lua-cli 3.31.0 → 3.32.1

package/dist/api-exports.d.ts

@@ -121,6 +121,14 @@ declare interface AgentInvocationInput {
     /** Per-request model override ("provider/model" code). Unknown codes fall back per
      *  approved-models policy server-side. */
     model?: string;
+    /**
+     * LUA-655 (review M2) — a platform re-ask the customer must not pay for: the workflow executor's
+     * output-repair turns. Honoured server-side ONLY on internally-authenticated turns
+     * (`buildChatRequest` drops a Bearer client's value): it rides `handleBilling` → lua-api's
+     * `deduct-credits` as `skipCredits`, which skips the legacy credit deduction (the seat gate and
+     * the settlement usage event still run, the skill-override posture).
+     */
+    skipCredits?: boolean;
     /** Task 14 (tasks-redesign) — per-task connector + skill scoping. See `AgentToolScope`. */
     toolScope?: AgentToolScope_2;
     /**
@@ -309,6 +317,15 @@ export declare interface AgentStepOptions {
     harness?: WorkflowJobHarness;
     /** Coding-turn cap for a tier:'job' step (1..500); absent ⇒ the platform default. A monorepo change needs more than the default. */
     maxTurns?: number;
+    /**
+     * Per-ATTEMPT ceilings for a tier:'job' step (LUA-636): `maxTurns` bounds one harness query; these bound the whole
+     * attempt (every pass and resumed segment). Crossing one checkpoints the workspace and ends the attempt
+     * `attempt_budget_exhausted` — retryable, so the step's `retry` policy continues from that tree with a fresh
+     * session. `maxMessages` counts harness messages (one per content block; 1..5000, default 400),
+     * `maxInputTokens` the attempt's input-side tokens (prompt + cache; 1M..500M, default 30M).
+     */
+    maxMessages?: number;
+    maxInputTokens?: number;
 }
 
 export declare interface AgentToolScope {
@@ -512,6 +529,15 @@ declare interface ApiResponse<T = any> {
         error?: string;
         oldAccountLabel?: string;
         newAccountLabel?: string;
+        /** Workflow envelope detail (09 §9.11 `{ statusCode, message, code, ...detail }` is spread top-level). */
+        issues?: Array<{
+            path?: string;
+            message?: string;
+            code?: string;
+        }>;
+        stepId?: string;
+        /** the live step status on 409 NOT_SUSPENDED (LUA-644) */
+        status?: string;
     };
 }
 
@@ -875,9 +901,11 @@ declare interface BuiltWorkflow {
     steps: Record<string, LuaWorkflowStep<any, any, any>>;
     warnings: LuaWorkflowBuildWarning[];
     envTemplateKeys: string[];
+    /** `.workflow(id, ref, …, { workspace })` targets; `workspace:'inherit'` marks an inherit child — the compiler defers `workspace-not-declared` for it (03 §3.1). */
     nestedRefs: Array<{
         id: string;
         name: string;
+        workspace?: 'inherit';
     }>;
 }
 
@@ -4891,16 +4919,23 @@ export declare class LuaWorkflow {
     getBuildWarnings(): LuaWorkflowBuildWarning[];
     /** Every `env.template(KEY)` placeholder key the graph carries (sorted, deduped) — `ManifestWorkflow.envTemplateKeys`. */
     getEnvTemplateKeys(): string[];
-    /** `.workflow(id, ref)` targets by name — `ManifestWorkflow.workflowRefs`. */
+    /** `.workflow(id, ref)` targets by name — `ManifestWorkflow.workflowRefs`; `workspace:'inherit'` marks the inherit children the compiler defers `workspace-not-declared` for. */
     getNestedWorkflowRefs(): Array<{
         id: string;
         name: string;
+        workspace?: 'inherit';
     }>;
     /** Pure: no I/O, no env, no time. Called by the compiler in the VM tier and by `lua test`. */
     __serializeGraph(): SerializedWorkflowGraph;
 }
 
