lua-cli 3.32.2 → 3.32.3

package/dist/api-exports.js

@@ -653,6 +653,48 @@ function scheduledTimeKey(scheduledTime) {
 function scheduledWorkflowRunIdForTime(jobId, scheduledTime) {
   return scheduledWorkflowRunId(jobId, scheduledTime);
 }
+function workflowRetryMaxAttemptsMessage(got) {
+  const tail = got === void 0 ? "" : ` (got ${JSON.stringify(got)})`;
+  return `\`retry.maxAttempts\` must be an integer ${WORKFLOW_RETRY_MIN_ATTEMPTS}..${WORKFLOW_RETRY_MAX_ATTEMPTS}${tail}`;
+}
+function isWithinWorkflowRetryAttempts(value3) {
+  return typeof value3 === "number" && Number.isInteger(value3) && value3 >= WORKFLOW_RETRY_MIN_ATTEMPTS && value3 <= WORKFLOW_RETRY_MAX_ATTEMPTS;
+}
+function workflowRetryUnknownMembersMessage(keys) {
+  const named = keys.map((k) => {
+    const engine = WORKFLOW_RETRY_ENGINE_KEYS.includes(k);
+    return `\`${k}\`${engine ? " (engine-owned \u2014 stamped by resetAttempts, never authored)" : ""}`;
+  });
+  return `\`retry\` has no member ${named.join(", ")}; members: ${WORKFLOW_RETRY_POLICY_KEYS.join(", ")}`;
+}
+function unknownWorkflowRetryMembers(retry) {
+  if (!retry || typeof retry !== "object" || Array.isArray(retry)) return [];
+  return Object.keys(retry).filter((k) => !WORKFLOW_RETRY_POLICY_KEYS.includes(k));
+}
+function authoredRetryPolicy(retry) {
+  if (!retry || typeof retry !== "object" || Array.isArray(retry)) return void 0;
+  const src = retry;
+  const out = {};
+  for (const k of WORKFLOW_RETRY_POLICY_KEYS) if (src[k] !== void 0) out[k] = src[k];
+  return Object.keys(out).length ? out : void 0;
+}
+function retryBudgetBaseAttempt(row) {
+  const base = row.retry?.budgetBaseAttempt;
+  return typeof base === "number" && Number.isSafeInteger(base) && base > 0 ? base : 0;
+}
+function retryBudgetAttempt(row) {
+  return Math.max(0, row.attempt - retryBudgetBaseAttempt(row));
+}
+function retryBudgetMaxAttempts(row) {
+  const max = row.retry?.maxAttempts;
+  return typeof max === "number" && Number.isFinite(max) && max >= 1 ? max : 1;
+}
+function retryBudgetRemaining(row) {
+  return retryBudgetAttempt(row) < retryBudgetMaxAttempts(row);
+}
+function retriesRemaining(row) {
+  return Math.max(0, retryBudgetMaxAttempts(row) - retryBudgetAttempt(row));
+}
 function isWithinWorkflowJobRange(member, value3) {
   const { min, max } = WORKFLOW_JOB_RANGES[member];
   return typeof value3 === "number" && Number.isInteger(value3) && value3 >= min && value3 <= max;
@@ -840,7 +882,66 @@ ${PREAMBLE}
 
 ${items.join("\n\n")}`;
 }
-var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE;
+function workflowApprovalDecisionOf(resumeData) {
+  if (resumeData.timedOut === true) return "timed_out";
+  return resumeData.approved === true ? "approved" : "denied";
+}
+function workflowApprovalOutput(resumeData) {
+  const decision = typeof resumeData.decision === "string" ? resumeData.decision : workflowApprovalDecisionOf(resumeData);
+  const note = typeof resumeData.note === "string" && resumeData.note.trim() !== "" ? resumeData.note : void 0;
+  const text = typeof resumeData.text === "string" ? resumeData.text : note ?? decision;
+  return {
+    ...resumeData,
+    decision,
+    text
+  };
+}
+function isWorkflowApprovalOutput(value3) {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) return false;
+  const v = value3;
+  return typeof v.approved === "boolean" && WORKFLOW_APPROVAL_OUTPUT_DECISIONS.includes(v.decision) && typeof v.text === "string";
+}
+function extractSingleJsonValue(text) {
+  const trimmed = (text ?? "").trim();
+  if (!trimmed) return {
+    reason: "reply is empty"
+  };
+  const fenced = [
+    ...trimmed.matchAll(JSON_FENCE_RE)
+  ];
+  if (fenced.length > 1) return {
+    reason: "reply carries more than one fenced block"
