diff --git a/examples/white-label-minimal/.env.example b/examples/white-label-minimal/.env.example
index 50cf776..ead90e2 100644
--- a/examples/white-label-minimal/.env.example
+++ b/examples/white-label-minimal/.env.example
@@ -3,17 +3,16 @@ GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 DATABASE_URL=
 DIRECT_URL=
-# Workspace key; it also needs the apps:watch scope for live builder updates.
+# Personal access token of the integration account, created in your enterprise
+# workspace with access to all apps and full permission.
+BASE44_ACCESS_TOKEN=
+BASE44_WORKSPACE_ID=
+# Workspace API key for live updates (apps:watch) and for signing builders into
+# their latest build (Provision app users, Mint embed sign-in tokens).
 BASE44_SVC_KEY=
-BASE44_ORG_ID=
 # Set to your Base44 HTTPS origin.
 BASE44_PLATFORM_HOST=
 # Set NEXTAUTH_URL explicitly, including in local development.
 NEXTAUTH_URL=http://127.0.0.1:3001
-# Exact HTTPS origin in production; leave empty for localhost.
-BUILDER_ORIGIN=
 # Optional: use Sunny's existing OAuth callback with a shared NEXTAUTH_SECRET.
 AUTH_REDIRECT_PROXY_URL=
-
-# Static preview hosting domain; confirm for your Base44 environment.
-BASE44_STATIC_PREVIEW_DOMAIN=
diff --git a/examples/white-label-minimal/AGENTS.md b/examples/white-label-minimal/AGENTS.md
index 643577d..fc7ad3c 100644
--- a/examples/white-label-minimal/AGENTS.md
+++ b/examples/white-label-minimal/AGENTS.md
@@ -1,3 +1,18 @@
+# Tiny Sunny
+
+This example is read by developers who just read the
+[white label docs](https://docs.base44.com/developers/white-label/overview), and its snippets go
+into integration guides. Write it the way a careful developer would write a guide.
+
+- **One Base44 call, one function.** Each function shows its request in the open: path, method,
+  body. A reader should be able to paste it into a guide as it is.
+- **Name things after the docs.** Use the step and field names the docs use.
+- **Plain control flow.** `if` statements on one clear state, not chained ternaries or clever helpers.
+  Prefer a few obvious lines over one dense line.
+- **Guard only what matters.** Keep the token on the server, check app ownership, filter what goes to
+  the browser, keep `X-Request-ID` stable. Skip checks for states that cannot happen.
+- **Comments say why, briefly.** No comment that repeats the code.
+
 <!-- BEGIN:nextjs-agent-rules -->
 
 # This is NOT the Next.js you know
diff --git a/examples/white-label-minimal/README.md b/examples/white-label-minimal/README.md
index 474ca27..3d4f65e 100644
--- a/examples/white-label-minimal/README.md
+++ b/examples/white-label-minimal/README.md
@@ -1,12 +1,31 @@
 # Tiny Sunny
 
-A minimal Base44 integration: sign in, connect a workspace, create an app,
-chat with the builder, answer its questions, preview, and publish.
+A minimal Base44 integration: sign in, create an app, chat with the builder,
+answer its questions, preview, and publish.
 
-This example uses the [service-user tenancy model](https://base44-docs-white-label-rewrite.mintlify.site/white-label/tenancy-and-credentials#service-users).
-Each builder gets a Base44 service user that owns their apps. Your backend provisions
-that identity using a workspace API key, then uses the service user's access token
-to create and manage apps. Both credentials stay on the server.
+It follows Base44's [tenancy model](https://docs.base44.com/developers/white-label/tenancy-and-credentials):
+one Base44 account owns every app, and your server calls Base44 with that account's
+personal access token. Base44 cannot tell your builders apart, so Tiny keeps them
+apart itself: it records which builder owns each app and checks that on every call.
+The token never reaches the browser.
+
+## From the docs to the code
+
+If you have read the [white label docs](https://docs.base44.com/developers/white-label/overview),
+each part of them lives in one place here:
+
+| Docs | Code |
+| --- | --- |
+| [Tenancy and credentials](https://docs.base44.com/developers/white-label/tenancy-and-credentials) | [server/base44/config.ts](server/base44/config.ts), [server/base44/request.ts](server/base44/request.ts) |
+| Keeping builders apart | [server/actions.ts](server/actions.ts), [server/ownership.ts](server/ownership.ts) |
+| [The build turn](https://docs.base44.com/developers/white-label/the-build-turn), steps 1–6 | [server/base44/build-turn.ts](server/base44/build-turn.ts), one function per call, numbered by step |
+| Watch it build (live, instead of polling) | [server/base44/live-updates.ts](server/base44/live-updates.ts), [client/useBuildTurn.ts](client/useBuildTurn.ts) |
+| Answer the agent's questions | [components/Question.tsx](client/components/Question.tsx), one UI per `waiting_on.kind` |
+| Publish the app | `publish()` in [components/Builder.tsx](client/components/Builder.tsx) |
+| [Embed the app](https://docs.base44.com/developers/white-label/embed-the-app) | [server/base44/embed.ts](server/base44/embed.ts), used for every preview |
+| [Custom instructions](https://docs.base44.com/developers/white-label/custom-instructions) | [server/base44/custom-instructions.ts](server/base44/custom-instructions.ts) |
+
+Everything else is Tiny's own product: sign-in, the app list, and the chat UI.
 
 ## Run locally
 
@@ -18,65 +37,62 @@ cp examples/white-label-minimal/.env.example examples/white-label-minimal/.env.l
 ```
 
 Fill in `.env.local` with Sunny's Google OAuth credentials, Auth.js secret,
-migrated Prisma database, and Base44 workspace service key. Keep `NEXTAUTH_URL`
-set to `http://127.0.0.1:3001`, then run:
+migrated Prisma database, and the integration account's
+[personal access token](https://docs.base44.com/Workspaces/Personal-access-tokens) and workspace ID.
+Create the token in your enterprise workspace, with access to all apps and full permission.
+Live chat updates also need a workspace API key with the `apps:watch` scope (`BASE44_SVC_KEY`).
+Keep `NEXTAUTH_URL` set to `http://127.0.0.1:3001`, then run:
 
 ```sh
 npm run minimal:dev
 ```
 
-Open [Tiny Sunny](http://127.0.0.1:3001), sign in, and select **Connect workspace**.
-Apps are saved in Sunny's ownership table, so existing apps in the same database
-and workspace are available here too.
+Open [Tiny Sunny](http://127.0.0.1:3001) and sign in.
 
 ## Copy the integration
 
-| Folder | Responsibility |
+| Folder | What runs there |
 | --- | --- |
-| `lib/base44/` | Base44 API calls, identity lifecycle, and custom instructions |
-| `lib/server/` | Authentication and request handling |
-| `lib/storage/` | Database access and app ownership |
-| `lib/chat/` | Browser API calls and conversation helpers |
-| `lib/types.ts` | Shared types |
-
-Start with [lib/base44/client.ts](lib/base44/client.ts). It contains the Base44
-endpoints and request payloads for creation, conversation, tool answers, preview,
-and publishing. Copy it with `lib/base44/config.ts`, `lib/base44/error.ts`,
-`lib/base44/custom-instructions.ts`, and `lib/types.ts`. It uses `fetch` and `server-only`, with
+| `server/` | The server: Base44 calls ([server/base44/](server/base44)), server actions, sign-in, and app ownership |
+| `client/` | The browser: the build turn's state, live updates, and the UI components |
+| `app/` | Next.js routes only: the page, its layout, and the sign-in callback |
+| `types.ts` | Types both sides share |
+
+Start with [server/base44/build-turn.ts](server/base44/build-turn.ts). It has one function per Base44 call,
+numbered by the step of the build turn: create, send a prompt, watch, answer, and publish.
+[embed.ts](server/base44/embed.ts) and [live-updates.ts](server/base44/live-updates.ts) cover the other two docs
+pages, and [request.ts](server/base44/request.ts) is the `fetch` they share. Copy them with
+`server/base44/config.ts`, `server/base44/error.ts`, `server/base44/custom-instructions.ts`, and `types.ts`. Every endpoint it calls is described in
+Base44's [Apps API reference](https://docs.base44.com/developers/references/apps-api/get-started/overview), which also links the OpenAPI spec if you prefer to generate a typed client. It uses `fetch` and `server-only`, with
 no Sunny imports. Set `BASE44_PLATFORM_HOST` to your Base44 HTTPS origin and
-adapt `lib/base44/custom-instructions.ts` to your product. New apps use the first 80
+adapt `server/base44/custom-instructions.ts` to your product. New apps use the first 80
 characters of the prompt as their initial name.
 
 For a complete browser integration, follow this path:
 
 ```text
-components/Builder.tsx → lib/chat/builder-api.ts → app/api/base44/route.ts
-  → lib/server/api-handler.ts → lib/server/app-service.ts → lib/base44/client.ts
+client/components/Builder.tsx → server/actions.ts → server/base44/build-turn.ts
 ```
 
-[lib/server/app-service.ts](lib/server/app-service.ts) is where your application plugs in:
+[server/actions.ts](server/actions.ts) holds Tiny's server actions, and is where your application plugs in:
 
-- [server/auth.ts](lib/server/auth.ts) supplies the verified user from your session.
-- [base44/identity.ts](lib/base44/identity.ts) provisions a service user, mints its token,
-  and refreshes it near expiry.
-- [storage/app-repository.ts](lib/storage/app-repository.ts) saves ownership and scopes app access to that user.
+- [server/auth.ts](server/auth.ts) supplies the verified user from your session.
+- [server/ownership.ts](server/ownership.ts) records which builder created each app, and checks it.
 
-[prisma/schema.prisma](prisma/schema.prisma) defines identity links and app ownership.
-[lib/storage/db.ts](lib/storage/db.ts) connects through `DATABASE_URL`. The Prisma client is generated
+[prisma/schema.prisma](prisma/schema.prisma) defines app ownership.
+[server/db.ts](server/db.ts) connects through `DATABASE_URL`. The Prisma client is generated
 on install and build; run `npm run db:generate` from the example after schema edits.
 
-Google login and Base44 connection are separate. `/api/base44/connection`
-provisions a service principal using the workspace key. Builder requests use its
-stored token; they do not provision identities or send credentials to the browser.
-The API handler validates requests and checks app ownership before app operations.
+Every Base44 call sends `Authorization: Bearer <token>` and `X-Active-Workspace-Id`, and
+new apps are created with `organization_id`, so they use your workspace's design system,
+skills, and plan. Each server action checks who is signed in and, for an app, that they own it,
+before it calls Base44.
 
-For the chat UI, copy `components/`, `lib/chat/`, and `lib/base44/socket-session.ts`.
-The chat uses assistant-ui's external-store runtime with Base44's live updates as its
-source of truth (see below). `Question.tsx` handles
+In the browser, [client/useBuildTurn.ts](client/useBuildTurn.ts) is the whole build turn: it opens
+live updates, sends prompts and answers questions. The components only show it. The chat uses
+assistant-ui's external-store runtime with Base44's live updates as its source of truth (see below). `Question.tsx` handles
 approvals, choices, and secrets; retries preserve the original answer and request ID.
-Preview URLs stay in page memory and remain stable during normal use. A timed-out
-creation may still succeed, so the UI asks users to check before creating again.
-An app can only be resumed here if its ownership was saved successfully.
+A timed-out creation may still succeed, and the error says so.
 
 ## Live builder updates
 
@@ -84,28 +100,27 @@ The chat updates live over the Base44 platform socket, through the Platform SDK,
 [`@base44/platform`](https://github.com/base44/javascript-sdk/tree/main/packages/platform).
 
 ```text
-components/useBuilderSocket.ts → lib/chat/live-updates.ts → @base44/platform
-lib/chat/builder-api.ts → app/api/base44/route.ts → lib/base44/socket-session.ts
+client/useBuildTurn.ts → server/actions.ts → server/base44/live-updates.ts
+client/useBuildTurn.ts → @base44/platform
 ```
 
-1. **Server** ([socket-session.ts](lib/base44/socket-session.ts)): after the usual
+1. **Server** ([server/base44/live-updates.ts](server/base44/live-updates.ts)): after the usual
    sign-in and app-ownership checks, opens a read-only session for one app with the
    workspace key. `BASE44_SVC_KEY` needs the `apps:watch` scope. Only the session
    token reaches the browser.
-2. **Browser** ([live-updates.ts](lib/chat/live-updates.ts)): connects with that
-   token and subscribes to the app. A snapshot (status and the last 50 messages)
-   arrives on every connect; then `message.updated`, `message.removed` and
-   `app.status_changed` keep the chat current.
-3. **React** ([useBuilderSocket.ts](components/useBuilderSocket.ts)): holds the
-   state and shows one error with **Reconnect live updates** if the connection stops.
+2. **Browser** ([useBuildTurn.ts](client/useBuildTurn.ts), step 2): creates the platform
+   client with that token and subscribes to the app. A snapshot (status and the last 50
+   messages) arrives on every connect; then `message.updated`, `message.removed` and
+   `app.status_changed` keep the chat current. If the connection stops, the builder sees
+   one error with **Reconnect live updates**.
 
 Kept out to stay minimal; add them in production:
 
 - The session is not closed on leave; it expires after an hour. Workspace keys have
   a limit on open sessions, so close it (`DELETE /api/service/socket-sessions/{id}`)
   when the builder unmounts.
-- The chat shows the last 50 messages. Load older ones over HTTP
-  (`getConversation`) if you need full history.
+- The chat shows the last 50 messages. Load older ones with
+  [Read conversation messages](https://docs.base44.com/api-reference/read-conversation-messages) if you need full history.
 - Generated images stay as placeholders until the next reconnect (`image.resolved`).
 
 ## Deploy to Netlify
@@ -115,7 +130,7 @@ as the package directory. Its `netlify.toml` builds the example without running
 migrations; use an already migrated Sunny database.
 
 Set the variables from `.env.example` for builds and production functions.
-Set `NEXTAUTH_URL` and `BUILDER_ORIGIN` to your deployment's exact HTTPS origin.
+Set `NEXTAUTH_URL` to your deployment's exact HTTPS origin.
 Register `<origin>/api/auth/callback/google` with your Google OAuth client, or
 set `AUTH_REDIRECT_PROXY_URL=https://sunny44.com/api/auth` and use Sunny's Google
 client and `NEXTAUTH_SECRET` for its existing redirect proxy.
@@ -132,33 +147,19 @@ npm run minimal:build
 API tests cover session checks, ownership, validation, and upstream failures.
 Browser tests use a separate fixture app with mocked Base44 responses.
 
-### Static and live previews
-
-Browsing uses `https://preview--{slug}.{BASE44_STATIC_PREVIEW_DOMAIN}`. Set
-`BASE44_STATIC_PREVIEW_DOMAIN` to the preview hosting domain confirmed for your
-Base44 environment. Without it, browsing uses screenshots or placeholders. This URL is derived by Tiny, not returned by Base44.
-Apps without a slug show a screenshot or placeholder; browsing never starts a sandbox.
-Editing requests a live preview and keeps static visible until the live iframe loads.
-A load event only controls the visual transition; it does not verify app health.
-Edited widgets remain live for the page session instead of silently switching to a
-potentially stale static build. Recovery checks the source window and live origin of `preview:requestRefresh` messages, with at most three recovery attempts per preview session and no retries on authorization failures. This observed Base44 message is not a confirmed public contract, so manual refresh remains available. Recovery reloads the iframe using its last parent-supplied path and parameters; cross-origin navigation inside the app cannot be preserved without a supported bridge. No private
-build-status, runtime-auth, or heartbeat endpoints are used.
-
-### Reusing the preview component
-
-`components/Base44Preview.tsx` owns static/live rendering, loading, recovery, and manual refresh. It depends only on React. `PreviewFrame` adapts Tiny's app model and backend client to its props:
-
-```tsx
-<Base44Preview
-  appId={app.id}
-  title="App preview"
-  staticUrl={app.static_preview_url}
-  screenshotUrl={app.preview_screenshot_url}
-  live={editing}
-  loadPreview={getPreviewUrl}
-/>
-```
+### Latest build and live previews
+
+Every preview is the app signed in as the builder, through
+[Embed the app](https://docs.base44.com/developers/white-label/embed-the-app)
+([server/base44/embed.ts](server/base44/embed.ts)). The builder is not a Base44 user, so
+without it a private app would show its own sign-in page inside the frame.
 
-`loadPreview(appId)` calls your authenticated backend and returns `{ url }`. Reject with an error carrying `status: 401` or `403` to stop automatic recovery on authorization failures. Keep platform credentials on the backend. Changing the app or live mode starts a new preview session; changing the callback does not reload the iframe.
+- **Latest build** (`target: "latest_preview"`): app cards, and the stage until the live preview
+  loads. It needs no sandbox. Before the first build there is no URL, and the card shows the
+  screenshot or a placeholder.
+- **Live preview** (`target: "live_preview"`): while editing. It runs the app's sandbox and shows
+  each change as the agent makes it.
 
-When copying the component, include the `preview-frame`, `preview-loading-frame`, `preview-fallback`, `preview-controls`, `preview-spinner`, `widget-placeholder`, and `secondary` styles from `app/globals.css`, or provide equivalent styles and a sized parent container.
+Each URL works once and expires in 60 seconds, so [AppPreview](client/components/AppPreview.tsx)
+asks for a new one whenever it loads a frame, and again on **Refresh preview**. While editing, the
+latest build stays visible until the live preview has loaded.
diff --git a/examples/white-label-minimal/app/api/auth/[...nextauth]/route.ts b/examples/white-label-minimal/app/api/auth/[...nextauth]/route.ts
index 2163731..ea67a23 100644
--- a/examples/white-label-minimal/app/api/auth/[...nextauth]/route.ts
+++ b/examples/white-label-minimal/app/api/auth/[...nextauth]/route.ts
@@ -1,2 +1,2 @@
-import { handlers } from "../../../../lib/server/auth";
+import { handlers } from "../../../../server/auth";
 export const { GET, POST } = handlers;
diff --git a/examples/white-label-minimal/app/api/base44/connection/route.ts b/examples/white-label-minimal/app/api/base44/connection/route.ts
deleted file mode 100644
index afe3caa..0000000
--- a/examples/white-label-minimal/app/api/base44/connection/route.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import { requireUser } from "../../../../lib/server/auth";
-import { connect, disconnect, getLink, linkStatus } from "../../../../lib/base44/identity";
-import { Base44Error } from "../../../../lib/base44/error";
-
-const headers = { "Cache-Control": "no-store, private" };
-
-export async function POST(request: Request) {
-  const origin = request.headers.get("origin");
-  const allowed = process.env.BUILDER_ORIGIN || new URL(request.url).origin;
-  if (origin !== allowed)
-    return Response.json(
-      { error: "This request origin is not allowed." },
-      { status: 403, headers },
-    );
-  try {
-    const actor = await requireUser();
-    const payload = await request.json().catch(() => null);
-    let result;
-    switch (payload?.action) {
-      case "status":
-        result = linkStatus(await getLink(actor.email));
-        break;
-      case "connect":
-        result = await connect(actor.email);
-        break;
-      case "disconnect":
-        result = await disconnect(actor.email);
-        break;
-      default:
-        return Response.json({ error: "Invalid connection action." }, { status: 400, headers });
-    }
-    return Response.json(result, { headers });
-  } catch (error) {
-    if (error instanceof Base44Error)
-      return Response.json({ error: error.message }, { status: error.status, headers });
-    return Response.json(
-      { error: "Could not update your Base44 connection." },
-      { status: 500, headers },
-    );
-  }
-}
diff --git a/examples/white-label-minimal/app/api/base44/route.ts b/examples/white-label-minimal/app/api/base44/route.ts
deleted file mode 100644
index efcc9c3..0000000
--- a/examples/white-label-minimal/app/api/base44/route.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { createHandler } from "../../../lib/server/api-handler";
-import { getAppClient } from "../../../lib/server/app-service";
-
-export const runtime = "nodejs";
-export const maxDuration = 180;
-export const POST = createHandler(getAppClient);
diff --git a/examples/white-label-minimal/app/globals.css b/examples/white-label-minimal/app/globals.css
index ada2421..e20c719 100644
--- a/examples/white-label-minimal/app/globals.css
+++ b/examples/white-label-minimal/app/globals.css
@@ -43,8 +43,10 @@ textarea,
 a {
   font: inherit;
 }
-button {
+button,
+a.button {
   display: inline-flex;
+  text-decoration: none;
   align-items: center;
   justify-content: center;
   gap: 8px;
@@ -147,23 +149,6 @@ h1 {
   grid-template-columns: repeat(auto-fit, minmax(min(100%, 360px), 1fr));
   gap: 20px;
 }
-.app-thumbnail {
-  display: flex;
-  width: 100%;
-  aspect-ratio: 4 / 3;
-  border: 0;
-  border-radius: 0;
-  padding: 0;
-  background: #edf0f4;
-  color: #c0c7d2;
-  font-size: 54px;
-  font-weight: 400;
-}
-.app-thumbnail img {
-  width: 100%;
-  height: 100%;
-  object-fit: cover;
-}
 .empty-state {
   min-height: 330px;
   display: flex;
@@ -183,10 +168,6 @@ h1 {
   font-size: 13px;
   margin-bottom: 24px;
 }
-.load-more {
-  display: flex;
-  margin: 30px auto;
-}
 .error,
 .builder aside {
   background: #fff2e7;
@@ -426,7 +407,7 @@ iframe {
 .composer > small { width: 100%; }
 .delivery { display: flex; flex-direction: column; align-items: flex-start; gap: 10px; margin: 16px 0 8px 34px; padding: 14px 16px; border: 1px solid var(--border); background: white; border-radius: 8px; }
 .delivery strong { font-size: 13px; font-weight: 600; }
-.delivery button { align-self: stretch; font-size: 12px; padding: 9px 12px; border-radius: 4px; }
+.delivery button, .delivery .button { align-self: stretch; font-size: 12px; padding: 9px 12px; border-radius: 4px; }
 .ready-badge { display: inline-flex; align-items: center; gap: 5px; margin: 0; padding: 3px 8px 3px 6px; border-radius: 999px; background: var(--ready-surface); color: var(--ready-ink); font-size: 11px; font-weight: 500; line-height: 1; }
 .build-progress { display: flex; align-items: center; gap: 8px; color: var(--muted); font-size: 12px; margin: 12px 0 12px 34px; }
 .builder > details, .builder > aside { max-height: 35%; overflow: auto; flex-shrink: 0; margin: 12px; }
@@ -451,9 +432,6 @@ iframe {
 @media (max-width: 600px) { .widget-actions button { min-width: 40px; min-height: 40px; } .widget-heading { padding: 8px; } .widget-preview { height: 420px; } }
 
 .preview-frame { position: relative; height: 100%; min-height: 240px; display: flex; flex-direction: column; }
-/* Base44Preview depends only on React, so its spinner is a styled element
-   rather than an icon import. */
-.preview-spinner { width: 18px; height: 18px; border: 2px solid var(--border); border-top-color: var(--muted); border-radius: 50%; animation: spin 0.8s linear infinite; }
 .preview-frame iframe { flex: 1; min-height: 0; width: 100%; margin: 0; border: 0; }
 .preview-frame .preview-loading-frame { position: absolute; inset: 0; visibility: hidden; width: 100%; height: 100%; }
 .preview-fallback { flex: 1; min-height: 0; width: 100%; object-fit: contain; }
diff --git a/examples/white-label-minimal/app/page.tsx b/examples/white-label-minimal/app/page.tsx
index eb7d0cd..50578eb 100644
--- a/examples/white-label-minimal/app/page.tsx
+++ b/examples/white-label-minimal/app/page.tsx
@@ -1,7 +1,7 @@
-import { getSessionUser } from "../lib/server/auth";
-import GoogleSignInButton from "../components/GoogleSignInButton";
-import TinySunnyLogo from "../components/TinySunnyLogo";
-import Workspace from "../components/Workspace";
+import { getSessionUser } from "../server/auth";
+import GoogleSignInButton from "../client/components/GoogleSignInButton";
+import TinySunnyLogo from "../client/components/TinySunnyLogo";
+import Workspace from "../client/components/Workspace";
 
 export default async function Page() {
   const user = await getSessionUser();
diff --git a/examples/white-label-minimal/client/chat-state.ts b/examples/white-label-minimal/client/chat-state.ts
new file mode 100644
index 0000000..eaa6c30
--- /dev/null
+++ b/examples/white-label-minimal/client/chat-state.ts
@@ -0,0 +1,42 @@
+import type { App, Message } from "../types";
+
+// Where the build turn stands, from the builder's point of view.
+export type ChatState =
+  | "loading"   // the chat has not arrived yet
+  | "paused"    // live updates stopped
+  | "question"  // the agent waits for the builder's answer
+  | "building"  // the agent is working
+  | "failed"    // the last build failed
+  | "ready"     // the app is built and can be published
+  | "idle";     // waiting for a prompt
+
+export function getChatState(app: App | null, messages: Message[], loading: boolean, liveError: string): ChatState {
+  if (loading) return "loading";
+  if (liveError) return "paused";
+  if (hasOpenQuestion(messages)) return "question";
+  if (app?.status?.state === "processing") return "building";
+  if (app?.status?.state === "error") return "failed";
+  if (app?.status?.state === "ready" && hasBuiltCode(messages)) return "ready";
+  return "idle";
+}
+
+function hasOpenQuestion(messages: Message[]) {
+  return messages.some((message) =>
+    message.tool_calls?.some((tool) => tool.status === "waiting_for_user_input"));
+}
+
+// "ready" alone also follows a greeting-only reply or an answer, so the app
+// counts as built only once the latest turn has written code and finished.
+function hasBuiltCode(messages: Message[]) {
+  if (messages.at(-1)?.role !== "assistant") return false;
+
+  const lastPrompt = messages.findLastIndex((message) => message.role === "user");
+  const latestTurn = messages.slice(lastPrompt + 1);
+  const stillWorking = latestTurn.some((message) =>
+    message.tool_calls?.some((tool) => tool.status === "pending" || tool.status === "running"));
+  if (stillWorking) return false;
+
+  return latestTurn.some((message) =>
+    message.tool_calls?.some((tool) =>
+      (tool.name === "write_file" || tool.name === "find_replace") && tool.status === "success"));
+}
diff --git a/examples/white-label-minimal/client/components/AppPreview.tsx b/examples/white-label-minimal/client/components/AppPreview.tsx
new file mode 100644
index 0000000..8144f4f
--- /dev/null
+++ b/examples/white-label-minimal/client/components/AppPreview.tsx
@@ -0,0 +1,98 @@
+"use client";
+import { useEffect, useState } from "react";
+import * as actions from "../../server/actions";
+import type { App } from "../../types";
+import { unwrap } from "../unwrap";
+
+const frameProps = {
+  referrerPolicy: "no-referrer",
+  sandbox: "allow-scripts allow-same-origin allow-forms allow-popups",
+} as const;
+
+// An app shown inside Tiny, signed in as the builder ("Embed the app").
+// It shows the latest build. While editing (live), the running sandbox loads
+// behind it and takes over once loaded. Each URL works once, so every load and
+// every refresh asks the server for a new one.
+export default function AppPreview({ app, title, live = false, showControls = true }: {
+  app: App;
+  title: string;
+  live?: boolean;
+  showControls?: boolean;
+}) {
+  const building = app.status?.state === "processing";
+  const [latestUrl, setLatestUrl] = useState<string | null>(null);
+  const [liveUrl, setLiveUrl] = useState<string | null>(null);
+  const [liveLoaded, setLiveLoaded] = useState(false);
+  const [error, setError] = useState("");
+  const [attempt, setAttempt] = useState(0);
+
+  // The latest build. It needs no sandbox; before the first build there is none.
+  useEffect(() => {
+    if (building) return;
+    let current = true;
+    unwrap(actions.getLatestBuildUrl(app.id)).then(
+      (result) => current && setLatestUrl(result.url),
+      () => {},
+    );
+    return () => {
+      current = false;
+    };
+  }, [app.id, building, attempt]);
+
+  // The live sandbox, only while editing.
