Release PR Buyer

Required key.

Add this in your Lovable project under Settings → Secrets before pasting the prompt below.

Paste into a fresh Lovable project. Make sure the key above is set first. read the build strategy →

Build "Release PR Buyer" as a ONE-SHOT Lovable build. The participant has only
5 credits — this single message must produce a working demo with no follow-ups.
Single-page TanStack Start app. Cut scope ruthlessly.

CONCEPT
Lovable AI runs a marketing agent that purchases playlist pitching and PR packages via UCP so independent artists boost streams.
Discipline: Music & Sound Design (music marketing).
Recipe: UCP Checkout (deterministic commerce) as the single agentic surface.
Why this kernel: UCP Checkout ensures PR agencies receive cryptographically signed proof of campaign funding.

LOVABLE BUDGET (HARD CAP: ONE-SHOT, ~5 CREDITS TOTAL):
The participant has FIVE Lovable credits for the whole build. This prompt MUST
ship a working demo on the FIRST message with zero follow-ups. Engineer for that.
- ONE TanStack Start app, ONE route (`src/routes/index.tsx`). No extra pages, no auth, no nav.
- ONE TanStack server function in `src/lib/agent.functions.ts` that runs the protocol.
- ONE client surface (a textarea + button) that triggers the server fn and renders the result.
- NO database, NO Lovable Cloud, NO auth, NO file uploads, NO extra integrations.
- NO tests, NO docs pages, NO settings screens, NO theming toggles.
- Libraries: template defaults + `zod` + `ai` + `@ai-sdk/openai-compatible`. Nothing else.
- Demo-fallback contract: every code path must boot with NO secrets and return
  realistic JSON flagged `simulated: true`. Real LLM calls activate only when
  `LOVABLE_API_KEY` is present (auto in Lovable).

STACK
- TanStack Start app, the index route only.
- Agent brain: Lovable AI Gateway via the AI SDK, called from a `createServerFn` handler so the key stays server-side.
- Protocol surface: UCP Checkout as defined below.
- Client surface fits the kernel: a prompt box (and any minimal extra inputs) that returns the agent's output.
- Tailwind + shadcn. Editorial look: gold accent on a dark or warm-cream background,
  generous type, one strong headline, one primary action.
- Footer renders: "Built during the Creative AI & Quantum Hackathon organised by StreetKode Fam during Indian Krump Festival 14".

GATEWAY HELPER (src/lib/ai-gateway.server.ts) — Lovable AI Gateway provider:
```ts
import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
/** Built during the Creative AI & Quantum Hackathon organised by StreetKode Fam during Indian Krump Festival 14 */
export function lovableGateway(apiKey: string) {
  return createOpenAICompatible({
    name: "lovable",
    baseURL: "https://ai.gateway.lovable.dev/v1",
    headers: { "Lovable-API-Key": apiKey, "X-Lovable-AIG-SDK": "vercel-ai-sdk" },
  });
}
```
Install once: `bun add ai @ai-sdk/openai-compatible zod`.

SERVER FUNCTION (src/lib/agent.functions.ts) — UCP Checkout agent:
```ts
import { createServerFn } from "@tanstack/react-start";
import { generateObject } from "ai";
import { z } from "zod";
import { lovableGateway } from "@/lib/ai-gateway.server";

const CATALOG = [
  { sku: "music marketing-basic",  name: "music marketing — basic",   price_minor: 1900,  currency: "USD" },
  { sku: "music marketing-pro",    name: "music marketing — pro",     price_minor: 4900,  currency: "USD" },
  { sku: "music marketing-studio", name: "music marketing — studio",  price_minor: 12900, currency: "USD" },
];

/** Built during the Creative AI & Quantum Hackathon organised by StreetKode Fam during Indian Krump Festival 14 */
export const buy = createServerFn({ method: "POST" })
  .inputValidator((d) => z.object({ goal: z.string().min(1).max(800) }).parse(d))
  .handler(async ({ data }) => {
    const key = process.env.LOVABLE_API_KEY;
    // Demo-fallback contract: boot with NO secrets, return realistic envelope.
    if (!key) {
      return ucpEnvelope([CATALOG[0]], data.goal, { simulated: true, reason: "no LOVABLE_API_KEY" });
    }
    const gw = lovableGateway(key);
    const { object } = await generateObject({
      model: gw("google/gemini-2.5-flash"),
      schema: z.object({ skus: z.array(z.enum([CATALOG[0].sku, CATALOG[1].sku, CATALOG[2].sku])).min(1) }),
      prompt: `Buyer agent for music marketing. Goal: ${data.goal}.\nCatalog: ${JSON.stringify(CATALOG)}.\nPick the smallest set of SKUs that satisfies the goal.`,
    });
    const items = object.skus.map((s) => CATALOG.find((c) => c.sku === s)!).filter(Boolean);
    return ucpEnvelope(items, data.goal, { simulated: false });
  });

function ucpEnvelope(items: typeof CATALOG, goal: string, meta: { simulated: boolean; reason?: string }) {
  const total_minor = items.reduce((s, i) => s + i.price_minor, 0);
  const order_id = `ucp-${crypto.randomUUID()}`;
  // RFC 9421-style envelope (signature stub — flag simulated when no real signer).
  return {
    discovery: { merchant: "music marketing Co.", protocol: "ucp/0.3" },
    order: { order_id, items, total_minor, currency: "USD", goal },
    signature: { alg: "hmac-sha256", keyid: "demo-key", sig: "stub", covered: "@method @path order" },
    meta: { ...meta, kernel: "ucp-checkout" },
  };
}
```

CLIENT (in `src/routes/index.tsx`): textarea for the goal + "Run agent" button.
On success render the order line items, total, and pretty-printed JSON envelope.
Show the `simulated: true` flag prominently when demo-fallback is active.

USER FLOW (the entire app — nothing else exists)
1. Land on the page; the headline previews what the agent does for music marketing.
2. The primary action (a one-tap checkout surface that lets an agent shop a fixed catalog and return a verifiable order JSON the user can copy or settle) is one tap away; the rest of the layout supports it.
3. The server fn runs the protocol, the result lands on screen, the user can retry, copy, or audit.

KEYS (Lovable AI first, AIsa AI fallback):
1. `LOVABLE_API_KEY` — PRIMARY agent brain. Auto-provisioned by Lovable. Used
   server-side to call Lovable AI Gateway (Gemini, Claude, GPT) for every
   reasoning step. Never expose to the client; read only via
   `process.env.LOVABLE_API_KEY`. This is the default code path.
2. `AISA_API_KEY` (OPTIONAL FALLBACK) — only set if Lovable credits are
   exhausted or a specific frontier model from https://aisa.one is required.
   The server fn should try Lovable first and fall back to AIsa only if
   `LOVABLE_API_KEY` is missing.
The demo MUST still boot with zero secrets and return realistic `simulated:true`
envelopes — that demo-fallback contract is non-negotiable (see UCP × A2A × AP2 spec).

CREDIT (must appear in UI footer AND as JSDoc on the server function):
Built during the Creative AI & Quantum Hackathon organised by StreetKode Fam during Indian Krump Festival 14

Market sizing.

Indicative figures for hackathon pitches — refine with your own research before raising.