+  };
+  const candidate = fenced.length === 1 ? fenced[0][1].trim() : trimmed;
+  try {
+    return {
+      value: JSON.parse(candidate)
+    };
+  } catch {
+    if (fenced.length === 1) return {
+      reason: "fenced block is not valid JSON"
+    };
+  }
+  const opens = [
+    trimmed.indexOf("{"),
+    trimmed.indexOf("[")
+  ].filter((i) => i !== -1);
+  const start = opens.length ? Math.min(...opens) : -1;
+  const end = Math.max(trimmed.lastIndexOf("}"), trimmed.lastIndexOf("]"));
+  if (start === -1 || end <= start) return {
+    reason: "reply is not JSON"
+  };
+  try {
+    return {
+      value: JSON.parse(trimmed.slice(start, end + 1))
+    };
+  } catch {
+    return {
+      reason: "reply does not contain a single JSON value"
+    };
+  }
+}
+var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1928,6 +2029,37 @@ This text is who you are for this person. As you learn them, their name, their w
       "fixed",
       "exponential"
     ];
+    WORKFLOW_RETRY_MIN_ATTEMPTS = 1;
+    WORKFLOW_RETRY_POLICY_KEYS = [
+      "maxAttempts",
+      "backoffSeconds",
+      "backoff",
+      "maxBackoffSeconds"
+    ];
+    WORKFLOW_RETRY_MAX_ATTEMPTS = 20;
+    __name(workflowRetryMaxAttemptsMessage, "workflowRetryMaxAttemptsMessage");
+    __name2(workflowRetryMaxAttemptsMessage, "workflowRetryMaxAttemptsMessage");
+    __name(isWithinWorkflowRetryAttempts, "isWithinWorkflowRetryAttempts");
+    __name2(isWithinWorkflowRetryAttempts, "isWithinWorkflowRetryAttempts");
+    WORKFLOW_RETRY_ENGINE_KEYS = [
+      "budgetBaseAttempt"
+    ];
+    __name(workflowRetryUnknownMembersMessage, "workflowRetryUnknownMembersMessage");
+    __name2(workflowRetryUnknownMembersMessage, "workflowRetryUnknownMembersMessage");
+    __name(unknownWorkflowRetryMembers, "unknownWorkflowRetryMembers");
+    __name2(unknownWorkflowRetryMembers, "unknownWorkflowRetryMembers");
+    __name(authoredRetryPolicy, "authoredRetryPolicy");
+    __name2(authoredRetryPolicy, "authoredRetryPolicy");
+    __name(retryBudgetBaseAttempt, "retryBudgetBaseAttempt");
+    __name2(retryBudgetBaseAttempt, "retryBudgetBaseAttempt");
+    __name(retryBudgetAttempt, "retryBudgetAttempt");
+    __name2(retryBudgetAttempt, "retryBudgetAttempt");
+    __name(retryBudgetMaxAttempts, "retryBudgetMaxAttempts");
+    __name2(retryBudgetMaxAttempts, "retryBudgetMaxAttempts");
+    __name(retryBudgetRemaining, "retryBudgetRemaining");
+    __name2(retryBudgetRemaining, "retryBudgetRemaining");
+    __name(retriesRemaining, "retriesRemaining");
+    __name2(retriesRemaining, "retriesRemaining");
     WORKFLOW_JOB_RESOURCES = [
       "small",
       "medium",
@@ -2200,6 +2332,8 @@ This text is who you are for this person. As you learn them, their name, their w
       "workflow.goal.resumed",
       "workflow.goal.done",
       "workflow.goal.closed",
+      // LUA-760: an ended goal's cadence Job retired (deleted) — inline on done / closed, by R21 / R28, or by sweep #30
+      "workflow.goal.job_retired",
       // --- org policy (02 §2.10 / 09 R23) ---
       "workflow.policy.retention_changed",
       "workflow.policy.pacing_changed",
@@ -2249,6 +2383,79 @@ listed here; never invent a target.`;
     __name2(reachingIt, "reachingIt");
     __name(renderTargetsBlock, "renderTargetsBlock");
     __name2(renderTargetsBlock, "renderTargetsBlock");
+    WORKFLOW_APPROVAL_OUTPUT_DECISIONS = [
+      "approved",
+      "denied",
+      "timed_out"
+    ];
+    WORKFLOW_APPROVAL_OUTPUT_SCHEMA = {
+      type: "object",
+      properties: {
+        approved: {
+          type: "boolean"
+        },
+        decision: {
+          type: "string",
+          enum: [
+            ...WORKFLOW_APPROVAL_OUTPUT_DECISIONS
+          ]
+        },