+  useEffect(() => {
+    if (!live) return;
+    let current = true;
+    unwrap(actions.getPreviewUrl(app.id)).then(
+      (result) => current && setLiveUrl(result.url),
+      (err) => current && setError(err.message),
+    );
+    return () => {
+      current = false;
+    };
+  }, [app.id, live, attempt]);
+
+  function refresh() {
+    setLiveUrl(null);
+    setLiveLoaded(false);
+    setError("");
+    setAttempt((n) => n + 1);
+  }
+
+  let underneath;
+  if (latestUrl) {
+    underneath = <iframe key={latestUrl} title={title} src={latestUrl} {...frameProps} />;
+  } else if (app.preview_screenshot_url) {
+    underneath = <img className="preview-fallback" src={app.preview_screenshot_url} alt={`${title} screenshot`} />;
+  } else if (live && !error) {
+    underneath = <div className="widget-placeholder" role="status">Starting your preview…</div>;
+  } else {
+    underneath = <div className="widget-placeholder">No built preview is available yet. Open the assistant to build this app.</div>;
+  }
+
+  let status = live ? "Starting live preview…" : "Last available build";
+  if (liveLoaded) status = "Live preview";
+
+  return (
+    <div className="preview-frame">
+      {!liveLoaded && underneath}
+      {liveUrl && (
+        <iframe
+          title={liveLoaded ? title : `${title} (starting live)`}
+          src={liveUrl}
+          className={liveLoaded ? "" : "preview-loading-frame"}
+          aria-hidden={!liveLoaded}
+          tabIndex={liveLoaded ? 0 : -1}
+          onLoad={() => setLiveLoaded(true)}
+          {...frameProps}
+        />
+      )}
+      {showControls && (
+        <div className="preview-controls">
+          {error ? <span role="alert">{error}</span> : <span>{status}</span>}
+          <button className="secondary" onClick={refresh}>Refresh preview</button>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/examples/white-label-minimal/client/components/AppWidget.tsx b/examples/white-label-minimal/client/components/AppWidget.tsx
new file mode 100644
index 0000000..4555c13
--- /dev/null
+++ b/examples/white-label-minimal/client/components/AppWidget.tsx
@@ -0,0 +1,41 @@
+"use client";
+import { Loader2, Pencil, Trash2 } from "lucide-react";
+import type { App } from "../../types";
+import AppPreview from "./AppPreview";
+
+// A card on the apps page. It shows the app's latest build, which starts no sandbox.
+export default function AppWidget({ app, removing, onEdit, onRemove }: {
+  app: App;
+  removing: boolean;
+  onEdit: () => void;
+  onRemove: () => void;
+}) {
+  const name = app.name || "Untitled";
+  const building = app.status?.state === "processing";
+
+  return (
+    <article className="app-widget" aria-label={name}>
+      <header className="widget-heading">
+        <h2>{name}</h2>
+        {building && <Loader2 size={14} className="spin" aria-label="Building" />}
+        <div className="widget-actions">
+          <button className="icon-button" aria-label={`Edit ${name}`} title="Open app" onClick={onEdit}>
+            <Pencil size={15} />
+          </button>
+          <button className="icon-button" aria-label={`Remove ${name} from My apps`} title="Remove from Tiny only" disabled={removing} onClick={onRemove}>
+            <Trash2 size={15} />
+          </button>
+        </div>
+      </header>
+      <div className="widget-preview">
+        {building ? (
+          <div className="widget-placeholder" role="status">
+            <Loader2 size={20} className="spin" aria-hidden="true" /> Generating your app…
+          </div>
+        ) : (
+          <AppPreview app={app} title={`${name} widget preview`} showControls={false} />
+        )}
+      </div>
+    </article>
+  );
+}
diff --git a/examples/white-label-minimal/client/components/AppsPage.tsx b/examples/white-label-minimal/client/components/AppsPage.tsx
new file mode 100644
index 0000000..c70b2c4
--- /dev/null
+++ b/examples/white-label-minimal/client/components/AppsPage.tsx
@@ -0,0 +1,65 @@
+"use client";
+import { Grid2X2, Loader2, Plus } from "lucide-react";
+import type { App } from "../../types";
+import AppWidget from "./AppWidget";
+
+// The home page: the builder's apps, or a way to create the first one.
+export default function AppsPage({ apps, loading, removing, error, onRetry, onCreate, onOpen, onRemove }: {
+  apps: App[];
+  loading: boolean;
+  removing: boolean;
+  error: string;
+  onRetry: () => void;
+  onCreate: () => void;
+  onOpen: (app: App) => void;
+  onRemove: (app: App) => void;
+}) {
+  let content;
+  if (loading && apps.length === 0) {
+    content = (
+      <div className="empty-state" role="status">
+        <Loader2 className="spin" />
+        <p>Loading your apps…</p>
+      </div>
+    );
+  } else if (apps.length === 0 && !error) {
+    content = (
+      <div className="empty-state">
+        <Grid2X2 size={28} />
+        <h2>Make room for your first idea</h2>
+        <p>Tell the assistant what you want to build.</p>
+        <button onClick={onCreate}>
+          <Plus size={16} /> Create an app
+        </button>
+      </div>
+    );
+  } else {
+    content = (
+      <div className="apps-grid">
+        {apps.map((app) => (
+          <AppWidget
+            key={app.id}
+            app={app}
+            removing={removing || loading}
+            onEdit={() => onOpen(app)}
+            onRemove={() => onRemove(app)}
+          />
+        ))}
+      </div>
+    );
+  }
+
+  return (
+    <main className="apps-page">
+      <div className="apps-content">
+        {error && (
+          <div role="alert" className="error">
+            <p>{error}</p>
+            <button className="secondary" onClick={onRetry}>Try again</button>
+          </div>
+        )}
+        {content}
+      </div>
+    </main>
+  );
+}
diff --git a/examples/white-label-minimal/client/components/Builder.tsx b/examples/white-label-minimal/client/components/Builder.tsx
new file mode 100644
index 0000000..047b7f0
--- /dev/null
+++ b/examples/white-label-minimal/client/components/Builder.tsx
@@ -0,0 +1,161 @@
+"use client";
+import { createContext, useContext, useEffect } from "react";
+import {
+  AssistantRuntimeProvider,
+  ComposerPrimitive,
+  MessagePrimitive,
+  ThreadPrimitive,
+  useAuiState,
+  useExternalStoreRuntime,
+  type TextMessagePartComponent,
+  type ToolCallMessagePartComponent,
+} from "@assistant-ui/react";
+import { MarkdownTextPrimitive } from "@assistant-ui/react-markdown";
+import { Bot, Loader2, Send, User } from "lucide-react";
+import type { App, ToolCall } from "../../types";
+import { toAssistantMessage } from "../messages";
+import { useBuildTurn } from "../useBuildTurn";
+import Question from "./Question";
+import ReadyCard from "./ReadyCard";
+import ToolActivity from "./ToolActivity";
+
+// The build turn, for the parts assistant-ui renders itself.
+const TurnContext = createContext<ReturnType<typeof useBuildTurn> | null>(null);
+
+// The builder's chat for one app. The logic is in useBuildTurn; assistant-ui
+// renders the conversation.
+export default function Builder({ initialAppId, autoFocus, onCreated, onUpdated, onGoHome }: {
+  initialAppId?: string;
+  autoFocus?: boolean;
+  onCreated?: (app: App) => void;
+  onUpdated?: (app: App) => void;
+  onGoHome?: () => void;
+}) {
+  const turn = useBuildTurn(initialAppId ?? null, onCreated);
+  const { app, appId, state, busy } = turn;
+
+  useEffect(() => {
+    if (app) onUpdated?.(app);
+  }, [app, onUpdated]);
+
+  const runtime = useExternalStoreRuntime({
+    messages: turn.messages,
+    convertMessage: toAssistantMessage,
+    isRunning: !!busy || state === "building",
+    isDisabled: !turn.canSend,
+    onNew: async (message) => {
+      const text = message.content.map((part) => (part.type === "text" ? part.text : "")).join("\n");
+      // assistant-ui clears the draft on send; put it back if sending failed.
+      if (!(await turn.send(text))) runtime.thread.composer.setText(text);
+    },
+  });
+
+  return (
+    <TurnContext.Provider value={turn}>
+      <div className="builder">
+        {state === "failed" && <p role="alert">The build failed. Review the conversation and send a follow-up prompt.</p>}
+        {turn.error && (
+          <aside role="alert">
+            <p>{turn.error}</p>
+            {appId && <button className="secondary" disabled={!!busy} onClick={turn.reconnect}>Reconnect live updates</button>}
+          </aside>
+        )}
+
+        <AssistantRuntimeProvider runtime={runtime}>
+          <ThreadPrimitive.Root className="builder-chat">
+            <ThreadPrimitive.Viewport aria-label="Conversation" role="region" aria-busy={state === "loading"} className="conversation">
+              {state === "loading" && (
+                <div className="conversation-loading" role="status">
+                  <Loader2 size={20} className="spin" aria-hidden="true" /> Loading conversation…
+                </div>
+              )}
+              {!appId && turn.messages.length === 0 && <div className="chat-welcome"><h2>Build an app</h2></div>}
+              <ThreadPrimitive.Messages components={{ UserMessage, AssistantMessage }} />
+              {state === "ready" && !busy && appId && <ReadyCard appId={appId} name={app?.name} onGoHome={onGoHome} />}
+              <Progress />
+            </ThreadPrimitive.Viewport>
+
+            <ComposerPrimitive.Root className="composer">
+              <ComposerPrimitive.Input
+                aria-label={appId ? "What should change?" : "What would you like to build?"}
+                placeholder={appId ? "Describe a change…" : "Describe the app you want…"}
+                autoFocus={autoFocus}
+                rows={1}
+                maxRows={4}
+              />
+              <ComposerPrimitive.Send className="send-button" aria-label={appId ? "Send prompt" : "Create app"}>
+                {busy ? <Loader2 size={16} className="spin" /> : <Send size={16} />}
+              </ComposerPrimitive.Send>
+              {state === "question" && <small>Answer or reject the waiting question to continue.</small>}
+            </ComposerPrimitive.Root>
+          </ThreadPrimitive.Root>
+        </AssistantRuntimeProvider>
+      </div>
+    </TurnContext.Provider>
+  );
+}
+
+function UserMessage() {
+  return (
+    <MessagePrimitive.Root className="chat-message from-user">
+      <span className="message-avatar" aria-label="You"><User size={14} /></span>
+      <div className="message-body">
+        <MessagePrimitive.Parts components={{ Text: PlainText }} />
+      </div>
+    </MessagePrimitive.Root>
+  );
+}
+
+function AssistantMessage() {
+  // assistant-ui adds an empty assistant message while a run is in progress.
+  const empty = useAuiState((s) => s.message.content.length === 0);
+  if (empty) return null;
+  return (
+    <MessagePrimitive.Root className="chat-message from-assistant">
+      <span className="message-avatar" aria-label="Assistant"><Bot size={14} /></span>
+      <div className="message-body">
+        <MessagePrimitive.Parts components={{ Text: MarkdownText, tools: { Fallback: ToolPart } }} />
+      </div>
+    </MessagePrimitive.Root>
+  );
+}
+
+const PlainText: TextMessagePartComponent = ({ text }) => <div className="message-bubble"><p>{text}</p></div>;
+const MarkdownText: TextMessagePartComponent = () => <div className="message-bubble"><MarkdownTextPrimitive /></div>;
+
+// A Base44 tool call: a question while it waits for the builder, activity otherwise.
+const ToolPart: ToolCallMessagePartComponent = ({ toolCallId, artifact }) => {
+  const turn = useContext(TurnContext)!;
+  const { tool, messageId } = artifact as { tool: ToolCall; messageId: string };
+  const asking = tool.status === "waiting_for_user_input" || tool.waiting_on?.kind;
+  if (!asking || !turn.appId) return <ToolActivity tool={tool} />;
+  return (
+    <Question
+      key={`${toolCallId}:${tool.status}`}
+      tool={tool}
+      messageId={messageId}
+      appId={turn.appId}
+      disabled={!!turn.busy || turn.state === "paused"}
+      onSubmit={turn.answer}
+    />
+  );
+};
+
+// The status line under the chat.
+function Progress() {
+  const { state, busy } = useContext(TurnContext)!;
+  let text = "";
+  if (busy === "create") text = "Creating app…";
+  else if (busy === "send") text = "Sending prompt…";
+  else if (busy === "answer") text = "Answering question…";
+  else if (state === "paused") text = "Connection paused";
+  else if (state === "question") text = "Waiting for your answer";
+  else if (state === "building") text = "Building…";
+  if (!text) return null;
+  return (
+    <div className="build-progress" role="status">
+      {(busy || state === "building") && <Loader2 size={12} className="spin" />}
+      {text}
+    </div>
+  );
+}
diff --git a/examples/white-label-minimal/client/components/EditorPanel.tsx b/examples/white-label-minimal/client/components/EditorPanel.tsx
new file mode 100644
index 0000000..41fcd21
--- /dev/null
+++ b/examples/white-label-minimal/client/components/EditorPanel.tsx
@@ -0,0 +1,69 @@
+"use client";
+import { useEffect, useRef, type ReactNode } from "react";
+import { MessageSquare, Sparkles, X } from "lucide-react";
+
+// The assistant panel beside the app. On a phone it opens over the page, from
+// the Assistant button, and closes with the X or Escape.
+export default function EditorPanel({ title, editing, open, onOpen, onClose, children }: {
+  title: string;
+  editing: boolean;
+  open: boolean;
+  onOpen: () => void;
+  onClose: () => void;
+  children: ReactNode;
+}) {
+  const openButton = useRef<HTMLButtonElement>(null);
+  const closeButton = useRef<HTMLButtonElement>(null);
+
+  // Move keyboard focus into the panel when it opens over the page.
+  useEffect(() => {
+    if (open && window.matchMedia("(max-width: 760px)").matches) closeButton.current?.focus();
+  }, [open]);
+
+  function close() {
+    onClose();
+    openButton.current?.focus();
+  }
+
+  return (
+    <>
+      <button
+        ref={openButton}
+        className="mobile-assistant"
+        onClick={onOpen}
+        aria-expanded={open}
+        aria-controls="app-editor"
+      >
+        <MessageSquare size={18} /> Assistant
+      </button>
+      <section
+        id="app-editor"
+        className={`editor-panel ${open ? "is-open" : ""} ${editing ? "is-editing" : ""}`}
+        aria-label="App editor"
+        onKeyDown={(e) => {
+          if (e.key === "Escape") close();
+        }}
+      >
+        <header className="editor-heading">
+          <div>
+            {editing ? (
+              <span className="editing-badge">
+                <span className="editing-flare" aria-hidden="true" />
+                Editing
+              </span>
+            ) : (
+              <Sparkles size={14} />
+            )}
+            <strong>{title}</strong>
+          </div>
+          <div>
+            <button ref={closeButton} className="icon-button mobile-close" aria-label="Close assistant" onClick={close}>
+              <X size={20} />
+            </button>
+          </div>
+        </header>
+        {children}
+      </section>
+    </>
+  );
+}
diff --git a/examples/white-label-minimal/components/GoogleSignInButton.tsx b/examples/white-label-minimal/client/components/GoogleSignInButton.tsx
similarity index 100%
rename from examples/white-label-minimal/components/GoogleSignInButton.tsx
rename to examples/white-label-minimal/client/components/GoogleSignInButton.tsx
diff --git a/examples/white-label-minimal/client/components/Question.tsx b/examples/white-label-minimal/client/components/Question.tsx
new file mode 100644
index 0000000..5e13064
--- /dev/null
+++ b/examples/white-label-minimal/client/components/Question.tsx
@@ -0,0 +1,242 @@
+"use client";
+import { useRef, useState } from "react";
+import type { ToolCall, ToolInput } from "../../types";
+
+// "Answer the agent's questions": a waiting tool call says what it needs in
+// waiting_on.kind, and there are exactly three kinds. One form for each.
+// https://docs.base44.com/developers/white-label/the-build-turn
+
+type Choice = { question: string; options: string[]; multi: boolean };
+type SecretField = { name: string; description: string };
+type ParsedQuestion =
+  | { kind: "choice"; choices: Choice[] }
+  | { kind: "input"; fields: SecretField[] }
+  | { kind: "approval" }
+  | { kind: "unknown" };
+
+export default function Question({ tool, messageId, appId, disabled, onSubmit }: {
+  tool: ToolCall;
+  messageId: string;
+  appId: string;
+  disabled: boolean;
+  onSubmit: (input: ToolInput) => Promise<void>;
+}) {
+  const question = parseQuestion(tool);
+  const [sending, setSending] = useState(false);
+  const [sent, setSent] = useState(false);
+  const [error, setError] = useState("");
+  // A failed answer is kept, and a retry sends it unchanged with the same request ID.
+  const [failed, setFailed] = useState<ToolInput | null>(null);
+  const lock = useRef(false);
+
+  async function send(input: ToolInput) {
+    if (lock.current) return;
+    lock.current = true;
+    setSending(true);
+    setError("");
+    try {
+      await onSubmit(input);
+      setSent(true);
+      setFailed(null);
+    } catch (err) {
+      setFailed(input);
+      setError(err instanceof Error ? err.message : "Could not send the answer.");
+    } finally {
+      lock.current = false;
+      setSending(false);
+    }
+  }
+
+  // Declining is an answer too: the tool never runs and the agent carries on.
+  function answer(approve: boolean, extraUserInput: Record<string, unknown> = {}) {
+    if (!tool.id) return;
+    void send({ appId, toolCallId: tool.id, messageId, approve, extraUserInput });
+  }
+  const reject = () => answer(false);
+
+  const waiting = tool.status === "waiting_for_user_input" && !sent;
+
+  return (
+    <section className="question">
+      <strong>{tool.name || "Agent action"}</strong> <small>{sent ? "Answer sent" : tool.status}</small>
+
+      {question.kind === "approval" && <Details summary="Review proposed action" text={tool.arguments_string} />}
+      {question.kind === "unknown" && <Details summary="Unsupported question / tool details" text={tool.arguments_string} />}
+
+      {waiting && (
+        <fieldset disabled={disabled || sending || !!failed || !tool.id}>
+          {question.kind === "choice" && (
+            <ChoiceForm name={tool.id ?? ""} choices={question.choices} onSend={(answers) => answer(true, { answers })} onReject={reject} />
+          )}
+          {question.kind === "input" && (
+            <SecretsForm fields={question.fields} onSend={(secrets) => answer(true, { secrets })} onReject={reject} />
+          )}
+          {question.kind === "approval" && (
+            <div className="actions">
+              <button onClick={() => answer(true)}>Approve</button>
+              <button className="secondary" onClick={reject}>Reject</button>
+            </div>
+          )}
+          {/* An unfamiliar question is never offered for approval, only rejection. */}
+          {question.kind === "unknown" && (
+            <div className="actions">
+              <button className="secondary" onClick={reject}>Reject</button>
+            </div>
+          )}
+        </fieldset>
+      )}
+
+      {waiting && failed && !sending && (
+        <button disabled={disabled} onClick={() => void send(failed)}>Retry original answer</button>
+      )}
+      {sending && <p role="status">Sending answer…</p>}
+      {error && <p role="alert">{error} Reconnect live updates to check the outcome, or retry the original answer.</p>}
+    </section>
+  );
+}
+
+// choice: pick from the options the agent offered, or write an answer.
+function ChoiceForm({ name, choices, onSend, onReject }: {
+  name: string;
+  choices: Choice[];
+  onSend: (answers: object[]) => void;
+  onReject: () => void;
+}) {
+  const [picked, setPicked] = useState<string[][]>(choices.map(() => []));
+  const [texts, setTexts] = useState<string[]>(choices.map(() => ""));
+
+  function pick(index: number, label: string, multi: boolean) {
+    const current = picked[index];
+    let next = [label];
+    if (multi) {
+      next = current.includes(label) ? current.filter((l) => l !== label) : [...current, label];
+    }
+    setPicked(picked.map((labels, i) => (i === index ? next : labels)));
+  }
+
+  const answers = choices
+    .map((_, i) => ({ question_index: i, selected_labels: picked[i], custom_text: texts[i] }))
+    .filter((answer) => answer.selected_labels.length > 0 || answer.custom_text.trim() !== "");
+
+  return (
+    <>
+      {choices.map((choice, i) => (
+        <div key={i}>
+          <p>{choice.question}</p>
+          {choice.options.map((label) => (
+            <label className="option" key={label}>
+              <input
+                type={choice.multi ? "checkbox" : "radio"}
+                name={`${name}-${i}`}
+                checked={picked[i].includes(label)}
+                onChange={() => pick(i, label, choice.multi)}
+              />
+              {label}
+            </label>
+          ))}
+          <label>
+            Additional answer
+            <input value={texts[i]} onChange={(e) => setTexts(texts.map((t, j) => (j === i ? e.target.value : t)))} />
+          </label>
+        </div>
+      ))}
+      <div className="actions">
+        <button disabled={answers.length === 0} onClick={() => onSend(answers)}>Send answer</button>
+        <button className="secondary" onClick={onReject}>Reject</button>
+      </div>
+    </>
+  );
+}
+
+// input: values the agent needs, such as API keys. Tiny passes them to Base44 and keeps none.
+function SecretsForm({ fields, onSend, onReject }: {
+  fields: SecretField[];
+  onSend: (secrets: Record<string, string>) => void;
+  onReject: () => void;
+}) {
+  const [values, setValues] = useState<Record<string, string>>({});
+  const filled = fields.filter((field) => values[field.name]?.trim());
+
+  return (
+    <>
+      {fields.map((field) => (
+        <label key={field.name}>
+          {field.name}
+          <small>{field.description}</small>
+          <input
+            type="password"
+            autoComplete="off"
+            value={values[field.name] ?? ""}
+            onChange={(e) => setValues({ ...values, [field.name]: e.target.value })}
+          />
+        </label>
+      ))}
+      <div className="actions">
+        <button
+          disabled={filled.length === 0}
+          onClick={() => onSend(Object.fromEntries(filled.map((field) => [field.name, values[field.name]])))}
+        >
+          Send answer
+        </button>
+        <button className="secondary" onClick={onReject}>Reject</button>
+      </div>
+    </>
+  );
+}
+
+function Details({ summary, text }: { summary: string; text?: string | null }) {
+  return (
+    <details>
+      <summary>{summary}</summary>
+      <pre>{text || "No arguments provided."}</pre>
+    </details>
+  );
+}
+
+export function parseQuestion(tool: ToolCall): ParsedQuestion {
+  const kind = tool.waiting_on?.kind;
+  if (kind === "approval") return { kind: "approval" };
+
+  const args = parseJson(tool.arguments_string);
+  if (kind === "choice") {
+    const choices = parseChoices(args?.questions);
+    if (choices) return { kind: "choice", choices };
+  }
+  if (kind === "input") {
+    const fields = parseSecretFields(args?.secrets_schema);
+    if (fields) return { kind: "input", fields };
+  }
+  // An unfamiliar or incomplete question must never become a blind approval.
+  return { kind: "unknown" };
+}
+
+function parseChoices(questions: unknown): Choice[] | null {
+  if (!Array.isArray(questions) || questions.length === 0) return null;
+  const choices: Choice[] = [];
+  for (const q of questions) {
+    if (typeof q?.question !== "string" || !Array.isArray(q.options)) return null;
+    // Options arrive as strings or as { label } objects.
+    const options = q.options.map((option: unknown) => (typeof option === "string" ? option : (option as { label?: unknown })?.label));
+    if (options.some((option: unknown) => typeof option !== "string")) return null;
+    choices.push({ question: q.question, options, multi: q.multi_select === true });
+  }
+  return choices;
+}
+
+function parseSecretFields(schema: unknown): SecretField[] | null {
+  if (!Array.isArray(schema) || schema.length === 0) return null;
+  const fields: SecretField[] = [];
+  for (const s of schema) {
+    if (typeof s?.secretName !== "string" || !s.secretName) return null;
+    fields.push({ name: s.secretName, description: typeof s.description === "string" ? s.description : "" });
+  }
+  return fields;
+}
+
+function parseJson(text?: string | null) {
+  try {
+    return JSON.parse(text || "{}");
+  } catch {
+    return null;
+  }
+}
diff --git a/examples/white-label-minimal/client/components/ReadyCard.tsx b/examples/white-label-minimal/client/components/ReadyCard.tsx
new file mode 100644
index 0000000..9ebc4d6
--- /dev/null
+++ b/examples/white-label-minimal/client/components/ReadyCard.tsx
@@ -0,0 +1,53 @@
+"use client";
+import { useState } from "react";
+import { ArrowRight, Check, ExternalLink } from "lucide-react";
+import * as actions from "../../server/actions";
+import { unwrap } from "../unwrap";
+
+// Shown when a build is done. Step 6 of the build turn: deploy the app, then
+// read back its address to link to.
+export default function ReadyCard({ appId, name, onGoHome }: {
+  appId: string;
+  name?: string;
+  onGoHome?: () => void;
+}) {
+  const [publishedUrl, setPublishedUrl] = useState<string | null>(null);
+  const [publishing, setPublishing] = useState(false);
+  const [error, setError] = useState("");
+
+  async function publish() {
+    setPublishing(true);
+    setError("");
+    try {
+      await unwrap(actions.deployApp(appId));
+      const { url } = await unwrap(actions.getPublishedUrl(appId));
+      setPublishedUrl(url);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Could not publish the app.");
+    } finally {
+      setPublishing(false);
+    }
+  }
+
+  return (
+    <section className="delivery" aria-label="App ready">
+      <p className="ready-badge">
+        <Check size={13} aria-hidden="true" /> Ready
+      </p>
+      <strong>{name || "Your app"}</strong>
+      {publishedUrl ? (
+        <a className="button" href={publishedUrl} target="_blank" rel="noopener noreferrer">
+          Open the published app <ExternalLink size={14} />
+        </a>
+      ) : (
+        <button disabled={publishing} onClick={publish}>{publishing ? "Publishing…" : "Publish"}</button>
+      )}
+      {error && <p role="alert">{error}</p>}
+      {onGoHome && (
+        <button onClick={onGoHome}>
+          See it in the home page <ArrowRight size={14} />
+        </button>
+      )}
+    </section>
+  );
+}
diff --git a/examples/white-label-minimal/components/TinySunnyLogo.tsx b/examples/white-label-minimal/client/components/TinySunnyLogo.tsx
similarity index 100%
rename from examples/white-label-minimal/components/TinySunnyLogo.tsx
rename to examples/white-label-minimal/client/components/TinySunnyLogo.tsx
diff --git a/examples/white-label-minimal/client/components/ToolActivity.tsx b/examples/white-label-minimal/client/components/ToolActivity.tsx
new file mode 100644
index 0000000..10bf515
--- /dev/null
+++ b/examples/white-label-minimal/client/components/ToolActivity.tsx
@@ -0,0 +1,25 @@
+import { CircleAlert, Loader2, ChevronDown } from "lucide-react";
+import type { ToolCall } from "../../types";
+
+// A tool call the agent made, collapsed: its name and status, then the details.
+export default function ToolActivity({ tool }: { tool: ToolCall }) {
+  const working = tool.status === "running" || tool.status === "pending";
+  const failed = tool.status === "error" || tool.status === "stopped";
+
+  let icon = <span className="tool-dot" />;
+  if (working) icon = <Loader2 size={14} className="spin" />;
+  if (failed) icon = <CircleAlert size={14} />;
+
+  return (
+    <details className="tool-activity">
+      <summary>
+        {icon}
+        <span>{tool.name || "Agent action"}</span>
+        <span className="sr-only">{working ? "Working" : failed ? "Failed" : "Done"}</span>
+        <ChevronDown size={12} className="tool-chevron" />
+      </summary>
+      {tool.arguments_string && <pre>{tool.arguments_string}</pre>}
+      {tool.results && <pre>{tool.results}</pre>}
+    </details>
+  );
+}
diff --git a/examples/white-label-minimal/client/components/Workspace.tsx b/examples/white-label-minimal/client/components/Workspace.tsx
new file mode 100644
index 0000000..b4cf07f
--- /dev/null
+++ b/examples/white-label-minimal/client/components/Workspace.tsx
@@ -0,0 +1,116 @@
+"use client";
+import { useCallback, useState } from "react";
+import Link from "next/link";
+import { signOut } from "next-auth/react";
+import { ArrowLeft, LogOut, Plus } from "lucide-react";
+import type { App } from "../../types";
+import { useApps } from "../useApps";
+import AppsPage from "./AppsPage";
+import Builder from "./Builder";
+import EditorPanel from "./EditorPanel";
+import AppPreview from "./AppPreview";
+import TinySunnyLogo from "./TinySunnyLogo";
+
+// Tiny's one screen: the apps page or an open app, with the assistant beside it.
