lua-cli 3.31.0 → 3.32.1

package/dist/api-exports.js

@@ -514,7 +514,6 @@ function luaClientMetricLabels(client) {
   const canonical2 = parseLuaClientHeader(serializeLuaClientHeader(client));
   return {
     client_family: canonical2?.app ?? "unknown",
-    client_version: canonical2?.version ?? "unknown",
     client_attribution: canonical2?.attribution ?? "unknown"
   };
 }
@@ -582,6 +581,59 @@ function scheduledTimeKey(scheduledTime) {
 function scheduledWorkflowRunIdForTime(jobId, scheduledTime) {
   return scheduledWorkflowRunId(jobId, scheduledTime);
 }
+function groupCount(re) {
+  let n2 = GROUP_COUNT.get(re);
+  if (n2 === void 0) {
+    n2 = new RegExp(`${re.source}|`, re.flags.replace("g", "")).exec("").length - 1;
+    GROUP_COUNT.set(re, n2);
+  }
+  return n2;
+}
+function applyPatterns(text, patterns) {
+  let out = text;
+  for (const { re, suffix } of patterns) {
+    re.lastIndex = 0;
+    if (!re.test(out)) continue;
+    re.lastIndex = 0;
+    const groups = groupCount(re);
+    out = out.replace(re, (...args) => {
+      const kept = args.slice(1, 1 + groups).map((g) => typeof g === "string" ? g : "");
+      if (suffix && kept.length > 0) {
+        const tail = kept[kept.length - 1];
+        return `${kept.slice(0, -1).join("")}${REDACTED_PLACEHOLDER}${tail}`;
+      }
+      return `${kept.join("")}${REDACTED_PLACEHOLDER}`;
+    });
+  }
+  return out;
+}
+function scrubSecretText(text) {
+  if (typeof text !== "string" || text.length < 4) return text;
+  return applyPatterns(applyPatterns(text, SECRET_LITERAL_PATTERNS), SECRET_PAIR_PATTERNS);
+}
+function scrubSecretLines(lines) {
+  return lines.map((l) => typeof l === "string" ? scrubSecretText(l) : l);
+}
+function messageText(value3) {
+  if (typeof value3 === "string") return value3;
+  if (value3 instanceof Error) return value3.message;
+  if (value3 && typeof value3 === "object") {
+    const m = value3.message;
+    if (typeof m === "string") return m;
+    try {
+      return JSON.stringify(value3);
+    } catch {
+      return "";
+    }
+  }
+  return value3 === void 0 || value3 === null ? "" : String(value3);
+}
+function scrubProviderMessage(raw, max = PROVIDER_MESSAGE_MAX_CHARS) {
+  const text = messageText(raw).replace(/\s+/g, " ").trim();
+  if (!text) return void 0;
+  const out = scrubSecretText(text);
+  return out.length > max ? `${out.slice(0, max - 1)}\u2026` : out;
+}
 function isWorkflowAuditEvent(action) {
   return typeof action === "string" && WORKFLOW_AUDIT_EVENTS.includes(action);
 }
@@ -676,7 +728,7 @@ ${PREAMBLE}
 
 ${items.join("\n\n")}`;
 }
-var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE;
+var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1688,6 +1740,27 @@ This text is who you are for this person. As you learn them, their name, their w
       ...WORKFLOW_RUN_IDLE,
       ...WORKFLOW_RUN_TERMINAL
     ];
+    WORKFLOW_STEP_STATUSES = [
+      "pending",
+      "ready",
+      "waiting",
+      "dispatched",
+      "claimed",
+      "running",
+      "suspended",
+      "cancellation_requested",
+      "completed",
+      "failed",
+      "skipped",
+      "cancelled",
+      "timeout",
+      "reaped"
+    ];
+    WORKFLOW_STEP_IN_FLIGHT = [
+      "claimed",
+      "running",
+      "cancellation_requested"
+    ];
     ARCHIVE_WINDOW_MARGIN_DAYS = 7;
     __name(shouldSkipArchive, "shouldSkipArchive");
     __name2(shouldSkipArchive, "shouldSkipArchive");
@@ -1717,11 +1790,90 @@ This text is who you are for this person. As you learn them, their name, their w
     __name2(workflowOccurrenceId, "workflowOccurrenceId");
     __name(workflowOrgSlotKey, "workflowOrgSlotKey");
     __name2(workflowOrgSlotKey, "workflowOrgSlotKey");
+    WORKFLOW_CONNECTION_KEY_RE = /^[a-z][a-z0-9_-]{0,63}$/;
     __name(scheduledTimeKey, "scheduledTimeKey");
     __name2(scheduledTimeKey, "scheduledTimeKey");
     __name(scheduledWorkflowRunIdForTime, "scheduledWorkflowRunIdForTime");
     __name2(scheduledWorkflowRunIdForTime, "scheduledWorkflowRunIdForTime");
     WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES = 64 * 1024;
+    REDACTED_PLACEHOLDER = "[REDACTED]";
+    PROVIDER_MESSAGE_MAX_CHARS = 300;
+    SECRET_LITERAL_PATTERNS = [
+      {
+        re: /\b(github_pat_)[A-Za-z0-9_]{16,}/g
+      },
+      {
+        re: /\b(gh[pousr]_)[A-Za-z0-9]{16,}/g
+      },
+      {
+        re: /\b(glpat-)[A-Za-z0-9_-]{16,}/g
+      },
+      {
+        re: /\b(sk-ant-)[A-Za-z0-9_-]{16,}/g
+      },
+      {
+        re: /\b(sk-)(?!ant-)[A-Za-z0-9_-]{20,}/g
+      },
+      {
+        re: /\b(AKIA)[A-Z0-9]{16}\b/g
+      },
+      {
+        re: /\b(xox[abprs]-)[A-Za-z0-9-]{10,}/g
+      },
+      {
+        re: /\b(AIza)[0-9A-Za-z_-]{35}/g
+      },
+      {
+        re: /\b(ya29\.)[A-Za-z0-9_-]{20,}/g
+      },
+      {
+        re: /\b(eyJ)[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+      },
+      {
+        re: /(-----BEGIN [A-Z ]*PRIVATE KEY-----)[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g
+      },
+      // `https://x-access-token:<token>@github.com/…` (the git credential shape the pod scrubbed already)
+      {
+        re: /\b(x-access-token:)[^@\s]+(@)/g,
+        suffix: true
+      }
+    ];
+    SECRET_NAME = "(?:authorization|proxy-authorization|x-api-key|x-wf-[a-z-]*key|x-internal-auth|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|secret|password|passwd|pwd|passphrase|token|credentials?)";
+    SECRET_PAIR_PATTERNS = [
+      // `Authorization: Bearer x`, `x-api-key: x`, `AWS_SECRET_ACCESS_KEY=x`, `SVC_JOB_KEY=x`, `"apiKey": "x"`,
+      // `FOO_TOKEN=x`, `secretKey=x`, `password=x`. Groups: the char before the name, the name, the separator
+      // (with its quotes), the scheme word — all kept; the value goes. A value a literal rule already replaced
+      // (`x-access-token:[REDACTED]@host`) is left alone so the host after it survives.