+        /** the approver's note when given, else the decision word — what `${stepResults.<id>.text}` reads */
+        text: {
+          type: "string"
+        },
+        note: {
+          type: "string"
+        },
+        editedPayload: {},
+        editRevision: {
+          type: "integer"
+        },
+        decidedBy: {
+          type: "object",
+          properties: {
+            id: {
+              type: "string"
+            },
+            kind: {
+              type: "string"
+            }
+          }
+        },
+        timedOut: {
+          type: "boolean"
+        },
+        escalations: {
+          type: "integer"
+        },
+        evidence: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        },
+        items: {
+          type: "array",
+          items: {
+            type: "object"
+          }
+        }
+      },
+      required: [
+        "approved",
+        "decision",
+        "text"
+      ]
+    };
+    __name(workflowApprovalDecisionOf, "workflowApprovalDecisionOf");
+    __name2(workflowApprovalDecisionOf, "workflowApprovalDecisionOf");
+    __name(workflowApprovalOutput, "workflowApprovalOutput");
+    __name2(workflowApprovalOutput, "workflowApprovalOutput");
+    __name(isWorkflowApprovalOutput, "isWorkflowApprovalOutput");
+    __name2(isWorkflowApprovalOutput, "isWorkflowApprovalOutput");
+    JSON_FENCE_RE = /```(?:json)?[ \t]*\r?\n([\s\S]*?)\r?\n?```/g;
+    __name(extractSingleJsonValue, "extractSingleJsonValue");
+    __name2(extractSingleJsonValue, "extractSingleJsonValue");
   }
 });
 
@@ -2257,6 +2464,208 @@ import { createHash } from "crypto";
 import { z as z4 } from "zod";
 import { z as z22 } from "zod";
 import { createHash as createHash2 } from "crypto";
+function isMapConfigObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function parseMapConfig(raw, stepId) {
+  if (isMapConfigObject(raw)) return raw;
+  if (typeof raw !== "string") {
+    throw new Error(`Stored mapping step "${stepId}" has a mapConfig that is neither a JSON string nor an object.`);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (e) {
+    throw new Error(`Stored mapping step "${stepId}" has invalid JSON mapConfig: ${e.message}`);
+  }
+}
+function mapConfigWire(raw) {
+  if (typeof raw === "string") return raw;
+  if (isMapConfigObject(raw)) return canonicalJson(raw);
+  return void 0;
+}
+function describeBadPlaceholder(template22, idx, rawExpr) {
+  return `Template placeholder #${idx} (\${${rawExpr}}) in '${template22}'`;
+}
+function parseTemplatePlaceholder(rawExpr) {
+  const dot = rawExpr.indexOf(".");
+  return {
+    scope: dot === -1 ? rawExpr : rawExpr.slice(0, dot),
+    rest: dot === -1 ? "" : rawExpr.slice(dot + 1)
+  };
+}
+function traverseMappingPath(root, path3, errorLabel) {
+  if (path3 === "" || path3 === ".") return root;
+  const parts = path3.split(".");
+  let value22 = root;
+  for (const part of parts) {
+    if (typeof value22 === "object" && value22 !== null) value22 = value22[part];
+    else throw new WorkflowTemplateError(`Invalid path ${path3} in ${errorLabel}`, path3);
+  }
+  return value22;
+}
+function stringifyTemplateValue(v, template22, idx, rawExpr) {
+  if (v === null || v === void 0) return "";
+  if (typeof v === "object") {
+    try {
+      return JSON.stringify(v);
+    } catch (err) {
+      throw new WorkflowTemplateError(`${describeBadPlaceholder(template22, idx, rawExpr)} resolved to a value that could not be JSON-stringified (${err.message}).`, rawExpr);
+    }
+  }
+  return String(v);
+}
+function escapeFence(content) {
+  return content.replace(/<\/lua-data/g, "<\\/lua-data");
+}
+function fenceBlock(name, source, content) {
