-full.txt: every page of the docs as one Markdown file, so there is no need to read the site page by page.";
-var SKILL_RULES = `1. **Never ask for or paste an API key.** Declare the connection in \`wirl.json\` and deploy. Needs no key at all (a public API)? Declare it with "kind": "none" and its hosts. If the key is missing, the deploy prints a link to the app's keys page; show the person that link. Locally, keys live in \`.wirl/keys.json\`, which git ignores. To try a vendor call locally without the key, map its connection to a server of your own in \`.wirl/mocks.json\`, like \`{ "anthropic": "http://127.0.0.1:4010" }\`: \`wirl dev\` then sends the calls to that connection's hosts there instead (\`wirl dev --help\` has the rest).
+var SKILL_RULES = `1. **Never ask for or paste an API key.** Declare the connection in \`wirl.json\` and deploy. Needs no key at all (a public API)? Declare it with "kind": "none" and its hosts. If the key is missing, the deploy prints a link to the app's keys page; show the person that link. Locally, keys live in \`.wirl/keys.json\`, which git ignores. To try a vendor call locally without the key, map its connection to a server of your own in \`.wirl/mocks.json\`, like \`{ "anthropic": "http://127.0.0.1:4010" }\`: \`wirl dev\` then sends the calls to that connection's hosts there instead (\`wirl dev --help\` has the rest). Models need no key either: call https://ai.wirl/<vendor>/\u2026 (see Models).
 2. **Call third-party APIs by their real URL** (\`fetch("https://api.hubspot.com/...")\`). wirl attaches the key on the way out, deployed and under \`wirl dev\` alike.
-3. If a command names several organisations and asks which, ask the person; pass \`--org\` or put \`"org"\` in \`wirl.json\`.
-4. To keep a file out of the deploy, list it in a \`.wirlignore\` at the project root (gitignore-style lines; no \`!\` negation).
-5. **A file that can lose data waits for a person.** A deploy that would apply a destructive file (one wirl.json's \`"destructive"\` list must name) to the live database stops and names the page where a person approves each one. Show the person those pages, and deploy again once they say they approved. If \`${WIRL_BIN} deploy\` asks you to type a file's name, stop it and show the page instead, or deploy with \`--json\`, which never asks. Never type the name yourself or send the confirmation: that is the person's, and no flag skips it.`;
+3. **Asked to connect an app to Slack, or to receive events from any outside service:** follow the pattern on https://docs.wirl.dev/models (public path with "verify": "slack", a connection of kind http_bearer for the bot token and one of kind webhook_secret for the signing secret, the Slack app manifest you give the person to create the app with). Never ask for the token or secret in chat: the person pastes them on the app's Connections page, and you say which two values.
+4. If a command names several organisations and asks which, ask the person; pass \`--org\` or put \`"org"\` in \`wirl.json\`.
+5. To keep a file out of the deploy, list it in a \`.wirlignore\` at the project root (gitignore-style lines; no \`!\` negation).
+6. **A file that can lose data waits for a person.** A deploy that would apply a destructive file (one wirl.json's \`"destructive"\` list must name) to the live database stops and names the page where a person approves each one. Show the person those pages, and deploy again once they say they approved. If \`${WIRL_BIN} deploy\` asks you to type a file's name, stop it and show the page instead, or deploy with \`--json\`, which never asks. Never type the name yourself or send the confirmation: that is the person's, and no flag skips it.`;
 var SKILL_MANIFEST_EXAMPLE = `\`\`\`json
 { "app": "crm-sync", "server": "server.mjs", "connections": [{ "slug": "hubspot", "hosts": ["api.hubspot.com"] }] }
 \`\`\``;
@@ -7291,6 +7460,465 @@ ${FLOWS_CONTRACT}
 `;
 }
 
+// packages/cli/src/starter.ts
+init_src();
+var STARTER_CONFLICT = "Choose one: --server or --starter.";
+var SUGGESTIONS = [
+  {
+    number: 1,
+    title: "Summarise the week",
+    capability: "A model comes with every app. Your agent just uses it; nothing to sign up for or paste.",
+    prompt: `Add a "Summarise this week" button above the notes. When pressed, send this week's notes to a language model and show a three-line summary at the top of the page. Try it with wirl dev, then deploy it with wirl deploy. Keep the latest summary so everyone who opens the page sees it.`,
+    youGet: "a summary card above the notes."
+  },
+  {
+    number: 2,
+    title: "Give notes a due date",
+    capability: "The database is yours. Changing its shape is one migration file and one deploy; wirl applies it before the new version goes live, and the Data page on the dashboard shows the result.",
+    prompt: "Add an optional due date to notes. Add the column in a new migration file with the next number, and never edit a migration that has already been applied. Let people set the date when they post or edit a note, show it on each note, and put notes due soonest at the top. Try it with wirl dev, then deploy it with wirl deploy.",
+    youGet: "a date on each note, the soonest first, and a new column on the Data page."
+  },
+  {
+    number: 3,
+    title: "Pull in something from outside",
+    capability: "Every call out goes through wirl. The agent declares the host as a connection; a public API needs no key, and one that does gets its key on the dashboard, never in the code.",
+    prompt: `Show today's weather under the notes for our city (ask me which city if you don't know), from a public weather API that needs no key. Declare the API's host as a connection in wirl.json with "kind": "none". Try it with wirl dev, then deploy it with wirl deploy. If the deploy says the connection is waiting on an admin, show me the link it prints.`,
+    youGet: "a weather line under the notes, and the host listed on the app's Connections page."
+  },
+  {
+    number: 4,
+    title: "Try a new look before anyone sees it",
+    // The mock says "Previews are free."; the starter carries no price words (its test forbids "free").
+    capability: "Previews are a safe place to try. A preview gets its own address and its own database, so you can look at a change with a colleague before it goes live.",
+    prompt: "Give the noticeboard a calmer look: more space between notes, a softer background, the newest note set apart at the top. Put it up as a preview called new-look with wirl preview and give me the link. Don't deploy it yet. Keep the change on a branch and don't run wirl deploy until I say deploy it.",
+    youGet: 'a second address to open next to this one. Say "deploy it" when you like it.'
+  },
+  {
+    number: 5,
+    title: "Share it with a colleague",
+    capability: "Company sign-in is already on. Anyone you name opens the link with their work account; the Access page shows who can, and you can take it back any time.",
+    prompt: "Help me share this app with a colleague: tell me how to give them access and the link they open.",
+    youGet: "their name on the Access page, and a link they open with their work account."
+  },
+  {
+    number: 6,
+    title: "Connect it to Slack",
+    capability: "Apps can reach the tools your company already uses. Your agent knows wirl's Slack pattern: it gives you a Slack app to create in one click, you paste two values on the app's Connections page, and the noticeboard starts a DM with you. Ask it about the notes, or tell it to add one, from Slack.",
+    prompt: "Connect this noticeboard to Slack so it DMs me this week's summary and I can chat with it there: ask it about the notes, or tell it to add or change one. Give me the Slack app manifest to create the app with, and tell me which two values to paste on the app's Connections page.",
+    youGet: "a DM from the noticeboard in Slack. Everything above works without it.",
+    optional: true
+  }
+];
+var splitCapability = (capability) => {
+  const stop = capability.indexOf(". ");
+  return [capability.slice(0, stop + 1), capability.slice(stop + 2)];
+};
+var SUGGESTIONS_SOURCE = [
+  "const SUGGESTIONS = [",
+  ...SUGGESTIONS.map(
+    ({ number, title, capability, prompt, youGet, optional }) => `  { number: ${String(number)}, title: ${JSON.stringify(title)}, capability: ${JSON.stringify(capability)}, prompt: ${JSON.stringify(prompt)}, youGet: ${JSON.stringify(youGet)}${optional ? ", optional: true" : ""} },`
+  ),
+  "];"
+].join("\n");
+var SERVER_HEAD = String.raw`/**
+ * Team noticeboard: your first app on wirl.