+      {
+        re: new RegExp(`(^|[^A-Za-z0-9])((?:[A-Za-z0-9-]+[_-])?${SECRET_NAME}|[A-Za-z0-9-]+_key)(["']?\\s*[:=]\\s*["']?)((?:basic\\s+|bearer\\s+|token\\s+)?)(?!\\[REDACTED\\])[^\\s"',;)}&]{4,}`, "gi")
+      },
+      // `?token=x`, `&key=x`, `&X-Amz-Signature=x`, `&sig=x`
+      {
+        re: /([?&](?:token|key|api[_-]?key|apikey|access[_-]?token|id[_-]?token|auth|sig|signature|secret|password|pwd|x-amz-signature|x-amz-credential|x-amz-security-token)=)[^&\s"'#]+/gi
+      },
+      // `mongodb+srv://user:pass@host`, `postgres://user:pass@host`, `https://user:pass@host`
+      {
+        re: /(\/\/[^\s/:@]+:)[^\s/@]+(@)/g,
+        suffix: true
+      },
+      // `Basic <base64>` / `bearer <short token>` (the literal list needs ≥ 16 chars; any case)
+      {
+        re: /\b((?:Basic|Bearer)\s+)(?!\[REDACTED\])[A-Za-z0-9+/=_.-]{8,}/gi
+      }
+    ];
+    GROUP_COUNT = /* @__PURE__ */ new WeakMap();
+    __name(groupCount, "groupCount");
+    __name2(groupCount, "groupCount");
+    __name(applyPatterns, "applyPatterns");
+    __name2(applyPatterns, "applyPatterns");
+    __name(scrubSecretText, "scrubSecretText");
+    __name2(scrubSecretText, "scrubSecretText");
+    __name(scrubSecretLines, "scrubSecretLines");
+    __name2(scrubSecretLines, "scrubSecretLines");
+    __name(messageText, "messageText");
+    __name2(messageText, "messageText");
+    __name(scrubProviderMessage, "scrubProviderMessage");
+    __name2(scrubProviderMessage, "scrubProviderMessage");
     WORKFLOW_AUDIT_EVENTS = [
       // --- definitions / versions / templates (13, 11 §11.11.5) ---
       "workflow.published",
@@ -1843,7 +1995,11 @@ listed here; never invent a target.`;
 // ../workflow-graph/dist/index.mjs
 import { createHash } from "crypto";
 import { z as z4 } from "zod";
+import { z as z22 } from "zod";
 import { createHash as createHash2 } from "crypto";
+function sleepUntilUnsupportedMessage(id) {
+  return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
+}
 function fillPolicy(node, defaultTimeout) {
   if (node.tier === void 0 && node.workspace !== void 0 && node.workspace !== "inherit") node.tier = "job";
   if (node.timeoutSeconds === void 0) node.timeoutSeconds = node.tier === "job" ? WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS : defaultTimeout;
@@ -1938,6 +2094,12 @@ function withDefaultsFilled(g) {
   out.definition.graph.forEach(fillEntry);
   return out;
 }
+function isConnectionKeyShaped(value22) {
+  return WORKFLOW_CONNECTION_KEY_RE.test(value22) && !CONNECTION_ID_HEX_RE.test(value22);
+}
+function connectionKeyUndeclaredMessage(path3, key) {
+  return `${path3} '${key}' is neither a connection id nor a declared connections[].key \u2014 declare it: connections: [{ key: '${key}', integrationType: '<catalog slug, e.g. github>' }] and it resolves on any agent`;
+}
 function classifyModelProvider(model) {
   const m = (model ?? "").trim().toLowerCase();
   if (!m) return null;
@@ -2040,6 +2202,33 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   if (envelopeWorkspace?.backend && envelopeWorkspace.backend !== "ebs" && opts.policy?.workspaceBackends && !opts.policy.workspaceBackends.includes(envelopeWorkspace.backend)) {
     err("workspace-backend-unavailable", `workspace.backend '${envelopeWorkspace.backend}' is not enabled (LUA_WF_WORKSPACE_BACKENDS = ${opts.policy.workspaceBackends.join(",")}) \u2014 'ebs' is the normative fallback`, "workspace.backend");
   }
+  const declaredKeys = new Set(opts.connectionKeys ?? []);
+  if (g.connections !== void 0 && !Array.isArray(g.connections)) {
+    err("connection-declaration-invalid", "`connections` must be an array of { key, integrationType }", "connections");
+  }
+  (Array.isArray(g.connections) ? g.connections : []).forEach((c, i) => {
+    const path3 = `connections.${i}`;
+    const key = c?.key;
+    const integrationType = c?.integrationType;
+    if (typeof key !== "string" || !WORKFLOW_CONNECTION_KEY_RE.test(key)) {
+      err("connection-declaration-invalid", `connections[${i}].key must match ${WORKFLOW_CONNECTION_KEY_RE}`, `${path3}.key`);
+      return;
+    }
+    if (declaredKeys.has(key)) {
+      err("connection-declaration-invalid", `connections[${i}].key "${key}" is declared twice`, `${path3}.key`);
+      return;
+    }
+    if (typeof integrationType !== "string" || !integrationType.trim()) {
+      err("connection-declaration-invalid", `connections[${i}] ("${key}") needs an integrationType (the catalog slug, e.g. 'github')`, `${path3}.integrationType`);
+      return;
+    }
+    declaredKeys.add(key);
+  });
+  const undeclaredKey = /* @__PURE__ */ __name3((ref) => typeof ref === "string" && !declaredKeys.has(ref) && isConnectionKeyShaped(ref) && opts.connectionIds?.has(ref) !== true, "undeclaredKey");
+  const credentialsRef = envelopeWorkspace?.credentialsRef;
+  if (undeclaredKey(credentialsRef)) {
+    err("connection-key-undeclared", connectionKeyUndeclaredMessage("workspace.credentialsRef", credentialsRef), "workspace.credentialsRef");
+  }
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
@@ -2051,6 +2240,16 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       seen.set(id, path3);
     }
   }, "checkId");
+  const checkPolicyEnums = /* @__PURE__ */ __name3((node, path3) => {
+    const id = singleId(node);
+    const check = /* @__PURE__ */ __name3((member, allowed) => {
+      const value22 = node[member];
+      if (value22 === void 0 || typeof value22 === "string" && allowed.includes(value22)) return;
+      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path3}.${member}`, id);
+    }, "check");
+    check("sideEffects", WORKFLOW_SIDE_EFFECTS);
+    check("jobResources", WORKFLOW_JOB_RESOURCES);
+  }, "checkPolicyEnums");
   const checkRetry = /* @__PURE__ */ __name3((node, path3) => {
     const r = node.retry;
     if (!r) return;
@@ -2058,6 +2257,9 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (r.backoff !== void 0 && r.backoff !== "fixed" && r.backoff !== "exponential") {
       err("backoff-invalid", `retry.backoff must be 'fixed' | 'exponential'`, `${path3}.retry.backoff`, id);
     }
+    if (r.backoffSeconds !== void 0 && r.backoffSeconds < 0) {
+      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path3}.retry.backoffSeconds`, id);
+    }
     if (r.maxBackoffSeconds !== void 0) {
       if (r.backoff !== "exponential") {
         err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path3}.retry`, id);
@@ -2119,10 +2321,15 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   }, "checkSpecialistRole");
   const checkRequiredConnections = /* @__PURE__ */ __name3((node, path3) => {
     const required = node.requiredConnections;
-    if (!Array.isArray(required) || !opts.connectionIds) return;
-    const unknown = required.filter((c) => typeof c !== "string" || !opts.connectionIds.has(c));
+    if (!Array.isArray(required)) return;
+    const undeclared = required.filter(undeclaredKey);
+    if (undeclared.length) {
+      err("connection-key-undeclared", connectionKeyUndeclaredMessage(`${path3}.requiredConnections`, undeclared[0]) + (undeclared.length > 1 ? ` (also undeclared: ${JSON.stringify(undeclared.slice(1))})` : ""), `${path3}.requiredConnections`, singleId(node));
+    }
+    if (!opts.connectionIds) return;
+    const unknown = required.filter((c) => typeof c !== "string" || !declaredKeys.has(c) && !opts.connectionIds.has(c));
     if (unknown.length) {
-      err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are not connections the owner can mount`, `${path3}.requiredConnections`, singleId(node));
+      err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are neither declared connections[].key values nor connections the owner can mount`, `${path3}.requiredConnections`, singleId(node));