+  return `<lua-data name="${name}" source="${source}" untrusted="true">${escapeFence(content)}</lua-data>`;
+}
+function renderTemplate(template22, ctx, opts) {
+  let idx = 0;
+  return template22.replace(TEMPLATE_PLACEHOLDER, (_match, rawExpr) => {
+    idx += 1;
+    const { scope, rest } = parseTemplatePlaceholder(rawExpr);
+    const label = describeBadPlaceholder(template22, idx, rawExpr);
+    let rendered;
+    let source;
+    switch (scope) {
+      case "initData":
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.initData, rest, label), template22, idx, rawExpr);
+        source = "initData";
+        break;
+      case "state":
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.state, rest, label), template22, idx, rawExpr);
+        source = "state";
+        break;
+      case "requestContext":
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.requestContext, rest, label), template22, idx, rawExpr);
+        source = "requestContext";
+        break;
+      case "stepResults": {
+        const innerDot = rest.indexOf(".");
+        const stepId = innerDot === -1 ? rest : rest.slice(0, innerDot);
+        const subPath = innerDot === -1 ? "" : rest.slice(innerDot + 1);
+        if (!stepId) throw new WorkflowTemplateError(`${label} must name a step: \${stepResults.<stepId>.<path>}.`, rawExpr);
+        if (!(stepId in ctx.stepResults) || ctx.stepResults[stepId] == null) {
+          throw new WorkflowTemplateError(`${label} references stepResults.${stepId} but step "${stepId}" has no resolvable output (not an ancestor, not run, failed, or produced no output).`, rawExpr);
+        }
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.stepResults[stepId], subPath, label), template22, idx, rawExpr);
+        source = `step:${stepId}`;
+        break;
+      }
+      default:
+        throw new WorkflowTemplateError(`${label} references unknown namespace "${scope}". Use one of: ${TEMPLATE_NAMESPACES.join(", ")}.`, rawExpr);
+    }
+    return opts.fenced ? fenceBlock(rawExpr, source, rendered) : rendered;
+  });
+}
+function isMapDescriptor(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  const d = v;
+  const keys = Object.keys(d);
+  const only = /* @__PURE__ */ __name3((...allowed) => keys.every((k) => allowed.includes(k)), "only");
+  if ("value" in d) return keys.length === 1;
+  if ("template" in d) return keys.length === 1 && typeof d.template === "string";
+  if ("requestContextPath" in d) return keys.length === 1 && typeof d.requestContextPath === "string";
+  if ("knowledge" in d) return keys.length === 1 && typeof d.knowledge === "object" && d.knowledge !== null;
+  if ("initData" in d) return d.initData === true && typeof d.path === "string" && only("initData", "path");
+  if ("step" in d) {
+    const stepOk = typeof d.step === "string" || Array.isArray(d.step) && d.step.every((x) => typeof x === "string");
+    return stepOk && typeof d.path === "string" && only("step", "path", "rows");
+  }
+  return false;
+}
+function malformedMapMembers(cfg) {
+  if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) return [];
+  const out = [];
+  for (const [member, v] of Object.entries(cfg)) {
+    if (!v || typeof v !== "object" || Array.isArray(v) || isMapDescriptor(v)) continue;
+    const keys = Object.keys(v).filter((k) => MAP_DESCRIPTOR_KEYS.includes(k));
+    if (keys.length > 0) out.push({
+      member,
+      keys
+    });
+  }
+  return out;
+}
+function mapMemberMalformedMessage(id, m) {
+  const keys = m.keys.map((k) => `\`${k}\``).join(", ");
+  return `"${id}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
+}
+function resolveDescriptor(key, m, ctx) {
+  if (!isMapDescriptor(m)) return {
+    value: m
+  };
+  try {
+    if ("value" in m) return {
+      value: m.value
+    };