+ *
+ * Your team posts short notes here, tags them, pins the ones everyone should
+ * see, and edits or removes their own. Every night a schedule archives old
+ * notes nobody pinned. Below the notes, "Make it yours": six prompts to
+ * paste to your coding agent, in order, each saying what wirl gives the app
+ * and what you get. Under them, the app's pages on app.wirl.dev.
+ *
+ * The whole app is this one file:
+ * - The page is HTML this module returns: plain forms, no script.
+ * - Notes live in env.DB, a SQLite database that belongs to this app alone.
+ *   Its tables are in migrations/0001_init.sql, and wirl applies each new
+ *   file in migrations/ before a version goes live. Put the next change in
+ *   migrations/0002_<what>.sql rather than editing that one.
+ * - Who is asking arrives in headers wirl sets after signing them in, which
+ *   the browser cannot forge. Who may change a note is a line of code here:
+ *   a check in the page is only a suggestion to whoever holds the browser.
+ * - The nightly schedule is declared in wirl.json. wirl sends it here as a
+ *   POST to /__wirl/schedule/tidy, and what it answers becomes the run's note.
+ * - console.log lines appear on the app's Logs page, and in wirl logs.
+ */
+
+const TITLE = "Team noticeboard";
+const DASHBOARD = "https://app.wirl.dev";
+const ARCHIVE_AFTER_DAYS = 30;
+const LONGEST_NOTE = 2000;
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    // One line per request, on the Logs page.
+    console.log(request.method, url.pathname);
+
+    // The nightly tidy-up, sent by wirl at the time wirl.json gives. wirl
+    // names the schedule in x-wirl-schedule as well as in the path, and a
+    // request without that header is not one wirl sent.
+    if (url.pathname.startsWith("/__wirl/schedule/")) {
+      const name = url.pathname.slice("/__wirl/schedule/".length);
+      const fromWirl = request.headers.get("x-wirl-schedule") === name;
+      if (name === "tidy" && request.method === "POST" && fromWirl) return tidy(env);
+      return text("No such schedule", 404);
+    }
+
+    const me = visitor(request);
+
+    if (request.method === "POST") {
+      // A form posted from another site is never one of yours.
+      if (request.headers.get("sec-fetch-site") === "cross-site") return text("Refused: this form came from another site.", 403);
+      if (me.id === "") return text("Sign in to change the board.", 403);
+      let form;
+      try {
+        form = await request.formData();
+      } catch {
+        return text("Send this as a form.", 400);
+      }
+      return change(url.pathname, form, me, env);
+    }
+
+    if (url.pathname === "/" && (request.method === "GET" || request.method === "HEAD")) {
+      return html(await page(request, url, me, env));
+    }
+    return text("Not found", 404);
+  },
+};
+
+// Set by wirl after it signed this person in. Never take identity from a form
+// or the query string: those say whatever the browser wants them to say. A
+// header carries only Latin-1 and a name can be anything, so wirl
+// percent-encodes the name; it is decoded here.
+function visitor(request) {
+  const header = (name) => decode(request.headers.get(name) || "");
+  return {
+    id: header("x-wirl-user-id"),
+    name: header("x-wirl-user-name") || header("x-wirl-user-email") || "someone",
+    role: header("x-wirl-role"),
+  };
+}
+
+// POST /notes, and POST /notes/<id>/<edit|pin|remove|restore>.
+async function change(path, form, me, env) {
+  const [, first, id, action] = path.split("/");
+  if (first !== "notes") return text("Not found", 404);
+
+  if (id === undefined) {
+    const body = clean(form.get("body"), LONGEST_NOTE);
+    if (body === "") return text("A note needs some words.", 400);
+    const { meta } = await env.DB.prepare("insert into notes (body, tags, author_id, author_name) values (?, ?, ?, ?)")
+      .bind(body, tags(form.get("tags")), me.id, me.name)
+      .run();
+    console.log("note", meta.last_row_id, "posted by", me.id);
+    return home();
+  }
+
+  const number = Number.parseInt(id, 10);
+  if (String(number) !== id) return text("Not found", 404);
+  const note = await env.DB.prepare("select id, author_id from notes where id = ?").bind(number).first();
+  if (!note) return text("No such note", 404);
+
+  // The rule that matters, in code: authors change their own notes, and the
+  // app's owner can change any. Anyone on the board can pin.
+  const mine = note.author_id === me.id || me.role === "owner";
+
+  if (action === "pin") {
+    await env.DB.prepare("update notes set pinned = 1 - pinned where id = ?").bind(number).run();
+    console.log("note", number, "pin changed by", me.id);
+    return home();
+  }
+  if (!mine) return text("Only the person who posted this note, or the app's owner, can change it.", 403);
+
+  if (action === "edit") {
+    const body = clean(form.get("body"), LONGEST_NOTE);
+    if (body === "") return text("A note needs some words.", 400);
+    await env.DB.prepare("update notes set body = ?, tags = ? where id = ?").bind(body, tags(form.get("tags")), number).run();
+    console.log("note", number, "edited by", me.id);
+    return home();
+  }
+  if (action === "remove") {
+    await env.DB.prepare("delete from notes where id = ?").bind(number).run();
+    console.log("note", number, "removed by", me.id);
+    return home();
+  }
+  if (action === "restore") {
+    // Back on the board as if posted today, so tonight's tidy-up leaves it be.
+    await env.DB.prepare("update notes set archived_at = null, created_at = datetime('now') where id = ?").bind(number).run();
+    console.log("note", number, "put back by", me.id);
+    return home("/?view=archived");
+  }
+  return text("Not found", 404);
+}
+
+// The schedule: archive notes older than ARCHIVE_AFTER_DAYS that nobody
+// pinned, and keep a line saying so, which the page shows as the last run.