     }
   }, "checkRequiredConnections");
   const checkTier = /* @__PURE__ */ __name3((node, path3) => {
@@ -2208,6 +2415,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       return;
     }
     checkId(singleId(node), path3);
+    checkPolicyEnums(node, path3);
     checkTimeout(node, path3);
     checkTier(node, path3);
     checkRetry(node, path3);
@@ -2274,6 +2482,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       case "sleepUntil": {
         const s = entry;
         checkId(s.id, path3);
+        err("node-type-unsupported-by-engine", sleepUntilUnsupportedMessage(s.id), path3, s.id);
         if (s.date === void 0 === (s.dateFrom === void 0)) {
           err("invalid-envelope", "sleepUntil needs exactly one of `date` | `dateFrom`", path3, s.id);
         }
@@ -2319,7 +2528,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
           err("invalid-envelope", "conditional.predicates must match conditional.steps one-to-one", path3);
         }
         (c.predicates ?? []).forEach((p, j) => {
-          if (!isPredicate(p)) err("closure-predicate", "a conditional predicate must be a LuaPredicate object, not a function", `${path3}.predicates.${j}`);
+          if (!isWellFormedPredicate(p)) err("closure-predicate", "a conditional predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path3}.predicates.${j}`);
         });
         c.steps.forEach((arm, j) => {
           checkArm(arm, `${path3}.steps.${j}`, 1);
@@ -2399,7 +2608,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         if (l.intervalSeconds !== void 0 && (!Number.isInteger(l.intervalSeconds) || l.intervalSeconds < 1 || l.intervalSeconds > caps.maxLoopIntervalSeconds)) {
           err("loop-interval-out-of-range", `loop.intervalSeconds must be an integer in 1..${caps.maxLoopIntervalSeconds}`, `${path3}.intervalSeconds`);
         }
-        if (!isPredicate(l.predicate)) err("closure-predicate", "a loop predicate must be a LuaPredicate object, not a function", `${path3}.predicate`);
+        if (!isWellFormedPredicate(l.predicate)) err("closure-predicate", "a loop predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path3}.predicate`);
         const bodyType = l.step.type;
         if (bodyType === "mapping") err("container-arm-empty", "a loop body needs a step, not a bare mapping", `${path3}.step`);
         else if (bodyType === "approval" || bodyType === "waitForSignal") err("approval-inside-container", "approval / waitForSignal are top-level only in v1", `${path3}.step`);
@@ -2462,6 +2671,41 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
 function isPredicate(p) {
   return typeof p === "object" && p !== null && typeof p.op === "string" && PREDICATE_OPS.has(p.op);
 }
+function isPathOrLiteral(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v;
+  if ("path" in r) return typeof r.path === "string" && r.path.length > 0;
+  return "literal" in r && isPredicateScalar(r.literal);
+}
+function isWellFormedPredicate(p) {
+  if (!isPredicate(p)) return false;
+  const r = p;
+  switch (r.op) {
+    case "eq":
+    case "ne":
+    case "lt":
+    case "lte":
+    case "gt":
+    case "gte":
+      return isPathOrLiteral(r.left) && isPathOrLiteral(r.right);
+    case "in":
+    case "notIn":
+      return isPathOrLiteral(r.value) && Array.isArray(r.set) && r.set.every(isPredicateScalar);
+    case "exists":
+    case "notExists":
+      return typeof r.path === "string" && r.path.length > 0;
+    case "truthy":
+    case "falsy":
+      return isPathOrLiteral(r.value);
+    case "and":
+    case "or":
+      return Array.isArray(r.args) && r.args.every(isWellFormedPredicate);
+    case "not":
+      return isWellFormedPredicate(r.arg);
+    default:
+      return false;
+  }
+}
 function canonicalJson(value22) {
   const seen = /* @__PURE__ */ new WeakSet();
   const encode = /* @__PURE__ */ __name3((v) => {
@@ -3024,6 +3268,25 @@ function resolveMapping(cfg, ctx) {
     value: result
   };
 }
+function continuedFailureValue(error, killReason) {
+  const code = typeof error?.code === "string" && error.code || typeof killReason === "string" && killReason || CONTINUED_FAILURE_DEFAULT_CODE;
+  const message = typeof error?.message === "string" && error.message ? error.message : code;
+  return {
+    __lua_workflow: CONTINUED_FAILURE_TAG,
+    failed: true,
+    error: {
+      code,
+      message
+    },
+    text: ""
+  };
+}
+function isContinuedFailureValue(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  const o = v;
+  const err = o.error;
+  return o.__lua_workflow === CONTINUED_FAILURE_TAG && o.failed === true && o.text === "" && err !== null && typeof err === "object" && typeof err.code === "string" && typeof err.message === "string";
+}
 function lowerContainerArm(mapping, step22) {
   const stepId = nodeIdOf(step22);
   return {
@@ -3121,7 +3384,7 @@ function resolvePlacements(calls) {
     if (!d) {
       issues.push({
         code: "unknown-step-ref",
-        message: `"${ref.ref}" is not declared anywhere in the chain \u2014 declare it with agentStep/specialistStep/toolStep/map(\u2026, { id })`,
+        message: `"${ref.ref}" is not declared anywhere in the chain \u2014 declare it with agentStep/specialistStep/toolStep/map(\u2026, { id })/workflow(\u2026)`,
         callIndex: i,
         stepId: ref.ref
       });
@@ -3173,9 +3436,9 @@ function resolvePlacements(calls) {
   });
   const graph = [];
   const lookup = /* @__PURE__ */ __name3((ref) => {
-    const n = "node" in ref ? ref.node : declared.get(ref.ref)?.node;
-    if (!n || !ref.armMap || n.type === "mapping") return n;
-    return lowerContainerArm(ref.armMap, n);
+    const n2 = "node" in ref ? ref.node : declared.get(ref.ref)?.node;
+    if (!n2 || !ref.armMap || n2.type === "mapping") return n2;
+    return lowerContainerArm(ref.armMap, n2);
   }, "lookup");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -3194,7 +3457,7 @@ function resolvePlacements(calls) {
         return;
       }
       case "parallel": {
-        const steps = call.arms.map(lookup).filter((n) => !!n && n.type !== "mapping");
+        const steps = call.arms.map(lookup).filter((n2) => !!n2 && n2.type !== "mapping");
         const node = {
           type: "parallel",
           steps
@@ -3207,9 +3470,9 @@ function resolvePlacements(calls) {
         const steps = [];
         const predicates = [];
         for (const a of call.arms) {
-          const n = lookup(a.target);
-          if (!n) continue;
-          steps.push(n);
+          const n2 = lookup(a.target);
+          if (!n2) continue;
+          steps.push(n2);
           predicates.push(a.predicate);
         }
         const node = {
@@ -3313,31 +3576,54 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
     graphChanged
   };
 }
+function branchSpecFromConditional(entry) {
+  return {
+    arms: entry.steps.map((arm, i) => ({
+      stepId: branchArmId(arm),
+      predicate: entry.predicates[i]
+    })),
+    ...entry.exclusive === true ? {
+      exclusive: true
+    } : {},
+    ...entry.otherwise ? {
+      otherwise: branchArmId(entry.otherwise)
+    } : {}
+  };
+}
+function selectBranchArms(spec, ctx) {
+  const taken = [];
+  for (const arm of spec.arms) {
+    if (spec.exclusive && taken.length > 0) break;
+    const hit = arm.predicate ? evaluatePredicate(arm.predicate, ctx) : false;
+    if (hit) taken.push(arm.stepId);
+  }
+  if (taken.length === 0 && spec.otherwise) taken.push(spec.otherwise);
+  return taken;
+}
 function replayLedger(g, ledger) {
   const plan = compilePlan(g);
   const rows22 = new Map(ledger.steps.map((r) => [
     r.stepId,
     r
   ]));
-  const stepResults = {};
-  for (const r of ledger.steps) if (r.status === "completed") stepResults[r.stepId] = r.output;