+    if ("template" in m && typeof m.template === "string") {
+      return {
+        value: renderTemplate(m.template, ctx, {
+          fenced: false
+        })
+      };
+    }
+    if ("knowledge" in m || "rows" in m && m.rows !== void 0) {
+      return {
+        error: "binding_unresolved",
+        key
+      };
+    }
+    if ("requestContextPath" in m) {
+      const label = `requestContext path for key "${key}"`;
+      return {
+        value: traverseMappingPath(ctx.requestContext, m.requestContextPath, label)
+      };
+    }
+    if ("path" in m) {
+      const source = "initData" in m && m.initData ? "initData" : "step";
+      if (source === "initData") {
+        return {
+          value: traverseMappingPath(ctx.initData, m.path, `initData for key "${key}"`)
+        };
+      }
+      const stepRef = m.step;
+      const candidates = Array.isArray(stepRef) ? stepRef : [
+        stepRef
+      ];
+      const stepId = candidates.find((s) => ctx.stepResults[s] !== void 0 && ctx.stepResults[s] !== null);
+      if (stepId === void 0) return {
+        error: "binding_unresolved",
+        key
+      };
+      return {
+        value: traverseMappingPath(ctx.stepResults[stepId], m.path, `step ${candidates.join("|")} for key "${key}"`)
+      };
+    }
+    return {
+      error: "binding_unresolved",
+      key
+    };
+  } catch (err) {
+    if (err instanceof WorkflowTemplateError) return {
+      error: "binding_unresolved",
+      key
+    };
+    throw err;
+  }
+}
+function resolveMapping(cfg, ctx) {
+  const keys = Object.keys(cfg);
+  if (keys.length === 1 && keys[0] === "") {
+    return resolveDescriptor("", cfg[""], ctx);
+  }
+  const result = {};
+  for (const key of keys) {
+    const resolved = resolveDescriptor(key, cfg[key], ctx);
+    if ("error" in resolved) return resolved;
+    result[key] = resolved.value;
+  }
+  return {
+    value: result
+  };
+}
 function workspaceTemplatePath(template22) {
   const key = template22.trim();
   const expr = WORKSPACE_TEMPLATE_EXPR_RE.exec(key);
@@ -2417,12 +2826,11 @@ function mapConfigStepRefs(raw) {
   if (!cfg) return [];
   const ids = [];
   for (const d of Object.values(cfg)) {
-    if (!d || typeof d !== "object") continue;
-    const desc = d;
-    if (desc.step !== void 0) ids.push(...Array.isArray(desc.step) ? desc.step : [
-      desc.step
+    if (!isMapDescriptor(d)) continue;
+    if ("step" in d) ids.push(...Array.isArray(d.step) ? d.step : [
+      d.step
     ]);
-    if (typeof desc.template === "string") ids.push(...templateStepRefs(desc.template));
+    if ("template" in d) ids.push(...templateStepRefs(d.template));
   }
   return ids;
 }
@@ -2547,6 +2955,12 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const r = node.retry;
     if (!r) return;
     const id = singleId(node);
+    const unknown = unknownWorkflowRetryMembers(r);
+    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path3}.retry`, id);
+    if (r.maxAttempts !== void 0 && !isWithinWorkflowRetryAttempts(r.maxAttempts)) {
+      const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
+      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path3}.retry.maxAttempts`, id);
+    }
     const backoffs = retryBackoffs();
     if (r.backoff !== void 0 && !backoffs.includes(r.backoff)) {
       const list = backoffs.map((b) => `'${b}'`).join(" | ");
@@ -2689,6 +3103,21 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const schema = node.type === "step" ? node.step.outputSchema : node.type === "agent" ? node.outputSchema : void 0;
     if (schema !== void 0) outputSchemas.set(singleId(node), schema);
   }, "recordOutputSchema");
+  const checkMapMembers = /* @__PURE__ */ __name3((cfg, basePath, id) => {