+export default function Workspace({ name }: { name: string }) {
+  const apps = useApps();
+  const [showApp, setShowApp] = useState(false);
+  // The app in the assistant, or null for a new one. A new key starts a fresh conversation.
+  const [editor, setEditor] = useState<{ app: App | null; key: number }>({ app: null, key: 0 });
+  const [panelOpen, setPanelOpen] = useState(false);
+  const title = editor.app?.name || "";
+
+  function openApp(app: App | null) {
+    setEditor((current) => ({ app, key: current.key + 1 }));
+    setShowApp(true);
+    setPanelOpen(true);
+  }
+
+  function backToApps() {
+    setEditor((current) => ({ app: null, key: current.key + 1 }));
+    setShowApp(false);
+    setPanelOpen(false);
+  }
+
+  // Keep the key: the conversation that created the app goes on.
+  function onCreated(app: App) {
+    apps.add(app);
+    setEditor((current) => ({ ...current, app }));
+    setShowApp(true);
+  }
+
+  const { update } = apps;
+  const onUpdated = useCallback((app: App) => {
+    update(app);
+    setEditor((current) => (current.app?.id === app.id ? { ...current, app } : current));
+  }, [update]);
+
+  return (
+    <div className="workspace">
+      <header className="topbar">
+        <Link href="/" aria-label="Tiny Sunny home">
+          <TinySunnyLogo />
+        </Link>
+        <div className="account">
+          <button className="secondary" onClick={() => openApp(null)}>
+            <Plus size={16} /> New app
+          </button>
+          <span>{name}</span>
+          <button className="icon-button" aria-label="Sign out" onClick={() => signOut({ callbackUrl: "/" })}>
+            <LogOut size={17} />
+          </button>
+        </div>
+      </header>
+
+      <div className="workspace-body">
+        {showApp ? (
+          <main className="app-stage">
+            <header className="stage-heading">
+              <button className="secondary" onClick={backToApps}>
+                <ArrowLeft size={16} /> All apps
+              </button>
+              <strong>{title || "New app"}</strong>
+            </header>
+            <div className="stage-body">
+              {editor.app ? (
+                <AppPreview key={editor.app.id} app={editor.app} live title={`${editor.app.name || "Untitled"} preview`} />
+              ) : (
+                <div className="widget-placeholder">
+                  Describe what you want to build. The preview appears here once the app exists.
+                </div>
+              )}
+            </div>
+          </main>
+        ) : (
+          <AppsPage
+            apps={apps.apps}
+            loading={apps.loading}
+            removing={apps.removing}
+            error={apps.error}
+            onRetry={apps.reload}
+            onCreate={() => openApp(null)}
+            onOpen={openApp}
+            onRemove={(app) => void apps.remove(app)}
+          />
+        )}
+
+        <EditorPanel
+          title={title || "Build an app"}
+          editing={!!editor.app}
+          open={panelOpen}
+          onOpen={() => setPanelOpen(true)}
+          onClose={() => setPanelOpen(false)}
+        >
+          <Builder
+            key={editor.key}
+            initialAppId={editor.app?.id}
+            autoFocus={editor.key > 0 && !editor.app}
+            onCreated={onCreated}
+            onUpdated={onUpdated}
+            onGoHome={backToApps}
+          />
+        </EditorPanel>
+      </div>
+    </div>
+  );
+}
diff --git a/examples/white-label-minimal/client/messages.ts b/examples/white-label-minimal/client/messages.ts
new file mode 100644
index 0000000..303587b
--- /dev/null
+++ b/examples/white-label-minimal/client/messages.ts
@@ -0,0 +1,93 @@
+import type { ThreadMessageLike } from "@assistant-ui/react";
+import type { ChatMessage } from "@base44/platform";
+import type { Message } from "../types";
+
+// Converts a live-updates message to the shape this example's chat UI renders.
+export function toMessage(message: ChatMessage): Message {
+  return {
+    id: message.id ?? "",
+    role: message.role,
+    content: message.content,
+    tool_calls: message.tool_calls?.map((tool) => ({
+      id: tool.id,
+      name: tool.name,
+      status: tool.status,
+      waiting_on: tool.waiting_on,
+      arguments_string: tool.arguments ? JSON.stringify(tool.arguments, null, 2) : null,
+      results: typeof tool.results === "string" ? tool.results : undefined,
+    })),
+  };
+}
+
+// Replaces the message with the same id, or appends it.
+export function upsertMessage(messages: Message[], message: Message): Message[] {
+  return messages.some((m) => m.id === message.id)
+    ? messages.map((m) => (m.id === message.id ? message : m))
+    : [...messages, message];
+}
+
+// The builder's prompt, shown from the moment they send it until Base44 sends it back.
+export type OptimisticMessage = {
+  message: Message;
+  knownIds: string[];
+};
+
+/** Match only new server messages, once each, so repeated prompts stay distinct. */
+export function mergeOptimisticMessages(
+  messages: Message[],
+  optimistic: OptimisticMessage[],
+): Message[] {
+  const result = [...messages];
+  const matched = new Set<string>();
+  const localIds = new Set<string>();
+  for (const { message, knownIds } of optimistic) {
+    const known = new Set(knownIds);
+    const server = messages.find((candidate) =>
+      candidate.role === "user" &&
+      !known.has(candidate.id) && !matched.has(candidate.id) &&
+      candidate.content?.trim() === message.content?.trim(),
+    );
+    if (server) {
+      matched.add(server.id);
+      // Keep React's identity stable when the server copy arrives.
+      result[result.findIndex((candidate) => candidate.id === server.id)] = {
+        ...server, id: message.id,
+      };
+    } else {
+      // Place the prompt before responses that arrived since it was submitted.
+      let after = -1;
+      result.forEach((candidate, index) => {
+        if (known.has(candidate.id) || localIds.has(candidate.id)) after = index;
+      });
+      result.splice(after + 1, 0, message);
+    }
+    localIds.add(message.id);
+  }
+  return result;
+}
+
+// Converts a message to assistant-ui's shape. Each tool call carries the original
+// call, so the chat can show it as a question or as activity.
+export function toAssistantMessage(message: Message): ThreadMessageLike {
+  const role = message.role === "user" ? "user" : "assistant";
+  const tools = role === "assistant" ? (message.tool_calls ?? []) : [];
+  return {
+    id: message.id,
+    role,
+    content: [
+      ...(message.content ? [{ type: "text" as const, text: message.content }] : []),
+      ...tools.map((tool, index) => ({
+        type: "tool-call" as const,
+        toolCallId: tool.id || `${message.id}:tool:${index}`,
+        toolName: tool.name || "Agent action",
+        argsText: tool.arguments_string || "",
+        artifact: { tool, messageId: message.id },
+        ...(tool.results != null ? { result: tool.results } : {}),
+        isError: tool.status === "error" || tool.status === "stopped",
+        ...(tool.status === "waiting_for_user_input"
+          ? { interrupt: { type: "human" as const, payload: tool.waiting_on } }
+          : {}),
+      })),
+    ],
+  };
+}
diff --git a/examples/white-label-minimal/client/unwrap.ts b/examples/white-label-minimal/client/unwrap.ts
new file mode 100644
index 0000000..6166bf8
--- /dev/null
+++ b/examples/white-label-minimal/client/unwrap.ts
@@ -0,0 +1,20 @@
+import type { ActionResult } from "../types";
+
+class ActionError extends Error {
+  constructor(message: string, public status: number) {
+    super(message);
+  }
+}
+
+// Server actions return { data } or { error }. unwrap turns an error into an
+// exception, so components can use try/catch.
+export async function unwrap<T>(result: Promise<ActionResult<T>>): Promise<T> {
+  let value: ActionResult<T>;
+  try {
+    value = await result;
+  } catch {
+    throw new ActionError("Connection lost. The operation may still be running.", 0);
+  }
+  if ("error" in value) throw new ActionError(value.error, value.status);
+  return value.data;
+}
diff --git a/examples/white-label-minimal/client/useApps.ts b/examples/white-label-minimal/client/useApps.ts
new file mode 100644
index 0000000..97b6727
--- /dev/null
+++ b/examples/white-label-minimal/client/useApps.ts
@@ -0,0 +1,59 @@
+"use client";
+import { useCallback, useEffect, useState } from "react";
+import * as actions from "../server/actions";
+import type { App } from "../types";
+import { unwrap } from "./unwrap";
+
+// The signed-in builder's apps: Tiny's ownership rows, each read from Base44.
+export function useApps() {
+  const [apps, setApps] = useState<App[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [removing, setRemoving] = useState(false);
+  const [error, setError] = useState("");
+
+  const load = useCallback(async () => {
+    try {
+      const all: App[] = [];
+      let skip = 0;
+      while (true) {
+        const page = await unwrap(actions.listApps(skip));
+        all.push(...page.apps);
+        if (!page.hasMore) break;
+        skip = page.nextSkip;
+      }
+      setApps(all);
+      setError("");
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Could not load your apps.");
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  // Removes the app from Tiny's list only. It stays in Base44.
+  async function remove(app: App) {
+    if (removing) return;
+    setRemoving(true);
+    setError("");
+    try {
+      await unwrap(actions.removeApp(app.id));
+      setApps((current) => current.filter((item) => item.id !== app.id));
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Could not remove the app.");
+    } finally {
+      setRemoving(false);
+    }
+  }
+
+  const add = useCallback((app: App) => setApps((current) => [app, ...current]), []);
+
+  const update = useCallback((app: App) => {
+    setApps((current) => current.map((item) => (item.id === app.id ? app : item)));
+  }, []);
+
+  return { apps, loading, removing, error, reload: load, remove, add, update };
+}
diff --git a/examples/white-label-minimal/client/useBuildTurn.ts b/examples/white-label-minimal/client/useBuildTurn.ts
new file mode 100644
index 0000000..f824649
--- /dev/null
+++ b/examples/white-label-minimal/client/useBuildTurn.ts
@@ -0,0 +1,195 @@
+"use client";
+import { useEffect, useMemo, useRef, useState } from "react";
+import { Base44PlatformClient } from "@base44/platform";
+import * as actions from "../server/actions";
+import type { App, Message, ToolInput } from "../types";
+import { getChatState } from "./chat-state";
+import { mergeOptimisticMessages, toMessage, upsertMessage, type OptimisticMessage } from "./messages";
+import { unwrap } from "./unwrap";
+
+export type Busy = "create" | "send" | "answer" | null;
+
+// The browser side of "The build turn": watch the app build over live updates,
+// send the builder's prompts, and answer the agent's questions. Every Base44
+// call goes through Tiny's server actions. The browser holds only a
+// live-updates session token.
+export function useBuildTurn(initialAppId: string | null, onCreated?: (app: App) => void) {
+  const [appId, setAppId] = useState(initialAppId);
+  const [app, setApp] = useState<App | null>(null);
+  const [messages, setMessages] = useState<Message[]>([]);
+  const [optimistic, setOptimistic] = useState<OptimisticMessage[]>([]);
+  const [busy, setBusy] = useState<Busy>(null);
+  const [error, setError] = useState("");
+  const [liveError, setLiveError] = useState("");
+  const lock = useRef(false);
+  const turnStarted = useRef<(() => void) | null>(null);
+
+  // Each app and each reconnect is a new live-updates session. It is loading
+  // until its first snapshot arrives or it fails.
+  const [attempt, setAttempt] = useState(0);
+  const session = `${appId}:${attempt}`;
+  const [readySession, setReadySession] = useState("");
+  const loading = !!appId && readySession !== session;
+
+  // 2. Watch it build.
+  useEffect(() => {
+    if (!appId) return;
+    let stopped = false;
+    let builder: { close(): void } | undefined;
+
+    async function readApp() {
+      const next = await unwrap(actions.getApp(appId!));
+      if (!stopped) setApp(next);
+    }
+
+    function fail() {
+      if (stopped) return;
+      stopped = true;
+      builder?.close();
+      setLiveError("Live updates paused. Reconnect to continue.");
+      setReadySession(session);
+    }
+
+    async function connect() {
+      // Tiny's server opens the session with the workspace key.
+      const first = await unwrap(actions.openLiveUpdates(appId!));
+      if (stopped) return;
+      let firstToken: string | undefined = first.sessionToken;
+      const client = new Base44PlatformClient({
+        serverUrl: first.serverUrl,
+        // The SDK asks again only when the session has ended; then open a new one.
+        async getSessionToken() {
+          const token = firstToken ?? (await unwrap(actions.openLiveUpdates(appId!))).sessionToken;
+          firstToken = undefined;
+          return token;
+        },
+      });
+
+      const live = client.builder.init({ onError: fail });
+      builder = live;
+      live.subscribe(appId!, {
+        // On every connect and reconnect: the app's status and its last 50 messages.
+        onSnapshot(snapshot) {
+          if (stopped) return;
+          setMessages(snapshot.messages.map(toMessage));
+          setApp((current) => current && { ...current, status: snapshot.status ?? undefined });
+          setLiveError("");
+          setReadySession(session);
+        },
+        onEvent(event) {
+          if (stopped) return;
+          if (event.type === "message.updated") {
+            const message = toMessage(event.data.message);
+            setMessages((current) => upsertMessage(current, message));
+          }
+          if (event.type === "message.removed") {
+            setMessages((current) => current.filter((m) => m.id !== event.data.message_id));
+          }
+          if (event.type === "app.status_changed") {
+            setApp((current) => current && { ...current, status: event.data.status ?? undefined });
+            // A finished build can rename the app, so read it again.
+            if (event.data.status?.state === "ready") readApp().catch(() => {});
+          }
+        },
+        onError: fail,
+      });
+      await live.connect();
+    }
+
+    readApp().catch(fail);
+    connect().catch(fail);
+    return () => {
+      stopped = true;
+      builder?.close();
+    };
+  }, [appId, session]);
+
+  const currentApp = app?.id === appId ? app : null;
+  const currentMessages = loading ? [] : messages;
+  const state = getChatState(currentApp, currentMessages, loading, liveError);
+  const displayedMessages = useMemo(
+    () => mergeOptimisticMessages(currentMessages, optimistic),
+    [currentMessages, optimistic],
+  );
+  // Send chat message stays open until the whole turn ends; see send().
+  useEffect(() => {
+    if (state === "building") turnStarted.current?.();
+  }, [state]);
+
+  // Base44 ignores new prompts while a question is open or a build runs.
+  const canSend = !busy && (state === "idle" || state === "ready" || state === "failed");
+
+  async function refreshApp() {
+    if (appId) setApp(await unwrap(actions.getApp(appId)));
+  }
+
+  // 1. Create the app from the first prompt; send every later prompt as a chat message.
+  async function send(prompt: string) {
+    if (lock.current || !canSend || !prompt.trim()) return false;
+    lock.current = true;
+    const optimisticId = `local:${crypto.randomUUID()}`;
+    setOptimistic((current) => [...current, {
+      message: { id: optimisticId, role: "user", content: prompt },
+      knownIds: currentMessages.map((message) => message.id),
+    }]);
+    setBusy(appId ? "send" : "create");
+    setError("");
+    try {
+      if (appId) {
+        // Base44 holds this request open until the whole turn ends, which can take
+        // minutes. Stop waiting once live updates show the build running; the
+        // app status reports how it ends.
+        const sent = unwrap(actions.sendMessage(appId, prompt));
+        sent.catch(() => {});
+        await Promise.race([sent, new Promise<void>((resolve) => { turnStarted.current = resolve; })]);
+        await refreshApp();
+      } else {
+        const created = await unwrap(actions.createApp(prompt));
+        setAppId(created.id);
+        onCreated?.(created);
+      }
+      return true;
+    } catch (err) {
+      setOptimistic((current) => current.filter(({ message }) => message.id !== optimisticId));
+      setError(err instanceof Error ? err.message : "Request failed.");
+      if (appId) await refreshApp().catch(() => {});
+      return false;
+    } finally {
+      turnStarted.current = null;
+      lock.current = false;
+      setBusy(null);
+    }
+  }
+
+  // 4. Send the answer back.
+  async function answer(input: ToolInput) {
+    if (lock.current) throw new Error("Another action is still running.");
+    lock.current = true;
+    setBusy("answer");
+    try {
+      await unwrap(actions.submitToolCallInput(input));
+    } finally {
+      await refreshApp().catch(() => {});
+      lock.current = false;
+      setBusy(null);
+    }
+  }
+
+  function reconnect() {
+    setError("");
+    setAttempt((n) => n + 1);
+  }
+
+  return {
+    appId,
+    app: currentApp,
+    messages: displayedMessages,
+    state,
+    busy,
+    canSend,
+    error: error || liveError,
+    send,
+    answer,
+    reconnect,
+  };
+}
diff --git a/examples/white-label-minimal/components/AppWidget.tsx b/examples/white-label-minimal/components/AppWidget.tsx
deleted file mode 100644
index 5f0dc47..0000000
--- a/examples/white-label-minimal/components/AppWidget.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-"use client";
-
-import { Loader2, Pencil, Trash2 } from "lucide-react";
-import PreviewFrame from "./PreviewFrame";
-import type { App } from "../lib/types";
-
-// A card in the apps list, showing the app's last static build. The live
-// preview belongs to the app you are editing, so listing apps starts no
-// sandboxes at all.
-export default function AppWidget({ app, removing, onEdit, onRemove }: {
-  app: App;
-  removing: boolean;
-  onEdit: () => void;
-  onRemove: () => void;
-}) {
-  const building = app.status?.state === "processing";
-  const name = app.name || "Untitled";
-  return <article className="app-widget" aria-label={name}>
-    <header className="widget-heading">
-      <h2>{name}</h2>
-      {building && <Loader2 size={14} className="spin" aria-label="Building" />}
-      <div className="widget-actions">
-        <button className="icon-button" aria-label={`Edit ${name}`} title="Open app" onClick={onEdit}><Pencil size={15} /></button>
-        <button className="icon-button" aria-label={`Remove ${name} from My apps`} title="Remove from Tiny only" disabled={removing} onClick={onRemove}><Trash2 size={15} /></button>
-      </div>
-    </header>
-    <div className="widget-preview">
-      {building
-        ? <div className="widget-placeholder" role="status">
-            <Loader2 size={20} className="spin" aria-hidden="true" />
-            <span>Generating your app…</span>
-          </div>
-        : <PreviewFrame app={app} showControls={false} title={`${name} widget preview`} />}
-    </div>
-  </article>;
-}
diff --git a/examples/white-label-minimal/components/Base44Preview.tsx b/examples/white-label-minimal/components/Base44Preview.tsx
deleted file mode 100644
index c479f63..0000000
--- a/examples/white-label-minimal/components/Base44Preview.tsx
+++ /dev/null
@@ -1,108 +0,0 @@
-"use client";
-
-import { useEffect, useRef, useState } from "react";
-
-export type Base44PreviewProps = {
-  appId: string;
-  title: string;
-  live?: boolean;
-  showControls?: boolean;
-  onStatusChange?: (status: string) => void;
-  staticUrl?: string;
-  screenshotUrl?: string;
-  loadPreview: (appId: string) => Promise<{ url: string }>;
-};
-
-export default function Base44Preview(props: Base44PreviewProps) {
-  return <PreviewSession key={`${props.appId}:${!!props.live}`} {...props} />;
-}
-
-function PreviewSession({ appId, live = false, title, staticUrl, screenshotUrl, loadPreview, showControls = true, onStatusChange }: Base44PreviewProps) {
-  const loadPreviewRef = useRef(loadPreview);
-  useEffect(() => { loadPreviewRef.current = loadPreview; }, [loadPreview]);
-  const frame = useRef<HTMLIFrameElement>(null);
-  const loadTimeout = useRef<ReturnType<typeof setTimeout> | undefined>(undefined);
-  const [url, setUrl] = useState("");
-  const [loaded, setLoaded] = useState(false);
-  const [error, setError] = useState("");
-  const [attempt, setAttempt] = useState(0);
-  useEffect(() => {
-    if (!live) return;
-    let cancelled = false;
-    let retryTimer: ReturnType<typeof setTimeout>;
-    let activeUrl = "";
-    let pending = false;
-    let recoveryAttempts = 0;
-    let blocked = false;
-    const timeout = loadTimeout.current = setTimeout(() => {
-      if (!cancelled) setError("Live preview is taking longer than expected. You can retry.");
-    }, 130_000);
-    async function connect(recovering = false) {
-      if (pending || blocked || cancelled) return;
-      if (recovering && recoveryAttempts >= 3) {
-        setError("Live preview could not recover. Try refreshing.");
-        return;
-      }
-      pending = true;
-      if (recovering) recoveryAttempts++;
-      try {
-        const result = await loadPreviewRef.current(appId);
-        if (cancelled) return;
-        const next = new URL(result.url);
-        if (activeUrl) {
-          const previous = new URL(activeUrl);
-          next.pathname = previous.pathname;
-          next.hash = previous.hash;
-          previous.searchParams.forEach((value, key) => {
-            if (key !== "_preview_token" && key !== "server_url" && !next.searchParams.has(key))
-              next.searchParams.set(key, value);
-          });
-        }
-        activeUrl = next.href;
-        setUrl(activeUrl);
-        setError("");
-      } catch (err) {
-        if (cancelled) return;
-        blocked = typeof err === "object" && err !== null && "status" in err && (err.status === 401 || err.status === 403);
-        setError(err instanceof Error ? err.message : "Live preview unavailable.");
-        if (recovering && !blocked && recoveryAttempts < 3)
-          retryTimer = setTimeout(() => { void connect(true); }, 1000 * 2 ** recoveryAttempts);
-      } finally {
-        pending = false;
-      }
-    }
-    function recover(event: MessageEvent) {
-      if (!activeUrl || event.source !== frame.current?.contentWindow ||
-        event.origin !== new URL(activeUrl).origin || event.data?.type !== "preview:requestRefresh") return;
-      clearTimeout(retryTimer);
-      void connect(true);
-    }
-    window.addEventListener("message", recover);
-    void connect();
-    return () => {
-      cancelled = true;
-      clearTimeout(timeout);
-      clearTimeout(retryTimer);
-      window.removeEventListener("message", recover);
-    };
-  }, [appId, live, attempt]);
-  const status = error ? "Preview unavailable" : live ? loaded ? "Live build" : "Starting live…" : "Last build";
-  useEffect(() => { onStatusChange?.(status); }, [onStatusChange, status]);
-  const retry = () => { setUrl(""); setLoaded(false); setError(""); setAttempt(value => value + 1); };
-  const frameProps = { referrerPolicy: "no-referrer" as const, sandbox: "allow-scripts allow-same-origin allow-forms allow-popups" };
-  return <div className="preview-frame">
-    {!loaded && (staticUrl ? <iframe key={`static-${attempt}`} title={title} src={staticUrl} loading="lazy" {...frameProps} />
-      : screenshotUrl ? <img className="preview-fallback" src={screenshotUrl} alt={`${title} screenshot`} />
-      : live && !error ? <div className="widget-placeholder" role="status">
-          <span className="preview-spinner" aria-hidden="true" />
-          <span>Starting your preview…</span>
-        </div>
-      : <div className="widget-placeholder">No built preview is available yet. Open the assistant to build this app.</div>)}
-    {url && <iframe ref={frame} title={loaded ? title : `${title} (starting live)`} src={url} className={loaded ? "" : "preview-loading-frame"} aria-hidden={!loaded} tabIndex={loaded ? 0 : -1} {...frameProps}
-      onLoad={() => { clearTimeout(loadTimeout.current); setLoaded(true); setError(""); }} onError={() => setError("Live preview could not load. Try refreshing.")} />}
-    {showControls && <div className="preview-controls">
-      {error ? <span role="alert">{error}</span> : live && !loaded ? <span role="status">Starting live preview…</span> : <span>{live ? "Live preview" : "Last available build"}</span>}
-      <button className="secondary" onClick={retry}>Refresh preview</button>
-    </div>}
-  </div>;
-}
diff --git a/examples/white-label-minimal/components/Builder.tsx b/examples/white-label-minimal/components/Builder.tsx
deleted file mode 100644
index 11d5715..0000000
--- a/examples/white-label-minimal/components/Builder.tsx
+++ /dev/null
@@ -1,205 +0,0 @@
-"use client";
-import { hasCompletedBuild } from "../lib/chat/build-readiness";
-import type { App, ToolInput } from "../lib/types";
-import { useEffect, useMemo, useRef, useState } from "react";
-import * as api from "../lib/chat/builder-api";
-import { ArrowRight, Check, Loader2 } from "lucide-react";
-import { mergeOptimisticMessages, type OptimisticMessage } from "../lib/chat/optimistic-messages";
-import BuilderChat from "./BuilderChat";
-import { useBuilderSocket } from "./useBuilderSocket";
-
-export default function Builder({
-  initialAppId,
-  onCreated,
-  onUpdated,
-  onGoHome,
-}: {
-  initialAppId?: string;
-  onCreated?: (app: App) => void;
-  onUpdated?: (app: App) => void;
-  onGoHome?: () => void;
-}) {
-  const [appId, setAppId] = useState<string | null>(initialAppId || null);
-  const [busy, setBusy] = useState("");
-  const [error, setError] = useState("");
-  const [creationUncertain, setCreationUncertain] = useState(false);
-  const [resumeId, setResumeId] = useState("");
-  const [optimistic, setOptimistic] = useState<OptimisticMessage[]>([]);
-  const lock = useRef(false);
-  const turnStarted = useRef<(() => void) | null>(null);
-  const { app, messages, error: socketError, loading, refresh, resume } = useBuilderSocket(appId);
-  const displayedMessages = useMemo(
-    () => mergeOptimisticMessages(messages, optimistic), [messages, optimistic],
-  );
-  useEffect(() => {
-    if (app) onUpdated?.(app);
-  }, [app, onUpdated]);
-  const waiting = messages.some((m) =>
-    m.tool_calls?.some((t) => t.status === "waiting_for_user_input"),
-  );
-  const processing = app?.status?.state === "processing";
-  useEffect(() => {
-    if (processing) turnStarted.current?.();
-  }, [processing]);
-  // A prompt/answer invalidates the previous ready state before live updates catch up.
-  // Preview and deploy operations themselves should keep the card mounted.
-  const submittingBuild = busy === "Sending prompt…" || busy === "Answering question…";
-  const canDeliver = app?.id === appId && app?.status?.state === "ready" &&
-    !waiting && !socketError && !submittingBuild && hasCompletedBuild(messages);
-
-  async function send(prompt: string) {
-    if (
-      lock.current ||
-      loading ||
-      !prompt.trim() ||
-      waiting ||
-      processing ||
-      socketError ||
-      creationUncertain
-    )
-      return false;
-    lock.current = true;
-    const optimisticId = `local:${crypto.randomUUID()}`;
-    setOptimistic((current) => [...current, {
-      message: { id: optimisticId, role: "user", content: prompt },
-      knownIds: messages.map((message) => message.id),
-    }]);
-    setBusy(appId ? "Sending prompt…" : "Creating app…");
-    setError("");
-    try {
-      if (appId) {
-        // Base44 holds this request open until the whole turn ends, which can take
-        // minutes; once live updates show the turn running, stop waiting on it.
-        const sent = api.sendMessage(appId, prompt);
-        sent.catch(() => {});
-        await Promise.race([sent, new Promise<void>((resolve) => { turnStarted.current = resolve; })]);
-        await refresh();
-      } else {
-        const created = await api.createApp(prompt);
-        setAppId(created.id);
-        onCreated?.(created);
-      }
-      return true;
-    } catch (err) {
-      setOptimistic((current) => current.filter(({ message }) => message.id !== optimisticId));
-      setError(err instanceof Error ? err.message : "Request failed.");
-      if (!appId) setCreationUncertain(!(err instanceof api.ApiError && err.notStarted));
-      else await refresh();
-      return false;
-    } finally {
-      turnStarted.current = null;
-      lock.current = false;
-      setBusy("");
-    }
-  }
-  async function answer(input: ToolInput) {
-    if (lock.current) throw new Error("Another action is still running.");
-    lock.current = true;
-    setBusy("Answering question…");
-    try {
-      await api.submitToolCallInput(input);
-    } finally {
-      await refresh();
-      lock.current = false;
-      setBusy("");
-    }
-  }
-  return (
-    <div className="builder">
-      {app?.status?.state === "error" && (
-        <p role="alert">
-          The build failed{app.status.error_source ? ` (${app.status.error_source})` : ""}. Review
-          the conversation and send a follow-up prompt.