-  const ctx = {
+  const requestContext = {
+    runId: "replay",
+    workflowId: g.definition.id,
+    orgId: "",
+    agentId: "",
+    userId: "",
+    trigger: "sdk",
+    threadId: "replay",
+    depth: 0,
+    startedAt: 0,
+    ...ledger.requestContext
+  };
+  const ctxFor = /* @__PURE__ */ __name3((id) => ({
     initData: ledger.initData,
-    stepResults,
+    stepResults: ancestorResults(plan, id, rows22),
     state: ledger.state ?? {},
-    requestContext: {
-      runId: "replay",
-      workflowId: g.definition.id,
-      orgId: "",
-      agentId: "",
-      userId: "",
-      trigger: "sdk",
-      threadId: "replay",
-      depth: 0,
-      startedAt: 0,
-      ...ledger.requestContext
-    }
-  };
+    requestContext
+  }), "ctxFor");
   const verdicts = [];
   for (const id of plan.order) {
     const node = plan.steps[id];
@@ -3345,17 +3631,7 @@ function replayLedger(g, ledger) {
     if (!recorded || recorded.status === "pending" || recorded.status === "skipped") continue;
     if (node.kind === "branch") {
       const entry = node.entry;
-      const taken = [];
-      entry.steps.forEach((arm, i) => {
-        const pred = entry.predicates[i];
-        const hit = pred ? evaluatePredicate(pred, {
-          initData: ledger.initData,
-          stepResults,
-          state: ledger.state
-        }) : false;
-        if (hit && (!entry.exclusive || taken.length === 0)) taken.push(armId2(arm));
-      });
-      if (taken.length === 0 && entry.otherwise) taken.push(armId2(entry.otherwise));
+      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id));
       const recordedTaken = recorded.taken ?? inferTaken(entry, rows22);
       verdicts.push({
         stepId: id,
@@ -3366,7 +3642,7 @@ function replayLedger(g, ledger) {
       });
     } else if (node.kind === "map" && !id.endsWith(".join") && recorded.status === "completed") {
       const entry = node.entry;
-      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id), ctx);
+      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id), ctxFor(id));
       const local = "error" in resolved ? {
         error: resolved.error,
         key: resolved.key
@@ -3381,7 +3657,7 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "foreach") {
       const entry = node.entry;
       const source = node.dependsOn[0];
-      const items = source ? stepResults[source] : void 0;
+      const items = source ? ctxFor(id).stepResults[source] : void 0;
       const local = Array.isArray(items) ? items.length : void 0;
       const recordedCount = recorded.itemCount ?? countChildren(entry, rows22);
       verdicts.push({
@@ -3398,6 +3674,71 @@ function replayLedger(g, ledger) {
     diverged: verdicts.some((v) => v.diverged)
   };
 }
+function replayResultOf(row, node) {
+  if (!row) return void 0;
+  if (row.status === "completed") return {
+    value: row.output
+  };
+  if (row.status === "failed") {
+    const onError = row.onError ?? node?.entry?.onError;
+    if (onError === "continue") return {
+      value: continuedFailureValue(row.error, row.killReason)
+    };
+  }
+  return void 0;
+}
+function ancestorResults(plan, id, rows22) {
+  const out = {};
+  const joinAliased = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  const take = /* @__PURE__ */ __name3((rowId) => {
+    const hit = replayResultOf(rows22.get(rowId), plan.steps[rowId]);
+    if (!hit) return void 0;
+    if (!joinAliased.has(rowId)) out[rowId] = hit.value;
+    const entryId = entryOfJoin(rowId);
+    if (entryId) {
+      out[entryId] = hit.value;
+      joinAliased.add(entryId);
+      const entryNode = plan.steps[entryId];
+      if (entryNode?.kind === "foreach") {
+        const body = branchArmId(entryNode.entry.step);
+        out[body] = hit.value;
+        joinAliased.add(body);
+      }
+    }
+    return hit;
+  }, "take");
+  const walk2 = /* @__PURE__ */ __name3((ids) => {
+    for (const dep of ids) {
+      if (seen.has(dep)) continue;
+      seen.add(dep);
+      take(dep);
+      const node = plan.steps[dep] ?? plan.steps[entryOfJoin(dep) ?? ""];
+      if (!node) continue;
+      if (node.kind === "foreach") {
+        const body = branchArmId(node.entry.step);
+        for (const rowId of rows22.keys()) if (rowId.startsWith(`${body}[`)) take(rowId);
+      } else if (node.kind === "loop") {
+        const body = branchArmId(node.entry.step);
+        let best = -1;
+        for (const rowId of rows22.keys()) {
+          if (!rowId.startsWith(`${body}#`)) continue;
+          const n2 = Number(rowId.slice(body.length + 1));
+          if (!Number.isInteger(n2)) continue;
+          const hit = take(rowId);
+          if (!hit) continue;
+          if (n2 > best) {
+            best = n2;
+            out[body] = hit.value;
+          }
+        }
+      }
+      walk2(node.dependsOn);
+    }
+  }, "walk");
+  walk2(plan.steps[id]?.dependsOn ?? []);
+  return out;
+}
 function inferTaken(entry, rows22) {
   const arms = [
     ...entry.steps,
@@ -3405,16 +3746,16 @@ function inferTaken(entry, rows22) {
       entry.otherwise
     ] : []
   ];
-  return arms.map(armId2).filter((id) => {
+  return arms.map(branchArmId).filter((id) => {
     const r = rows22.get(id);
     return r !== void 0 && r.status !== "skipped" && r.status !== "pending";
   });
 }
 function countChildren(entry, rows22) {
-  const body = armId2(entry.step);
-  let n = 0;
-  for (const id of rows22.keys()) if (id.startsWith(`${body}[`)) n += 1;
-  return n;
+  const body = branchArmId(entry.step);
+  let n2 = 0;
+  for (const id of rows22.keys()) if (id.startsWith(`${body}[`)) n2 += 1;
+  return n2;
 }
 function isTerminalRunStatus(status) {
   return TERMINAL.has(status);
@@ -3423,19 +3764,48 @@ function pruneUndefined(o) {
   return Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
 }
 function runNextAction(run) {
-  if (isTerminalRunStatus(run.status) || !run.cancel?.requestedAt) return "none";
+  if (isTerminalRunStatus(run.status)) return "none";
+  if (run.status === "suspended" && run.gate?.kind === "budget") return "raise_budget";
+  if (!run.cancel?.requestedAt) return "none";
   const forceAt = run.cancel.forceAfter ?? run.cancel.requestedAt + FORCE_CANCEL_STALE_MS;
   return Date.now() >= forceAt ? "force" : "cancel_again";
 }
+function emptyRunCounts() {
+  const out = {
+    total: 0,
+    inFlight: 0
+  };
+  for (const status of WORKFLOW_STEP_STATUSES) out[status] = 0;
+  return out;
+}
+function runCountsFromStatusTally(tally) {
+  const out = emptyRunCounts();
+  for (const [status, n2] of Object.entries(tally)) {
+    if (!Number.isFinite(n2) || n2 <= 0) continue;
+    out.total += n2;
+    if (WORKFLOW_STEP_STATUSES.includes(status)) out[status] += n2;
+    if (IN_FLIGHT.has(status)) out.inFlight += n2;
+  }
+  return out;
+}
+function runCountsFromStepStatuses(statuses) {
+  const tally = {};
+  for (const s of statuses) tally[s] = (tally[s] ?? 0) + 1;
+  return runCountsFromStatusTally(tally);
+}
 function runCounts(counts) {
+  const c = counts ?? {};
+  const rawInFlight = c.dispatched !== void 0 || c.claimed !== void 0 || c.running !== void 0 || c.cancellation_requested !== void 0;
   return {
-    total: counts?.total ?? 0,
-    completed: counts?.completed ?? 0,
-    failed: counts?.failed ?? 0,
-    skipped: counts?.skipped ?? 0,
-    running: counts?.inFlight ?? 0,
-    suspended: counts?.suspended ?? 0,
-    pending: (counts?.pending ?? 0) + (counts?.ready ?? 0) + (counts?.waiting ?? 0)
+    total: n(c.total),
+    completed: n(c.completed),
+    failed: n(c.failed) + n(c.timeout) + n(c.reaped),
+    skipped: n(c.skipped),
+    // LUA-664: cancelled rows never ran — their own wire bucket, never a failure (the detail's map, verbatim).