+    for (const m of malformedMapMembers(cfg)) {
+      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id, m), `${basePath}.${m.member}`, id);
+    }
+  }, "checkMapMembers");
+  const checkInputShape = /* @__PURE__ */ __name3((node, path3) => {
+    if (node.type !== "tool" && node.type !== "workflow") return;
+    const input = node.input;
+    if (input === void 0) return;
+    if (input !== null && typeof input === "object" && !Array.isArray(input)) {
+      checkMapMembers(input, `${path3}.input`, node.id);
+      return;
+    }
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path3}.input`, node.id);
+  }, "checkInputShape");
   const checkSingle = /* @__PURE__ */ __name3((node, path3, depth) => {
     recordOutputSchema(node);
     if (node.type === "workflow" && node.workflowId === WORKFLOW_ARM_SUBRUN_ID) {
@@ -2716,6 +3145,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     checkId(singleId(node), path3);
     checkPolicyEnums(node, path3);
+    checkInputShape(node, path3);
     checkTimeout(node, path3);
     checkTier(node, path3);
     checkRetry(node, path3);
@@ -2796,6 +3226,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const checkArm = /* @__PURE__ */ __name3((arm, path3, depth, container) => {
     if (arm.type === "mapping") {
       checkId(arm.id, path3);
+      checkMapMembers(readMapConfig(arm.mapConfig), `${path3}.mapConfig`, arm.id);
       for (const ref of nodeStepRefs(arm)) {
         if (!upstream.has(ref)) err("template-reference-unresolved", `"${arm.id}" references stepResults.${ref}, which is not upstream`, path3, arm.id);
       }
@@ -2820,6 +3251,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         break;
       case "mapping":
         checkId(entry.id, path3);
+        checkMapMembers(readMapConfig(entry.mapConfig), `${path3}.mapConfig`, entry.id);
         for (const ref of nodeStepRefs(entry)) {
           if (!upstream.has(ref)) err("template-reference-unresolved", `"${entry.id}" references stepResults.${ref}, which is not upstream`, path3, entry.id);
         }
@@ -3361,227 +3793,61 @@ function renderPredicate(pred) {
     case "eq":
       return `${renderRef(pred.left)} == ${renderRef(pred.right)}`;
     case "ne":
-      return `${renderRef(pred.left)} != ${renderRef(pred.right)}`;
-    case "lt":
-      return `${renderRef(pred.left)} < ${renderRef(pred.right)}`;
-    case "lte":
-      return `${renderRef(pred.left)} <= ${renderRef(pred.right)}`;
-    case "gt":
-      return `${renderRef(pred.left)} > ${renderRef(pred.right)}`;
-    case "gte":
-      return `${renderRef(pred.left)} >= ${renderRef(pred.right)}`;
-  }
-}
-function wrapLabel(child, rendered) {
-  return child.op === "and" || child.op === "or" || child.op === "not" ? `(${rendered})` : rendered;
-}
-function renderRef(ref) {
-  if ("literal" in ref) return JSON.stringify(ref.literal);
-  return ref.path;
-}
-function step(s) {
-  const id = stepIdOf(s);
-  return {
-    path: /* @__PURE__ */ __name3((p) => ({
-      path: p === "" ? `stepResults.${id}` : `stepResults.${id}.${p}`
-    }), "path")
-  };
-}
-function stepOf(id) {
-  return step(id);
-}
-function init(path3) {
-  return {
-    path: path3 === "" ? "initData" : `initData.${path3}`
-  };
-}
-function state(path3) {
-  return {
-    path: path3 === "" ? "state" : `state.${path3}`
-  };
-}
-function lit(v) {
-  return {
-    literal: v
-  };
-}
-function toPathOrLiteral(v) {
-  if (typeof v === "object" && v !== null) {
-    if ("path" in v) return {
-      path: v.path
-    };
-    if ("literal" in v) return {
-      literal: v.literal
-    };
-  }
-  return {
-    literal: v
-  };
-}
-function isMapConfigObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function parseMapConfig(raw, stepId) {