-        </p>
-      )}
-      {(error || socketError) && (
-        <aside role="alert">
-          <p>{error || socketError}</p>
-          {appId && (
-            <button
-              className="secondary"
-              disabled={!!busy}
-              onClick={() => {
-                setError("");
-                resume();
-              }}
-            >
-              Reconnect live updates
-            </button>
-          )}
-        </aside>
-      )}
-      {!appId && creationUncertain && (
-        <details open>
-          <summary>Resume an existing app</summary>
-          <p>
-            Creation may have succeeded. Check your Base44 workspace before creating another app.
-            Only apps already saved to your account can be resumed here.
-          </p>
-          <label>
-            Existing app ID
-            <input value={resumeId} onChange={(e) => setResumeId(e.target.value)} />
-          </label>
-          <div className="actions">
-            <button
-              disabled={!/^[A-Za-z0-9_-]{1,200}$/.test(resumeId)}
-              onClick={() => {
-                setAppId(resumeId);
-                setCreationUncertain(false);
-                setError("");
-              }}
-            >
-              Resume this app
-            </button>
-            <button
-              className="secondary"
-              onClick={() => {
-                setCreationUncertain(false);
-                setError("");
-              }}
-            >
-              I checked — allow a new creation
-            </button>
-          </div>
-        </details>
-      )}
-      <BuilderChat
-        appId={appId}
-        messages={displayedMessages}
-        loading={loading}
-        busy={!!busy}
-        processing={processing}
-        waiting={waiting}
-        disabled={loading || !!busy || waiting || processing || !!socketError || creationUncertain}
-        questionsDisabled={!!busy || !!socketError}
-        onSend={send}
-        onAnswer={answer}
-      >
-        {canDeliver && (
-          <section className="delivery" aria-label="App ready">
-            <p className="ready-badge">
-              <Check size={13} aria-hidden="true" /> Ready
-            </p>
-            <strong>{app?.name || "Your app"}</strong>
-            {onGoHome && (
-              <button onClick={onGoHome}>
-                See it in the home page <ArrowRight size={14} />
-              </button>
-            )}
-          </section>
-        )}
-        {(busy || waiting || processing || socketError) && (
-          <div className="build-progress" role="status">
-            {(busy || processing) && <Loader2 size={12} className="spin" />}
-            {busy ||
-              (socketError
-                ? "Connection paused"
-                : waiting
-                  ? "Waiting for your answer"
-                  : "Building…")}
-          </div>
-        )}
-      </BuilderChat>
-    </div>
-  );
-}
diff --git a/examples/white-label-minimal/components/BuilderChat.tsx b/examples/white-label-minimal/components/BuilderChat.tsx
deleted file mode 100644
index bbd9f00..0000000
--- a/examples/white-label-minimal/components/BuilderChat.tsx
+++ /dev/null
@@ -1,152 +0,0 @@
-"use client";
-
-import { useMemo, type ReactNode } from "react";
-import {
-  AssistantRuntimeProvider,
-  ComposerPrimitive,
-  MessagePrimitive,
-  ThreadPrimitive,
-  useExternalStoreRuntime,
-} from "@assistant-ui/react";
-import { MarkdownTextPrimitive } from "@assistant-ui/react-markdown";
-import { Bot, Loader2, Send, User } from "lucide-react";
-import { toAssistantMessage } from "../lib/chat/assistant-messages";
-import type { Message, ToolCall, ToolInput } from "../lib/types";
-import Question from "./Question";
-import ToolActivity from "./ToolActivity";
-
-export default function BuilderChat({
-  appId,
-  messages,
-  loading,
-  busy,
-  processing,
-  waiting,
-  disabled,
-  questionsDisabled,
-  onSend,
-  onAnswer,
-  children,
-}: {
-  appId: string | null;
-  messages: Message[];
-  loading: boolean;
-  busy: boolean;
-  processing: boolean;
-  waiting: boolean;
-  disabled: boolean;
-  questionsDisabled: boolean;
-  onSend: (text: string) => Promise<boolean>;
-  onAnswer: (input: ToolInput) => Promise<void>;
-  children: ReactNode;
-}) {
-  const visibleMessages = useMemo(() => messages.filter((m) => !m.hidden), [messages]);
-  const runtime = useExternalStoreRuntime({
-    messages: visibleMessages,
-    convertMessage: toAssistantMessage,
-    isRunning: busy || processing,
-    isDisabled: disabled,
-    isSendDisabled: disabled,
-    onNew: async (message) => {
-      const text = message.content
-        .flatMap((part) => (part.type === "text" ? [part.text] : []))
-        .join("\n");
-      // Restore the draft that assistant-ui cleared before sending.
-      if (!(await onSend(text))) runtime.thread.composer.setText(text);
-    },
-  });
-
-  return (
-    <AssistantRuntimeProvider runtime={runtime}>
-      <ThreadPrimitive.Root className="builder-chat">
-        <ThreadPrimitive.Viewport aria-label="Conversation" role="region" aria-busy={loading} className="conversation">
-          {loading && (
-            <div className="conversation-loading" role="status">
-              <Loader2 size={20} className="spin" aria-hidden="true" />
-              <span>Loading conversation…</span>
-            </div>
-          )}
-          {!loading && !visibleMessages.length &&
-            (appId ? (
-              <p className="empty">No messages yet.</p>
-            ) : (
-              <div className="chat-welcome">
-                <h2>Build an app</h2>
-              </div>
-            ))}
-          <ThreadPrimitive.Messages>
-            {({ message }) => message.content.length === 0 ? null : (
-              <MessagePrimitive.Root
-                className={`chat-message ${message.role === "user" ? "from-user" : "from-assistant"}`}
-              >
-                <span
-                  className="message-avatar"
-                  aria-label={message.role === "user" ? "You" : "Assistant"}
-                >
-                  {message.role === "user" ? <User size={14} /> : <Bot size={14} />}
-                </span>
-                <div className="message-body">
-                  <MessagePrimitive.Parts>
-                    {({ part }) => {
-                      if (part.type === "text")
-                        return (
-                          <div className="message-bubble">
-                            {message.role === "user" ? (
-                              <p>{part.text}</p>
-                            ) : (
-                              <MarkdownTextPrimitive />
-                            )}
-                          </div>
-                        );
-                      if (part.type !== "tool-call") return null;
-                      const { tool, messageId } = part.artifact as {
-                        tool: ToolCall;
-                        messageId: string;
-                      };
-                      return (tool.status === "waiting_for_user_input" || tool.waiting_on?.kind) &&
-                        appId ? (
-                        <Question
-                          key={`${part.toolCallId}:${tool.status}`}
-                          tool={tool}
-                          messageId={messageId}
-                          appId={appId}
-                          disabled={questionsDisabled}
-                          onSubmit={onAnswer}
-                        />
-                      ) : (
-                        <ToolActivity tool={tool} />
-                      );
-                    }}
-                  </MessagePrimitive.Parts>
-                </div>
-              </MessagePrimitive.Root>
-            )}
-          </ThreadPrimitive.Messages>
-          {children}
-        </ThreadPrimitive.Viewport>
-        <ComposerPrimitive.Root className="composer">
-          <ComposerPrimitive.Input
-            aria-label={appId ? "What should change?" : "What would you like to build?"}
-            placeholder={
-              waiting
-                ? "Answer the question above…"
-                : appId
-                  ? "Describe a change…"
-                  : "Describe the app you want…"
-            }
-            maxLength={16000}
-            rows={1}
-            maxRows={4}
-          />
-          <ComposerPrimitive.Send
-            className="send-button"
-            aria-label={appId ? "Send prompt" : "Create app"}
-          >
-            {busy ? <Loader2 size={16} className="spin" /> : <Send size={16} />}
-          </ComposerPrimitive.Send>
-          {waiting && <small>Answer or reject the waiting question to continue.</small>}
-        </ComposerPrimitive.Root>
-      </ThreadPrimitive.Root>
-    </AssistantRuntimeProvider>
-  );
-}
diff --git a/examples/white-label-minimal/components/PreviewFrame.tsx b/examples/white-label-minimal/components/PreviewFrame.tsx
deleted file mode 100644
index 32d7a16..0000000
--- a/examples/white-label-minimal/components/PreviewFrame.tsx
+++ /dev/null
@@ -1,18 +0,0 @@
-"use client";
-
-import { getPreviewUrl } from "../lib/chat/builder-api";
-import type { App } from "../lib/types";
-import Base44Preview, { type Base44PreviewProps } from "./Base44Preview";
-
-export default function PreviewFrame({ app, live = false, title, showControls, onStatusChange }: { app: App; live?: boolean; title: string } & Pick<Base44PreviewProps, "showControls" | "onStatusChange">) {
-  return <Base44Preview
-    appId={app.id}
-    title={title}
-    live={live}
-    showControls={showControls}
-    onStatusChange={onStatusChange}
-    staticUrl={app.static_preview_url}
-    screenshotUrl={app.preview_screenshot_url}
-    loadPreview={getPreviewUrl}
-  />;
-}
diff --git a/examples/white-label-minimal/components/Question.tsx b/examples/white-label-minimal/components/Question.tsx
deleted file mode 100644
index 8d4f07d..0000000
--- a/examples/white-label-minimal/components/Question.tsx
+++ /dev/null
@@ -1,210 +0,0 @@
-"use client";
-import { useRef, useState } from "react";
-import type { ToolCall, ToolInput } from "../lib/types";
-
-type Choice = { question: string; options: string[]; multi: boolean };
-type Field = { name: string; description: string };
-export function parseQuestion(
-  tool: ToolCall,
-):
-  | { kind: "choice"; choices: Choice[] }
-  | { kind: "input"; fields: Field[] }
-  | { kind: "approval" }
-  | { kind: "unknown" } {
-  try {
-    const args = JSON.parse(tool.arguments_string || "{}");
-    if (tool.waiting_on?.kind === "approval") return { kind: "approval" };
-    if (
-      tool.waiting_on?.kind === "choice" &&
-      Array.isArray(args.questions) &&
-      args.questions.length
-    ) {
-      const choices = args.questions.map((q: Record<string, unknown>) => {
-        if (typeof q.question !== "string" || !Array.isArray(q.options)) throw Error();
-        const options = q.options.map((o) => (typeof o === "string" ? o : o?.label));
-        if (options.some((o) => typeof o !== "string")) throw Error();
-        return { question: q.question, options, multi: q.multi_select === true };
-      });
-      return { kind: "choice", choices };
-    }
-    if (
-      tool.waiting_on?.kind === "input" &&
-      Array.isArray(args.secrets_schema) &&
-      args.secrets_schema.length
-    ) {
-      const fields = args.secrets_schema.map((s: Record<string, unknown>) => {
-        if (typeof s.secretName !== "string" || !s.secretName) throw Error();
-        return {
-          name: s.secretName,
-          description: typeof s.description === "string" ? s.description : "",
-        };
-      });
-      return { kind: "input", fields };
-    }
-  } catch {
-    /* Incomplete or unfamiliar schemas must not become blind approvals. */
-  }
-  return { kind: "unknown" };
-}
-
-export default function Question({
-  tool,
-  messageId,
-  appId,
-  disabled,
-  onSubmit,
-}: {
-  tool: ToolCall;
-  messageId: string;
-  appId: string;
-  disabled: boolean;
-  onSubmit: (input: ToolInput) => Promise<void>;
-}) {
-  const question = parseQuestion(tool);
-  const [selected, setSelected] = useState<Record<number, string[]>>({});
-  const [values, setValues] = useState<Record<string, string>>({});
-  const [attempt, setAttempt] = useState<ToolInput | null>(null);
-  const [error, setError] = useState("");
-  const [busy, setBusy] = useState(false);
-  const [submitted, setSubmitted] = useState(false);
-  const lock = useRef(false);
-  const waiting = tool.status === "waiting_for_user_input";
-  async function submit(approve: boolean, extraUserInput: Record<string, unknown>) {
-    if (lock.current || !tool.id) return;
-    lock.current = true;
-    setBusy(true);
-    setError("");
-    // Retries must use the same payload with the same request ID.
-    const input = attempt ?? { appId, toolCallId: tool.id, messageId, approve, extraUserInput };
-    setAttempt(input);
-    try {
-      await onSubmit(input);
-      setSubmitted(true);
-      setAttempt(null);
-      setValues({});
-    } catch (err) {
-      setError(err instanceof Error ? err.message : "Submission failed.");
-    } finally {
-      lock.current = false;
-      setBusy(false);
-    }
-  }
-  const answers =
-    question.kind === "choice"
-      ? question.choices
-          .map((_, i) => ({
-            question_index: i,
-            selected_labels: selected[i] || [],
-            custom_text: values[i] || "",
-          }))
-          .filter((a) => a.selected_labels.length || a.custom_text.trim())
-      : [];
-  const secrets =
-    question.kind === "input"
-      ? Object.fromEntries(
-          question.fields
-            .filter((f) => values[f.name]?.trim())
-            .map((f) => [f.name, values[f.name]]),
-        )
-      : {};
-  const payload =
-    question.kind === "choice" ? { answers } : question.kind === "input" ? { secrets } : {};
-  const empty =
-    question.kind === "choice"
-      ? !answers.length
-      : question.kind === "input"
-        ? !Object.keys(secrets).length
-        : false;
-  return (
-    <section className="question">
-      <strong>{tool.name || "Agent action"}</strong>{" "}
-      <small>{submitted ? "Answer sent" : tool.status}</small>
-      {(question.kind === "unknown" || question.kind === "approval") && (
-        <details>
-          <summary>
-            {question.kind === "unknown"
-              ? "Unsupported question / tool details"
-              : "Review proposed action"}
-          </summary>
-          <pre>{tool.arguments_string || "No arguments provided."}</pre>
-        </details>
-      )}
-      {waiting && !submitted && (
-        <>
-          <fieldset disabled={disabled || busy || !!attempt || !tool.id}>
-            {question.kind === "choice" &&
-              question.choices.map((q, i) => (
-                <div key={i}>
-                  <p>{q.question}</p>
-                  {q.options.map((label) => (
-                    <label className="option" key={label}>
-                      <input
-                        type={q.multi ? "checkbox" : "radio"}
-                        name={`${tool.id}-${i}`}
-                        checked={(selected[i] || []).includes(label)}
-                        onChange={() =>
-                          setSelected((s) => ({
-                            ...s,
-                            [i]: q.multi
-                              ? (s[i] || []).includes(label)
-                                ? s[i].filter((x) => x !== label)
-                                : [...(s[i] || []), label]
-                              : [label],
-                          }))
-                        }
-                      />
-                      {label}
-                    </label>
-                  ))}
-                  <label>
-                    Additional answer
-                    <input
-                      value={values[i] || ""}
-                      onChange={(e) => setValues((v) => ({ ...v, [i]: e.target.value }))}
-                    />
-                  </label>
-                </div>
-              ))}
-            {question.kind === "input" &&
-              question.fields.map((f) => (
-                <label key={f.name}>
-                  {f.name}
-                  <small>{f.description}</small>
-                  <input
-                    type="password"
-                    autoComplete="off"
-                    value={values[f.name] || ""}
-                    onChange={(e) => setValues((v) => ({ ...v, [f.name]: e.target.value }))}
-                  />
-                </label>
-              ))}
-            <div className="actions">
-              {question.kind !== "unknown" && (
-                <button disabled={empty} onClick={() => void submit(true, payload)}>
-                  {question.kind === "approval" ? "Approve" : "Send answer"}
-                </button>
-              )}
-              <button className="secondary" onClick={() => void submit(false, {})}>
-                Reject
-              </button>
-            </div>
-          </fieldset>
-          {attempt && !busy && (
-            <button
-              disabled={disabled}
-              onClick={() => void submit(attempt.approve, attempt.extraUserInput)}
-            >
-              Retry original answer
-            </button>
-          )}
-          {busy && <p role="status">Sending answer…</p>}
-          {error && (
-            <p role="alert">
-              {error} Reconnect live updates to check the outcome, or retry the original answer.
-            </p>
-          )}
-        </>
-      )}
-    </section>
-  );
-}
diff --git a/examples/white-label-minimal/components/ToolActivity.tsx b/examples/white-label-minimal/components/ToolActivity.tsx
deleted file mode 100644
index 574d99d..0000000
--- a/examples/white-label-minimal/components/ToolActivity.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-import { CircleAlert, Loader2, ChevronDown } from "lucide-react";
-import type { ToolCall } from "../lib/types";
-
-export default function ToolActivity({ tool }: { tool: ToolCall }) {
-  const pending = ["running", "pending"].includes(tool.status || "");
-  const failed = ["error", "stopped"].includes(tool.status || "");
-  let argumentsText = tool.arguments_string || "";
-  try {
-    argumentsText = JSON.stringify(JSON.parse(argumentsText), null, 2);
-  } catch {}
-  return (
-    <details className="tool-activity">
-      <summary>
-        {pending ? (
-          <Loader2 size={14} className="spin" />
-        ) : failed ? (
-          <CircleAlert size={14} />
-        ) : (
-          <span className="tool-dot" />
-        )}
-        <span>{tool.name || "Agent action"}</span>
-        <span className="sr-only">{pending ? "Working" : failed ? "Failed" : "Done"}</span>
-        <ChevronDown size={12} className="tool-chevron" />
-      </summary>
-      {argumentsText && (
-        <div>
-          <strong>Arguments</strong>
-          <pre>{argumentsText}</pre>
-        </div>
-      )}
-      {tool.results && (
-        <div>
-          <strong>Result</strong>
-          <pre>
-            {typeof tool.results === "string"
-              ? tool.results
-              : JSON.stringify(tool.results, null, 2)}
-          </pre>
-        </div>
-      )}
-    </details>
-  );
-}
diff --git a/examples/white-label-minimal/components/Workspace.tsx b/examples/white-label-minimal/components/Workspace.tsx
deleted file mode 100644
index 27fd70d..0000000
--- a/examples/white-label-minimal/components/Workspace.tsx
+++ /dev/null
@@ -1,281 +0,0 @@
-"use client";
-import type { App } from "../lib/types";
-import { useCallback, useEffect, useRef, useState } from "react";
-import Link from "next/link";
-import { signOut } from "next-auth/react";
-import { ArrowLeft, Grid2X2, Loader2, LogOut, MessageSquare, Plus, Sparkles, X } from "lucide-react";
-import TinySunnyLogo from "./TinySunnyLogo";
-import * as api from "../lib/chat/builder-api";
-import Builder from "./Builder";
-import AppWidget from "./AppWidget";
-import PreviewFrame from "./PreviewFrame";
-
-export default function Workspace({ name }: { name: string }) {
-  const [removing, setRemoving] = useState<string | null>(null);
-  const editorPanel = useRef<HTMLElement>(null);
-  const assistantButton = useRef<HTMLButtonElement>(null);
-  const closeButton = useRef<HTMLButtonElement>(null);
-  const backButton = useRef<HTMLButtonElement>(null);
-  const [apps, setApps] = useState<App[]>([]);
-  const [loading, setLoading] = useState(true);
-  const [error, setError] = useState("");
-  const [needsConnection, setNeedsConnection] = useState(false);
-  // What the stage shows. Kept apart from `editor` so an app created mid-chat
-  // can appear beside the conversation without remounting the Builder.
-  const [stageApp, setStageApp] = useState<App | null>(null);
-  const [editor, setEditor] = useState<{ app: App | null; version: number }>({
-    app: null,
-    version: 0,
-  });
-  const [inApp, setInApp] = useState(false);
-  function closeAssistant() {
-    setMobileEditorOpen(false);
-    assistantButton.current?.focus();
-  }
-  const [activeName, setActiveName] = useState("");
-  const [mobileEditorOpen, setMobileEditorOpen] = useState(false);
-  useEffect(() => {
-    if (mobileEditorOpen && window.matchMedia("(max-width: 760px)").matches)
-      closeButton.current?.focus();
-  }, [mobileEditorOpen]);
-  useEffect(() => {
-    if (editor.version > 0 && !editor.app)
-      editorPanel.current?.querySelector<HTMLTextAreaElement>(".composer textarea")?.focus();
-  }, [editor.version, editor.app]);
-  const updateApp = useCallback((app: App) => {
-    setActiveName(app.name || "");
-    setApps((current) => current.map((item) => (item.id === app.id ? app : item)));
-    setStageApp((current) => (current?.id === app.id ? app : current));
-    setEditor((current) => (current.app?.id === app.id ? { ...current, app } : current));
-    // useState setters are stable, so this stays a stable callback; naming them
-    // is what lets the React Compiler keep the memoization.
-  }, [setActiveName, setApps, setStageApp, setEditor]);
-  function openApp(app: App | null = null) {
-    setActiveName(app?.name || "");
-    setStageApp(app);
-    setEditor((current) => ({ app, version: current.version + 1 }));
-    setInApp(true);
-    setMobileEditorOpen(true);
-  }
-  function backToApps() {
-    setInApp(false);
-    setMobileEditorOpen(false);
-    setStageApp(null);
-    setActiveName("");
-    setEditor((current) => ({ app: null, version: current.version + 1 }));
-  }
-  const load = useCallback(() => {
-    return (async () => {
-      const allApps: App[] = [];
-      let skip = 0;
-      while (true) {
-        const page = await api.listApps(skip);
-        allApps.push(...page.apps);
-        if (!page.hasMore) return allApps;
-        if (page.nextSkip <= skip) throw new Error("Could not load the next page of apps.");
-        skip = page.nextSkip;
-      }
-    })()
-      .then((result) => {
-        setError("");
-        setApps(result);
-        setNeedsConnection(false);
-      })
-      .catch((err) => {
-        if (err instanceof api.ApiError && err.status === 428) setNeedsConnection(true);
-        else setError(err instanceof Error ? err.message : "Could not load your apps.");
-      })
-      .finally(() => setLoading(false));
-  }, []);
-  useEffect(() => {
-    void load();
-  }, [load]);
-  async function removeApp(app: App) {
-    if (removing) return;
-    setRemoving(app.id);
-    setError("");
-    try {
-      await api.removeApp(app.id);
-      setApps((current) => current.filter((item) => item.id !== app.id));
-      // No guard for "was the open app removed": the cards only exist on the
-      // home page, and stageApp is only set once you are inside an app.
-    } catch (err) {
-      setError(err instanceof Error ? err.message : "Could not remove the app.");
-    } finally {
-      setRemoving(null);
-    }
-  }
-  async function connect() {
-    setLoading(true);
-    setError("");
-    try {
-      const response = await fetch("/api/base44/connection", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ action: "connect" }),
-      });
-      if (!response.ok) throw new Error("Could not connect your workspace. Please try again.");
-      setNeedsConnection(false);
-      await load();
-    } catch (err) {
-      setError((err as Error).message);
-      setLoading(false);
-    }
-  }
-  return (
-    <div className="workspace">
-      <header className="topbar">
-        <Link href="/" aria-label="Tiny Sunny home">
-          <TinySunnyLogo />
-        </Link>
-        <div className="account">
-          <button className="secondary" onClick={() => openApp()} disabled={needsConnection}>
-            <Plus size={16} /> New app
-          </button>
-          <span>{name}</span>
-          <button
-            className="icon-button"
-            aria-label="Sign out"
-            onClick={() => signOut({ callbackUrl: "/" })}
-          >
-            <LogOut size={17} />
-          </button>
-        </div>
-      </header>
-      <div className="workspace-body">
-        {!inApp ? (
-          <main className="apps-page">
-            <div className="apps-content">
-              {error && (
-                <div role="alert" className="error">
-                  <p>{error}</p>
-                  <button className="secondary" onClick={() => load()}>
-                    Try again
-                  </button>
-                </div>
-              )}
-              {needsConnection ? (
-                <div className="empty-state">
-                  <MessageSquare size={28} />
-                  <h2>Your ideas start here</h2>
-                  <p>Connect your workspace to build your first app.</p>
-                  <button disabled={loading} onClick={connect}>
-                    {loading ? "Connecting…" : "Connect workspace"}
-                  </button>
-                </div>
-              ) : loading && !apps.length ? (
-                <div className="empty-state" role="status">
-                  <Loader2 className="spin" />
-                  <p>Loading your apps…</p>
-                </div>
-              ) : !error && !apps.length ? (
-                <div className="empty-state">
-                  <Grid2X2 size={28} />
-                  <h2>Make room for your first idea</h2>
-                  <p>Tell the assistant what you want to build.</p>
-                  <button onClick={() => openApp()}>
-                    <Plus size={16} /> Create an app
-                  </button>
-                </div>
-              ) : (
-                <div className="apps-grid">
-                  {apps.map((app) => (
-                    <AppWidget
-                      key={app.id}
-                      app={app}
-                      removing={!!removing || loading}
-                      onEdit={() => openApp(app)}
-                      onRemove={() => void removeApp(app)}
-                    />
-                  ))}
-                </div>
-              )}
-            </div>
-          </main>
-        ) : (
-          <main className="app-stage">
-            <header className="stage-heading">
-              <button ref={backButton} className="secondary" onClick={backToApps}>
-                <ArrowLeft size={16} /> All apps
-              </button>
-              <strong>{activeName || "New app"}</strong>
-            </header>
-            <div className="stage-body">
-              {stageApp ? (
-                <PreviewFrame
-                  key={stageApp.id}
-                  app={stageApp}
-                  live
-                  title={`${stageApp.name || "Untitled"} preview`}
-                />
-              ) : (
-                <div className="widget-placeholder">
-                  Describe what you want to build. The preview appears here once the app exists.
-                </div>
-              )}
-            </div>
-          </main>
-        )}
-        <button
-          ref={assistantButton}
-            className="mobile-assistant"
-            onClick={() => setMobileEditorOpen(true)}
-            aria-expanded={mobileEditorOpen}
-            aria-controls="app-editor"
-          >
-            <MessageSquare size={18} /> Assistant
-          </button>
-          <section
-            ref={editorPanel}
-            id="app-editor"
-            className={`editor-panel ${mobileEditorOpen ? "is-open" : ""} ${
-            editor.app ? "is-editing" : ""
-          }`}
-            aria-label="App editor"
-            onKeyDown={(e) => {
-              if (e.key === "Escape") closeAssistant();
-            }}
-          >
-            <header className="editor-heading">
-              <div>
-                {editor.app ? (
-                  <span className="editing-badge">
-                    <span className="editing-flare" aria-hidden="true" />
-                    Editing
-                  </span>
-                ) : (
-                  <Sparkles size={14} />
-                )}
-                <strong>{activeName || "Build an app"}</strong>
-              </div>
-              <div>
-                <button
-                  ref={closeButton}
-                  className="icon-button mobile-close"
-                  aria-label="Close assistant"
-                  onClick={closeAssistant}
-                >
-                  <X size={20} />
-                </button>
-              </div>
-            </header>
-            <Builder
-              key={editor.version}
-              initialAppId={editor.app?.id}
-              onUpdated={updateApp}
-              onGoHome={backToApps}
-              onCreated={(app) => {
-                setActiveName(app.name || "");
-                setStageApp(app);
-                setApps((current) => [app, ...current]);
-                // Adopt the app without bumping the version: the conversation
-                // that just created it has to survive.
-                setEditor((current) => ({ ...current, app }));
-                setInApp(true);
-              }}
-            />
-        </section>
-      </div>
-    </div>
-  );
-}
diff --git a/examples/white-label-minimal/components/useBuilderSocket.ts b/examples/white-label-minimal/components/useBuilderSocket.ts
deleted file mode 100644
index 1ff0a3a..0000000
--- a/examples/white-label-minimal/components/useBuilderSocket.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-"use client";
-import { useCallback, useEffect, useState } from "react";
-import { getApp } from "../lib/chat/builder-api";
-import { watchApp } from "../lib/chat/live-updates";
-import type { App, Message } from "../lib/types";
-
-// The app, its chat and the connection state, kept live over the Base44 socket.