+async function tidy(env) {
+  const { meta } = await env.DB.prepare(
+    "update notes set archived_at = datetime('now') where archived_at is null and pinned = 0 and created_at < datetime('now', ?)",
+  )
+    .bind("-" + ARCHIVE_AFTER_DAYS + " days")
+    .run();
+  const note = "Archived " + meta.changes + (meta.changes === 1 ? " note" : " notes") + " older than " + ARCHIVE_AFTER_DAYS + " days.";
+  await env.DB.prepare("insert into runs (schedule, note) values (?, ?)").bind("tidy", note).run();
+  console.log("tidy:", note);
+  return text(note);
+}
+
+async function page(request, url, me, env) {
+  const tag = tags(url.searchParams.get("tag")).split(",")[0];
+  const archived = url.searchParams.get("view") === "archived";
+  let sql = "select id, body, tags, pinned, author_id, author_name, created_at from notes where archived_at is " + (archived ? "not null" : "null");
+  const binds = [];
+  if (tag !== "") {
+    sql += " and (',' || tags || ',') like ?";
+    binds.push("%," + tag + ",%");
+  }
+  sql += " order by pinned desc, id desc limit 200";
+  const notes = (await env.DB.prepare(sql).bind(...binds).all()).results;
+  const archivedCount = await env.DB.prepare("select count(*) as n from notes where archived_at is not null").first("n");
+  const lastRun = await env.DB.prepare("select note, ran_at from runs where schedule = 'tidy' order by id desc limit 1").first();
+
+  const shown = archived
+    ? "<p class='dim'>Notes the nightly tidy-up moved off the board. <a href='/'>Back to the board</a></p>"
+    : form() +
+      "<p class='dim filters'>" +
+      (tag === "" ? "All notes" : "Tagged <b>" + escape(tag) + "</b> · <a href='/'>show all</a>") +
+      " · <a href='/?view=archived'>Archived (" + archivedCount + ")</a></p>";
+
+  return [
+    "<!doctype html>",
+    "<html lang='en'>",
+    "<meta charset='utf-8'>",
+    "<meta name='viewport' content='width=device-width, initial-scale=1'>",
+    "<title>" + TITLE + "</title>",
+    "<style>" + STYLE + "</style>",
+    "<main>",
+    "<header><h1>" + TITLE + "</h1>",
+    "<p class='dim'>Your first app on wirl. Signed in as <b>" + escape(me.name) + "</b>" + (me.role ? " (" + escape(me.role) + ")" : "") + ".</p></header>",
+    shown,
+    "<ul class='notes'>" + (notes.length === 0 ? "<li class='dim'>Nothing here yet.</li>" : notes.map((note) => card(note, me, archived)).join("")) + "</ul>",
+    "<p class='dim'>Nightly tidy-up, which archives notes older than " + ARCHIVE_AFTER_DAYS + " days that nobody pinned: " +
+      (lastRun ? "last run " + escape(lastRun.ran_at.slice(0, 16)) + " UTC: " + escape(lastRun.note) : "Not run yet.") + "</p>",
+    prompts(request),
+    "</main>",
+    "</html>",
+  ].join("\n");
+}
+
+function form() {
+  return [
+    "<form class='add' method='post' action='/notes'>",
+    "<textarea name='body' rows='3' maxlength='" + LONGEST_NOTE + "' required placeholder='Post a note for the team'></textarea>",
+    "<input name='tags' placeholder='Tags, separated by commas'>",
+    "<button class='primary'>Post</button>",
+    "</form>",
+  ].join("");
+}
+
+function card(note, me, archived) {
+  const mine = note.author_id === me.id || me.role === "owner";
+  const action = (what, label) =>
+    "<form method='post' action='/notes/" + note.id + "/" + what + "'><button>" + label + "</button></form>";
+  const tagLinks = note.tags
+    .split(",")
+    .filter((tag) => tag !== "")
+    .map((tag) => "<a class='tag' href='/?tag=" + encodeURIComponent(tag) + "'>#" + escape(tag) + "</a>")
+    .join(" ");
+  const controls = archived
+    ? (mine ? action("restore", "Put back") : "")
+    : action("pin", note.pinned ? "Unpin" : "Pin") +
+      (mine
+        ? "<details><summary>Edit</summary><form class='edit' method='post' action='/notes/" + note.id + "/edit'>" +
+          "<textarea name='body' rows='3' maxlength='" + LONGEST_NOTE + "' required>" + escape(note.body) + "</textarea>" +
+          "<input name='tags' value='" + escape(note.tags.split(",").join(", ")) + "'>" +
+          "<button class='primary'>Save</button></form></details>" +
+          action("remove", "Remove")
+        : "");
+  return (
+    "<li class='note" + (note.pinned && !archived ? " pinned" : "") + "'>" +
+    "<p>" + escape(note.body) + "</p>" +
+    "<div class='meta dim'>" + (note.pinned && !archived ? "<b>Pinned</b> · " : "") +
+    escape(note.author_name || "someone") + " · " + escape(note.created_at.slice(0, 10)) + (tagLinks ? " · " + tagLinks : "") + "</div>" +
+    "<div class='actions'>" + controls + "</div>" +
+    "</li>"
+  );
+}
+
+// The app's pages on the dashboard, from the address it was opened at:
+// <org>--<app>.wirl.run, or <org>--<app>--<preview>.wirl.run for a preview.
+// Under wirl dev the address is 127.0.0.1, which names no app: null.
+function dashboard(request) {
+  const label = new URL(request.url).hostname.split(".")[0];
+  const parts = label.split("--");
+  if (parts.length < 2) return null;
+  const org = encodeURIComponent(request.headers.get("x-wirl-org") || parts[0]);
+  return { app: DASHBOARD + "/apps/" + org + "/" + encodeURIComponent(parts[1]), org: DASHBOARD + "/orgs/" + org };
+}
+
+// The onboarding path: each prompt whole, visible and ready to select and
+// copy, with what wirl gives the app and what you get. Then what the app
+// already uses, and its pages on the dashboard.
+function prompts(request) {
+  const where = dashboard(request);
+  const pages = [
+    ["Overview", "app", ""],
+    ["Data", "app", "/data"],
+    ["Access", "app", "/access"],
+    ["Logs", "app", "/logs"],
+    ["Deployments", "app", "/deployments"],
+    ["Models", "org", "/models"],
+    ["Connections", "app", "/connections"],
+    ["Settings", "app", "/settings"],
+  ];
+  const link = ([label, of, path]) =>
+    where === null ? "<span class='dim'>" + label + "</span>" : "<a href='" + escape(where[of] + path) + "'>" + label + "</a>";
+  const step = (each) => {
+    const stop = each.capability.indexOf(". ");
+    return (
+      "<li class='step" + (each.optional ? " optional" : "") + "'>" +
+      "<h3><span class='number'>" + each.number + "</span> " + escape(each.title) +
+      (each.optional ? " <span class='badge'>Optional. The big one.</span>" : "") + "</h3>" +
+      "<p class='dim'><b>" + escape(each.capability.slice(0, stop + 1)) + "</b> " + escape(each.capability.slice(stop + 2)) + "</p>" +
+      "<pre>" + escape(each.prompt) + "</pre>" +
+      "<p class='dim'>You get: " + escape(each.youGet) + "</p>" +
+      "</li>"
+    );
+  };
+  return [
+    "<section id='prompts'><h2>Make it yours</h2>",
+    "<p>This app is live, at a link your team can open. Everything below is a whole prompt. Copy one, paste it to the coding agent that made this app, and the feature appears here on the next deploy. Go in order or skip around; the last one is the big one.</p>",
+    "<ol class='steps'>",
+    ...SUGGESTIONS.map(step),
+    "</ol>",
+    "<p class='dim uses'>This app already uses a database, a nightly schedule, company sign-in and logs. Each has a page on the dashboard: " + pages.map(link).join(" · ") + "</p>",
+    where === null ? "<p class='dim'>Running under wirl dev, so these pages are not linked here: they open on app.wirl.dev once it is deployed.</p>" : "",
+    "</section>",
+  ].join("\n");
+}
+
+`;
+var SERVER_TAIL = String.raw`
+
+const STYLE = [
+  ":root { color-scheme: light dark; --ink: #1d1d1b; --dim: #66655f; --line: #e2e0d9; --card: #ffffff; --bg: #f7f6f2; --pin: #fff3bf; --accent: #2b6b5a; }",
+  "@media (prefers-color-scheme: dark) { :root { --ink: #ecebe6; --dim: #a6a59f; --line: #36352f; --card: #1f1f1c; --bg: #161614; --pin: #3b3420; --accent: #8fd1bd; } }",
+  "body { margin: 0; background: var(--bg); color: var(--ink); font: 15px/1.5 system-ui, sans-serif; }",