-  if (isMapConfigObject(raw)) return raw;
-  if (typeof raw !== "string") {
-    throw new Error(`Stored mapping step "${stepId}" has a mapConfig that is neither a JSON string nor an object.`);
-  }
-  try {
-    return JSON.parse(raw);
-  } catch (e) {
-    throw new Error(`Stored mapping step "${stepId}" has invalid JSON mapConfig: ${e.message}`);
-  }
-}
-function mapConfigWire(raw) {
-  if (typeof raw === "string") return raw;
-  if (isMapConfigObject(raw)) return canonicalJson(raw);
-  return void 0;
-}
-function describeBadPlaceholder(template22, idx, rawExpr) {
-  return `Template placeholder #${idx} (\${${rawExpr}}) in '${template22}'`;
-}
-function parseTemplatePlaceholder(rawExpr) {
-  const dot = rawExpr.indexOf(".");
-  return {
-    scope: dot === -1 ? rawExpr : rawExpr.slice(0, dot),
-    rest: dot === -1 ? "" : rawExpr.slice(dot + 1)
-  };
-}
-function traverseMappingPath(root, path3, errorLabel) {
-  if (path3 === "" || path3 === ".") return root;
-  const parts = path3.split(".");
-  let value22 = root;
-  for (const part of parts) {
-    if (typeof value22 === "object" && value22 !== null) value22 = value22[part];
-    else throw new WorkflowTemplateError(`Invalid path ${path3} in ${errorLabel}`, path3);
-  }
-  return value22;
-}
-function stringifyTemplateValue(v, template22, idx, rawExpr) {
-  if (v === null || v === void 0) return "";
-  if (typeof v === "object") {
-    try {
-      return JSON.stringify(v);
-    } catch (err) {
-      throw new WorkflowTemplateError(`${describeBadPlaceholder(template22, idx, rawExpr)} resolved to a value that could not be JSON-stringified (${err.message}).`, rawExpr);
-    }
-  }
-  return String(v);
-}
-function escapeFence(content) {
-  return content.replace(/<\/lua-data/g, "<\\/lua-data");
-}
-function fenceBlock(name, source, content) {
-  return `<lua-data name="${name}" source="${source}" untrusted="true">${escapeFence(content)}</lua-data>`;
-}
-function renderTemplate(template22, ctx, opts) {
-  let idx = 0;
-  return template22.replace(TEMPLATE_PLACEHOLDER, (_match, rawExpr) => {
-    idx += 1;
-    const { scope, rest } = parseTemplatePlaceholder(rawExpr);
-    const label = describeBadPlaceholder(template22, idx, rawExpr);
-    let rendered;
-    let source;
-    switch (scope) {
-      case "initData":
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.initData, rest, label), template22, idx, rawExpr);
-        source = "initData";
-        break;
-      case "state":
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.state, rest, label), template22, idx, rawExpr);
-        source = "state";
-        break;
-      case "requestContext":
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.requestContext, rest, label), template22, idx, rawExpr);
-        source = "requestContext";
-        break;
-      case "stepResults": {
-        const innerDot = rest.indexOf(".");
-        const stepId = innerDot === -1 ? rest : rest.slice(0, innerDot);
-        const subPath = innerDot === -1 ? "" : rest.slice(innerDot + 1);
-        if (!stepId) throw new WorkflowTemplateError(`${label} must name a step: \${stepResults.<stepId>.<path>}.`, rawExpr);
-        if (!(stepId in ctx.stepResults) || ctx.stepResults[stepId] == null) {
-          throw new WorkflowTemplateError(`${label} references stepResults.${stepId} but step "${stepId}" has no resolvable output (not an ancestor, not run, failed, or produced no output).`, rawExpr);
-        }
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.stepResults[stepId], subPath, label), template22, idx, rawExpr);
-        source = `step:${stepId}`;
-        break;
-      }
-      default:
-        throw new WorkflowTemplateError(`${label} references unknown namespace "${scope}". Use one of: ${TEMPLATE_NAMESPACES.join(", ")}.`, rawExpr);