-export function useBuilderSocket(appId: string | null) {
-  const [app, setApp] = useState<App | null>(null);
-  const [messages, setMessages] = useState<Message[]>([]);
-  const [error, setError] = useState("");
-  const [attempt, setAttempt] = useState(0);
-  const [loaded, setLoaded] = useState("");
-  const key = `${appId}:${attempt}`;
-
-  const refresh = useCallback(async () => {
-    if (appId) setApp(await getApp(appId));
-  }, [appId]);
-
-  useEffect(() => {
-    if (!appId) return;
-    let stopped = false;
-    let stop: (() => void) | undefined;
-    const readApp = () => getApp(appId).then((next) => { if (!stopped) setApp(next); });
-    const fail = () => {
-      if (stopped) return;
-      stopped = true;
-      stop?.();
-      setError("Live updates paused. Reconnect to continue.");
-      setLoaded(key);
-    };
-
-    readApp().catch(fail);
-    watchApp(appId, {
-      onMessages(update) {
-        if (stopped) return;
-        setMessages(update);
-        setError("");
-        setLoaded(key);
-      },
-      onStatus(status) {
-        if (stopped) return;
-        setApp((current) => current && { ...current, status: status ?? undefined });
-        // A finished build can rename the app, so read it again.
-        if (status?.state === "ready") readApp().catch(() => {});
-      },
-      onError: fail,
-    }).then((close) => (stopped ? close() : (stop = close)), fail);
-
-    return () => {
-      stopped = true;
-      stop?.();
-    };
-  }, [appId, key]);
-
-  const loading = !!appId && loaded !== key;
-  return {
-    app: app?.id === appId ? app : null,
-    messages: loading ? [] : messages,
-    error,
-    loading,
-    refresh,
-    resume: () => setAttempt((n) => n + 1),
-  };
-}
diff --git a/examples/white-label-minimal/lib/base44/client.ts b/examples/white-label-minimal/lib/base44/client.ts
deleted file mode 100644
index 03b25c7..0000000
--- a/examples/white-label-minimal/lib/base44/client.ts
+++ /dev/null
@@ -1,219 +0,0 @@
-import "server-only";
-import { customInstructions } from "./custom-instructions";
-import type { App, Message, ToolInput } from "../types";
-import { Base44Error } from "./error";
-import { getBase44Config } from "./config";
-
-export function createBase44Client(accessToken: string) {
-  async function request(
-    path: string,
-    {
-      body,
-      timeout = 30_000,
-      headers,
-    }: {
-      body?: object;
-      timeout?: number;
-      headers?: Record<string, string>;
-    } = {},
-  ) {
-    const { host } = getBase44Config();
-    let response: Response;
-    try {
-      response = await fetch(`${host}${path}`, {
-        method: body ? "POST" : "GET",
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          "Content-Type": "application/json",
-          ...headers,
-        },
-        body: body ? JSON.stringify(body) : undefined,
-        cache: "no-store",
-        redirect: "error",
-        signal: AbortSignal.timeout(timeout),
-      });
-    } catch {
-      // Never include fetch errors: they can contain a URL or upstream credentials.
-      throw new Base44Error(
-        "Base44 did not return a response. The operation may still be running.",
-        504,
-      );
-    }
-    if (!response.ok) {
-      const hint =
-        response.status === 401
-          ? "Reconnect your workspace."
-          : response.status === 403
-            ? "Check the account’s workspace access."
-            : response.status === 429
-              ? "Rate limit reached. Wait before trying again."
-              : response.status === 409
-                ? "The app may not build yet. Ask the agent to fix it."
-                : "Refresh the app state before repeating an operation.";
-      throw new Base44Error(`Base44 returned ${response.status}. ${hint}`, response.status);
-    }
-    const text = await response.text();
-    if (!text) return null;
-    try {
-      return JSON.parse(text);
-    } catch {
-      throw new Base44Error("Base44 returned an unreadable response. The outcome is uncertain.");
-    }
-  }
-
-  // Whether a derived static preview URL actually serves a build. Cached
-  // because getApp runs on every build.
-  const probes = new Map<string, { ok: boolean; at: number }>();
-  const probeTtl = 60_000;
-  async function servesABuild(url: string) {
-    const cached = probes.get(url);
-    if (cached && Date.now() - cached.at < probeTtl) return cached.ok;
-    let ok = false;
-    try {
-      const response = await fetch(url, {
-        redirect: "follow",
-        headers: { Accept: "text/html" },
-        signal: AbortSignal.timeout(5_000),
-      });
-      // An app with no build yet answers with a JSON error, which an iframe
-      // would render to the user as raw JSON.
-      ok = response.ok && (response.headers.get("content-type") || "").includes("text/html");
-    } catch {
-      ok = false;
-    }
-    probes.set(url, { ok, at: Date.now() });
-    return ok;
-  }
-
-  function staticPreviewUrl(slug: App["slug"]) {
-    const domain = process.env.BASE44_STATIC_PREVIEW_DOMAIN;
-    if (!domain || !slug || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(slug) ||
-      !/^[a-z0-9.-]+$/i.test(domain)) return undefined;
-    return `https://preview--${slug}.${domain}`;
-  }
-
-  // The static preview URL is derived here rather than returned by Base44, so
-  // it can name a build that does not exist. Verify the guess before handing
-  // it to a browser that would point an iframe at it.
-  async function appSummary(value: App): Promise<App> {
-    if (!value || typeof value.id !== "string")
-      throw new Base44Error("Base44 returned an app without an ID.");
-    const derived = staticPreviewUrl(value.slug);
-    return {
-      id: value.id,
-      name: value.name,
-      slug: value.slug,
-      static_preview_url: derived && (await servesABuild(derived)) ? derived : undefined,
-      preview_screenshot_url: value.preview_screenshot_url,
-      logo_url: value.logo_url,
-      user_description: value.user_description,
-      status: value.status
-        ? { state: value.status.state, error_source: value.status.error_source }
-        : undefined,
-    };
-  }
-
-  async function createApp(prompt: string) {
-    const app = await request("/api/apps", {
-      body: {
-        name: prompt.trim().slice(0, 80),
-        user_description: prompt,
-        initial_message: { content: prompt },
-        custom_instructions: customInstructions,
-        prevent_iframe_embedding: false,
-      },
-      timeout: 120_000,
-    });
-    return appSummary(app);
-  }
-
-  const getApp = async (id: string) => appSummary(await request(`/api/apps/${id}`));
-  async function getConversation(id: string, skip: number) {
-    const data = await request(`/api/apps/${id}/chat/full-conversation?limit=20&skip=${skip}`, {
-      timeout: 60_000,
-    });
-    if (!data || typeof data !== "object")
-      throw new Base44Error("Unexpected conversation response.");
-    if (data.messages != null && !Array.isArray(data.messages))
-      throw new Base44Error("Unexpected conversation response.");
-    const messages: Message[] = (data.messages ?? []).map((m: Message) => {
-      if (!m || typeof m.id !== "string" || !m.id)
-        throw new Base44Error("A conversation message has no stable ID.");
-      return {
-        id: m.id,
-        role: m.role,
-        content: m.content,
-        hidden: m.hidden,
-        tool_calls: m.tool_calls?.map((t) => ({
-          id: t.id,
-          name: t.name,
-          status: t.status,
-          waiting_on: t.waiting_on,
-          arguments_string: t.arguments_string,
-          results: typeof t.results === "string" ? t.results : undefined,
-        })),
-      };
-    });
-    return { messages };
-  }
-  const sendMessage = (id: string, content: string) =>
-    request(`/api/apps/${id}/chat/message`, { body: { content }, timeout: 120_000 }).then(
-      () => ({}),
-    );
-  const submitToolCallInput = (p: ToolInput) =>
-    request(`/api/apps/${p.appId}/chat/submit-tool-call-input`, {
-      body: {
-        tool_call_id: p.toolCallId,
-        message_id: p.messageId,
-        action: p.approve ? "approved" : "rejected",
-        extra_user_input: p.extraUserInput,
-      },
-      timeout: 120_000,
-      headers: { "X-Request-ID": `submit-${p.toolCallId}` },
-    }).then(() => ({}));
-  const deployApp = (id: string) =>
-    request(`/api/apps/${id}/deploy`, { body: {}, timeout: 120_000 }).then(() => ({}));
-
-  function httpsUrl(raw: unknown) {
-    if (typeof raw !== "string" || !raw)
-      throw new Base44Error("Base44 has not returned a URL yet. Try again shortly.");
-    let url: URL;
-    try {
-      url = new URL(raw.includes("://") ? raw : `https://${raw}`);
-    } catch {
-      throw new Base44Error("Base44 returned an invalid URL.");
-    }
-    if (url.protocol !== "https:" || url.username || url.password)
-      throw new Base44Error("Base44 returned an unsafe URL.");
-    return url;
-  }
-  async function getPreviewUrl(id: string) {
-    const data = await request(`/api/apps/${id}/sandbox/preview-url`, { timeout: 120_000 });
-    const url = httpsUrl(data?.preview_url);
-    if (data.preview_token) url.searchParams.set("_preview_token", data.preview_token);
-    url.searchParams.set("server_url", url.origin);
-    url.searchParams.set("hide_badge", "true");
-    url.searchParams.set("analytics-enable", "false");
-    return { url: url.href };
-  }
-  async function getPublishedUrl(id: string) {
-    try {
-      const data = await request(`/api/apps/platform/${id}/published-url`);
-      return { url: httpsUrl(data?.url).href };
-    } catch (error) {
-      if (error instanceof Base44Error && error.status === 404) return { url: null };
-      throw error;
-    }
-  }
-
-  return {
-    createApp,
-    getApp,
-    getConversation,
-    sendMessage,
-    submitToolCallInput,
-    getPreviewUrl,
-    deployApp,
-    getPublishedUrl,
-  };
-}
diff --git a/examples/white-label-minimal/lib/base44/config.ts b/examples/white-label-minimal/lib/base44/config.ts
deleted file mode 100644
index bd551e7..0000000
--- a/examples/white-label-minimal/lib/base44/config.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import "server-only";
-import { Base44Error } from "./error";
-
-export function getBase44Config() {
-  let host: URL;
-  try {
-    host = new URL(process.env.BASE44_PLATFORM_HOST || "");
-  } catch {
-    throw new Base44Error("The workspace connection is not configured.", 503);
-  }
-  if (
-    host.protocol !== "https:" ||
-    host.username ||
-    host.password ||
-    host.pathname !== "/" ||
-    host.search ||
-    host.hash
-  ) {
-    throw new Base44Error("The workspace connection requires an HTTPS platform origin.", 503);
-  }
-  return { host: host.origin };
-}
diff --git a/examples/white-label-minimal/lib/base44/identity.ts b/examples/white-label-minimal/lib/base44/identity.ts
deleted file mode 100644
index 8c79b84..0000000
--- a/examples/white-label-minimal/lib/base44/identity.ts
+++ /dev/null
@@ -1,151 +0,0 @@
-import "server-only";
-import { createHash } from "node:crypto";
-import type { Base44Link } from "../../generated/prisma";
-import { prisma } from "../storage/db";
-import { Base44Error } from "./error";
-import { getBase44Config } from "./config";
-import { withIdentityLock } from "../storage/identity-repository";
-
-export function getLink(email: string) {
-  return prisma.base44Link.findUnique({ where: { appUserEmail: email.toLowerCase() } });
-}
-
-export function linkStatus(link: Base44Link | null) {
-  return {
-    linked: link?.status === "linked" && Boolean(link.accessToken),
-    base44_user_email: link?.base44UserEmail ?? null,
-    organization_id: link?.organizationId ?? null,
-  };
-}
-
-function required(name: string) {
-  const value = process.env[name]?.trim();
-  if (!value) throw new Base44Error(`Configure ${name} on the server.`, 503);
-  return value;
-}
-
-async function request(path: string, body: object | URLSearchParams, key?: string) {
-  const { host } = getBase44Config();
-  let response: Response;
-  try {
-    response = await fetch(`${host}${path}`, {
-      method: "POST",
-      headers: {
-        "Content-Type": body instanceof URLSearchParams
-          ? "application/x-www-form-urlencoded" : "application/json",
-        ...(key ? { Authorization: key } : {}),
-      },
-      body: body instanceof URLSearchParams ? body : JSON.stringify(body),
-      cache: "no-store",
-      redirect: "error",
-      signal: AbortSignal.timeout(30_000),
-    });
-  } catch {
-    throw new Base44Error("Could not reach Base44. Please try again.", 504);
-  }
-  if (!response.ok) {
-    const expired = path === "/oauth/token" && [400, 401, 403].includes(response.status);
-    throw new Base44Error(
-      expired ? "Reconnect your workspace to continue." : `Base44 returned ${response.status}. Please try again.`,
-      expired ? 428 : 502,
-    );
-  }
-  try {
-    return await response.json();
-  } catch {
-    throw new Base44Error("Base44 returned an unreadable identity response.");
-  }
-}
-
-function tokenFields(data: Record<string, unknown> | null, previousRefreshToken?: string | null) {
-  if (!data) throw new Base44Error("Base44 returned invalid credentials.");
-  const refreshToken = data.refresh_token ?? previousRefreshToken;
-  const expiresIn = Number(data.expires_in);
-  if (typeof data.access_token !== "string" || !data.access_token ||
-      typeof refreshToken !== "string" || !refreshToken ||
-      !Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Base44Error("Base44 returned invalid credentials.");
-  }
-  return {
-    accessToken: data.access_token,
-    refreshToken,
-    expiresAt: new Date(Date.now() + expiresIn * 1000),
-  };
-}
-
-export async function connect(email: string) {
-  const appUserEmail = email.toLowerCase();
-  const organizationId = required("BASE44_ORG_ID");
-  const key = required("BASE44_SVC_KEY");
-  const existing = await getLink(appUserEmail);
-  const digest = createHash("sha256").update(`${organizationId}:${appUserEmail}`).digest("hex");
-  const serviceExternalId = existing?.serviceExternalId ?? `sunny-${digest.slice(0, 32)}`;
-  const principal = await request("/api/service/users", {
-    service_external_id: serviceExternalId,
-    display_name: `Builder ${serviceExternalId.slice(-8)}`,
-  }, process.env.BASE44_PROVISION_KEY?.trim() || key);
-  const domain = typeof principal?.email === "string" ? principal.email.split("@")[1] : "";
-  if (!domain || !(domain === "svc.base44.invalid" || domain.endsWith(".svc.base44.invalid")))
-    throw new Base44Error("Base44 returned an invalid service-user identity.");
-  const tokens = await request("/api/service/user-tokens", {
-    service_external_id: serviceExternalId,
-  }, key);
-  const record = {
-    ...tokenFields(tokens),
-    status: "linked" as const,
-    organizationId,
-    serviceExternalId,
-    base44UserEmail: principal.email,
-    principalProvisioned: true,
-  };
-  return linkStatus(await prisma.base44Link.upsert({
-    where: { appUserEmail },
-    create: { appUserEmail, createdBy: appUserEmail, ...record },
-    update: record,
-  }));
-}
-
-export async function getBase44AccessToken(email: string): Promise<string> {
-  const appUserEmail = email.toLowerCase();
-  return withIdentityLock(appUserEmail, async (identities) => {
-    const link = await identities.findUnique({ where: { appUserEmail } });
-    if (link?.status !== "linked" || !link.accessToken)
-      throw new Base44Error("Connect your workspace to start building.", 428);
-    if (link.expiresAt && link.expiresAt.getTime() > Date.now() + 60_000)
-      return link.accessToken;
-    if (!link.refreshToken)
-      throw new Base44Error("Reconnect your workspace to continue.", 428);
-    const tokens = await request("/oauth/token", new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: "svc_delegate",
-      refresh_token: link.refreshToken,
-    }));
-    const refreshed = await identities.update({
-      where: { appUserEmail },
-      data: tokenFields(tokens, link.refreshToken),
-    });
-    return refreshed.accessToken!;
-  });
-}
-
-export async function disconnect(email: string) {
-  const link = await getLink(email);
-  if (link?.refreshToken) {
-    const { host } = getBase44Config();
-    try {
-      await fetch(`${host}/oauth/revoke`, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({ token: link.refreshToken, client_id: "svc_delegate" }),
-        redirect: "error",
-        signal: AbortSignal.timeout(15_000),
-      });
-    } catch {
-    }
-  }
-  await prisma.base44Link.updateMany({
-    where: { appUserEmail: email.toLowerCase() },
-    data: { status: "pending", accessToken: null, refreshToken: null, expiresAt: null },
-  });
-  return linkStatus(null);
-}
diff --git a/examples/white-label-minimal/lib/base44/socket-session.ts b/examples/white-label-minimal/lib/base44/socket-session.ts
deleted file mode 100644
index 3be572f..0000000
--- a/examples/white-label-minimal/lib/base44/socket-session.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import "server-only";
-import { Base44Error } from "./error";
-import { getBase44Config } from "./config";
-
-// Opens a read-only live-updates session for one app. The browser gets only the
-// session token; the workspace key (it needs the apps:watch scope) stays here.
-export async function openSocketSession(appId: string) {
-  const { host } = getBase44Config();
-  const response = await fetch(`${host}/api/service/socket-sessions`, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${process.env.BASE44_SVC_KEY}`, "Content-Type": "application/json" },
-    body: JSON.stringify({ app_ids: [appId] }),
-    cache: "no-store",
-  });
-  if (response.status === 401 || response.status === 403)
-    throw new Base44Error("Live updates need a workspace key with the apps:watch scope.", 503);
-  if (!response.ok) throw new Base44Error(`Base44 returned ${response.status} opening live updates.`);
-  const { socket_url, session_token } = await response.json();
-  return { serverUrl: new URL(socket_url).origin, sessionToken: String(session_token) };
-}
diff --git a/examples/white-label-minimal/lib/chat/assistant-messages.ts b/examples/white-label-minimal/lib/chat/assistant-messages.ts
deleted file mode 100644
index d714fb5..0000000
--- a/examples/white-label-minimal/lib/chat/assistant-messages.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import type { ThreadMessageLike } from "@assistant-ui/react";
-import type { Message } from "../types";
-
-export function toAssistantMessage(message: Message): ThreadMessageLike {
-  const role = message.role === "user" ? "user" : "assistant";
-  const tools = role === "assistant" ? (message.tool_calls ?? []) : [];
-  return {
-    id: message.id,
-    role,
-    content: [
-      ...(message.content ? [{ type: "text" as const, text: message.content }] : []),
-      ...tools.map((tool, index) => ({
-        type: "tool-call" as const,
-        toolCallId: tool.id || `${message.id}:tool:${index}`,
-        toolName: tool.name || "Agent action",
-        argsText: tool.arguments_string || "",
-        artifact: { tool, messageId: message.id },
-        ...(tool.results != null ? { result: tool.results } : {}),
-        isError: tool.status === "error" || tool.status === "stopped",
-        ...(tool.status === "waiting_for_user_input"
-          ? { interrupt: { type: "human" as const, payload: tool.waiting_on } }
-          : {}),
-      })),
-    ],
-  };
-}
diff --git a/examples/white-label-minimal/lib/chat/build-readiness.ts b/examples/white-label-minimal/lib/chat/build-readiness.ts
deleted file mode 100644
index 854f9c0..0000000
--- a/examples/white-label-minimal/lib/chat/build-readiness.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import type { Message } from "../types";
-
-const CODE_TOOLS = new Set(["write_file", "find_replace"]);
-const ACTIVE_STATUSES = new Set(["pending", "running", "waiting_for_user_input"]);
-
-export function hasCompletedBuild(messages: Message[]): boolean {
-  const visible = messages.filter(message => !message.hidden);
-  if (visible.at(-1)?.role !== "assistant") return false;
-  const lastUser = messages.findLastIndex(message => message.role === "user");
-  const activeTurn = messages.slice(lastUser + 1);
-  if (activeTurn.some(message => message.tool_calls?.some(tool =>
-    ACTIVE_STATUSES.has(tool.status || "")))) return false;
-  // Only this turn counts: a later turn that just answers or asks is not a new build.
-  return activeTurn.some(message => message.tool_calls?.some(tool =>
-    CODE_TOOLS.has(tool.name || "") && tool.status === "success"));
-}
diff --git a/examples/white-label-minimal/lib/chat/builder-api.ts b/examples/white-label-minimal/lib/chat/builder-api.ts
deleted file mode 100644
index 7a50d8f..0000000
--- a/examples/white-label-minimal/lib/chat/builder-api.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import type { App, AppPage, Message, ToolInput } from "../types";
-
-export class ApiError extends Error {
-  constructor(
-    message: string,
-    public status = 0,
-    public notStarted = false,
-  ) {
-    super(message);
-  }
-}
-
-async function call<T>(action: string, params: object, signal?: AbortSignal): Promise<T> {
-  let response: Response;
-  try {
-    response = await fetch("/api/base44", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ action, ...params }),
-      cache: "no-store",
-      signal,
-    });
-  } catch (error) {
-    if (signal?.aborted) throw error;
-    throw new ApiError("Connection lost. The operation may still be running.");
-  }
-  let data;
-  try {
-    data = await response.json();
-  } catch {
-    throw new ApiError(
-      "The server returned an unreadable response. The outcome is uncertain.",
-      502,
-    );
-  }
-  if (!response.ok)
-    throw new ApiError(
-      data.error || "The request failed.",
-      response.status,
-      data.outcome === "not_started",
-    );
-  return data as T;
-}
-
-export const createApp = (prompt: string) => call<App>("createApp", { prompt });
-export const getApp = (appId: string, signal?: AbortSignal) =>
-  call<App>("getApp", { appId }, signal);
-export const getConversation = (appId: string, skip = 0, signal?: AbortSignal) =>
-  call<{ messages: Message[] }>("getConversation", { appId, skip }, signal);
-export const sendMessage = (appId: string, content: string) =>
-  call("sendMessage", { appId, content });
-export const submitToolCallInput = (input: ToolInput) => call("submitToolCallInput", input);
-export const getPreviewUrl = (appId: string) => call<{ url: string }>("getPreviewUrl", { appId });
-export const deployApp = (appId: string) => call("deployApp", { appId });
-export const getPublishedUrl = (appId: string) =>
-  call<{ url: string | null }>("getPublishedUrl", { appId });
-
-export const listApps = (skip = 0) => call<AppPage>("listApps", { skip });
-
-export const removeApp = (appId: string) => call("removeApp", { appId });
-
-export const openBuilderSession = (appId: string) =>
-  call<{ serverUrl: string; sessionToken: string }>("openBuilderSession", { appId });
diff --git a/examples/white-label-minimal/lib/chat/conversation.ts b/examples/white-label-minimal/lib/chat/conversation.ts
deleted file mode 100644
index 52d6eec..0000000
--- a/examples/white-label-minimal/lib/chat/conversation.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import type { Message } from "../types";
-
-export const isPending = (m: Message) =>
-  m.tool_calls?.some((t) => t.status === "running" || t.status === "waiting_for_user_input");
-
-// skip counts backward from the newest message, not forward from the oldest.
-export async function refreshConversation(
-  previous: Message[],
-  read: (skip: number) => Promise<{ messages: Message[] }>,
-): Promise<Message[]> {
-  const known = new Set(previous.map((m) => m.id));
-  const oldestPending = previous.find(isPending)?.id;
-  let fetched: Message[] = [];
-  for (let skip = 0; skip <= 100_000; skip += 20) {
-    const { messages } = await read(skip);
-    if (messages.some((m) => !m.id)) throw new Error("Conversation messages need stable IDs.");
-    // Keep the fresher copy when concurrent appends shift page boundaries.
-    const newer = new Set(fetched.map((m) => m.id));
-    fetched = [...messages.filter((m) => !newer.has(m.id)), ...fetched];
-    const reachedHistory = oldestPending
-      ? fetched.some((m) => m.id === oldestPending)
-      : messages.some((m) => known.has(m.id));
-    if (messages.length < 20 || reachedHistory) {
-      const updates = new Map(fetched.map((m) => [m.id, m]));
-      return [
-        ...previous.map((m) => updates.get(m.id) ?? m),
-        ...fetched.filter((m) => !known.has(m.id)),
-      ];
-    }
-  }
-  throw new Error("Conversation is too large for this learning example.");
-}
diff --git a/examples/white-label-minimal/lib/chat/live-messages.ts b/examples/white-label-minimal/lib/chat/live-messages.ts
deleted file mode 100644
index cf6de8d..0000000
--- a/examples/white-label-minimal/lib/chat/live-messages.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import type { ChatMessage } from "@base44/platform";
-import type { Message } from "../types";
-
-// Converts a socket message to the shape this example's chat UI renders.
-export function toMessage(message: ChatMessage): Message {
-  return {
-    id: message.id ?? "",
-    role: message.role,
-    content: message.content,
-    tool_calls: message.tool_calls?.map((tool) => ({
-      id: tool.id,
-      name: tool.name,
-      status: tool.status,
-      waiting_on: tool.waiting_on,
-      arguments_string: tool.arguments ? JSON.stringify(tool.arguments) : null,
-      results: typeof tool.results === "string" ? tool.results : undefined,
-    })),
-  };
-}
-
-// Replaces the message with the same id, or appends it.
-export function upsertMessage(messages: Message[], message: Message): Message[] {
-  return messages.some((m) => m.id === message.id)
-    ? messages.map((m) => (m.id === message.id ? message : m))
-    : [...messages, message];
-}
diff --git a/examples/white-label-minimal/lib/chat/live-updates.ts b/examples/white-label-minimal/lib/chat/live-updates.ts
deleted file mode 100644
index 15686f9..0000000
--- a/examples/white-label-minimal/lib/chat/live-updates.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-import { Base44PlatformClient, type AppStatus } from "@base44/platform";
-import type { Message } from "../types";
-import { openBuilderSession } from "./builder-api";
-import { toMessage, upsertMessage } from "./live-messages";
-
-export type LiveUpdateHandlers = {
-  onMessages: (update: (messages: Message[]) => Message[]) => void;
-  onStatus: (status: AppStatus | null) => void;
-  onError: () => void;
-};
-
-// Watches one app's builder chat over the Base44 socket. Resolves to a function
-// that stops watching.
-export async function watchApp(appId: string, handlers: LiveUpdateHandlers) {
-  const session = await openBuilderSession(appId);
-  let firstToken: string | undefined = session.sessionToken;
-  const client = new Base44PlatformClient({
-    serverUrl: session.serverUrl,
-    // The first connection uses the session opened above. The SDK calls this
-    // again only when that session has ended, and our server opens a new one.
-    async getSessionToken() {
-      const token = firstToken ?? (await openBuilderSession(appId)).sessionToken;
-      firstToken = undefined;
-      return token;
-    },
-  });
-
-  const builder = client.builder.init({ onError: handlers.onError });
-  builder.subscribe(appId, {
-    // Arrives on every connect and reconnect, with the last 50 messages.
-    onSnapshot(snapshot) {
-      handlers.onMessages(() => snapshot.messages.map(toMessage));
-      handlers.onStatus(snapshot.status);
-    },
-    onEvent(event) {
-      if (event.type === "message.updated") {
-        const message = toMessage(event.data.message);
-        handlers.onMessages((messages) => upsertMessage(messages, message));
-      }
-      if (event.type === "message.removed") {
-        const id = event.data.message_id;
-        handlers.onMessages((messages) => messages.filter((m) => m.id !== id));
-      }
-      if (event.type === "app.status_changed") handlers.onStatus(event.data.status);
-    },
-    onError: handlers.onError,
-  });
-  await builder.connect();
-  return () => builder.close();
-}
diff --git a/examples/white-label-minimal/lib/chat/optimistic-messages.ts b/examples/white-label-minimal/lib/chat/optimistic-messages.ts
deleted file mode 100644
index 02a7d9a..0000000
--- a/examples/white-label-minimal/lib/chat/optimistic-messages.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import type { Message } from "../types";
-
-export type OptimisticMessage = {
-  message: Message;
-  knownIds: string[];
-};
-
-/** Match only new server messages, once each, so repeated prompts stay distinct. */
-export function mergeOptimisticMessages(
-  messages: Message[],
-  optimistic: OptimisticMessage[],
-): Message[] {
-  const result = [...messages];
-  const matched = new Set<string>();
-  const localIds = new Set<string>();
-  for (const { message, knownIds } of optimistic) {
-    const known = new Set(knownIds);
-    const server = messages.find((candidate) =>
-      !candidate.hidden && candidate.role === "user" &&
-      !known.has(candidate.id) && !matched.has(candidate.id) &&
-      candidate.content?.trim() === message.content?.trim(),
-    );
-    if (server) {
-      matched.add(server.id);
-      // Keep React's identity stable when the server copy arrives.