+  "main { max-width: 760px; margin: 0 auto; padding: 24px 16px 48px; }",
+  "h1 { font-size: 24px; margin: 0 0 4px; } h2 { font-size: 17px; margin: 36px 0 8px; }",
+  "a { color: var(--accent); } .dim { color: var(--dim); }",
+  "form.add, form.edit { display: grid; gap: 8px; margin: 16px 0 8px; }",
+  "textarea, input, button { font: inherit; color: inherit; padding: 7px 10px; border: 1px solid var(--line); border-radius: 6px; background: var(--card); }",
+  "button { cursor: pointer; } button.primary { justify-self: start; background: var(--accent); border-color: var(--accent); color: var(--bg); }",
+  "ul.notes { list-style: none; padding: 0; display: grid; gap: 10px; }",
+  ".note { background: var(--card); border: 1px solid var(--line); border-radius: 8px; padding: 12px 14px; }",
+  ".note.pinned { background: var(--pin); }",
+  ".note p { margin: 0 0 6px; white-space: pre-wrap; overflow-wrap: anywhere; }",
+  ".meta, .actions { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; font-size: 13px; }",
+  ".actions { margin-top: 8px; } .actions form { margin: 0; } .actions details { flex-basis: 100%; order: 3; }",
+  ".tag { text-decoration: none; }",
+  "ol.steps { list-style: none; padding: 0; display: grid; gap: 12px; }",
+  ".step { background: var(--card); border: 1px solid var(--line); border-radius: 8px; padding: 12px 14px; }",
+  ".step.optional { border: 2px solid var(--accent); }",
+  ".step h3 { font-size: 16px; margin: 0 0 6px; display: flex; flex-wrap: wrap; align-items: center; gap: 8px; }",
+  ".step p { margin: 6px 0; } .step b { color: var(--accent); }",
+  ".number { font-size: 12px; background: var(--ink); color: var(--bg); padding: 2px 7px; border-radius: 5px; }",
+  ".optional .number { background: var(--accent); }",
+  ".badge { font-size: 12px; font-weight: 600; color: var(--dim); border: 1px solid var(--line); padding: 1px 8px; border-radius: 999px; }",
+  ".uses { border-top: 1px solid var(--line); padding-top: 12px; font-size: 14px; }",
+  "pre { white-space: pre-wrap; user-select: all; background: var(--bg); border: 1px solid var(--line); border-radius: 6px; padding: 10px; font-size: 13px; }",
+  "details { margin: 6px 0; } summary { cursor: pointer; }",
+].join("\n");
+
+const home = (to = "/") => new Response(null, { status: 303, headers: { location: to } });
+
+const text = (body, status = 200) => new Response(body, { status, headers: { "content-type": "text/plain; charset=utf-8" } });
+
+const html = (markup) => new Response(markup, { headers: { "content-type": "text/html; charset=utf-8" } });
+
+// Escapes text for HTML, in content and in quoted attribute values alike.
+const escape = (value) =>
+  String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+
+const decode = (value) => {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
+
+// A form field as trimmed text, at most max characters.
+const clean = (value, max) => (typeof value === "string" ? value.trim().slice(0, max) : "");
+
+// "Team, Stand-up" becomes "team,stand-up": lowercase words, letters, digits
+// and hyphens only, so a tag is safe in a link and in the LIKE above.
+const tags = (value) =>
+  clean(value, 200)
+    .split(",")
+    .map((tag) => tag.toLowerCase().split(/[^\p{L}\p{N}]+/u).filter((word) => word !== "").join("-"))
+    .filter((tag, i, all) => tag !== "" && all.indexOf(tag) === i)
+    .slice(0, 8)
+    .join(",");
+`;
+var SERVER_MODULE = `${SERVER_HEAD}${SUGGESTIONS_SOURCE}${SERVER_TAIL}`;
+var STARTER_MIGRATION = [
+  "-- The noticeboard's tables. wirl applies each new file here, in order, before a version goes live.",
+  "-- Make the next change in 0002_<what>.sql; never edit a file that has been deployed.",
+  "create table notes (id integer primary key, body text not null, tags text not null default '', pinned integer not null default 0, author_id text not null, author_name text not null default '', created_at text not null default (datetime('now')), archived_at text)",
+  "create table runs (id integer primary key, schedule text not null, note text not null, ran_at text not null default (datetime('now')))",
+  "insert into notes (body, tags, pinned, author_id, author_name) values ('Welcome to the noticeboard. Post a note below, tag it, and pin the ones everyone should see.', 'welcome', 1, '', 'wirl')",
+  ""
+].join("\n");
+function starterManifest(app, org) {
+  const manifest = {
+    app,
+    ...org ? { org } : {},
+    dir: ".",
+    server: "server.mjs",
+    description: "A team noticeboard: your first app on wirl",
+    visibility: "private",
+    schedules: [{ name: "tidy", cron: "0 2 * * *", timezone: "UTC" }]
+  };
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+var README = [
+  "# Team noticeboard",
+  "",
+  "Your first app on wirl: a board where your team posts short notes, tags them, pins the ones everyone should see, and edits or removes their own. Every night a schedule archives old notes nobody pinned.",
+  "",
+  "Open it at the address `wirl deploy` prints. It starts private to you. Its page is the way in: six prompts to give your coding agent, each saying what wirl gives the app and what you get, and under them the app's pages on app.wirl.dev.",
+  "",
+  "## What is where",
+  "",
+  "- `server.mjs`: the whole app, one module with one `fetch`. The page, the forms, who may change a note, and the nightly tidy-up.",
+  "- `migrations/0001_init.sql`: the tables, one statement a line. Put the next change in `migrations/0002_<what>.sql`.",
+  "- `wirl.json`: the app's name, its module, its nightly schedule, and that it is created private.",
+  "- `.claude/skills/wirl/SKILL.md`: how a coding agent works with wirl.",
+  "",
+  "## Run it on this computer",
+  "",
+  `    ${WIRL_BIN} dev`,
+  "",
+  "It prints the address to open, and a `curl` line that runs the nightly tidy-up now.",
+  "",
+  "## Make it yours",
+  "",
+  "The same six prompts as the page. Each is a whole prompt: paste it to your coding agent as it is. Go in order or skip around; the last one is the big one.",
+  "",
+  ...SUGGESTIONS.flatMap(({ number, title, capability, prompt, youGet, optional }) => {
+    const [bold, rest] = splitCapability(capability);
+    return [`### ${String(number)}. ${title}`, "", ...optional ? ["Optional. The big one.", ""] : [], `**${bold}** ${rest}`, "", `> ${prompt}`, "", `You get: ${youGet}`, ""];
+  })
+].join("\n");
+var STARTER_FILES = {
+  "server.mjs": SERVER_MODULE,
+  "migrations/0001_init.sql": STARTER_MIGRATION,
+  "README.md": README,
+  "wirl.json": starterManifest("starter")
+};
+
 // packages/cli/src/core.ts
 function credentialsPath(env = process.env) {
   return env["WIRL_CREDENTIALS_PATH"] || join5(homedir(), ".config", "wirl", "credentials.json");
@@ -7353,6 +7981,14 @@ async function loadCredentials(env = process.env) {
   }
   throw new CliError("Not signed in.", `Run \`${WIRL_BIN} login\` first, or set WIRL_TOKEN.`, { code: "not_signed_in" });
 }
+async function loadCredentialsIfAny(env = process.env) {
+  try {
+    return await loadCredentials(env);
+  } catch (error) {
+    if (error instanceof CliError && error.code === "not_signed_in") return null;
+    throw error;
+  }
+}
 async function saveCredentials(creds, env = process.env) {
   const path = credentialsPath(env);
   await mkdir3(dirname3(path), { recursive: true });
@@ -7633,23 +8269,23 @@ var INIT_MIGRATION = [
   ""
 ].join("\n");
 var INIT_MIGRATION_PATH = `${MIGRATIONS_DIR}/${ADOPTED_FILE}`;
-async function refuseInitMigrations(dir) {
+async function refuseInitMigrations(dir, flag) {
   for (const entry of await readdir(dir, { withFileTypes: true })) {
     if (entry.name.toLowerCase() !== MIGRATIONS_DIR) continue;
     if (entry.isSymbolicLink()) {
-      throw new CliError(`${entry.name}/ is a symbolic link, and wirl writes into no links: make migrations/ a real folder, then run wirl init --server again.`);