-export declare type LuaWorkflowBuildCode = 'duplicate-step-id' | 'unknown-step-ref' | 'map-id-required' | 'closure-predicate' | 'closure-binding' | 'timeout-out-of-range' | 'timeout-exceeds-tier' | 'job-timeout-exceeds-cap' | 'long-job-requires-workspace' | 'workspace-requires-job-tier' | 'workspace-not-declared' | 'workspace-inherit-without-parent-workspace' | 'workspace-inherit-conflict' | 'harness-requires-job-tier' | 'max-turns-requires-job-tier' | 'max-turns-invalid' | 'cap-exceeded' | 'chunk-size-invalid' | 'rate-limit-invalid' | 'backoff-invalid' | 'loop-interval-out-of-range' | 'mapping-placement' | 'container-arm-empty' | 'approval-inside-container' | 'empty-graph' | 'ephemeral-role-too-long' | 'role-ref-and-inline' | 'approver-excludes-only-candidate' | 'four-eyes-requires-editable' | 'escalation-chain-not-terminal' | 'escalation-chain-too-long' | 'editable-path-invalid' | 'env-template-secret-key' | 'invalid-envelope' | 'invalid-step' | 'invalid-step-id' | 'invalid-workflow-name' | 'schedule-input-required' | 'schedule-input-invalid' | 'hitl-duration-defaulted' | 'WORKFLOW_UNPLACED_STEP';
+export declare type LuaWorkflowBuildCode = 'duplicate-step-id' | 'unknown-step-ref' | 'map-id-required' | 'closure-predicate' | 'closure-binding' | 'timeout-out-of-range' | 'timeout-exceeds-tier' | 'job-timeout-exceeds-cap' | 'long-job-requires-workspace' | 'workspace-requires-job-tier'
+/**
+* @deprecated LUA-635 — the builder no longer throws it: a mount with no envelope `workspace` is the SHARED validator's
+* verdict (deferred for an inherit child, 03 §3.1 table). Kept for one minor so a consumer switching on the union still
+* compiles; removed in the next.
+*/
+| 'workspace-not-declared' | 'workspace-inherit-without-parent-workspace' | 'workspace-inherit-conflict' | 'harness-requires-job-tier' | 'max-turns-requires-job-tier' | 'max-turns-invalid' | 'cap-exceeded' | 'chunk-size-invalid' | 'rate-limit-invalid' | 'backoff-invalid' | 'loop-interval-out-of-range' | 'mapping-placement' | 'container-arm-empty' | 'approval-inside-container' | 'empty-graph' | 'ephemeral-role-too-long' | 'role-ref-and-inline' | 'approver-excludes-only-candidate' | 'four-eyes-requires-editable' | 'escalation-chain-not-terminal' | 'escalation-chain-too-long' | 'editable-path-invalid' | 'env-template-secret-key' | 'invalid-envelope' | 'invalid-step' | 'invalid-step-id' | 'invalid-workflow-name' | 'schedule-input-required' | 'schedule-input-invalid' | 'hitl-duration-defaulted' | 'WORKFLOW_UNPLACED_STEP';
 
 export declare interface LuaWorkflowBuilder {
     then(step: StepRef): this;
@@ -4938,7 +4973,7 @@ export declare interface LuaWorkflowBuilder {
     toolStep(id: string, tool: LuaTool<any>, opts?: ToolStepOptions): this;
     approval(id: string, opts: ApprovalOptions): this;
     waitForSignal(id: string, opts: WaitForSignalOptions): this;
-    /** nested run; depth ≤ 3 */
+    /** nested run; depth ≤ 3 — declares `id`, so a container may place it by string ref (03 §3.2.0) */
     workflow(id: string, ref: LuaWorkflow | string, input?: LuaMapConfig, opts?: {
         workspace?: 'inherit';
     }): this;
@@ -4986,6 +5021,13 @@ export declare interface LuaWorkflowConfig {
     /** NEVER set by hand — the compiler derives it from the source file. */
     form?: 'graph' | 'script';
     workspace?: WorkspaceSpec;
+    /**
+     * Declared connection keys. `workspace.credentialsRef` and a step's `requiredConnections` may name a
+     * `key` instead of a connection id; the engine resolves it against the owner agent's own connections
+     * at run time (agent-scoped first, then org-scoped — never a user's), so the same definition runs on
+     * a template install, a hand-built agent and a duplicate without a frozen id.
+     */
+    connections?: WorkflowConnectionDeclaration[];
 }
 
 export declare interface LuaWorkflowStep<TIn extends ZodType = ZodType, TOut extends ZodType = ZodType, TResume extends ZodType = ZodType> {
@@ -7033,6 +7075,15 @@ export declare interface WorkflowBusinessHours {
     };
 }
 
+declare interface WorkflowConnectionDeclaration {
+    /** /^[a-z][a-z0-9_-]{0,63}$/ — unique per workflow. */
+    key: string;
+    /** Catalog integration type (`'github'`, `'linear'`, …). */
+    integrationType: string;
+    required?: boolean;
+    description?: string;
+}
+
 export declare interface WorkflowFourEyes {
     edit: WorkflowApproverSpec;
     approve: WorkflowApproverSpec;
@@ -7067,9 +7118,14 @@ export declare interface WorkflowOutputVisibility {
     ownerBypass?: boolean;
 }
 
-/** Matches WorkflowRunDto (R4 `fields:'summary'` — outputs are never inlined here). */
+/**
+ * Matches WorkflowRunDto (R4 `fields:'summary'` — outputs are never inlined here).
+ * The wire names the run `runId` (shared-types `WorkflowRunSummary`); `id` is the pre-R4 spelling some
+ * envelopes still carry — read through `runIdOf()` (LUA-668: `status` printed "Run undefined").
+ */
 declare interface WorkflowRun {
-    id: string;
+    id?: string;
+    runId?: string;
     workflowId: string;
     workflowVersionId: string;
     agentId: string;
@@ -7088,7 +7144,27 @@ declare interface WorkflowRun {
     };
     failureReason?: string;
     restricted?: boolean;
+    /** LUA-623: the keys the run's version declares, and what each resolved to on its agent (`connection.resolved` rows). */
+    connections?: {
+        declared: Array<{
+            key: string;
+            integrationType: string;
+            required?: boolean;
+        }>;
+        resolved: Array<{
+            key: string;
+            connectionId: string;
+            integrationType: string;
+            scope: 'agent' | 'org';
+            at: number;
+        }>;
+    };
+    /** R4 `fields:'full'` only: the payload inline, else the `{__cdnRef}` it was offloaded under (LUA-643). */
     output?: unknown;
+    /** LUA-643: ≤ 2 KB preview beside an offloaded `output`. */
+    outputPreview?: string;
+    /** LUA-643: every shape says whether a result exists; `--steps` (`fields:'full'`) serves it. */
+    hasOutput?: boolean;
     createdAt: string;
     startedAt?: string;
     completedAt?: string;