+    cancelled: n(c.cancelled),
+    running: rawInFlight ? n(c.dispatched) + n(c.claimed) + n(c.running) + n(c.cancellation_requested) : n(c.inFlight),
+    suspended: n(c.suspended),
+    pending: n(c.pending) + n(c.ready) + n(c.waiting)
   };
 }
 function runUsage(run) {
@@ -3459,7 +3829,7 @@ function runWorkspaceView(ws) {
   if (!ws) return void 0;
   const w = ws;
   return pruneUndefined({
-    kind: w.kind ?? "empty",
+    kind: w.spec?.kind ?? w.kind ?? "empty",
     backend: w.backend,
     status: String(w.status ?? ""),
     branch: w.branch,
@@ -3521,7 +3891,10 @@ function toWorkflowRunSummary(run) {
     eventSeq: run.eventSeq ?? 0,
     cancellable: !isTerminalRunStatus(status),
     nextAction: runNextAction(run),
-    workspace: runWorkspaceView(run.workspace)
+    workspace: runWorkspaceView(run.workspace),
+    // LUA-643: the runs list says a result exists; R4 `fields:'full'` (output-ACL gated, audited) serves it. The
+    // stamped flag is what a list page carries (it projects `output` out); the payload members cover R4's full row.
+    hasOutput: run.hasOutput === true || run.output !== void 0 || run.outputRef !== void 0 ? true : void 0
   });
 }
 function timeZoneSupported(tz) {
@@ -4216,8 +4589,8 @@ function armEntry(arm) {
 }
 function ofEntry(e) {
   if (!e || typeof e !== "object") return ZERO;
-  const n = e;
-  switch (n.type) {
+  const n2 = e;
+  switch (n2.type) {
     case "agent":
       return {
         steps: {
@@ -4250,17 +4623,17 @@ function ofEntry(e) {
         agentCalls: 0
       };
     case "parallel": {
-      const arms = Array.isArray(n.steps) ? n.steps : [];
+      const arms = Array.isArray(n2.steps) ? n2.steps : [];
       return arms.map(armEntry).map(ofEntry).reduce(add, ZERO);
     }
     case "conditional": {
-      const arms = (Array.isArray(n.steps) ? n.steps : []).map(armEntry).map(ofEntry);
+      const arms = (Array.isArray(n2.steps) ? n2.steps : []).map(armEntry).map(ofEntry);
       if (arms.length === 0) return ZERO;
-      const hasOtherwise = n.otherwise !== void 0;
+      const hasOtherwise = n2.otherwise !== void 0;
       const minArm = arms.reduce((a, b) => b.credits.min < a.credits.min ? b : a);
       const maxArm = arms.reduce((a, b) => b.credits.max > a.credits.max ? b : a);
       const summed = arms.reduce(add, ZERO);
-      const max = n.exclusive === true ? maxArm : summed;
+      const max = n2.exclusive === true ? maxArm : summed;
       const min = hasOtherwise ? minArm : {
         ...ZERO
       };
@@ -4277,17 +4650,14 @@ function ofEntry(e) {
       };
     }
     case "foreach": {
-      const body = ofEntry(armEntry(n.step));
-      const opts = n.options ?? {};
-      const cap = typeof opts.maxItems === "number" && opts.maxItems > 0 ? opts.maxItems : 1;
+      const body = ofEntry(armEntry(n2.step));
+      const opts = n2.opts ?? {};
+      const cap = typeof opts.maxItems === "number" && opts.maxItems > 0 ? opts.maxItems : WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS;
       return scale(body, 0, cap);
     }
-    case "loop":
-    case "dowhile":
-    case "dountil": {
-      const body = ofEntry(armEntry(n.step));
-      const opts = n.options ?? {};
-      const cap = typeof opts.maxIterations === "number" && opts.maxIterations > 0 ? opts.maxIterations : 1;
+    case "loop": {
+      const body = ofEntry(armEntry(n2.step));
+      const cap = typeof n2.maxIterations === "number" && n2.maxIterations > 0 ? n2.maxIterations : WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS;
       return scale(body, 1, cap);
     }
     default:
@@ -4318,14 +4688,84 @@ function estimateGraph(envelopeOrGraph) {
     consentCredits: r.credits.max
   };
 }
-var __defProp3, __name3, WORKFLOW_ARM_SUBRUN_ID, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, GRAPH_HASH_PREFIX, WorkflowPlanError, SINGLE_STEP_KINDS, isSingleStep, singleStepId, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, nodeIdOf, armId2, canonical, sortKeys, FORCE_CANCEL_STALE_MS, TERMINAL, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, BINDING_ROOTS, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO;
+function* singleStepsOf(entry) {
+  if (!isRecord2(entry)) return;
+  switch (entry.type) {
+    case "step":
+    case "agent":
+    case "tool":
+      yield entry;
+      return;
+    case "workflow":
+      yield entry;
+      if (Array.isArray(entry.graph)) yield* singleStepsOf(entry.graph[1]);
+      return;
+    case "parallel":
+    case "conditional":
+      if (Array.isArray(entry.steps)) for (const arm of entry.steps) yield* singleStepsOf(arm);
+      yield* singleStepsOf(entry.otherwise);
+      return;
+    case "foreach":
+    case "loop":
+      yield* singleStepsOf(entry.step);
+      return;
+    default:
+      return;
+  }
+}
+function entriesOf(graph) {
+  const definition = isRecord2(graph) ? graph.definition : void 0;
+  const entries = isRecord2(definition) ? definition.graph : void 0;
+  return Array.isArray(entries) ? entries : [];
+}
+function inheritTargets(graphs) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const graph of graphs) {
+    for (const entry of entriesOf(graph)) {
+      for (const node of singleStepsOf(entry)) {
+        if (node.type === "workflow" && node.workspace === "inherit" && typeof node.workflowId === "string" && node.workflowId.length > 0) {
+          targets.add(node.workflowId);
+        }
+      }
+    }
+  }
+  return targets;
+}
+function needsInheritedWorkspace(graph) {
+  if (!isRecord2(graph) || graph.workspace !== void 0) return false;
+  for (const entry of entriesOf(graph)) {
+    for (const node of singleStepsOf(entry)) {
+      if (node.workspace !== void 0 && node.workspace !== "inherit") return true;
+    }
+  }
+  return false;
+}
+var __defProp3, __name3, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RESOURCES, SideEffectsSchema, JobResourcesSchema, WORKFLOW_ARM_SUBRUN_ID, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, SINGLE_STEP_KINDS, isSingleStep, singleStepId, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, nodeIdOf, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, IN_FLIGHT, n, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, BINDING_ROOTS, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
     init_dist();
+    init_dist();
     __defProp3 = Object.defineProperty;
     __name3 = /* @__PURE__ */ __name((target, value22) => __defProp3(target, "name", { value: value22, configurable: true }), "__name");
+    WORKFLOW_SIDE_EFFECTS = [
+      "none",
+      "external"
+    ];
+    WORKFLOW_JOB_RESOURCES = [
+      "small",
+      "medium",
+      "large"
+    ];
+    SideEffectsSchema = z4.enum(WORKFLOW_SIDE_EFFECTS);
+    JobResourcesSchema = z4.enum(WORKFLOW_JOB_RESOURCES);
     WORKFLOW_ARM_SUBRUN_ID = "$arm";
+    SLEEP_UNTIL_REPLACEMENT = Object.freeze({
+      type: "sleep",
+      duration: 6e4
+    });
+    __name(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
+    __name3(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
     WORKFLOW_CAPS_DEFAULT = Object.freeze({
       maxParallelArms: 16,
       maxForeachConcurrency: 16,
@@ -4361,6 +4801,11 @@ var init_dist2 = __esm({
     __name3(fillEntry, "fillEntry");
     __name(withDefaultsFilled, "withDefaultsFilled");
     __name3(withDefaultsFilled, "withDefaultsFilled");
+    CONNECTION_ID_HEX_RE = /^[0-9a-f]{24}$/;
+    __name(isConnectionKeyShaped, "isConnectionKeyShaped");
+    __name3(isConnectionKeyShaped, "isConnectionKeyShaped");
+    __name(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
+    __name3(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
     WORKFLOW_JOB_TOOLS = [
       "shell",
       "read",
@@ -4424,6 +4869,11 @@ var init_dist2 = __esm({
     ]);
     __name(isPredicate, "isPredicate");