+      throw new CliError(`${entry.name}/ is a symbolic link, and wirl writes into no links: make migrations/ a real folder, then run wirl init ${flag} again.`);
     }
     if (entry.name !== MIGRATIONS_DIR) {
-      throw new CliError(`${entry.name}/ is spelled differently from migrations/: wirl reads migrations/ in lowercase only. Rename it, then run wirl init --server again.`);
+      throw new CliError(`${entry.name}/ is spelled differently from migrations/: wirl reads migrations/ in lowercase only. Rename it, then run wirl init ${flag} again.`);
     }
     if (!entry.isDirectory()) {
       throw new CliError(
-        `migrations is a file, and wirl init --server writes ${INIT_MIGRATION_PATH} into a folder of that name. Move it aside, then run wirl init --server again.`
+        `migrations is a file, and wirl init ${flag} writes ${INIT_MIGRATION_PATH} into a folder of that name. Move it aside, then run wirl init ${flag} again.`
       );
     }
     const names = await readdir(join5(dir, entry.name));
     if (names.some((name) => name.toLowerCase().endsWith(".sql"))) {
-      throw new CliError(`migrations/ already holds .sql files; wirl init --server writes ${INIT_MIGRATION_PATH} into a folder with none.`);
+      throw new CliError(`migrations/ already holds .sql files; wirl init ${flag} writes ${INIT_MIGRATION_PATH} into a folder with none.`);
     }
   }
 }
@@ -7694,23 +8330,52 @@ async function pulledDevCommand(dir) {
   }
   return `${needsInstall ? "npm install && " : ""}${WIRL_BIN} dev`;
 }
+function starterFile(path) {
+  const text = STARTER_FILES[path];
+  if (text === void 0) throw new Error(`starter.ts has no ${path}`);
+  return text;
+}
+function moduleKit(options) {
+  if (options.starter) {
+    return {
+      flag: "--starter",
+      files: ["server.mjs", INIT_MIGRATION_PATH, "README.md"].map((path) => [path, starterFile(path)]),
+      hint: "Run wirl init --starter in a new folder, or move the existing file."
+    };
+  }
+  if (options.server) {
+    return {
+      flag: "--server",
+      files: [
+        ["server.mjs", SERVER_TEMPLATE],
+        [INIT_MIGRATION_PATH, INIT_MIGRATION]
+      ],
+      hint: "Remove --server, or move the existing file."
+    };
+  }
+  return null;
+}
 async function scaffold(dir, options) {
+  if (options.server && options.starter) throw new CliError(STARTER_CONFLICT);
+  const kit = moduleKit(options);
   const written = [];
   await mkdir3(dir, { recursive: true });
-  if (options.server) {
-    const target = join5(dir, "server.mjs");
-    try {
-      await readFile3(target);
-      throw new CliError(`server.mjs already exists in ${dir}.`, "Remove --server, or move the existing file.");
-    } catch (error) {
-      if (error instanceof CliError) throw error;
-    }
-    await refuseInitMigrations(dir);
-    await writeFile2(target, SERVER_TEMPLATE, "utf8");
-    written.push("server.mjs");
-    await mkdir3(join5(dir, MIGRATIONS_DIR), { recursive: true });
-    await writeFile2(join5(dir, MIGRATIONS_DIR, ADOPTED_FILE), INIT_MIGRATION, { encoding: "utf8", flag: "wx" });
-    written.push(INIT_MIGRATION_PATH);
+  if (kit !== null) {
+    for (const [name] of kit.files) {
+      if (name === INIT_MIGRATION_PATH) continue;
+      try {
+        await readFile3(join5(dir, name));
+        throw new CliError(`${name} already exists in ${dir}.`, kit.hint);
+      } catch (error) {
+        if (error instanceof CliError) throw error;
+      }
+    }
+    await refuseInitMigrations(dir, kit.flag);
+    for (const [name, text] of kit.files) {
+      await mkdir3(dirname3(join5(dir, name)), { recursive: true });
+      await writeFile2(join5(dir, name), text, { encoding: "utf8", flag: "wx" });
+      written.push(name);
+    }
     const pkg = join5(dir, "package.json");
     if (await readFile3(pkg, "utf8").catch(() => null) === null) {
       await writeFile2(pkg, `${JSON.stringify({ name: options.app, private: true, type: "module" }, null, 2)}
@@ -7724,8 +8389,9 @@ async function scaffold(dir, options) {
     dir: ".",
     ...options.server ? { server: "server.mjs" } : {}
   };
-  await writeFile2(join5(dir, MANIFEST_NAME), `${JSON.stringify(manifest, null, 2)}
-`, "utf8");
+  const manifestText = kit?.flag === "--starter" ? starterManifest(options.app, options.org) : `${JSON.stringify(manifest, null, 2)}
+`;
+  await writeFile2(join5(dir, MANIFEST_NAME), manifestText, "utf8");
   const gitignore = join5(dir, ".gitignore");
   const existing = await readFile3(gitignore, "utf8").catch(() => "");
   const wanted = [".wirl/", ".env"].filter((line) => !existing.split("\n").includes(line));
@@ -7994,7 +8660,7 @@ async function callApi(creds, path, options = {}) {
     const body = parsed ?? {};
     const refusal = apiRefusal(parsed, response);
     if (response.status === 403 && body.error === "insufficient_scope" && body.message) {
-      throw new CliError(body.message, "Ask the person to do it in the dashboard, or reconnect with full access.", refusal);
+      throw new CliError(body.message, `Ask the person to do it in the dashboard, or run ${WIRL_BIN} login and tick full access on the approval page.`, refusal);
     }
     if (response.status === 403 && (body.error === "person_only" || body.error === "bad_confirmation") && body.message) {
       throw new CliError(body.message, void 0, refusal);
@@ -8038,7 +8704,7 @@ async function callApiBytes(creds, path, options = {}) {
       body = {};
     }
     if (response.status === 401 || response.status === 403) {
-      throw new CliError("Not signed in, or this token cannot do that.", `Try \`${WIRL_BIN} login\`.`);
+      throw new CliError("Not signed in, or this token cannot do that.", `Try \`${WIRL_BIN} login\`.`, { code: "unauthenticated" });
     }
     if (response.status === 404) throw new CliError("Not found, or you do not have access to it.");
     throw new CliError(body.message ?? body.error ?? `Request failed (${response.status}).`);
@@ -8195,6 +8861,11 @@ function manifestWarningLines(manifest) {
   const parsed = parseManifest(manifest);
   return parsed.ok ? parsed.warnings.map((warning) => `Warning: ${warning}`) : [];
 }
+function manifestVisibility(manifest) {
+  if (manifest === null || manifest === void 0) return void 0;
+  const parsed = parseManifest(manifest);
+  return parsed.ok ? parsed.manifest.visibility : void 0;
+}
 async function prepareDeployBundle(dir, manifest, door, projectDir) {
   let server;
   let rules = NO_MANIFEST;
@@ -8401,6 +9072,10 @@ function formatOrgLine(org) {
   return org.domain ? `${head}  ${org.domain}: new apps start visible to everyone in it` : `${head}  no company domain: new apps start private`;
 }
 var whoami = (creds) => callApi(creds, "/api/v1/me");
+function signedInSentence(me) {
+  const gave = (me.scope ?? "full") === "full" ? "full access" : "build-and-update";
+  return `Signed in (${gave}). Organisations: ${me.orgs.map((o) => o.slug).join(", ") || "none yet"}.`;
+}
 function chooseOrg(orgs, given, hint = 'Pass --org <slug>, or add "org" to wirl.json.') {
   const named = (given ?? "").trim();
   if (named) return named;
@@ -8414,13 +9089,25 @@ async function resolveAppsOrg(creds, orgFlag, manifestOrg) {
   return chooseOrg((await whoami(creds)).orgs, null);
 }
 var listApps = (creds, org) => callApi(creds, `/api/v1/orgs/${seg(org)}/apps`);
-var createRemoteApp = (creds, org, slug, name) => callApi(creds, `/api/v1/orgs/${seg(org)}/apps`, {
+var createRemoteApp = (creds, org, slug, name, visibility) => callApi(creds, `/api/v1/orgs/${seg(org)}/apps`, {
   method: "POST",
-  body: JSON.stringify({ slug, name: name ?? slug }),
+  // `visibility` rides along only when wirl.json said it: absent, the
+  // org's default holds. It applies to the app this create makes and to
+  // no other: an app that exists answers 409 and is left as it is.