-      result[result.findIndex((candidate) => candidate.id === server.id)] = {
-        ...server, id: message.id,
-      };
-    } else {
-      // Place the prompt before responses that arrived since it was submitted.
-      let after = -1;
-      result.forEach((candidate, index) => {
-        if (known.has(candidate.id) || localIds.has(candidate.id)) after = index;
-      });
-      result.splice(after + 1, 0, message);
-    }
-    localIds.add(message.id);
-  }
-  return result;
-}
diff --git a/examples/white-label-minimal/lib/server/api-handler.ts b/examples/white-label-minimal/lib/server/api-handler.ts
deleted file mode 100644
index 4ea2ff4..0000000
--- a/examples/white-label-minimal/lib/server/api-handler.ts
+++ /dev/null
@@ -1,169 +0,0 @@
-import { Base44Error } from "../base44/error";
-import type { AppClient } from "../types";
-
-const headers = { "Cache-Control": "no-store, private", "Referrer-Policy": "no-referrer" };
-const bad = (message: string, status = 400): never => {
-  throw new Base44Error(message, status);
-};
-
-export function createHandler(resolveClient: () => Promise<AppClient>) {
-  return async function POST(request: Request) {
-    let dispatched = false;
-    try {
-      const host = request.headers.get("host");
-      const origin = request.headers.get("origin");
-      const hostedOrigin = process.env.BUILDER_ORIGIN;
-      if (hostedOrigin) {
-        const allowed = new URL(hostedOrigin);
-        if (
-          allowed.protocol !== "https:" ||
-          allowed.origin !== hostedOrigin ||
-          host !== allowed.host ||
-          origin !== hostedOrigin
-        )
-          bad("This request origin is not allowed.", 403);
-      } else if (
-        !host ||
-        !/^(127\.0\.0\.1|localhost|\[::1\])(?::\d+)?$/.test(host) ||
-        origin !== `http://${host}`
-      ) {
-        bad("This request origin is not allowed.", 403);
-      }
-      const client = await resolveClient();
-      if (request.headers.get("content-type")?.split(";")[0].trim() !== "application/json")
-        bad("Send application/json.", 415);
-      const reader = request.body?.getReader();
-      if (!reader) return bad("A JSON body is required.");
-      const chunks: Uint8Array[] = [];
-      let size = 0;
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        size += value.byteLength;
-        if (size > 64_000) {
-          await reader.cancel();
-          bad("Request body is too large.", 413);
-        }
-        chunks.push(value);
-      }
-      let p: Record<string, unknown>;
-      try {
-        p = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-      } catch {
-        return Response.json(
-          { error: "Invalid JSON.", outcome: "not_started" },
-          { status: 400, headers },
-        );
-      }
-      if (!p || typeof p !== "object" || Array.isArray(p)) bad("Expected a JSON object.");
-      const fields = (...allowed: string[]) => {
-        if (Object.keys(p).some((k) => !["action", ...allowed].includes(k)))
-          bad("Unexpected request field.");
-      };
-      const string = (key: string, max = 16_000): string => {
-        const v = p[key];
-        if (typeof v !== "string" || !v.trim() || v.length > max) return bad(`Invalid ${key}.`);
-        return v;
-      };
-      const id = (key: string) => {
-        const v = string(key, 200);
-        if (!/^[A-Za-z0-9_-]+$/.test(v)) bad(`Invalid ${key}.`);
-        return v;
-      };
-      const skip = () => {
-        const value = p.skip ?? 0;
-        if (
-          typeof value !== "number" ||
-          !Number.isSafeInteger(value) ||
-          value < 0 ||
-          value > 100_000
-        )
-          return bad("Invalid skip.");
-        return value;
-      };
-      function execute<Args extends unknown[], Result>(
-        operation: (...args: Args) => Promise<Result>,
-        ...args: Args
-      ) {
-        dispatched = true;
-        return operation(...args);
-      }
-      let result;
-      if (p.appId !== undefined) await client.authorize(id("appId"));
-      switch (p.action) {
-        case "openBuilderSession":
-          fields("appId");
-          result = await execute(client.openBuilderSession, id("appId"));
-          break;
-        case "listApps": {
-          fields("skip");
-          result = await execute(client.listApps, skip());
-          break;
-        }
-        case "createApp":
-          fields("prompt");
-          result = await execute(client.createApp, string("prompt"));
-          break;
-        case "removeApp":
-          fields("appId");
-          result = await execute(client.removeApp, id("appId"));
-          break;
-        case "getApp":
-          fields("appId");
-          result = await execute(client.getApp, id("appId"));
-          break;
-        case "getConversation": {
-          fields("appId", "skip");
-          result = await execute(client.getConversation, id("appId"), skip());
-          break;
-        }
-        case "sendMessage":
-          fields("appId", "content");
-          result = await execute(client.sendMessage, id("appId"), string("content"));
-          break;
-        case "submitToolCallInput": {
-          fields("appId", "toolCallId", "messageId", "approve", "extraUserInput");
-          if (
-            typeof p.approve !== "boolean" ||
-            !p.extraUserInput ||
-            typeof p.extraUserInput !== "object" ||
-            Array.isArray(p.extraUserInput)
-          )
-            bad("Invalid tool-call decision or input.");
-          result = await execute(client.submitToolCallInput, {
-            appId: id("appId"),
-            toolCallId: id("toolCallId"),
-            messageId: id("messageId"),
-            approve: p.approve as boolean,
-            extraUserInput: p.extraUserInput as Record<string, unknown>,
-          });
-          break;
-        }
-        case "getPreviewUrl":
-          fields("appId");
-          result = await execute(client.getPreviewUrl, id("appId"));
-          break;
-        case "deployApp":
-          fields("appId");
-          result = await execute(client.deployApp, id("appId"));
-          break;
-        case "getPublishedUrl":
-          fields("appId");
-          result = await execute(client.getPublishedUrl, id("appId"));
-          break;
-        default:
-          bad("Unsupported action.");
-      }
-      return Response.json(result, { headers });
-    } catch (error) {
-      const safe =
-        error instanceof Base44Error
-          ? error
-          : new Base44Error("The local request failed. Check configuration and refresh app state.");
-      return Response.json(
-        { error: safe.message, outcome: dispatched ? "unknown" : "not_started" },
-        { status: safe.status, headers },
-      );
-    }
-  };
-}
diff --git a/examples/white-label-minimal/lib/server/app-service.ts b/examples/white-label-minimal/lib/server/app-service.ts
deleted file mode 100644
index 8d0f52d..0000000
--- a/examples/white-label-minimal/lib/server/app-service.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import "server-only";
-import { requireUser } from "./auth";
-import { getBase44AccessToken } from "../base44/identity";
-import { createAppRepository } from "../storage/app-repository";
-import { resolveAppPage } from "../storage/app-list";
-import { createBase44Client } from "../base44/client";
-import { openSocketSession } from "../base44/socket-session";
-import type { AppClient } from "../types";
-
-export async function getAppClient(): Promise<AppClient> {
-  const actor = await requireUser();
-  const token = await getBase44AccessToken(actor.email);
-  const client = createBase44Client(token);
-  const apps = createAppRepository(actor);
-  return {
-    ...client,
-    authorize: apps.authorize,
-    openBuilderSession: openSocketSession,
-    removeApp: apps.remove,
-    async createApp(prompt) {
-      const app = await client.createApp(prompt);
-      await apps.save(app);
-      return app;
-    },
-    async listApps(skip) {
-      return resolveAppPage(await apps.list(skip), skip, client.getApp);
-    },
-  };
-}
diff --git a/examples/white-label-minimal/lib/storage/app-repository.ts b/examples/white-label-minimal/lib/storage/app-repository.ts
deleted file mode 100644
index a2e19b0..0000000
--- a/examples/white-label-minimal/lib/storage/app-repository.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import "server-only";
-import { prisma } from "./db";
-import type { App } from "../types";
-import { Base44Error } from "../base44/error";
-
-export function createAppRepository(actor: { email: string }) {
-  const owner = { createdBy: actor.email };
-  return {
-    async authorize(appId: string) {
-      const owned = await prisma.appOwnership.findFirst({
-        where: { ...owner, appId },
-        select: { id: true },
-      });
-      if (!owned) throw new Base44Error("App not found.", 404);
-    },
-    async save(app: App) {
-      await prisma.appOwnership.upsert({
-        where: { appId_createdBy: { appId: app.id, createdBy: owner.createdBy } },
-        create: { ...owner, appId: app.id, appName: app.name },
-        update: { appName: app.name },
-      });
-    },
-    async remove(appId: string) {
-      await prisma.appOwnership.deleteMany({ where: { ...owner, appId } });
-      return {};
-    },
-    list(skip: number) {
-      return prisma.appOwnership.findMany({
-        where: owner,
-        orderBy: { createdAt: "desc" },
-        skip,
-        take: 13,
-        select: { appId: true },
-      });
-    },
-  };
-}
diff --git a/examples/white-label-minimal/lib/storage/identity-repository.ts b/examples/white-label-minimal/lib/storage/identity-repository.ts
deleted file mode 100644
index d163992..0000000
--- a/examples/white-label-minimal/lib/storage/identity-repository.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import "server-only";
-import type { Prisma } from "../../generated/prisma";
-import { prisma } from "./db";
-
-export function withIdentityLock<T>(
-  email: string,
-  operation: (identities: Prisma.TransactionClient["base44Link"]) => Promise<T>,
-) {
-  return prisma.$transaction(async (db) => {
-    await db.$queryRaw`SELECT id FROM base44_links WHERE app_user_email = ${email} FOR UPDATE`;
-    return operation(db.base44Link);
-  }, { timeout: 40_000 });
-}
diff --git a/examples/white-label-minimal/lib/types.ts b/examples/white-label-minimal/lib/types.ts
deleted file mode 100644
index 2f53de1..0000000
--- a/examples/white-label-minimal/lib/types.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-export type App = {
-  id: string;
-  name?: string;
-  slug?: string | null;
-  static_preview_url?: string;
-  preview_screenshot_url?: string;
-  logo_url?: string;
-  user_description?: string;
-  status?: { state?: string; error_source?: string };
-};
-export type ToolCall = {
-  id?: string | null;
-  name?: string | null;
-  status?: string | null;
-  waiting_on?: { kind?: string } | null;
-  arguments_string?: string | null;
-  results?: string | null;
-};
-export type Message = {
-  id: string;
-  role?: string | null;
-  content?: string | null;
-  hidden?: boolean | null;
-  tool_calls?: ToolCall[] | null;
-};
-export type ToolInput = {
-  appId: string;
-  toolCallId: string;
-  messageId: string;
-  approve: boolean;
-  extraUserInput: Record<string, unknown>;
-};
-
-export type AppPage = { apps: App[]; hasMore: boolean; nextSkip: number };
-
-export interface AppClient {
-  openBuilderSession(appId: string): Promise<{ serverUrl: string; sessionToken: string }>;
-  createApp(prompt: string): Promise<App>;
-  getApp(appId: string): Promise<App>;
-  getConversation(appId: string, skip: number): Promise<{ messages: Message[] }>;
-  sendMessage(appId: string, content: string): Promise<object>;
-  submitToolCallInput(input: ToolInput): Promise<object>;
-  getPreviewUrl(appId: string): Promise<{ url: string }>;
-  deployApp(appId: string): Promise<object>;
-  getPublishedUrl(appId: string): Promise<{ url: string | null }>;
-  removeApp(appId: string): Promise<object>;
-  authorize(appId: string): Promise<void>;
-  listApps(skip: number): Promise<AppPage>;
-}
diff --git a/examples/white-label-minimal/package.json b/examples/white-label-minimal/package.json
index 8643c88..acb0e40 100644
--- a/examples/white-label-minimal/package.json
+++ b/examples/white-label-minimal/package.json
@@ -7,7 +7,7 @@
     "build": "npm run db:generate && next build",
     "start": "next start --hostname 127.0.0.1 --port 3001",
     "typecheck": "next typegen && tsc --noEmit",
-    "test": "tsx --conditions=react-server --test tests/server.test.ts tests/identity.test.ts && tsx --test tests/conversation.test.ts tests/live-messages.test.ts tests/questions.test.tsx",
+    "test": "tsx --conditions=react-server --test tests/server.test.ts && tsx --test tests/messages.test.ts tests/questions.test.tsx",
     "test:browser": "playwright test",
     "db:generate": "prisma generate",
     "postinstall": "npm run db:generate"
diff --git a/examples/white-label-minimal/prisma/schema.prisma b/examples/white-label-minimal/prisma/schema.prisma
index cb0915b..b207b79 100644
--- a/examples/white-label-minimal/prisma/schema.prisma
+++ b/examples/white-label-minimal/prisma/schema.prisma
@@ -9,11 +9,6 @@ datasource db {
   url      = env("DATABASE_URL")
 }
 
-enum Base44LinkStatus {
-  pending
-  linked
-}
-
 model AppOwnership {
   id      String  @id @default(cuid())
   appId   String  @map("app_id")
@@ -27,27 +22,3 @@ model AppOwnership {
   @@index([createdBy])
   @@map("app_ownerships")
 }
-
-model Base44Link {
-  id String @id @default(cuid())
-
-  appUserEmail String @unique @map("app_user_email")
-
-  serviceExternalId String? @unique @map("service_external_id")
-
-  status       Base44LinkStatus @default(pending)
-  accessToken  String?          @map("access_token")
-  refreshToken String?          @map("refresh_token")
-  expiresAt    DateTime?        @map("expires_at")
-
-  organizationId       String? @map("organization_id")
-  base44UserEmail      String? @map("base44_user_email")
-  principalProvisioned Boolean @default(false) @map("principal_provisioned")
-
-  createdBy String   @map("created_by")
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@index([createdBy])
-  @@map("base44_links")
-}
diff --git a/examples/white-label-minimal/server/actions.ts b/examples/white-label-minimal/server/actions.ts
new file mode 100644
index 0000000..28acf5d
--- /dev/null
+++ b/examples/white-label-minimal/server/actions.ts
@@ -0,0 +1,119 @@
+"use server";
+import * as buildTurn from "./base44/build-turn";
+import { getEmbedUrl } from "./base44/embed";
+import { Base44Error } from "./base44/error";
+import * as liveUpdates from "./base44/live-updates";
+import { requireUser } from "./auth";
+import { resolveAppPage } from "./app-list";
+import { listOwnedApps, removeOwner, requireOwner, saveOwner } from "./ownership";
+import type { ActionResult, ToolInput } from "../types";
+
+// Server actions: functions Tiny's pages call that run on the server, where the
+// Base44 credentials are. Next.js exposes each one to the browser, so each one
+// checks who is signed in and, for an app, that they own it, before calling Base44.
+
+export async function listApps(skip: number) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    const rows = await listOwnedApps(user.email, skip);
+    return resolveAppPage(rows, skip, buildTurn.getApp);
+  });
+}
+
+export async function createApp(prompt: string) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    const app = await buildTurn.createApp(prompt);
+    await saveOwner(user.email, app);
+    return app;
+  });
+}
+
+// Removes the app from Tiny only. It stays in Base44.
+export async function removeApp(appId: string) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    await requireOwner(user.email, appId);
+    return removeOwner(user.email, appId);
+  });
+}
+
+export async function getApp(appId: string) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    await requireOwner(user.email, appId);
+    return buildTurn.getApp(appId);
+  });
+}
+
+export async function sendMessage(appId: string, content: string) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    await requireOwner(user.email, appId);
+    return buildTurn.sendMessage(appId, content);
+  });
+}
+
+export async function submitToolCallInput(input: ToolInput) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    await requireOwner(user.email, input.appId);
+    return buildTurn.submitToolCallInput(input);
+  });
+}
+
+export async function deployApp(appId: string) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    await requireOwner(user.email, appId);
+    return buildTurn.deployApp(appId);
+  });
+}
+
+export async function getPublishedUrl(appId: string) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    await requireOwner(user.email, appId);
+    return buildTurn.getPublishedUrl(appId);
+  });
+}
+
+// The app's latest build, signed in as the builder.
+export async function getLatestBuildUrl(appId: string) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    await requireOwner(user.email, appId);
+    return getEmbedUrl(appId, user.email, "latest_preview");
+  });
+}
+
+// The app's running sandbox, signed in as the builder.
+export async function getPreviewUrl(appId: string) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    await requireOwner(user.email, appId);
+    const { url } = await getEmbedUrl(appId, user.email, "live_preview");
+    if (!url) throw new Base44Error("The live preview is not available yet. Try refreshing.", 502);
+    return { url };
+  });
+}
+
+export async function openLiveUpdates(appId: string) {
+  return returnErrors(async () => {
+    const user = await requireUser();
+    await requireOwner(user.email, appId);
+    return liveUpdates.openLiveUpdates(appId);
+  });
+}
+
+// Next.js hides thrown error messages from the browser in production, so an
+// action returns its error instead of throwing it.
+async function returnErrors<T>(action: () => Promise<T>): Promise<ActionResult<T>> {
+  try {
+    return { data: await action() };
+  } catch (error) {
+    if (error instanceof Base44Error) return { error: error.message, status: error.status };
+    console.error("[actions]", error);
+    return { error: "The request failed. Check the server configuration.", status: 500 };
+  }
+}
diff --git a/examples/white-label-minimal/lib/storage/app-list.ts b/examples/white-label-minimal/server/app-list.ts
similarity index 64%
rename from examples/white-label-minimal/lib/storage/app-list.ts
rename to examples/white-label-minimal/server/app-list.ts
index 247e1c4..bec7da9 100644
--- a/examples/white-label-minimal/lib/storage/app-list.ts
+++ b/examples/white-label-minimal/server/app-list.ts
@@ -1,12 +1,16 @@
 import type { App } from "../types";
-import { Base44Error } from "../base44/error";
+import { Base44Error } from "./base44/error";
 
+export const PAGE_SIZE = 12;
+
+// rows holds one extra row so we know whether another page exists.
+// Apps deleted in Base44 (404) are dropped without shifting pagination.
 export async function resolveAppPage(
   rows: { appId: string }[],
   skip: number,
   getApp: (id: string) => Promise<App>,
 ) {
-  const page = rows.slice(0, 12);
+  const page = rows.slice(0, PAGE_SIZE);
   const results = await Promise.all(
     page.map(async (row) => {
       try {
@@ -19,7 +23,7 @@ export async function resolveAppPage(
   );
   return {
     apps: results.filter((app): app is App => app !== null),
-    hasMore: rows.length > 12,
+    hasMore: rows.length > PAGE_SIZE,
     nextSkip: skip + page.length,
   };
 }
diff --git a/examples/white-label-minimal/lib/server/auth.ts b/examples/white-label-minimal/server/auth.ts
similarity index 95%
rename from examples/white-label-minimal/lib/server/auth.ts
rename to examples/white-label-minimal/server/auth.ts
index 8c5e6ca..aecd6b5 100644
--- a/examples/white-label-minimal/lib/server/auth.ts
+++ b/examples/white-label-minimal/server/auth.ts
@@ -2,7 +2,7 @@ import "server-only";
 import { cache } from "react";
 import NextAuth from "next-auth";
 import Google from "next-auth/providers/google";
-import { Base44Error } from "../base44/error";
+import { Base44Error } from "./base44/error";
 
 export const { handlers, auth } = NextAuth({
   secret: process.env.NEXTAUTH_SECRET,
diff --git a/examples/white-label-minimal/server/base44/build-turn.ts b/examples/white-label-minimal/server/base44/build-turn.ts
new file mode 100644
index 0000000..8a021c1
--- /dev/null
+++ b/examples/white-label-minimal/server/base44/build-turn.ts
@@ -0,0 +1,109 @@
+import "server-only";
+import type { App, ToolInput } from "../../types";
+import { getBase44Config } from "./config";
+import { customInstructions } from "./custom-instructions";
+import { Base44Error } from "./error";
+import { base44 } from "./request";
+
+// "The build turn": https://docs.base44.com/developers/white-label/the-build-turn
+// The calls a builder's turn is made of, in order.
+//
+// Every app belongs to the integration account, so Base44 cannot tell builders
+// apart. Before calling these, the caller checks that the builder owns the app
+// and that its ID is a plain ID (server/actions.ts).
+
+// Create app, Send chat message, Submit tool-call input and Deploy an app wait
+// on a whole build turn, which can take minutes.
+const BUILD_TURN_TIMEOUT = 120_000;
+
+// 1. Create the app from a prompt. The build starts inside this call.
+export async function createApp(prompt: string): Promise<App> {
+  const { workspaceId } = getBase44Config();
+  const app = await base44("/api/apps", {
+    method: "POST",
+    body: {
+      // Without it, the app lands in the account's personal workspace.
+      organization_id: workspaceId,
+      name: prompt.slice(0, 80),
+      user_description: prompt,
+      initial_message: { content: prompt },
+      custom_instructions: customInstructions,
+      prevent_iframe_embedding: false,
+    },
+    timeout: BUILD_TURN_TIMEOUT,
+  });
+  return toApp(app);
+}
+
+// Every later prompt goes through Send chat message.
+export async function sendMessage(appId: string, content: string) {
+  await base44(`/api/apps/${appId}/chat/message`, {
+    method: "POST",
+    body: { content },
+    timeout: BUILD_TURN_TIMEOUT,
+  });
+  return {};
+}
+
+// 2. Watch it build: status.state is processing, ready or error.
+//    The chat itself arrives over live updates (live-updates.ts).
+export async function getApp(appId: string): Promise<App> {
+  const app = await base44(`/api/apps/${appId}`);
+  return toApp(app);
+}
+
+// 3. Answer the agent's questions: the UI is components/Question.tsx.
+// 4. Send the answer back. The request ID must stay the same when you retry,
+//    so Base44 resumes the turn only once.
+export async function submitToolCallInput(input: ToolInput) {
+  await base44(`/api/apps/${input.appId}/chat/submit-tool-call-input`, {
+    method: "POST",
+    headers: { "X-Request-ID": `submit-${input.toolCallId}` },
+    body: {
+      tool_call_id: input.toolCallId,
+      message_id: input.messageId,
+      action: input.approve ? "approved" : "rejected",
+      extra_user_input: input.extraUserInput,
+    },
+    timeout: BUILD_TURN_TIMEOUT,
+  });
+  return {};
+}
+
+// 5. Show the preview: see embed.ts, which signs the builder in.
+
+// 6. Publish the app.
+export async function deployApp(appId: string) {
+  await base44(`/api/apps/${appId}/deploy`, { method: "POST", body: {}, timeout: BUILD_TURN_TIMEOUT });
+  return {};
+}
+
+// A 404 means there is nothing to link to yet.
+export async function getPublishedUrl(appId: string) {
+  try {
+    const data = await base44(`/api/apps/platform/${appId}/published-url`);
+    return { url: httpsUrl(data.url) };
+  } catch (error) {
+    if (error instanceof Base44Error && error.status === 404) {
+      return { url: null };
+    }
+    throw error;
+  }
+}
+
+// Send the browser only the fields it uses, never the raw Base44 app.
+function toApp(app: App): App {
+  return {
+    id: app.id,
+    name: app.name,
+    preview_screenshot_url: app.preview_screenshot_url,
+    status: app.status && { state: app.status.state, error_source: app.status.error_source },
+  };
+}
+
+function httpsUrl(url: string) {
+  if (!url.startsWith("https://")) {
+    throw new Base44Error("Base44 returned an unsafe URL.");
+  }
+  return url;
+}
diff --git a/examples/white-label-minimal/server/base44/config.ts b/examples/white-label-minimal/server/base44/config.ts
new file mode 100644
index 0000000..41ff637
--- /dev/null
+++ b/examples/white-label-minimal/server/base44/config.ts
@@ -0,0 +1,23 @@
+import "server-only";
+import { Base44Error } from "./error";
+
+// One Base44 account owns every app. Its personal access token must come from
+// your enterprise workspace, with access to all apps and full permission.
+// The workspace key is optional: it signs builders into previews and opens
+// live updates.
+export function getBase44Config() {
+  const token = process.env.BASE44_ACCESS_TOKEN?.trim();
+  const workspaceId = process.env.BASE44_WORKSPACE_ID?.trim();
+  let host: URL;
+  try {
+    host = new URL(process.env.BASE44_PLATFORM_HOST || "");
+  } catch {
+    throw new Base44Error("The Base44 connection is not configured.", 503);
+  }
+  // A bare origin only: no credentials, path, query, or fragment.
+  if (host.protocol !== "https:" || host.href !== `${host.origin}/`) {
+    throw new Base44Error("The Base44 connection requires an HTTPS platform origin.", 503);
+  }
+  if (!token || !workspaceId) throw new Base44Error("The Base44 connection is not configured.", 503);
+  return { host: host.origin, token, workspaceId, workspaceKey: process.env.BASE44_SVC_KEY?.trim() };
+}
diff --git a/examples/white-label-minimal/lib/base44/custom-instructions.ts b/examples/white-label-minimal/server/base44/custom-instructions.ts
similarity index 100%
rename from examples/white-label-minimal/lib/base44/custom-instructions.ts
rename to examples/white-label-minimal/server/base44/custom-instructions.ts
diff --git a/examples/white-label-minimal/server/base44/embed.ts b/examples/white-label-minimal/server/base44/embed.ts
new file mode 100644
index 0000000..87483a8
--- /dev/null
+++ b/examples/white-label-minimal/server/base44/embed.ts
@@ -0,0 +1,35 @@
+import "server-only";
+import { Base44Error } from "./error";
+import { base44, workspaceKey } from "./request";
+
+// "Embed the app": https://docs.base44.com/developers/white-label/embed-the-app
+// Signs a viewer into one version of an app. The URL works once and expires in
+// 60 seconds. The email must come from your session, never from the browser.
+export async function getEmbedUrl(
+  appId: string,
+  email: string,
+  target: "live_site" | "latest_preview" | "live_preview",
+) {
+  const auth = { api_key: workspaceKey() };
+  try {
+    // Provisioning is idempotent, so it is safe before every mint.
+    await base44(`/api/apps/${appId}/users/provisions`, {
+      method: "POST",
+      auth,
+      body: { email, role: "user" },
+    });
+    const token = await base44(`/api/apps/${appId}/embed-tokens`, {
+      method: "POST",
+      auth,
+      body: { email, target },
+    });
+    return { url: token.embed_url as string };
+  } catch (error) {
+    // For example app_has_no_slug before the first build: nothing to show yet.
+    if (error instanceof Base44Error && error.status < 500) {
+      console.warn(`[embed] ${appId} ${target}: ${error.status} ${error.code ?? ""}`);
+      return { url: null };
+    }
+    throw error;
+  }
+}
diff --git a/examples/white-label-minimal/lib/base44/error.ts b/examples/white-label-minimal/server/base44/error.ts
similarity index 57%
rename from examples/white-label-minimal/lib/base44/error.ts
rename to examples/white-label-minimal/server/base44/error.ts
index e338ffe..6067660 100644
--- a/examples/white-label-minimal/lib/base44/error.ts
+++ b/examples/white-label-minimal/server/base44/error.ts
@@ -2,6 +2,8 @@ export class Base44Error extends Error {
   constructor(
     message: string,
     public status = 502,
+    // Base44's error.code, when it sent one. Codes never hold secrets.
+    public code?: string,
   ) {
     super(message);
   }
diff --git a/examples/white-label-minimal/server/base44/live-updates.ts b/examples/white-label-minimal/server/base44/live-updates.ts
new file mode 100644
index 0000000..dabf5f2
--- /dev/null
+++ b/examples/white-label-minimal/server/base44/live-updates.ts
@@ -0,0 +1,28 @@
+import "server-only";
+import { Base44Error } from "./error";
+import { base44, workspaceKey } from "./request";
+
+// Live updates: a read-only socket session for one app. The browser receives
+// only the session token, never the workspace key.
+export async function openLiveUpdates(appId: string) {
+  try {
+    const session = await base44("/api/service/socket-sessions", {
+      method: "POST",
+      auth: { Authorization: `Bearer ${workspaceKey()}` },
+      body: { app_ids: [appId] },
+    });
+    return { serverUrl: new URL(session.socket_url).origin, sessionToken: session.session_token as string };
+  } catch (error) {
+    if (!(error instanceof Base44Error) || error.status === 504) throw error;
+    throw new Base44Error(liveUpdatesProblem(error), 503);
+  }
+}
+
+// Why Base44 refused a live-updates session, as a setup step for whoever runs the server.
