Skip to main content
Before production:
  1. Pass an AI SDK LanguageModel to createVendo.
  2. Resolve every host request to a stable Principal.subject.
  3. Point createStore({ url }) at Postgres and run ensureSchema().
  4. Mount the fetch handler under one base path and preserve SSE streaming.
  5. Configure policy or a judge if the default auto-run posture is not intended.
  6. Schedule /tick or start the long-lived timer.
  7. Register and verify every webhook source.
  8. Add a sandbox adapter only if server-backed apps are needed.
Present tool execution forwards the signed-in request’s auth material on a same-origin fetch. Away host API execution requires actAs; without it, those calls fail cleanly with not-implemented. Generated components run in a no-egress iframe. App machines enforce the app’s domain allowlist and receive secret handles, never secret values. Use /status for a live composition probe. Use the public Postgres tables for backup and retention.