+  body: JSON.stringify({ slug, name: name ?? slug, ...visibility === void 0 ? {} : { visibility } }),
   contentType: "application/json"
 });
-async function ensureRemoteApp(creds, org, app) {
-  return createRemoteApp(creds, org, app).then(() => true, (error) => {
+async function ensureRemoteApp(creds, org, app, visibility) {
+  return createRemoteApp(creds, org, app, void 0, visibility).then((created) => {
+    const made = created.app?.visibility;
+    if (visibility === "private" && typeof made === "string" && made !== "private") {
+      process.stderr.write(
+        `${terminalSafe(`wirl: asked for a private app, but ${org}/${app} was created visible to everyone in the organisation (an older control plane, or someone created it first). Change it with: wirl visibility private --org ${org} --app ${app}`)}
+`
+      );
+    }
+    return true;
+  }, (error) => {
     if (!(error instanceof CliError)) throw error;
     if (error.fields["code"] === "app_deleted") throw deletedNameError(error, app);
     if (error.fields["code"] === "app_exists" || error.fields["code"] === "app_moved") throw takenNameError(error, app);
@@ -8466,7 +9153,7 @@ function deletedAppMessage(org, app, done) {
   return `Deleted ${org}/${app}. Its address has stopped answering${runs}. Its data is kept until ${done.dataKeptUntil.slice(0, 10)}; until then wirl apps restore ${app} --org ${org} brings it back (one that was public comes back only from the Recently deleted list on the dashboard). Its name stays taken.`;
 }
 function deleteNeedsFullScopeMessage(apiOrigin, org, app) {
-  return `This sign-in can deploy, but not delete an app: deleting one needs a full-scope sign-in. Sign in with ${WIRL_BIN} login (with WIRL_TOKEN unset), or delete it on its Settings page: ${apiOrigin}/apps/${seg(org)}/${seg(app)}/settings`;
+  return `This sign-in can deploy, but not delete an app: deleting one needs a full-scope sign-in. Sign in with ${WIRL_BIN} login (with WIRL_TOKEN unset) and tick full access on the approval page, or delete it on its Settings page: ${apiOrigin}/apps/${seg(org)}/${seg(app)}/settings`;
 }
 var VISIBILITY_LEVELS = ["private", "org", "public"];
 function describeVisibility(level, org) {
@@ -9973,6 +10660,7 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "no-skill",
   "print",
   "server",
+  "starter",
   "force",
   "errors",
   "follow",
@@ -9994,7 +10682,7 @@ function commandFlags(listed2, everywhere = true) {
 }
 var COMMAND_FLAGS = /* @__PURE__ */ new Map([
   ["login", commandFlags({ values: ["token", "api"] })],
-  ["init", commandFlags({ booleans: ["server", "no-skill"] })],
+  ["init", commandFlags({ booleans: ["server", "starter", "no-skill"] })],
   ["skill", commandFlags({ booleans: ["print"] })],
   // Only what it lists, as DEV_FLAGS in bin.ts does (OIM-887): `--json` and `--app` were always refused here.
   ["dev", commandFlags({ values: ["user", "name", "role", "org", "port"], booleans: ["verbose"] }, false)],
@@ -10196,6 +10884,8 @@ function orMock(declared) {
 var MOCKS_FILE = join6(".wirl", "mocks.json");
 var MOCKS_FILE_MAX_BYTES = 65536;
 var MOCK_PLACEHOLDER = "wirl-dev-mock";
+var MODELS_MOCK = "ai";
+var isModelsMock = (mock) => mock.hosts.length === 1 && mock.hosts[0] === AI_HOST;
 var MOCKS_EXAMPLE = 'It should look like: { "anthropic": "http://127.0.0.1:4010" }';
 async function readBounded2(path, limit) {
   let handle;
@@ -10248,7 +10938,8 @@ async function readLocalMocks(dir, manifest) {
   for (const [slug, value] of Object.entries(parsed)) {
     const name = JSON.stringify(slug);
     const declared = manifest.connections.find((each) => each.slug === slug);
-    if (declared === void 0) {
+    const forModels = declared === void 0 && slug === MODELS_MOCK;
+    if (declared === void 0 && !forModels) {
       throw new CliError(`${path} maps ${name}, and wirl.json declares no connection called that.`, "Each name in it is a connection wirl.json declares.");
     }
     if (typeof value !== "string") {
@@ -10269,6 +10960,10 @@ async function readLocalMocks(dir, manifest) {
     if (base.search !== "" || base.hash !== "") {
       throw new CliError(`${path}: the base URL for ${name} has a query or a fragment; a call's own path and query are added to it.`);
     }
+    if (declared === void 0) {
+      mocks.set(slug, { slug, hosts: [AI_HOST], base });
+      continue;
+    }
     const hosts = declared.hosts ?? [];
     if (hosts.length === 0) {
       throw new CliError(`${path} maps ${name}, which declares no hosts in wirl.json, so no call could go to its mock.`);
@@ -10339,6 +11034,111 @@ function routeToMocks(manifest, mocks, real, toMock) {
     return toMock(mockTarget(mock.base, url), init);
   };
 }
+function forwardedHeaders(incoming) {
+  const out2 = new Headers();
+  incoming.forEach((value, name) => {
+    const lower = name.toLowerCase();
+    if (NOT_FORWARDED.has(lower) || lower.startsWith("x-wirl-")) return;
+    out2.set(name, value);
+  });
+  return out2;
+}
+var NOT_FORWARDED = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "host",
+  "connection",
+  "keep-alive",
+  "transfer-encoding",
+  "upgrade",
+  "te",
+  "trailer",
+  "content-length",
+  "accept-encoding"
+]);
+function passedOn(response) {
+  const headers = new Headers();
+  response.headers.forEach((value, name) => {
+    const lower = name.toLowerCase();
+    if (lower === "content-encoding" || lower === "content-length" || lower.startsWith("x-wirl-")) return;
+    headers.append(name, value);
+  });
+  return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+function reasonOf3(error) {
+  const cause = error instanceof Error ? error.cause : void 0;
+  if (typeof cause?.code === "string") return cause.code;
+  return error instanceof Error ? error.message : String(error);
+}
+function localModels(ai, mock, log) {
+  if (ai === void 0 && mock === null) return void 0;
+  const credentials = ai?.credentials ?? null;
+  let org = null;
+  const orgOnce = () => {
+    org ??= (ai?.org ?? (async () => null))().catch((error) => {
+      org = null;
+      throw error;
+    });
+    return org;
+  };
+  return async (request, _caller, target, body) => {
+    const said = `wirl dev \xB7 ai.wirl ${request.method} ${target.pathname}`;
+    const headers = forwardedHeaders(request.headers);
+    const sent = body === null || request.method === "GET" || request.method === "HEAD" ? null : body;
+    if (mock !== null) {
+      let response2;
+      try {
+        response2 = await fetch(mockTarget(mock, target), { method: request.method, headers, body: sent, redirect: "manual", signal: request.signal });
+      } catch (error) {
+        if (request.signal.aborted) throw error;
+        log(`${said} \u2192 mock unreachable (${reasonOf3(error)})`);
+        return aiRefusal(502, "ai_vendor_unreachable", "The ai mock could not be reached.");
+      }
+      log(`${said} \u2192 mock ${response2.status}`);
+      return passedOn(response2);
+    }
+    if (credentials === null) {
+      log(`${said} \u2192 ai_no_key 402 (not signed in)`);
+      return aiRefusal(402, "ai_no_key", "Run `wirl login` to use models locally.");
+    }
+    let slug;