+function liveUpdatesProblem(error: Base44Error) {
+  if (error.status === 401) return "Base44 rejected BASE44_SVC_KEY.";
+  if (error.code === "scope_required") return "Live updates need a workspace key with the apps:watch scope.";
+  if (error.code === "whitelabel_sockets_disabled") return "Live updates are not enabled for this Base44 workspace yet.";
+  if (error.code === "app_not_allowed") return "The workspace key cannot watch this app. Use a key from the app's workspace.";
+  return `Live updates unavailable: Base44 returned ${error.status}.`;
+}
diff --git a/examples/white-label-minimal/server/base44/request.ts b/examples/white-label-minimal/server/base44/request.ts
new file mode 100644
index 0000000..81bf4c1
--- /dev/null
+++ b/examples/white-label-minimal/server/base44/request.ts
@@ -0,0 +1,54 @@
+import "server-only";
+import { getBase44Config } from "./config";
+import { Base44Error } from "./error";
+
+type Options = {
+  method?: "GET" | "POST";
+  body?: object;
+  headers?: Record<string, string>;
+  // Defaults to the integration account's personal access token.
+  auth?: Record<string, string>;
+  timeout?: number;
+};
+
+// Calls Base44 from the server. Errors are Base44Errors that are safe to show.
+export async function base44(path: string, { method = "GET", body, headers, auth, timeout = 30_000 }: Options = {}) {
+  const { host, token, workspaceId } = getBase44Config();
+
+  let response: Response;
+  try {
+    response = await fetch(`${host}${path}`, {
+      method,
+      headers: {
+        ...(auth ?? { Authorization: `Bearer ${token}` }),
+        // Base44 checks permissions against the active workspace, not the body.
+        "X-Active-Workspace-Id": workspaceId,
+        "Content-Type": "application/json",
+        ...headers,
+      },
+      body: body ? JSON.stringify(body) : undefined,
+      cache: "no-store",
+      redirect: "error",
+      signal: AbortSignal.timeout(timeout),
+    });
+  } catch {
+    // Not the fetch error itself: it can contain the URL or a credential.
+    throw new Base44Error("Base44 did not return a response. The operation may still be running.", 504);
+  }
+
+  const data = await response.json().catch(() => null);
+  if (!response.ok) {
+    throw new Base44Error(`Base44 returned ${response.status}.`, response.status, data?.error?.code);
+  }
+  return data;
+}
+
+// The workspace key is for embedding and live updates. Everything else uses the
+// integration account's personal access token.
+export function workspaceKey() {
+  const { workspaceKey } = getBase44Config();
+  if (!workspaceKey) {
+    throw new Base44Error("Previews and live updates need BASE44_SVC_KEY on the server.", 503);
+  }
+  return workspaceKey;
+}
diff --git a/examples/white-label-minimal/lib/storage/db.ts b/examples/white-label-minimal/server/db.ts
similarity index 82%
rename from examples/white-label-minimal/lib/storage/db.ts
rename to examples/white-label-minimal/server/db.ts
index 39add0d..83bb981 100644
--- a/examples/white-label-minimal/lib/storage/db.ts
+++ b/examples/white-label-minimal/server/db.ts
@@ -1,5 +1,5 @@
 import "server-only";
-import { PrismaClient } from "../../generated/prisma";
+import { PrismaClient } from "../generated/prisma";
 
 const globalForDb = globalThis as unknown as { minimalPrisma?: PrismaClient };
 
diff --git a/examples/white-label-minimal/server/ownership.ts b/examples/white-label-minimal/server/ownership.ts
new file mode 100644
index 0000000..cff9f26
--- /dev/null
+++ b/examples/white-label-minimal/server/ownership.ts
@@ -0,0 +1,42 @@
+import "server-only";
+import type { App } from "../types";
+import { Base44Error } from "./base44/error";
+import { PAGE_SIZE } from "./app-list";
+import { prisma } from "./db";
+
+// Base44 sees one account behind every app, so Tiny records which builder
+// created which app, and checks it before every call about an app.
+
+export async function saveOwner(email: string, app: App) {
+  await prisma.appOwnership.upsert({
+    where: { appId_createdBy: { appId: app.id, createdBy: email } },
+    create: { appId: app.id, appName: app.name, createdBy: email },
+    update: { appName: app.name },
+  });
+}
+
+export async function requireOwner(email: string, appId: string) {
+  // The ID also goes into Base44 URLs, so it must be a plain ID.
+  if (!/^[A-Za-z0-9_-]{1,200}$/.test(appId)) {
+    throw new Base44Error("Invalid app ID.", 400);
+  }
+  const owned = await prisma.appOwnership.findFirst({ where: { createdBy: email, appId } });
+  if (!owned) {
+    throw new Base44Error("App not found.", 404);
+  }
+}
+
+// One extra row tells the caller whether another page exists.
+export function listOwnedApps(email: string, skip: number) {
+  return prisma.appOwnership.findMany({
+    where: { createdBy: email },
+    orderBy: { createdAt: "desc" },
+    skip,
+    take: PAGE_SIZE + 1,
+  });
+}
+
+export async function removeOwner(email: string, appId: string) {
+  await prisma.appOwnership.deleteMany({ where: { createdBy: email, appId } });
+  return {};
+}
diff --git a/examples/white-label-minimal/tests/browser.spec.ts b/examples/white-label-minimal/tests/browser.spec.ts
index da99279..fc8a101 100644
--- a/examples/white-label-minimal/tests/browser.spec.ts
+++ b/examples/white-label-minimal/tests/browser.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect, type Page, type Route } from '@playwright/test';
-import type { ToolCall } from '../lib/types';
+import type { ToolCall } from '../types';
 
 // Live updates in every test: our server opens a session, then a fake Base44
 // socket serves the fixture's own conversation and app status.
@@ -34,7 +34,7 @@ async function pushUpdates(page: Page) {
 test.beforeEach(async ({ page }) => {
   const route = page.route.bind(page);
   page.route = ((url: string, handler: (route: Route) => unknown, options?: object) => route(url, url === '**/api/base44'
-    ? (r: Route) => r.request().postDataJSON()?.action === 'openBuilderSession'
+    ? (r: Route) => r.request().postDataJSON()?.action === 'openLiveUpdates'
       ? r.fulfill({ json: { serverUrl: 'https://socket.example', sessionToken: 'wlst_fixture' } })
       : handler(r)
     : handler, options)) as Page['route'];
@@ -138,20 +138,6 @@ test('approval rejection is an answer and removes the waiting state', async ({ p
   expect(f.submissions[0].approve).toBe(false);
   expect(f.submissions[0].extraUserInput).toEqual({});
 });
-test('uncertain create never retries automatically and offers existing-app recovery', async ({ page }) => {
-  let creates = 0;
-  await page.route('**/api/base44', route => {
-    if (route.request().postDataJSON().action === 'listApps') return route.fulfill({ json: { apps: [], hasMore: false } });
-    creates++; return route.abort('failed');
-  });
-  await page.goto('/');
-  await page.getByRole('button', { name: 'Create an app', exact: true }).click();
-  await page.getByLabel('What would you like to build?').fill('Reading list');
-  await page.getByRole('button', { name: 'Create app', exact: true }).click();
-  await expect(page.getByLabel('Existing app ID')).toBeVisible();
-  await expect(page.getByRole('button', { name: 'Create app', exact: true })).toBeDisabled();
-  expect(creates).toBe(1);
-});
 test('an ended live session pauses updates, reconnect restores them', async ({ page }) => {
   await fixture(page);
   const socket = sockets.get(page)!;
@@ -163,37 +149,9 @@ test('an ended live session pauses updates, reconnect restores them', async ({ p
   await expect(page.getByText('Your app is taking shape.')).toBeVisible();
 });
 
-test('live preview stays stable and recovers only from its own expiry message', async ({ page }) => {
-  await page.clock.install();
-  await fixture(page);
-  await expect(page.locator('.stage-body iframe')).toBeVisible();
-  const initialUrl = await page.locator('.stage-body iframe').getAttribute('src');
-  await page.clock.fastForward(300_000);
-  await expect(page.locator('.stage-body iframe')).toHaveAttribute('src', initialUrl!);
-  await page.evaluate(() => window.postMessage({ type: 'preview:requestRefresh' }, '*'));
-  await expect(page.locator('.stage-body iframe')).toHaveAttribute('src', initialUrl!);
-  const preview = page.frames().find(frame => frame.url() === initialUrl)!;
-  await preview.evaluate(() => window.parent.postMessage({ type: 'preview:requestRefresh' }, '*'));
-  await expect(page.locator('.stage-body iframe')).not.toHaveAttribute('src', initialUrl!);
-  await expect(page.locator('.stage-body iframe')).toBeVisible();
-});
-
-test('real Next route requires authentication for local browser origins and rejects foreign origins', async ({ page, request }) => {
-  await page.goto('/');
-  const status = await page.evaluate(async () => (await fetch('/api/base44', {
-    method: 'POST', headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ action: 'unknown' }),
-  })).status);
-  expect(status).toBe(401); // Validation reached; Next may normalize request.url internally.
-  const foreign = await request.post('/api/base44', {
-    headers: { Origin: 'https://foreign.example' }, data: { action: 'unknown' },
-  });
-  expect(foreign.status()).toBe(403);
-});
-
 test('rejected access preserves prompt and allows retry without uncertain creation warning', async ({ page }) => {
   await page.route('**/api/base44', route => route.fulfill({ status: 401, contentType: 'application/json',
-    body: JSON.stringify({ error: 'Sign in to continue.', outcome: 'not_started' }) }));
+    body: JSON.stringify({ error: 'Sign in to continue.' }) }));
   await openBuilder(page);
   await page.getByLabel('What would you like to build?').fill('Hello world');
   await page.getByRole('button', { name: 'Create app', exact: true }).click();
@@ -355,6 +313,28 @@ test('preview card waits for build completion and hides during follow-up submiss
   await expect(card).toBeVisible();
 });
 
+test('a ready app publishes once and then links to the published address', async ({ page }) => {
+  const actions: string[] = [];
+  await page.route('**/api/base44', async route => {
+    const { action } = route.request().postDataJSON();
+    actions.push(action);
+    if (action === 'listApps') return route.fulfill({ json: { apps: [], hasMore: false } });
+    if (action === 'getConversation') return route.fulfill({ json: { messages: [
+      { id: 'm1', role: 'assistant', content: 'Your scoreboard is live.', tool_calls: [{ id: 'write', name: 'write_file', status: 'success' }] },
+    ] } });
+    if (action === 'deployApp') return route.fulfill({ json: {} });
+    if (action === 'getPublishedUrl') return route.fulfill({ json: { url: 'https://scoreboard.example' } });
+    return route.fulfill({ json: { id: APP, name: 'Scoreboard', status: { state: 'ready' } } });
+  });
+  await openBuilder(page);
+  await page.getByLabel('What would you like to build?').fill('Build a scoreboard');
+  await page.getByRole('button', { name: 'Create app', exact: true }).click();
+  const card = page.getByRole('region', { name: 'App ready' });
+  await card.getByRole('button', { name: 'Publish' }).click();
+  await expect(card.getByRole('link', { name: 'Open the published app' })).toHaveAttribute('href', 'https://scoreboard.example');
+  expect(actions.filter(a => a === 'deployApp' || a === 'getPublishedUrl')).toEqual(['deployApp', 'getPublishedUrl']);
+});
+
 test('a follow-up stops showing "Sending prompt" once the turn is running', async ({ page }) => {
   let state = 'ready';
   await page.route('**/api/base44', async route => {
@@ -448,9 +428,10 @@ test('the empty state owns its CTA and app cards render their build', async ({ p
   let previews = 0;
   await page.route('https://preview.example/**', route => route.fulfill({ contentType: 'text/html', body: '<h1>Working app</h1>' }));
   await page.route('**/api/base44', route => {
+    if (route.request().postDataJSON().action === 'getLatestBuildUrl') return route.fulfill({ json: { url: 'https://preview.example/static' } });
     const { action } = route.request().postDataJSON();
     return route.fulfill({ json: action === 'listApps'
-      ? { apps: populated ? [{ id: 'reading', name: 'Reading list', static_preview_url: 'https://preview.example/static' }] : [], hasMore: false }
+      ? { apps: populated ? [{ id: 'reading', name: 'Reading list' }] : [], hasMore: false }
       : { url: `https://preview.example/?token=${++previews}` } });
   });
   await page.goto('/');
@@ -474,10 +455,11 @@ test('the empty state owns its CTA and app cards render their build', async ({ p
 
 test('the card, the chat thumbnail and the stage show the same app', async ({ page }) => {
   const screenshot = 'https://preview.example/thumbnail.svg';
-  const app = { id: 'reading', name: 'Reading list', static_preview_url: 'https://preview.example/static', preview_screenshot_url: screenshot, status: { state: 'ready' } };
+  const app = { id: 'reading', name: 'Reading list', preview_screenshot_url: screenshot, status: { state: 'ready' } };
   await page.route('https://preview.example/**', route => route.fulfill({ contentType: 'text/html', body: '<h1>Reading app</h1>' }));
   await page.route(screenshot, route => route.fulfill({ contentType: 'image/svg+xml', body: '<svg xmlns="http://www.w3.org/2000/svg" width="320" height="180"><rect width="320" height="180" fill="skyblue"/></svg>' }));
   await page.route('**/api/base44', route => {
+    if (route.request().postDataJSON().action === 'getLatestBuildUrl') return route.fulfill({ json: { url: 'https://preview.example/static' } });
     const { action } = route.request().postDataJSON();
     return route.fulfill({ json: action === 'listApps' ? { apps: [app], hasMore: false }
       : action === 'getConversation' ? { messages: [{ id: 'built', role: 'assistant', content: 'Ready', tool_calls: [{ id: 'file', name: 'write_file', status: 'success' }] }] }
@@ -527,7 +509,7 @@ test('remove persists, handles failures, and New app lives in the topbar', async
     const { action, skip, appId } = route.request().postDataJSON();
     if (action === 'listApps') {
       skips.push(skip);
-      return route.fulfill({ json: { apps: [{ id: skip ? 'second' : 'first', name: skip ? 'Second app' : 'First app', static_preview_url: `https://widgets.example/${skip}` }], hasMore: !skip, nextSkip: skip + 12 } });
+      return route.fulfill({ json: { apps: [{ id: skip ? 'second' : 'first', name: skip ? 'Second app' : 'First app' }], hasMore: !skip, nextSkip: skip + 12 } });
     }
     return route.fulfill({ json: { url: `https://widgets.example/${appId}` } });
   });
@@ -552,8 +534,9 @@ test('remove persists, handles failures, and New app lives in the topbar', async
     await new Promise<void>(resolve => { release = resolve; });
     await route.fulfill({ contentType: 'text/html', body: '<h1>Live build</h1>' });
   });
-  const app = { id: 'reading', name: 'Reading list', static_preview_url: 'https://static.example/app', status: { state: 'ready' } };
+  const app = { id: 'reading', name: 'Reading list', status: { state: 'ready' } };
   await page.route('**/api/base44', route => {
+    if (route.request().postDataJSON().action === 'getLatestBuildUrl') return route.fulfill({ json: { url: 'https://static.example/app' } });
     const { action } = route.request().postDataJSON();
     if (action === 'getPreviewUrl') { requests++; return route.fulfill({ json: { url: 'https://live.example/app' } }); }
     return route.fulfill({ json: action === 'listApps' ? { apps: [app], hasMore: false } : action === 'getConversation' ? { messages: [] } : app });
diff --git a/examples/white-label-minimal/tests/conversation.test.ts b/examples/white-label-minimal/tests/conversation.test.ts
deleted file mode 100644
index ed07ed7..0000000
--- a/examples/white-label-minimal/tests/conversation.test.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-import { refreshConversation } from '../lib/chat/conversation';
-import type { Message } from '../lib/types';
-const messages = (count: number): Message[] => Array.from({ length: count }, (_, i) => ({ id: `m${i}`, content: `Message ${i}` }));
-const page = (all: Message[], skip: number) => ({ messages: all.slice(Math.max(0, all.length - skip - 20), all.length - skip) });
-test('initial history is chronological, hidden messages still count toward offsets', async () => {
-  const all = messages(47); all[2].hidden = true;
-  const skips: number[] = [];
-  const result = await refreshConversation([], async skip => { skips.push(skip); return page(all, skip); });
-  assert.deepEqual(result, all); assert.deepEqual(skips, [0, 20, 40]);
-});
-test('refresh replaces mutable messages and backfills more than one page of arrivals', async () => {
-  const old = messages(25), current = messages(70);
-  current[24].content = 'Updated';
-  const result = await refreshConversation(old, async skip => page(current, skip));
-  assert.deepEqual(result, current);
-});
-test('older unresolved calls are revisited until their status is updated', async () => {
-  const old = messages(65);
-  old[2].tool_calls = [{ id: 't1', status: 'waiting_for_user_input' }];
-  const current = structuredClone(old); current[2].tool_calls![0].status = 'success';
-  assert.deepEqual(await refreshConversation(old, async skip => page(current, skip)), current);
-});
-test('settled history only refreshes the latest page', async () => {
-  const old = messages(65); const skips: number[] = [];
-  await refreshConversation(old, async skip => { skips.push(skip); return page(old, skip); });
-  assert.deepEqual(skips, [0]);
-});
-test('overlapping pages from concurrent appends are deduplicated', async () => {
-  const old = messages(21); let reads = 0;
-  const result = await refreshConversation([], async skip => page(reads++ ? messages(22) : old, skip));
-  assert.equal(new Set(result.map(m => m.id)).size, result.length);
-  assert.deepEqual(result, old);
-});
-
-import { mergeOptimisticMessages } from '../lib/chat/optimistic-messages';
-test('optimistic prompts survive empty polls and merge once without confusing repeated text', () => {
-  const first: Message = { id: 'local:1', role: 'user', content: 'Add a button' };
-  const pending = [{ message: first, knownIds: [] }];
-  assert.deepEqual(mergeOptimisticMessages([], pending), [first]);
-  const server: Message = { ...first, id: 'server:1' };
-  const reply: Message = { id: 'reply', role: 'assistant', content: 'Done' };
-  assert.deepEqual(mergeOptimisticMessages([reply], pending), [first, reply]);
-  assert.deepEqual(mergeOptimisticMessages([server, reply], pending), [first, reply]);
-  const second = { ...first, id: 'local:2' };
-  const repeated = [...pending, { message: second, knownIds: [server.id, reply.id] }];
-  assert.deepEqual(mergeOptimisticMessages([server, reply], repeated), [first, reply, second]);
-  assert.deepEqual(mergeOptimisticMessages([server, reply, { ...server, id: 'server:2' }], repeated), [first, reply, second]);
-});
-
- test('build readiness requires code and a settled assistant turn', async () => {
-  const { hasCompletedBuild } = await import('../lib/chat/build-readiness');
-  const built = { id: 'built', role: 'assistant', tool_calls: [{ name: 'write_file', status: 'success' }] };
-  assert.equal(hasCompletedBuild([{ id: 'hello', role: 'assistant', content: 'Hello!' }]), false);
-  assert.equal(hasCompletedBuild([built]), true);
-  assert.equal(hasCompletedBuild([{ ...built, tool_calls: [{ name: 'write_file', status: 'error' }] }]), false);
-  assert.equal(hasCompletedBuild([built, { id: 'followup', role: 'user' }]), false);
-  assert.equal(hasCompletedBuild([built, { id: 'question', role: 'user' }, { id: 'answer', role: 'assistant', content: 'Want confetti too?' }]), false);
-  assert.equal(hasCompletedBuild([built, { id: 'running', role: 'assistant', tool_calls: [{ name: 'find_replace', status: 'running' }] }]), false);
-});
diff --git a/examples/white-label-minimal/tests/fixture/app/api/base44/route.ts b/examples/white-label-minimal/tests/fixture/app/api/base44/route.ts
deleted file mode 100644
index 74591f6..0000000
--- a/examples/white-label-minimal/tests/fixture/app/api/base44/route.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import { createHandler } from '../../../../../lib/server/api-handler';
-import { Base44Error } from '../../../../../lib/base44/error';
-export const POST = createHandler(async () => { throw new Base44Error('Sign in to continue.', 401); });
diff --git a/examples/white-label-minimal/tests/fixture/app/page.tsx b/examples/white-label-minimal/tests/fixture/app/page.tsx
index cd11d0a..3b3cc2f 100644
--- a/examples/white-label-minimal/tests/fixture/app/page.tsx
+++ b/examples/white-label-minimal/tests/fixture/app/page.tsx
@@ -1,2 +1,2 @@
-import Workspace from '../../../components/Workspace';
+import Workspace from '../../../client/components/Workspace';
 export default function Page() { return <Workspace name="Alex Morgan" />; }
diff --git a/examples/white-label-minimal/tests/fixture/fake-actions.ts b/examples/white-label-minimal/tests/fixture/fake-actions.ts
new file mode 100644
index 0000000..b496381
--- /dev/null
+++ b/examples/white-label-minimal/tests/fixture/fake-actions.ts
@@ -0,0 +1,26 @@
+import type { ActionResult, ToolInput } from "../../types";
+
+// Stands in for server/actions.ts in the browser tests (see next.config.ts). Each
+// action goes to /api/base44, which the tests answer with page.route.
+async function call<T>(action: string, params: object): Promise<ActionResult<T>> {
+  const response = await fetch("/api/base44", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ action, ...params }),
+  });
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) return { error: body.error || "The request failed.", status: response.status };
+  return { data: body };
+}
+
+export const listApps = (skip: number) => call("listApps", { skip });
+export const createApp = (prompt: string) => call("createApp", { prompt });
+export const removeApp = (appId: string) => call("removeApp", { appId });
+export const getApp = (appId: string) => call("getApp", { appId });
+export const sendMessage = (appId: string, content: string) => call("sendMessage", { appId, content });
+export const submitToolCallInput = (input: ToolInput) => call("submitToolCallInput", input);
+export const deployApp = (appId: string) => call("deployApp", { appId });
+export const getPublishedUrl = (appId: string) => call("getPublishedUrl", { appId });
+export const getLatestBuildUrl = (appId: string) => call("getLatestBuildUrl", { appId });
+export const getPreviewUrl = (appId: string) => call("getPreviewUrl", { appId });
+export const openLiveUpdates = (appId: string) => call("openLiveUpdates", { appId });
diff --git a/examples/white-label-minimal/tests/fixture/next.config.ts b/examples/white-label-minimal/tests/fixture/next.config.ts
new file mode 100644
index 0000000..f80cf80
--- /dev/null
+++ b/examples/white-label-minimal/tests/fixture/next.config.ts
@@ -0,0 +1,14 @@
+import type { NextConfig } from "next";
+
+// The browser tests mock Tiny's server in the page, so the fixture swaps the
+// server actions for fake-actions.ts, which sends each one to a mocked route.