     __name3(isPredicate, "isPredicate");
+    isPredicateScalar = /* @__PURE__ */ __name3((v) => v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean", "isPredicateScalar");
+    __name(isPathOrLiteral, "isPathOrLiteral");
+    __name3(isPathOrLiteral, "isPathOrLiteral");
+    __name(isWellFormedPredicate, "isWellFormedPredicate");
+    __name3(isWellFormedPredicate, "isWellFormedPredicate");
     GRAPH_HASH_PREFIX = "sha256-cj1:";
     __name(canonicalJson, "canonicalJson");
     __name3(canonicalJson, "canonicalJson");
@@ -4612,16 +5062,71 @@ var init_dist2 = __esm({
     fromKnowledge = /* @__PURE__ */ __name3((k) => ({
       knowledge: k
     }), "fromKnowledge");
+    CONTINUED_FAILURE_TAG = "continued_failure";
+    CONTINUED_FAILURE_DEFAULT_CODE = "step_failed";
+    CONTINUED_FAILURE_OUTPUT_SCHEMA = Object.freeze({
+      type: "object",
+      properties: {
+        __lua_workflow: {
+          type: "string",
+          const: CONTINUED_FAILURE_TAG
+        },
+        failed: {
+          type: "boolean",
+          const: true
+        },
+        error: {
+          type: "object",
+          properties: {
+            code: {
+              type: "string"
+            },
+            message: {
+              type: "string"
+            }
+          },
+          required: [
+            "code",
+            "message"
+          ]
+        },
+        text: {
+          type: "string",
+          const: ""
+        }
+      },
+      required: [
+        "__lua_workflow",
+        "failed",
+        "error",
+        "text"
+      ]
+    });
+    CONTINUED_FAILURE_LEAF_PATHS = Object.freeze([
+      "failed",
+      "error",
+      "error.code",
+      "error.message",
+      "text"
+    ]);
+    __name(continuedFailureValue, "continuedFailureValue");
+    __name3(continuedFailureValue, "continuedFailureValue");
+    __name(isContinuedFailureValue, "isContinuedFailureValue");
+    __name3(isContinuedFailureValue, "isContinuedFailureValue");
     __name(lowerContainerArm, "lowerContainerArm");
     __name3(lowerContainerArm, "lowerContainerArm");
-    nodeIdOf = /* @__PURE__ */ __name3((n) => n.type === "step" ? n.step.id : n.id, "nodeIdOf");
+    nodeIdOf = /* @__PURE__ */ __name3((n2) => n2.type === "step" ? n2.step.id : n2.id, "nodeIdOf");
     __name(entryIds, "entryIds");
     __name3(entryIds, "entryIds");
     __name(resolvePlacements, "resolvePlacements");
     __name3(resolvePlacements, "resolvePlacements");
     __name(seedLedgerFromRun, "seedLedgerFromRun");
     __name3(seedLedgerFromRun, "seedLedgerFromRun");
-    armId2 = /* @__PURE__ */ __name3((arm) => arm.type === "step" ? arm.step.id : arm.id, "armId");
+    branchArmId = /* @__PURE__ */ __name3((arm) => arm.type === "step" ? arm.step.id : arm.id, "branchArmId");
+    __name(branchSpecFromConditional, "branchSpecFromConditional");
+    __name3(branchSpecFromConditional, "branchSpecFromConditional");
+    __name(selectBranchArms, "selectBranchArms");
+    __name3(selectBranchArms, "selectBranchArms");
     canonical = /* @__PURE__ */ __name3((v) => JSON.stringify(sortKeys(v)), "canonical");
     sortKeys = /* @__PURE__ */ __name3((v) => {
       if (Array.isArray(v)) return v.map(sortKeys);
@@ -4635,6 +5140,12 @@ var init_dist2 = __esm({
     }, "sortKeys");
     __name(replayLedger, "replayLedger");
     __name3(replayLedger, "replayLedger");
+    JOIN = ".join";
+    entryOfJoin = /* @__PURE__ */ __name3((id) => id.endsWith(JOIN) ? id.slice(0, -JOIN.length) : void 0, "entryOfJoin");
+    __name(replayResultOf, "replayResultOf");
+    __name3(replayResultOf, "replayResultOf");
+    __name(ancestorResults, "ancestorResults");
+    __name3(ancestorResults, "ancestorResults");
     __name(inferTaken, "inferTaken");
     __name3(inferTaken, "inferTaken");
     __name(countChildren, "countChildren");
@@ -4647,6 +5158,14 @@ var init_dist2 = __esm({
     __name3(pruneUndefined, "pruneUndefined");
     __name(runNextAction, "runNextAction");
     __name3(runNextAction, "runNextAction");
+    IN_FLIGHT = new Set(WORKFLOW_STEP_IN_FLIGHT);
+    __name(emptyRunCounts, "emptyRunCounts");
+    __name3(emptyRunCounts, "emptyRunCounts");
+    __name(runCountsFromStatusTally, "runCountsFromStatusTally");
+    __name3(runCountsFromStatusTally, "runCountsFromStatusTally");
+    __name(runCountsFromStepStatuses, "runCountsFromStepStatuses");
+    __name3(runCountsFromStepStatuses, "runCountsFromStepStatuses");
+    n = /* @__PURE__ */ __name3((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
     __name(runCounts, "runCounts");
     __name3(runCounts, "runCounts");
     __name(runUsage, "runUsage");
@@ -4750,54 +5269,54 @@ var init_dist2 = __esm({
     __name3(rebaseItemPointer, "rebaseItemPointer");
     APPROVER_SPEC_MAX_USERS = 20;
     ESCALATION_MAX_HOPS = 3;
-    TemplateBindingSchema = z4.object({
-      template: z4.string().min(1).max(2048)
+    TemplateBindingSchema = z22.object({
+      template: z22.string().min(1).max(2048)
     }).strict();
-    ApproverSpecSchema = z4.union([
-      z4.literal("creator"),
-      z4.literal("org-admins"),
-      z4.object({
-        users: z4.union([
-          z4.array(z4.string().min(1).max(128)).min(1).max(APPROVER_SPEC_MAX_USERS),
+    ApproverSpecSchema = z22.union([
+      z22.literal("creator"),
+      z22.literal("org-admins"),
+      z22.object({
+        users: z22.union([
+          z22.array(z22.string().min(1).max(128)).min(1).max(APPROVER_SPEC_MAX_USERS),
           TemplateBindingSchema
         ])
       }).strict(),
-      z4.object({
-        role: z4.union([
-          z4.string().min(1).max(128),
+      z22.object({
+        role: z22.union([
+          z22.string().min(1).max(128),
           TemplateBindingSchema
         ])
       }).strict(),
-      z4.object({
-        group: z4.union([
-          z4.string().min(1).max(128),
+      z22.object({
+        group: z22.union([
+          z22.string().min(1).max(128),
           TemplateBindingSchema
         ])
       }).strict(),
-      z4.object({
-        governance: z4.object({
-          policyId: z4.string().min(1).max(128)
+      z22.object({
+        governance: z22.object({
+          policyId: z22.string().min(1).max(128)
         }).strict()
       }).strict()
     ]);
-    FourEyesSchema = z4.object({
+    FourEyesSchema = z22.object({
       edit: ApproverSpecSchema,
       approve: ApproverSpecSchema
     }).strict();
-    EscalationHopSchema = z4.object({
+    EscalationHopSchema = z22.object({
       escalateTo: ApproverSpecSchema,
-      timeoutHours: z4.number().finite().min(1).max(720)
+      timeoutHours: z22.number().finite().min(1).max(720)
     }).strict();
-    TerminalOutcomeSchema = z4.enum([
+    TerminalOutcomeSchema = z22.enum([
       "deny",
       "cancel-run",
       "fail",
       "continue"
     ]);
-    ApprovalOnTimeoutSchema = z4.union([
+    ApprovalOnTimeoutSchema = z22.union([
       TerminalOutcomeSchema,
       EscalationHopSchema,
-      z4.array(z4.union([
+      z22.array(z22.union([
         TerminalOutcomeSchema,
         EscalationHopSchema
       ])).min(1).max(ESCALATION_MAX_HOPS + 1)
@@ -4850,6 +5369,15 @@ var init_dist2 = __esm({
     __name3(ofEntry, "ofEntry");
     __name(estimateGraph, "estimateGraph");
     __name3(estimateGraph, "estimateGraph");
+    isRecord2 = /* @__PURE__ */ __name3((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
+    __name(singleStepsOf, "singleStepsOf");
+    __name3(singleStepsOf, "singleStepsOf");
+    __name(entriesOf, "entriesOf");
+    __name3(entriesOf, "entriesOf");
+    __name(inheritTargets, "inheritTargets");
+    __name3(inheritTargets, "inheritTargets");
+    __name(needsInheritedWorkspace, "needsInheritedWorkspace");
+    __name3(needsInheritedWorkspace, "needsInheritedWorkspace");
   }
 });
 