+    try {
+      slug = await orgOnce();
+    } catch (error) {
+      if (error instanceof CliError && (error.code === "unauthenticated" || error.code === "not_signed_in")) {
+        log(`${said} \u2192 ai_no_key 402 (login not accepted)`);
+        return aiRefusal(402, "ai_no_key", "Run `wirl login` to use models locally.");
+      }
+      log(`${said} \u2192 ai_vendor_unreachable 502 (whoami failed)`);
+      return aiRefusal(502, "ai_vendor_unreachable", "app.wirl.dev could not be reached to find your organisation.");
+    }
+    if (slug === null) {
+      log(`${said} \u2192 ai_no_key 402 (no org in wirl.json)`);
+      return aiRefusal(402, "ai_no_key", 'Add "org" to wirl.json to say which organisation local model calls count against.');
+    }
+    headers.set("authorization", `Bearer ${credentials.token}`);
+    headers.set("x-wirl-org", slug);
+    headers.set("x-wirl-client", "cli");
+    let response;
+    try {
+      response = await (credentials.fetchImpl ?? fetch)(`${credentials.apiOrigin}/ai/_${target.pathname}${target.search}`, {
+        method: request.method,
+        headers,
+        body: sent,
+        redirect: "manual",
+        signal: request.signal
+      });
+    } catch (error) {
+      if (request.signal.aborted) throw error;
+      log(`${said} \u2192 ai_vendor_unreachable 502 (${reasonOf3(error)})`);
+      return aiRefusal(502, "ai_vendor_unreachable", "app.wirl.dev could not be reached for this model call.");
+    }
+    const answer = restoreStatus(response);
+    log(`${said} \u2192 ${answer.status}`);
+    return passedOn(answer);
+  };
+}
 async function toRequest(incoming, outgoing, origin) {
   const left = new AbortController();
   outgoing.once("close", () => {
@@ -10408,7 +11208,10 @@ async function startLocalBroker(options) {
     heldBodyLimits: options.heldBodyLimits,
     heldAnswerLimits: options.heldAnswerLimits
   });
-  const mocks = options.mocks ?? /* @__PURE__ */ new Map();
+  const allMocks = options.mocks ?? /* @__PURE__ */ new Map();
+  const modelsMock = [...allMocks.values()].find(isModelsMock);
+  const mocks = new Map([...allMocks].filter(([, mock]) => !isModelsMock(mock)));
+  const models = localModels(options.ai, options.ai?.mock ?? modelsMock?.base ?? null, log);
   const fetchImpl = mocks.size === 0 ? transport.fetchImpl : routeToMocks(
     options.manifest,
     mocks,
@@ -10441,7 +11244,8 @@ async function startLocalBroker(options) {
         flows: async (request, _caller, target) => {
           log(`wirl dev \xB7 flows.wirl ${request.method} ${target.pathname} \u2192 no_flows 404`);
           return noFlowsAnswer();
-        }
+        },
+        ...models === void 0 ? {} : { ai: models }
       });
       await send2(response, outgoing);
     } catch (error) {
@@ -10528,7 +11332,21 @@ async function dev(dir, options = {}) {
   }
   const keys = await readLocalKeys(dir);
   const mocks = await readLocalMocks(dir, parsed.manifest);
-  const broker = await startLocalBroker({ manifest: parsed.manifest, dir, log, mocks });
+  const credentials = await loadCredentialsIfAny();
+  const manifestOrg = (await loadManifest(dir))?.org ?? null;
+  const org = async () => {
+    if (manifestOrg !== null) return manifestOrg;
+    if (credentials === null) return null;
+    try {
+      return chooseOrg((await whoami(credentials)).orgs, null);
+    } catch (error) {
+      if (error instanceof CliError && (error.code === "no_org" || error.code === "missing_argument")) return null;
+      throw error;
+    }
+  };
+  const broker = await startLocalBroker({ manifest: parsed.manifest, dir, log, mocks, ai: { credentials, org } });
+  const modelsMock = parsed.manifest.connections.some((each) => each.slug === MODELS_MOCK) ? void 0 : mocks.get(MODELS_MOCK);
+  if (modelsMock !== void 0) log(`mock ${MODELS_MOCK}: calls to ${modelsMock.hosts.join(", ")} go to ${modelsMock.base.href}, with no token`);
   for (const declared of parsed.manifest.connections) {
     log(keyLine(declared, keys));
     const misshapen = keyShapeWarning(declared, keys);
@@ -10978,7 +11796,7 @@ var Restarts = class {
 init_src();
 var GRACE_DAYS = String(RETENTION.deletedAppGraceDays);
 var DEV_RELOAD_NOTE = `The server module, and every file it imports, is rebuilt and restarted at the same address when one of them changes, with a line on stderr each time; the app's own write to a file does not count. While a change does not build, it tries again every second, and whenever you save a file in the project, until it builds, so a new file or a package installed counts. wirl.json, .wirl/mocks.json and migrations/ are read once, at start, when migrations/ is applied to .wirl/local.sqlite: stop this and run it again after changing any of them. A change to migrations/ is said once on stderr and restarts nothing. Files in a "static" folder are read fresh on every request.`;
-var DEV_KEYS_NOTE = `Keys come from .wirl/keys.json, in the shape this prints for each connection that has none. To try a connection without its key, map it to a server of your own in .wirl/mocks.json, like { "anthropic": "http://127.0.0.1:4010" }. A call to one of that connection's declared hosts then goes to that URL instead, its path added to the URL's own and its query kept. It carries the key from .wirl/keys.json, or, when that has none, the placeholder "wirl-dev-mock" in the shape of the connection's kind. With no key there, an http_header connection sends no key header, since only .wirl/keys.json names the header, and a none connection never sends one. A host the connection does not declare is refused as before. .wirl/mocks.json is read once, at start, and never uploaded.`;
+var DEV_KEYS_NOTE = `Keys come from .wirl/keys.json, in the shape this prints for each connection that has none. To try a connection without its key, map it to a server of your own in .wirl/mocks.json, like { "anthropic": "http://127.0.0.1:4010" }. A call to one of that connection's declared hosts then goes to that URL instead, its path added to the URL's own and its query kept. It carries the key from .wirl/keys.json, or, when that has none, the placeholder "wirl-dev-mock" in the shape of the connection's kind. With no key there, an http_header connection sends no key header, since only .wirl/keys.json names the header, and a none connection never sends one. A host the connection does not declare is refused as before. .wirl/mocks.json is read once, at start, and never uploaded. Model calls to https://ai.wirl go to your account's allowance on app.wirl.dev while you are signed in (wirl login); they count against the org in wirl.json.`;
 var DEV_FLAGS_NOTE = "A flag not listed below, other than --help, is refused, not ignored.";
 var DEV_TWO_PEOPLE_NOTE = "To try two people on one app, run wirl dev a second time in the same folder with another --user: the two share .wirl/local.sqlite, so each sees what the other writes.";
 var PREVIEW_LINK_MINUTES = String(VISIT_TOKEN_TTL_SECONDS / 60);
@@ -10988,6 +11806,7 @@ var USAGE = `wirl \u2014 deploy an app somewhere real, behind a sign-in
 
   wirl login                    Sign in from this terminal (or --token wirl_...)