+const config: NextConfig = {
+  turbopack: {
+    resolveAlias: {
+      "../server/actions": "./fake-actions.ts",
+      "../../server/actions": "./fake-actions.ts",
+    },
+  },
+};
+
+export default config;
diff --git a/examples/white-label-minimal/tests/fixture/tsconfig.json b/examples/white-label-minimal/tests/fixture/tsconfig.json
index 35f95b7..cefdaea 100644
--- a/examples/white-label-minimal/tests/fixture/tsconfig.json
+++ b/examples/white-label-minimal/tests/fixture/tsconfig.json
@@ -1 +1 @@
-{"extends":"../../tsconfig.json","compilerOptions":{"paths":{"@/*":["../../../../src/*"]}},"include":["app/**/*.tsx","app/**/*.ts"]}
+{"extends": "../../tsconfig.json", "include": ["app/**/*.tsx", "app/**/*.ts"]}
diff --git a/examples/white-label-minimal/tests/identity.test.ts b/examples/white-label-minimal/tests/identity.test.ts
deleted file mode 100644
index 96f23be..0000000
--- a/examples/white-label-minimal/tests/identity.test.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, test } from "node:test";
-import { createHash } from "node:crypto";
-import { prisma } from "../lib/storage/db";
-import { connect, disconnect, getBase44AccessToken } from "../lib/base44/identity";
-
-const originalFetch = globalThis.fetch;
-const originalEnv = { ...process.env };
-const originalTransaction = prisma.$transaction;
-const originalMethods = {
-  findUnique: prisma.base44Link.findUnique,
-  upsert: prisma.base44Link.upsert,
-  updateMany: prisma.base44Link.updateMany,
-};
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-  process.env = { ...originalEnv };
-  prisma.$transaction = originalTransaction;
-  Object.assign(prisma.base44Link, originalMethods);
-});
-
-function setup(overrides = {}) {
-  process.env.BASE44_PLATFORM_HOST = "https://base44.example";
-  process.env.BASE44_ORG_ID = "workspace";
-  process.env.BASE44_SVC_KEY = "workspace-key";
-  let row: any = {
-    appUserEmail: "builder@example.com", status: "linked", accessToken: "old-access",
-    refreshToken: "old-refresh", expiresAt: new Date(0), serviceExternalId: "existing-id",
-    ...overrides,
-  };
-  const calls: { url: string; init?: RequestInit }[] = [];
-  const db = {
-    $queryRaw: async () => [],
-    base44Link: {
-      findUnique: async () => row,
-      update: async ({ data }: any) => (row = { ...row, ...data }),
-    },
-  };
-  prisma.$transaction = (async (fn: any) => fn(db)) as any;
-  prisma.base44Link.findUnique = db.base44Link.findUnique as any;
-  prisma.base44Link.upsert = (async ({ update }: any) => (row = { ...row, ...update })) as any;
-  prisma.base44Link.updateMany = (async ({ data }: any) => {
-    row = { ...row, ...data }; return { count: 1 };
-  }) as any;
-  globalThis.fetch = async (url, init) => {
-    calls.push({ url: String(url), init });
-    return Response.json(String(url).endsWith("/api/service/users")
-      ? { email: "builder@workspace.svc.base44.invalid" }
-      : { access_token: "new-access", refresh_token: "new-refresh", expires_in: 3600 });
-  };
-  return { calls, row: () => row };
-}
-
-test("connect provisions then mints with workspace credentials and preserves the stored identity", async () => {
-  const state = setup();
-  const result = await connect("BUILDER@example.com");
-  assert.deepEqual(state.calls.map(c => new URL(c.url).pathname), ["/api/service/users", "/api/service/user-tokens"]);
-  for (const call of state.calls) {
-    assert.equal(new Headers(call.init?.headers).get("Authorization"), "workspace-key");
-    assert.equal(JSON.parse(String(call.init?.body)).service_external_id, "existing-id");
-  }
-  assert.equal(result.linked, true);
-  assert.equal(JSON.stringify(result).includes("new-access"), false);
-});
-
-test("new identities retain the deterministic ID used by existing apps", async () => {
-  const state = setup({ serviceExternalId: null });
-  await connect("BUILDER@example.com");
-  const digest = createHash("sha256").update("workspace:builder@example.com").digest("hex");
-  assert.equal(state.row().serviceExternalId, `sunny-${digest.slice(0, 32)}`);
-});
-
-test("unexpired tokens are reused without an upstream request", async () => {
-  const state = setup({ expiresAt: new Date(Date.now() + 120_000) });
-  assert.equal(await getBase44AccessToken("builder@example.com"), "old-access");
-  assert.equal(state.calls.length, 0);
-});
-
-test("refresh uses the OAuth exchange and persists rotated credentials and lifetime", async () => {
-  const state = setup();
-  assert.equal(await getBase44AccessToken("builder@example.com"), "new-access");
-  assert.equal(state.calls[0].url, "https://base44.example/oauth/token");
-  assert.equal(new Headers(state.calls[0].init?.headers).has("Authorization"), false);
-  assert.equal(String(state.calls[0].init?.body), "grant_type=refresh_token&client_id=svc_delegate&refresh_token=old-refresh");
-  assert.equal(state.row().refreshToken, "new-refresh");
-  assert.ok(state.row().expiresAt.getTime() > Date.now() + 3500_000);
-});
-
-test("refresh failures preserve stored credentials and never expose upstream bodies", async () => {
-  const state = setup();
-  for (const status of [400, 429, 503]) {
-    globalThis.fetch = async () => new Response("secret-canary", { status });
-    await assert.rejects(getBase44AccessToken("builder@example.com"), (error: any) => {
-      assert.equal(error.status, status === 400 ? 428 : 502);
-      assert.equal(error.message.includes("secret-canary"), false);
-      return true;
-    });
-    assert.equal(state.row().refreshToken, "old-refresh");
-  }
-});
-
-test("disconnect clears tokens but retains identity mapping", async () => {
-  const state = setup();
-  await disconnect("builder@example.com");
-  assert.equal(state.row().serviceExternalId, "existing-id");
-  assert.equal(state.row().accessToken, null);
-  assert.equal(state.row().refreshToken, null);
-  assert.equal(state.row().status, "pending");
-});
diff --git a/examples/white-label-minimal/tests/live-messages.test.ts b/examples/white-label-minimal/tests/live-messages.test.ts
deleted file mode 100644
index 1183f8e..0000000
--- a/examples/white-label-minimal/tests/live-messages.test.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-import { toMessage, upsertMessage } from '../lib/chat/live-messages';
-
-test('socket messages convert to the shape the chat renders', () => {
-  const message = toMessage({ id: 'm1', role: 'assistant', content: 'Hi', tool_calls: [
-    { id: 't1', name: 'ask', status: 'waiting_for_user_input', waiting_on: { kind: 'choice' }, arguments: { questions: [] } },
-    { id: 't2', name: 'generate_video', status: 'success', results: 'https://media.example/v.mp4' },
-  ] });
-  assert.deepEqual(message.tool_calls, [
-    { id: 't1', name: 'ask', status: 'waiting_for_user_input', waiting_on: { kind: 'choice' }, arguments_string: '{"questions":[]}', results: undefined },
-    { id: 't2', name: 'generate_video', status: 'success', waiting_on: undefined, arguments_string: null, results: 'https://media.example/v.mp4' },
-  ]);
-});
-
-test('upsert replaces a message by id and appends new ones', () => {
-  const messages = [{ id: 'm1', content: 'old' }, { id: 'm2', content: 'two' }];
-  assert.deepEqual(upsertMessage(messages, { id: 'm1', content: 'new' }).map(m => m.content), ['new', 'two']);
-  assert.deepEqual(upsertMessage(messages, { id: 'm3', content: 'three' }).map(m => m.id), ['m1', 'm2', 'm3']);
-});
diff --git a/examples/white-label-minimal/tests/messages.test.ts b/examples/white-label-minimal/tests/messages.test.ts
new file mode 100644
index 0000000..caa2a78
--- /dev/null
+++ b/examples/white-label-minimal/tests/messages.test.ts
@@ -0,0 +1,48 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { getChatState } from '../client/chat-state';
+import { mergeOptimisticMessages, toMessage, upsertMessage } from '../client/messages';
+import type { Message } from '../types';
+
+test('socket messages convert to the shape the chat renders', () => {
+  const message = toMessage({ id: 'm1', role: 'assistant', content: 'Hi', tool_calls: [
+    { id: 't1', name: 'ask', status: 'waiting_for_user_input', waiting_on: { kind: 'choice' }, arguments: { questions: [] } },
+    { id: 't2', name: 'generate_video', status: 'success', results: 'https://media.example/v.mp4' },
+  ] });
+  assert.deepEqual(message.tool_calls, [
+    { id: 't1', name: 'ask', status: 'waiting_for_user_input', waiting_on: { kind: 'choice' }, arguments_string: '{\n  "questions": []\n}', results: undefined },
+    { id: 't2', name: 'generate_video', status: 'success', waiting_on: undefined, arguments_string: null, results: 'https://media.example/v.mp4' },
+  ]);
+});
+
+test('upsert replaces a message by id and appends new ones', () => {
+  const messages = [{ id: 'm1', content: 'old' }, { id: 'm2', content: 'two' }];
+  assert.deepEqual(upsertMessage(messages, { id: 'm1', content: 'new' }).map(m => m.content), ['new', 'two']);
+  assert.deepEqual(upsertMessage(messages, { id: 'm3', content: 'three' }).map(m => m.id), ['m1', 'm2', 'm3']);
+});
+
+test('a pending prompt survives empty snapshots and merges once without confusing repeated text', () => {
+  const first: Message = { id: 'local:1', role: 'user', content: 'Add a button' };
+  const pending = [{ message: first, knownIds: [] }];
+  assert.deepEqual(mergeOptimisticMessages([], pending), [first]);
+  const server: Message = { ...first, id: 'server:1' };
+  const reply: Message = { id: 'reply', role: 'assistant', content: 'Done' };
+  assert.deepEqual(mergeOptimisticMessages([reply], pending), [first, reply]);
+  assert.deepEqual(mergeOptimisticMessages([server, reply], pending), [first, reply]);
+  const second = { ...first, id: 'local:2' };
+  const repeated = [...pending, { message: second, knownIds: [server.id, reply.id] }];
+  assert.deepEqual(mergeOptimisticMessages([server, reply], repeated), [first, reply, second]);
+  assert.deepEqual(mergeOptimisticMessages([server, reply, { ...server, id: 'server:2' }], repeated), [first, reply, second]);
+});
+
+test('an app is ready only when the latest turn wrote code and finished', () => {
+  const app = { id: 'app_1', status: { state: 'ready' } };
+  const state = (messages: Message[]) => getChatState(app, messages, false, '');
+  const built: Message = { id: 'built', role: 'assistant', tool_calls: [{ name: 'write_file', status: 'success' }] };
+  assert.equal(state([{ id: 'hello', role: 'assistant', content: 'Hello!' }]), 'idle');
+  assert.equal(state([built]), 'ready');
+  assert.equal(state([{ ...built, tool_calls: [{ name: 'write_file', status: 'error' }] }]), 'idle');
+  assert.equal(state([built, { id: 'followup', role: 'user' }]), 'idle');
+  assert.equal(state([built, { id: 'question', role: 'user' }, { id: 'answer', role: 'assistant', content: 'Want confetti too?' }]), 'idle');
+  assert.equal(state([built, { id: 'running', role: 'assistant', tool_calls: [{ name: 'find_replace', status: 'running' }] }]), 'idle');
+});
diff --git a/examples/white-label-minimal/tests/questions.test.tsx b/examples/white-label-minimal/tests/questions.test.tsx
index ec8003f..59158c1 100644
--- a/examples/white-label-minimal/tests/questions.test.tsx
+++ b/examples/white-label-minimal/tests/questions.test.tsx
@@ -1,8 +1,8 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { renderToStaticMarkup } from 'react-dom/server';
-import Question, { parseQuestion } from '../components/Question';
-import type { ToolCall } from '../lib/types';
+import Question, { parseQuestion } from '../client/components/Question';
+import type { ToolCall } from '../types';
 const tool = (kind: string, args: object): ToolCall => ({ id: 'tool_1', status: 'waiting_for_user_input', waiting_on: { kind }, arguments_string: JSON.stringify(args) });
 const render = (t: ToolCall) => renderToStaticMarkup(<Question tool={t} appId="app_1" messageId="m1" disabled={false} onSubmit={async () => {}} />);
 test('choice accepts string and object options, including multiple selection', () => {
diff --git a/examples/white-label-minimal/tests/server.test.ts b/examples/white-label-minimal/tests/server.test.ts
index 5458f9f..7e913bf 100644
--- a/examples/white-label-minimal/tests/server.test.ts
+++ b/examples/white-label-minimal/tests/server.test.ts
@@ -1,145 +1,127 @@
 import assert from 'node:assert/strict';
 import { afterEach, test } from 'node:test';
-import { createHandler } from '../lib/server/api-handler';
-import { createBase44Client } from '../lib/base44/client';
-import { Base44Error } from '../lib/base44/error';
-import { openSocketSession } from '../lib/base44/socket-session';
-let signedIn = true;
-const POST = createHandler(async () => {
-  if (!signedIn) throw new Base44Error('Sign in to continue.', 401);
-  return { ...createBase44Client('user-token-canary'), openBuilderSession: openSocketSession, authorize: async (id: string) => {
-    if (id === 'other_app') throw new Base44Error('App not found.', 404);
-  }, removeApp: async () => ({}), listApps: async () => ({ apps: [], hasMore: false, nextSkip: 0 }) };
-});
-import { customInstructions } from '../lib/base44/custom-instructions';
+import * as buildTurn from '../server/base44/build-turn';
+import { customInstructions } from '../server/base44/custom-instructions';
+import { getEmbedUrl } from '../server/base44/embed';
+import { Base44Error } from '../server/base44/error';
+import { openLiveUpdates } from '../server/base44/live-updates';
+import { resolveAppPage } from '../server/app-list';
+import { requireOwner } from '../server/ownership';
+import { prisma } from '../server/db';
 
 const originalFetch = globalThis.fetch;
 const originalEnv = { ...process.env };
-afterEach(() => { signedIn = true; globalThis.fetch = originalFetch; process.env = { ...originalEnv }; });
+const originalFindFirst = prisma.appOwnership.findFirst;
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  process.env = { ...originalEnv };
+  prisma.appOwnership.findFirst = originalFindFirst;
+});
+
 function setup(reply: unknown = { id: 'app_1' }, status = 200) {
-  process.env.BASE44_ORG_ID = 'workspace_1';
   process.env.BASE44_PLATFORM_HOST = 'https://platform.example';
-  const calls: { url: string; init?: RequestInit }[] = [];
+  process.env.BASE44_ACCESS_TOKEN = 'pat-canary';
+  process.env.BASE44_WORKSPACE_ID = 'workspace_1';
+  process.env.BASE44_SVC_KEY = 'b44k_workspace';
+  const calls: { url: string; init: RequestInit }[] = [];
   globalThis.fetch = async (url, init) => {
-    calls.push({ url: String(url), init });
+    calls.push({ url: String(url), init: init! });
     return Response.json(reply, { status });
   };
   return calls;
 }
-const request = (body: unknown, headers = {}) => POST(new Request('http://127.0.0.1:3001/api/base44', {
-  method: 'POST', headers: { host: '127.0.0.1:3001', origin: 'http://127.0.0.1:3001', 'content-type': 'application/json', ...headers }, body: JSON.stringify(body),
-}));
+const headers = (init: RequestInit) => new Headers(init.headers);
+const body = (init: RequestInit) => JSON.parse(String(init.body));
 
-test('invalid actions, paths, fields, pagination and decisions never reach Base44', async () => {
-  const calls = setup();
-  for (const body of [null, [], { action: 'proxy' }, { action: 'createApp', prompt: '' }, { action: 'getApp', appId: '../other' },
-    { action: 'getApp', appId: 'app_1', host: 'https://evil.example' },
-    { action: 'getApp', appId: 'app_1', workspaceId: 'other' },
-    { action: 'getApp', appId: 'app_1', api_key: 'other' },
-    { action: 'getConversation', appId: 'app_1', skip: -1 },
-    { action: 'getConversation', appId: 'app_1', skip: 1.5 },
-    { action: 'submitToolCallInput', appId: 'app_1', toolCallId: 'tool_1', messageId: 'message_1', approve: 'false', extraUserInput: {} }]) {
-    const response = await request(body);
-    assert.equal(response.status, 400);
-    assert.equal((await response.json()).outcome, 'not_started');
-  }
-  assert.equal(calls.length, 0);
-});
-test('rejects foreign origins, nonlocal hosts, non-JSON and oversized bodies', async () => {
-  const calls = setup();
-  assert.equal((await request({}, { origin: 'https://evil.example' })).status, 403);
-  assert.equal((await request({}, { host: 'evil.example', origin: 'http://evil.example' })).status, 403);
-  assert.equal((await request({}, { 'content-type': 'text/plain' })).status, 415);
-  assert.equal((await request({ action: 'createApp', prompt: 'x'.repeat(65000) })).status, 413);
-  assert.equal(calls.length, 0);
-});
-test('creation uses the user token without organization routing', async () => {
-  const calls = setup({ id: 'app_1', name: 'Build a reading list', user_description: 'Build a reading list', custom_instructions: customInstructions, api_key: 'should-not-return' });
-  delete process.env.BASE44_ORG_ID;
-  const response = await request({ action: 'createApp', prompt: 'Build a reading list' });
-  assert.deepEqual(await response.json(), { id: 'app_1', name: 'Build a reading list', user_description: 'Build a reading list' });
-  const init = calls[0].init!;
-  assert.equal(new Headers(init.headers).get('authorization'), 'Bearer user-token-canary');
-  assert.equal(new Headers(init.headers).get('X-Active-Workspace-Id'), null);
-  const body = JSON.parse(String(init.body));
-  assert.equal(Object.hasOwn(body, 'organization_id'), false);
-  assert.equal(body.name, 'Build a reading list');
-  assert.equal(body.initial_message.content, 'Build a reading list');
-  assert.equal(body.custom_instructions, customInstructions);
-  assert.equal(init.cache, 'no-store');
-  assert.equal(init.redirect, 'error');
+test('creating an app authenticates as the integration account in the configured workspace', async () => {
+  const calls = setup({ id: 'app_1', name: 'Reading list', api_key: 'must-not-return' });
+  const app = await buildTurn.createApp('Build a reading list');
+  assert.equal(Object.hasOwn(app, 'api_key'), false);
+  assert.equal(calls[0].url, 'https://platform.example/api/apps');
+  assert.equal(headers(calls[0].init).get('authorization'), 'Bearer pat-canary');
+  assert.equal(headers(calls[0].init).get('X-Active-Workspace-Id'), 'workspace_1');
+  assert.equal(body(calls[0].init).organization_id, 'workspace_1');
+  assert.equal(body(calls[0].init).initial_message.content, 'Build a reading list');
+  assert.equal(body(calls[0].init).custom_instructions, customInstructions);
+  assert.equal(calls[0].init.cache, 'no-store');
+  assert.equal(calls[0].init.redirect, 'error');
 });
-test('tool approvals, rejection and retries preserve payload and request identity', async () => {
+
+test('answers keep the same request ID when retried, and a rejection is an answer', async () => {
   const calls = setup({});
-  const input = { action: 'submitToolCallInput', appId: 'app_1', toolCallId: 'tool_1', messageId: 'message_1', approve: true, extraUserInput: { answers: [{ question_index: 0, selected_labels: ['Blue'], custom_text: '' }] } };
-  await request(input); await request(input);
-  await request({ ...input, toolCallId: 'tool_2', approve: false, extraUserInput: {} });
-  assert.equal(new Headers(calls[0].init?.headers).get('X-Request-ID'), 'submit-tool_1');
-  assert.equal(new Headers(calls[1].init?.headers).get('X-Request-ID'), 'submit-tool_1');
-  assert.equal(calls[0].init?.body, calls[1].init?.body);
-  assert.deepEqual(JSON.parse(String(calls[0].init?.body)), { tool_call_id: 'tool_1', message_id: 'message_1', action: 'approved', extra_user_input: input.extraUserInput });
-  assert.equal(JSON.parse(String(calls[2].init?.body)).action, 'rejected');
+  const answer = { appId: 'app_1', toolCallId: 'tool_1', messageId: 'message_1', approve: true, extraUserInput: { answers: [] } };
+  await buildTurn.submitToolCallInput(answer);
+  await buildTurn.submitToolCallInput(answer);
+  await buildTurn.submitToolCallInput({ ...answer, toolCallId: 'tool_2', approve: false });
+  assert.equal(headers(calls[0].init).get('X-Request-ID'), 'submit-tool_1');
+  assert.equal(headers(calls[1].init).get('X-Request-ID'), 'submit-tool_1');
+  assert.deepEqual(body(calls[0].init), { tool_call_id: 'tool_1', message_id: 'message_1', action: 'approved', extra_user_input: { answers: [] } });
+  assert.equal(body(calls[2].init).action, 'rejected');
 });
-test('preview response is not cached and upstream failures cannot expose tokens', async () => {
-  const calls = setup({ preview_url: 'preview.example/?existing=1', preview_token: 'token-canary' });
-  const result = await request({ action: 'getPreviewUrl', appId: 'app_1' });
-  assert.match(result.headers.get('cache-control')!, /no-store/);
-  assert.equal(result.headers.get('referrer-policy'), 'no-referrer');
-  assert.equal(new URL((await result.json()).url).searchParams.get('_preview_token'), 'token-canary');
-  assert.equal(calls[0].init?.cache, 'no-store');
-  setup({ error: 'token-canary personal-key-canary' }, 500);
-  assert.doesNotMatch(await (await request({ action: 'getPreviewUrl', appId: 'app_1' })).text(), /canary/);
+
+test('previews sign the builder in with the workspace key', async () => {
+  const calls = setup({ status: 'exists', embed_url: 'https://reading.example/?ott=once', expires_in: 60 });
+  assert.deepEqual(await getEmbedUrl('app_1', 'builder@example.com', 'live_preview'), { url: 'https://reading.example/?ott=once' });
+  assert.deepEqual(calls.map(c => new URL(c.url).pathname), ['/api/apps/app_1/users/provisions', '/api/apps/app_1/embed-tokens']);
+  for (const call of calls) {
+    assert.equal(headers(call.init).get('api_key'), 'b44k_workspace');
+    assert.equal(body(call.init).email, 'builder@example.com');
+  }
+  assert.equal(body(calls[1].init).target, 'live_preview');
+});
+
+test('before the first build there is no preview; a Base44 failure never leaks its body', async () => {
+  setup({ error: { code: 'app_has_no_slug' } }, 400);
+  assert.deepEqual(await getEmbedUrl('app_1', 'builder@example.com', 'latest_preview'), { url: null });
+
+  setup({ error: 'token-canary' }, 500);
+  await assert.rejects(getEmbedUrl('app_1', 'builder@example.com', 'live_preview'), (error: Base44Error) => {
+    assert.equal(error.status, 500);
+    assert.doesNotMatch(error.message, /canary/);
+    return true;
+  });
 });
+
 test('network failures are uncertain, not retried, and safe to display', async () => {
-  setup(); let calls = 0;
+  setup();
+  let calls = 0;
   globalThis.fetch = async () => { calls++; throw Error('secret-canary'); };
-  const response = await request({ action: 'sendMessage', appId: 'app_1', content: 'Update' });
-  assert.equal(response.status, 504); assert.equal(calls, 1);
-  const text = await response.text(); assert.match(text, /may still be running/); assert.doesNotMatch(text, /canary/);
+  await assert.rejects(buildTurn.sendMessage('app_1', 'Update'), (error: Base44Error) => {
+    assert.equal(error.status, 504);
+    assert.match(error.message, /may still be running/);
+    assert.doesNotMatch(error.message, /canary/);
+    return true;
+  });
+  assert.equal(calls, 1);
 });
-test('published endpoint maps 404 to no link; rejects unsafe URLs', async () => {
+
+test('an app that was never published has no link; an unsafe link is refused', async () => {
   const calls = setup({}, 404);
-  assert.deepEqual(await (await request({ action: 'getPublishedUrl', appId: 'app_1' })).json(), { url: null });
+  assert.deepEqual(await buildTurn.getPublishedUrl('app_1'), { url: null });
   assert.equal(calls[0].url, 'https://platform.example/api/apps/platform/app_1/published-url');
   setup({ url: 'javascript://evil' });
-  assert.equal((await request({ action: 'getPublishedUrl', appId: 'app_1' })).status, 502);
-});
-test('missing configuration makes no network call; conversation uses newest-relative paging', async () => {
-  const calls = setup(); delete process.env.BASE44_PLATFORM_HOST;
-  assert.equal((await request({ action: 'getApp', appId: 'app_1' })).status, 503);
-  assert.equal(calls.length, 0);
-  const reads = setup({ messages: [{ id: 'm1', content: 'Hello', hidden: true }] });
-  const result = await request({ action: 'getConversation', appId: 'app_1', skip: 20 });
-  assert.equal(result.status, 200); assert.match(reads[0].url, /limit=20&skip=20$/);
+  await assert.rejects(buildTurn.getPublishedUrl('app_1'), { status: 502 });
 });
 
-test('requires a session and exact origin before calling Base44', async () => {
+test('missing configuration makes no network call', async () => {
   const calls = setup();
-  process.env.BUILDER_ORIGIN = 'https://tiny.sunny44.com';
-  const h = { host: 'tiny.sunny44.com', origin: 'https://tiny.sunny44.com' };
-  signedIn = false;
-  const denied = await request({ action: 'createApp', prompt: 'Hello' }, h);
-  assert.equal(denied.status, 401);
-  assert.equal((await denied.json()).outcome, 'not_started');
-  signedIn = true;
-  assert.equal((await request({}, { ...h, origin: 'https://evil.example' })).status, 403);
+  delete process.env.BASE44_PLATFORM_HOST;
+  await assert.rejects(buildTurn.getApp('app_1'), { status: 503 });
   assert.equal(calls.length, 0);
-  assert.equal((await request({ action: 'getApp', appId: 'app_1' }, h)).status, 200);
 });
 
-test('another owner’s apps cannot be read, edited, previewed or deployed', async () => {
-  const calls = setup();
-  for (const action of ['getApp', 'getConversation', 'sendMessage', 'getPreviewUrl', 'deployApp', 'getPublishedUrl']) {
-    const response = await request({ action, appId: 'other_app', content: 'Update' });
-    assert.equal(response.status, 404);
-    assert.equal((await response.json()).outcome, 'not_started');
-  }
-  assert.equal(calls.length, 0);
+test('a builder can only reach apps they own', async () => {
+  let query: unknown;
+  prisma.appOwnership.findFirst = (async (args: { where: unknown }) => {
+    query = args.where;
+    return null;
+  }) as unknown as typeof prisma.appOwnership.findFirst;
+  await assert.rejects(requireOwner('builder@example.com', 'other_app'), { status: 404 });
+  await assert.rejects(requireOwner('builder@example.com', '../other'), { status: 400 });
+  assert.deepEqual(query, { createdBy: 'builder@example.com', appId: 'other_app' });
 });
 
-
-test('unavailable apps do not hide valid apps or corrupt pagination', async () => {
-  const { resolveAppPage } = await import('../lib/storage/app-list');
+test('apps missing in Base44 do not hide valid apps or break pagination', async () => {
   const rows = Array.from({ length: 13 }, (_, i) => ({ appId: `app_${i}` }));
   const page = await resolveAppPage(rows, 24, async id => {
     if (id === 'app_0') throw new Base44Error('App not found.', 404);
@@ -151,65 +133,17 @@ test('unavailable apps do not hide valid apps or corrupt pagination', async () =
   await assert.rejects(resolveAppPage(rows, 0, async () => { throw new Base44Error('Unavailable', 503); }));
 });
 
-
-test('remove requires ownership and never calls the upstream app deletion API', async () => {
-  const calls = setup();
-  assert.equal((await request({ action: 'removeApp', appId: 'other_app' })).status, 404);
-  assert.equal((await request({ action: 'removeApp', appId: 'app_1' })).status, 200);
-  assert.equal((await request({ action: 'removeApp' })).status, 400);
-  assert.equal(calls.length, 0);
-});
-
- test('a static preview is only offered once the derived URL serves a build', async () => {
-  // The URL is derived from the slug, not returned by Base44, so it can name a
-  // build that does not exist; the host then answers with a JSON error that an
-  // iframe would render as raw JSON. Hence the probe.
-  process.env.BASE44_ORG_ID = 'workspace_1';
-  process.env.BASE44_PLATFORM_HOST = 'https://platform.example';
-  process.env.BASE44_STATIC_PREVIEW_DOMAIN = 'preview.example';
-  const derived = 'https://preview--my-app.preview.example';
-
-  const serve = (body: string, contentType: string, status = 200) => {
-    const calls: string[] = [];
-    globalThis.fetch = async (url) => {
-      const href = String(url);
-      calls.push(href);
-      if (href.startsWith(derived)) return new Response(body, { status, headers: { 'content-type': contentType } });
-      return Response.json({ id: 'app_1', slug: 'my-app' });
-    };
-    return calls;
-  };
-
-  const built = serve('<!doctype html><title>App</title>', 'text/html');
-  assert.equal((await (await request({ action: 'getApp', appId: 'app_1' })).json()).static_preview_url, derived);
-  assert.ok(built.includes('https://platform.example/api/apps/app_1'));
-  assert.ok(built.some(url => url.startsWith(derived)), 'the derived URL is probed');
-
-  // A different slug, so the probe cache cannot answer for it.
-  globalThis.fetch = async (url) => String(url).includes('preview--other')
-    ? new Response('{"message":"Preview not available yet"}', { status: 404, headers: { 'content-type': 'application/json' } })
-    : Response.json({ id: 'app_2', slug: 'other' });
-  assert.equal((await (await request({ action: 'getApp', appId: 'app_2' })).json()).static_preview_url, undefined);
-});
-
-test('the live-updates session opens with the workspace key only after sign-in and app ownership', async () => {
+test('live updates open with the workspace key, and a refusal says how to fix it', async () => {
   const calls = setup({ session_id: 'session_1', session_token: 'wlst_canary', socket_url: 'https://platform.example/ws' });
-  process.env.BASE44_SVC_KEY = 'b44k_workspace';
-  const response = await request({ action: 'openBuilderSession', appId: 'app_1' });
-  assert.equal(response.status, 200);
-  assert.deepEqual(await response.json(), { serverUrl: 'https://platform.example', sessionToken: 'wlst_canary' });
+  assert.deepEqual(await openLiveUpdates('app_1'), { serverUrl: 'https://platform.example', sessionToken: 'wlst_canary' });
   assert.equal(calls[0].url, 'https://platform.example/api/service/socket-sessions');
-  assert.equal(new Headers(calls[0].init!.headers).get('authorization'), 'Bearer b44k_workspace');
-  assert.deepEqual(JSON.parse(String(calls[0].init!.body)), { app_ids: ['app_1'] });
-  assert.equal((await request({ action: 'openBuilderSession', appId: 'other_app' })).status, 404);
-  signedIn = false;
-  assert.equal((await request({ action: 'openBuilderSession', appId: 'app_1' })).status, 401);
-  assert.equal(calls.length, 1);
-});
+  assert.equal(headers(calls[0].init).get('authorization'), 'Bearer b44k_workspace');
+  assert.deepEqual(body(calls[0].init), { app_ids: ['app_1'] });
 
-test('a workspace key without the apps:watch scope is reported as configuration', async () => {
   setup({ error: { code: 'scope_required' } }, 403);
-  const response = await request({ action: 'openBuilderSession', appId: 'app_1' });
-  assert.equal(response.status, 503);
-  assert.match((await response.json()).error, /apps:watch/);
+  await assert.rejects(openLiveUpdates('app_1'), (error: Base44Error) => {
+    assert.equal(error.status, 503);
+    assert.match(error.message, /apps:watch/);
+    return true;
+  });
 });
diff --git a/examples/white-label-minimal/tsconfig.json b/examples/white-label-minimal/tsconfig.json
index 150f686..8755096 100644
--- a/examples/white-label-minimal/tsconfig.json
+++ b/examples/white-label-minimal/tsconfig.json
@@ -21,12 +21,7 @@
         "name": "next"
       }
     ],
-    "allowJs": true,
-    "paths": {
-      "@/*": [
-        "../../src/*"
-      ]
-    }
+    "allowJs": true
   },
   "include": [
     "next-env.d.ts",
diff --git a/examples/white-label-minimal/types.ts b/examples/white-label-minimal/types.ts
new file mode 100644
index 0000000..89db9dd
--- /dev/null
+++ b/examples/white-label-minimal/types.ts
@@ -0,0 +1,34 @@
+export type App = {
+  id: string;
+  name?: string;
+  preview_screenshot_url?: string;
+  status?: { state?: string; error_source?: string };
+};
+
+export type ToolCall = {
+  id?: string | null;
+  name?: string | null;
+  status?: string | null;
+  waiting_on?: { kind?: string } | null;
+  arguments_string?: string | null;
+  results?: string | null;
+};
+
+export type Message = {
+  id: string;
+  role?: string | null;
+  content?: string | null;
+  tool_calls?: ToolCall[] | null;
+};
+
+export type ToolInput = {
+  appId: string;
+  toolCallId: string;
+  messageId: string;
+  approve: boolean;
+  extraUserInput: Record<string, unknown>;
+};
+
+// What a server action returns. Next.js hides thrown errors from the browser in
+// production, so an error is a value.
+export type ActionResult<T> = { data: T } | { error: string; status: number };