@@ -4908,16 +5436,16 @@ function stepNodeOf(s) {
   });
 }
 function materializeEntry(entry, steps) {
-  const single = /* @__PURE__ */ __name((n) => {
-    if (n.type === "step" && steps[n.step.id]) return stepNodeOf(steps[n.step.id]);
-    if (n.type === "workflow" && n.workflowId === WORKFLOW_ARM_SUBRUN_ID && n.graph) return {
-      ...n,
+  const single = /* @__PURE__ */ __name((n2) => {
+    if (n2.type === "step" && steps[n2.step.id]) return stepNodeOf(steps[n2.step.id]);
+    if (n2.type === "workflow" && n2.workflowId === WORKFLOW_ARM_SUBRUN_ID && n2.graph) return {
+      ...n2,
       graph: [
-        n.graph[0],
-        single(n.graph[1])
+        n2.graph[0],
+        single(n2.graph[1])
       ]
     };
-    return n;
+    return n2;
   }, "single");
   switch (entry.type) {
     case "step":
@@ -4962,8 +5490,8 @@ function createWorkflow(cfg) {
     if (v.roles.length > 20 || (v.users?.length ?? 0) > 50) throw new LuaWorkflowBuildError("cap-exceeded", "outputVisibility allows \u2264 20 roles and \u2264 50 users");
   }
   if (cfg.backfillOnEnable?.maxOccurrences !== void 0) {
-    const n = cfg.backfillOnEnable.maxOccurrences;
-    if (!Number.isInteger(n) || n < 1 || n > 200) throw new LuaWorkflowBuildError("invalid-envelope", "backfillOnEnable.maxOccurrences must be an integer in 1..200 (backfill-max-occurrences-out-of-range; the org maxBatchItems twin is checked at publish/R56)");
+    const n2 = cfg.backfillOnEnable.maxOccurrences;
+    if (!Number.isInteger(n2) || n2 < 1 || n2 > 200) throw new LuaWorkflowBuildError("invalid-envelope", "backfillOnEnable.maxOccurrences must be an integer in 1..200 (backfill-max-occurrences-out-of-range; the org maxBatchItems twin is checked at publish/R56)");
   }
   const keys = /* @__PURE__ */ new Set();
   envRefKeys(cfg.schedule, keys);
@@ -5154,7 +5682,7 @@ var init_workflow = __esm({
       getEnvTemplateKeys() {
         return this.built.envTemplateKeys;
       }
-      /** `.workflow(id, ref)` targets by name — `ManifestWorkflow.workflowRefs`. */
+      /** `.workflow(id, ref)` targets by name — `ManifestWorkflow.workflowRefs`; `workspace:'inherit'` marks the inherit children the compiler defers `workspace-not-declared` for. */
       getNestedWorkflowRefs() {
         return this.built.nestedRefs;
       }
@@ -5184,6 +5712,7 @@ var init_workflow = __esm({
         };
         if (cfg.concurrencyPolicy !== void 0) envelope.concurrencyPolicy = cfg.concurrencyPolicy;
         if (cfg.workspace !== void 0) envelope.workspace = cfg.workspace;
+        if (cfg.connections !== void 0) envelope.connections = cfg.connections;
         return withDefaultsFilled(envelope);
       }
     };
@@ -5219,7 +5748,6 @@ var init_workflow = __esm({
         if (this.steps[s.id] && this.steps[s.id] !== s) throw new LuaWorkflowBuildError("duplicate-step-id", `step id "${s.id}" is declared twice`);
         const tier = s.tier ?? (s.workspace ? "job" : void 0);
         if (s.workspace && s.tier !== void 0 && s.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${s.id}": a step mounting a workspace must be tier:'job'`);
-        if (s.workspace && !this.config.workspace) throw new LuaWorkflowBuildError("workspace-not-declared", `"${s.id}" mounts a workspace but createWorkflow declares none`);
         if (s.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${s.id}": jobTools require tier:'job' (job-tools-require-job-tier)`);
         assertTimeout({
           id: s.id,
@@ -5460,13 +5988,20 @@ var init_workflow = __esm({
         }
         const tier = opts.tier ?? (opts.workspace ? "job" : void 0);
         if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id}": a step mounting a workspace must be tier:'job'`);
-        if (opts.workspace && !this.config.workspace) throw new LuaWorkflowBuildError("workspace-not-declared", `"${id}" mounts a workspace but createWorkflow declares none`);
         if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id}": harness is only legal on a tier:'job' agent step`);
         if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
         if (opts.maxTurns !== void 0) {
           if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": maxTurns is only legal on a tier:'job' agent step`);
           if (!Number.isInteger(opts.maxTurns) || opts.maxTurns < 1 || opts.maxTurns > 500) throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": maxTurns must be an integer 1..500`);
         }
+        if (opts.maxMessages !== void 0) {
+          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": maxMessages is only legal on a tier:'job' agent step`);
+          if (!Number.isInteger(opts.maxMessages) || opts.maxMessages < 1 || opts.maxMessages > 5e3) throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": maxMessages must be an integer 1..5000`);
+        }
+        if (opts.maxInputTokens !== void 0) {
+          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": maxInputTokens is only legal on a tier:'job' agent step`);
+          if (!Number.isInteger(opts.maxInputTokens) || opts.maxInputTokens < 1e6 || opts.maxInputTokens > 5e8) throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": maxInputTokens must be an integer 1000000..500000000`);
+        }
         assertTimeout({
           id,
           timeoutSeconds: opts.timeoutSeconds,
@@ -5493,7 +6028,9 @@ var init_workflow = __esm({
           workspace: opts.workspace,
           jobResources: opts.jobResources,
           harness: opts.harness,
-          maxTurns: opts.maxTurns
+          maxTurns: opts.maxTurns,
+          maxMessages: opts.maxMessages,
+          maxInputTokens: opts.maxInputTokens
         });
         return this.push({
           kind: "declare",
@@ -5648,7 +6185,11 @@ var init_workflow = __esm({
         }
         assertNoClosure(input, `workflow("${id}").input`);
         this.recordEnvRefs(input);
-        this.nestedRefs.push({
+        this.nestedRefs.push(opts?.workspace === "inherit" ? {
+          id,
+          name,
+          workspace: "inherit"
+        } : {
           id,
           name
         });
@@ -5660,8 +6201,8 @@ var init_workflow = __esm({
           workspace: opts?.workspace
         });
         return this.push({
-          kind: "entry",
-          entry: node
+          kind: "declare",
+          node
         });
       }
       commit() {
@@ -5671,7 +6212,7 @@ var init_workflow = __esm({
         const { graph, issues } = resolvePlacements(this.calls);
         const fatal = issues[0];
         if (fatal) {
-          const hint = fatal.code === "unknown-step-ref" ? "a string StepRef must name an entry declared by agentStep/specialistStep/toolStep/map(\u2026, { id }) somewhere in the chain \u2014 before OR after the reference" : void 0;
+          const hint = fatal.code === "unknown-step-ref" ? "a string StepRef must name an entry declared by agentStep/specialistStep/toolStep/map(\u2026, { id })/workflow(\u2026) somewhere in the chain \u2014 before OR after the reference" : void 0;
           throw new LuaWorkflowBuildError(fatal.code, fatal.message, hint);
         }
         if (graph.length === 0) throw new LuaWorkflowBuildError("empty-graph", `workflow "${this.config.name}" has no entries`);
@@ -5684,7 +6225,8 @@ var init_workflow = __esm({
         if (graphHasHitl(graph, this.steps) && this.config.budget?.maxDurationSeconds === void 0) {
           this.warnings.push({
             code: "hitl-duration-defaulted",
-            message: `budget.maxDurationSeconds defaulted to ${WORKFLOW_HITL_MAX_DURATION_SECONDS} s (30 d) because the graph contains an approval / waitForSignal / suspend-capable step \u2014 set it explicitly to silence`
+            // LUA-668: names the workflow — two HITL workflows in one project printed two identical lines that read as a duplicate.