   wirl init [dir] [--server]    Create wirl.json, and a working server module with --server
+  wirl init [dir] --starter     Write your first app: a small team noticeboard, ready to deploy
   wirl skill [dir] [--print]    Write the skill file a coding agent reads (init does this too; --no-skill to skip)
   wirl dev [dir]                Run the app here, signed in as a stub user
   wirl deploy [dir]             Build, scan and deploy (creates the app if new)
@@ -11051,14 +11870,18 @@ var HELP = {
     example: "wirl login"
   },
   init: {
-    usage: ["wirl init [dir] [--server] [--app <name>] [--org <slug>] [--no-skill]"],
+    usage: ["wirl init [dir] [--server|--starter] [--app <name>] [--org <slug>] [--no-skill]"],
     flags: [
       { flag: "--app <name>", desc: "App slug. Defaults to the directory name." },
       { flag: "--org <slug>", desc: "Organisation to put in wirl.json." },
       { flag: "--server", desc: "Also write server.mjs, a working backend to build on." },
+      {
+        flag: "--starter",
+        desc: "Write your first app instead: a team noticeboard that shows what wirl does, private to you when deployed. Without [dir], the folder is <your-name>-starter."
+      },
       { flag: "--no-skill", desc: "Skip writing the skill file a coding agent reads." }
     ],
-    example: "wirl init my-app --server"
+    example: "wirl init --starter\n  wirl init my-app --server"
   },
   skill: {
     usage: ["wirl skill [dir] [--print]"],
@@ -11502,6 +12325,13 @@ async function resolveTarget(creds, args2, dir) {
   return { org: String(org), app };
 }
 var args = parseArgs(process.argv.slice(2).map((token) => token === "-h" ? "--help" : token));
+async function starterFolder() {
+  const creds = await loadCredentials().catch(() => null);
+  if (creds === null) return starterName(null);
+  const me = await whoami(creds).catch(() => null);
+  if (me === null) err("Could not read your account, so the starter is named starter.");
+  return starterName(me?.email ?? null);
+}
 async function main() {
   const json2 = args.flags.has("json");
   if (process.argv[2] === "--version" || process.argv[2] === "-v") {
@@ -11542,23 +12372,28 @@ async function main() {
     const creds2 = await pollDeviceLogin(apiOrigin, login);
     const path = await saveCredentials(creds2);
     const me = await whoami(creds2);
-    out(`Signed in. Organisations: ${me.orgs.map((o) => o.slug).join(", ") || "none yet"}.`);
+    out(signedInSentence(me));
     out(`Saved to ${path}`);
     return 0;
   }
   if (args.command === "init") {
     refuseBadFlags(args);
     refuseExtraPositionals("init", args.positional, 1, "one folder", { hint: folderHint("The app's name goes after --app <name>.") });
-    const dir = resolve6(args.positional[0] ?? ".");
+    const starter = args.flags.has("starter");
+    if (starter && args.flags.has("server")) throw new CliError(STARTER_CONFLICT);
+    const dir = resolve6(args.positional[0] ?? (starter ? await starterFolder() : "."));
     const app = String(args.flags.get("app") ?? basename4(dir));
     const written = await scaffold(dir, {
       app,
       ...args.flags.has("org") ? { org: String(args.flags.get("org")) } : {},
       server: args.flags.has("server"),
+      starter,
       skill: !args.flags.has("no-skill")
     });
     for (const file of written) out(`Wrote ${file}`);
     if (args.flags.has("server")) out("Deploy it with: wirl deploy");
+    const folder = relative3(process.cwd(), dir);
+    if (starter) out(`Deploy it with: ${folder === "" ? "" : `cd ${shellPath(folder)} && `}wirl deploy`);
     return 0;
   }
   if (args.command === "skill") {
@@ -11664,7 +12499,7 @@ async function main() {
       const upload = { dir, projectDir: project.manifestDir, org: target.org, app: target.app, ...manifest === null ? {} : { manifest } };
       const prepared = await prepareUpload(dir, upload.manifest, "wirl deploy", upload.projectDir);
       for (const line of prepared.notices) err(line);
-      const made = !args.flags.has("no-create") && await ensureRemoteApp(creds, target.org, target.app);
+      const made = !args.flags.has("no-create") && await ensureRemoteApp(creds, target.org, target.app, manifestVisibility(manifest));
       const terminal = terminalMayConfirm({ stdinIsTTY: process.stdin.isTTY, stdoutIsTTY: process.stdout.isTTY, stderrIsTTY: process.stderr.isTTY, json: json2 }) ? personAt(process.stdin, process.stderr) : void 0;
       const result = await deploy(creds, { ...upload, prepared, ...terminal === void 0 ? {} : { terminal } }).catch((error) => {
         throw withMadeApp(error, made, "wirl deploy", target.app);
@@ -11725,7 +12560,7 @@ async function main() {
       const upload = { dir, projectDir: project.manifestDir, org: target.org, app: target.app, name: resolved, ...manifest === null ? {} : { manifest } };
       const prepared = await prepareUpload(dir, upload.manifest, "wirl preview", upload.projectDir);
       for (const line of prepared.notices) err(line);
-      const made = !args.flags.has("no-create") && await ensureRemoteApp(creds, target.org, target.app);
+      const made = !args.flags.has("no-create") && await ensureRemoteApp(creds, target.org, target.app, manifestVisibility(manifest));
       const result = await deployPreview(creds, { ...upload, prepared }).catch((error) => {
         throw withMadeApp(error, made, "wirl preview", target.app);
       });