+            message: `workflow "${this.config.name}": budget.maxDurationSeconds defaulted to ${WORKFLOW_HITL_MAX_DURATION_SECONDS} s (30 d) because the graph contains an approval / waitForSignal / suspend-capable step \u2014 set it explicitly to silence`
           });
         }
         this.checkScheduleInput();
@@ -11215,7 +11757,7 @@ function createWorkflowsRuntime(getApi) {
     }
   };
 }
-var WORKFLOW_START_MAX_WAIT_SECONDS, WORKFLOW_START_CLIENT_DEADLINE_SLACK_MS, WorkflowApiError, unwrap, assertBoundAgent, unavailable, WorkflowApi;
+var WORKFLOW_START_MAX_WAIT_SECONDS, WORKFLOW_START_CLIENT_DEADLINE_SLACK_MS, WorkflowApiError, unwrap, assertBoundAgent, pathId, unavailable, WorkflowApi;
 var init_workflow_api_service = __esm({
   "src/api/workflow.api.service.ts"() {
     "use strict";
@@ -11252,6 +11794,7 @@ var init_workflow_api_service = __esm({
         throw new WorkflowApiError("FORBIDDEN", `Workflows.${member}: goals are scoped to the bound agent ${api.agentId}`, 403);
       }
     }, "assertBoundAgent");
+    pathId = /* @__PURE__ */ __name((id) => encodeURIComponent(id), "pathId");
     unavailable = /* @__PURE__ */ __name((member, route) => async () => {
       throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route} lands with a later wave)`, 501);
     }, "unavailable");
@@ -11377,7 +11920,7 @@ var init_workflow_api_service = __esm({
       /** R5 — one step of a run (`?attempt=n` selects from the attempt history). */
       async getRunStep(runId, stepId, options = {}) {
         const qs = options.attempt !== void 0 ? `?attempt=${options.attempt}` : "";
-        return this.httpGet(`${this.runs}/${runId}/steps/${stepId}${qs}`, await this.auth());
+        return this.httpGet(`${this.runs}/${runId}/steps/${pathId(stepId)}${qs}`, await this.auth());
       }
       /** R6 — script-form journal page (404 `NOT_SCRIPT_RUN` for graph runs — IF-16). */
       async getRunJournal(runId, options = {}) {
@@ -11397,7 +11940,7 @@ var init_workflow_api_service = __esm({
       }
       /** R12 — resume a suspended step; the loser of a race gets `{ resumed:false, reason:'already_resumed' }`, never a 4xx. */
       async resumeRun(runId, stepId, data) {
-        return this.httpPost(`${this.runs}/${runId}/steps/${stepId}/resume`, data, await this.auth());
+        return this.httpPost(`${this.runs}/${runId}/steps/${pathId(stepId)}/resume`, data, await this.auth());
       }
       /**
       * R36 — re-arm a parked step: a failed row past its retries, a gate-2 park, or a billing hold (the only exit
@@ -11405,15 +11948,15 @@ var init_workflow_api_service = __esm({
       * STEP_NOT_PARKED.
       */
       async retryStep(runId, stepId, data = {}) {
-        return this.httpPost(`${this.runs}/${runId}/steps/${stepId}/retry`, data, await this.auth());
+        return this.httpPost(`${this.runs}/${runId}/steps/${pathId(stepId)}/retry`, data, await this.auth());
       }
       /** R13 — resolve an approval (human; `expectedFingerprint` guards against an edited payload — 409 `PAYLOAD_MISMATCH`). */
       async resolveApproval(runId, approvalId, data) {
-        return this.httpPost(`${this.runs}/${runId}/approvals/${approvalId}/resolve`, data, await this.auth());
+        return this.httpPost(`${this.runs}/${runId}/approvals/${pathId(approvalId)}/resolve`, data, await this.auth());
       }
       /** R14 — deliver a named signal (`dedupeKey` ⇒ 200 `duplicate:true` on replay). */
       async signalRun(runId, name, data = {}) {
-        return this.httpPost(`${this.runs}/${runId}/signals/${encodeURIComponent(name)}`, data, await this.auth());
+        return this.httpPost(`${this.runs}/${runId}/signals/${pathId(name)}`, data, await this.auth());
       }
       /** R31 — `DELETE …/runs/:runId` (`eraseRun`; human principal) → 202 `{ accepted, purgeId }`; 409 `RUN_NOT_TERMINAL { nextAction:'cancel' }`. */
       /** R50 — request an evidence-bundle export (202 `{exportId, status:'pending'}`; 409 `RUN_NOT_TERMINAL` / `EXPORT_IN_PROGRESS`). */
@@ -11470,6 +12013,23 @@ var init_workflow_api_service = __esm({
       async closeGoal(goalId, data = {}) {
         return this.httpPost(`${this.goals}/${encodeURIComponent(goalId)}/close`, data, await this.auth());
       }
+      // ─── Schedules (R4-MF-2 list/get + R28 delete — `/workflows/:agentId/schedules`; LUA-627 stanza) ───
+      /** Schedule tree (09 §9.5 — the write-only R27/R56/R28 family plus the R4-MF-2 read rows). */
+      get schedules() {
+        return `/workflows/${this.agentId}/schedules`;
+      }
+      /** R4-MF-2 — every `Job{kind:'workflow'}` of the agent with the PRO-726 strike fields (`goalId` marks a goal's cadence). */
+      async listSchedules() {
+        return this.httpGet(this.schedules, await this.auth());
+      }
+      /** R4-MF-2 — one schedule row; unknown, cross-agent and non-workflow-kind jobs all 404 `SCHEDULE_NOT_FOUND`. */
+      async getSchedule(jobId) {
+        return this.httpGet(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
+      }
+      /** R28 — delete a schedule Job (404 `SCHEDULE_NOT_FOUND`). The CLI refuses a goal-owned job BEFORE this call (`goal_schedule`). */
+      async deleteSchedule(jobId) {
+        return this.httpDelete(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
+      }
       // ─── Events (R7 — SSE `watch`, WF-204) ───
       /**
       * R7 SSE — `GET …/runs/:runId/events` as a frame stream (`id:<seq>` / `event:<type>` /
@@ -11513,7 +12073,7 @@ var init_workflow_api_service = __esm({
         if (options.attempt !== void 0) query.append("attempt", String(options.attempt));
         if (options.tail !== void 0) query.append("tail", String(options.tail));
         const qs = query.toString();
-        return this.httpGet(`${this.runs}/${runId}/steps/${stepId}/job${qs ? `?${qs}` : ""}`, await this.auth());
+        return this.httpGet(`${this.runs}/${runId}/steps/${pathId(stepId)}/job${qs ? `?${qs}` : ""}`, await this.auth());
       }
     };
   }