-    }
-    return opts.fenced ? fenceBlock(rawExpr, source, rendered) : rendered;
-  });
-}
-function resolveDescriptor(key, m, ctx) {
-  try {
-    if ("value" in m) return {
-      value: m.value
-    };
-    if ("template" in m && typeof m.template === "string") {
-      return {
-        value: renderTemplate(m.template, ctx, {
-          fenced: false
-        })
-      };
-    }
-    if ("knowledge" in m || "rows" in m && m.rows !== void 0) {
-      return {
-        error: "binding_unresolved",
-        key
-      };
-    }
-    if ("requestContextPath" in m) {
-      const label = `requestContext path for key "${key}"`;
-      return {
-        value: traverseMappingPath(ctx.requestContext, m.requestContextPath, label)
-      };
-    }
-    if ("path" in m) {
-      const source = "initData" in m && m.initData ? "initData" : "step";
-      if (source === "initData") {
-        return {
-          value: traverseMappingPath(ctx.initData, m.path, `initData for key "${key}"`)
-        };
-      }
-      const stepRef = m.step;
-      const candidates = Array.isArray(stepRef) ? stepRef : [
-        stepRef
-      ];
-      const stepId = candidates.find((s) => ctx.stepResults[s] !== void 0 && ctx.stepResults[s] !== null);
-      if (stepId === void 0) return {
-        error: "binding_unresolved",
-        key
-      };
-      return {
-        value: traverseMappingPath(ctx.stepResults[stepId], m.path, `step ${candidates.join("|")} for key "${key}"`)
-      };
-    }
-    return {
-      error: "binding_unresolved",
-      key
-    };
-  } catch (err) {
-    if (err instanceof WorkflowTemplateError) return {
-      error: "binding_unresolved",
-      key
-    };
-    throw err;
+      return `${renderRef(pred.left)} != ${renderRef(pred.right)}`;
+    case "lt":
+      return `${renderRef(pred.left)} < ${renderRef(pred.right)}`;
+    case "lte":
+      return `${renderRef(pred.left)} <= ${renderRef(pred.right)}`;
+    case "gt":
+      return `${renderRef(pred.left)} > ${renderRef(pred.right)}`;
+    case "gte":
+      return `${renderRef(pred.left)} >= ${renderRef(pred.right)}`;
   }
 }
-function resolveMapping(cfg, ctx) {
-  const keys = Object.keys(cfg);
-  if (keys.length === 1 && keys[0] === "") {
-    return resolveDescriptor("", cfg[""], ctx);
-  }
-  const result = {};
-  for (const key of keys) {
-    const resolved = resolveDescriptor(key, cfg[key], ctx);
-    if ("error" in resolved) return resolved;
-    result[key] = resolved.value;
+function wrapLabel(child, rendered) {
+  return child.op === "and" || child.op === "or" || child.op === "not" ? `(${rendered})` : rendered;
+}
+function renderRef(ref) {
+  if ("literal" in ref) return JSON.stringify(ref.literal);
+  return ref.path;
+}
+function step(s) {
+  const id = stepIdOf(s);
+  return {
+    path: /* @__PURE__ */ __name3((p) => ({
+      path: p === "" ? `stepResults.${id}` : `stepResults.${id}.${p}`
+    }), "path")
+  };
+}
+function stepOf(id) {
+  return step(id);
+}
+function init(path3) {
+  return {
+    path: path3 === "" ? "initData" : `initData.${path3}`
+  };
+}
+function state(path3) {
+  return {
+    path: path3 === "" ? "state" : `state.${path3}`
+  };
+}
+function lit(v) {
+  return {
+    literal: v
+  };
+}
+function toPathOrLiteral(v) {
+  if (typeof v === "object" && v !== null) {
+    if ("path" in v) return {
+      path: v.path
+    };
+    if ("literal" in v) return {
+      literal: v.literal
+    };
   }
   return {
-    value: result
+    literal: v
   };
 }
 function continuedFailureValue(error, killReason) {
@@ -4218,15 +4484,64 @@ function runCounts(counts) {
     pending: n(c.pending) + n(c.ready) + n(c.waiting)
   };
 }
-function runUsage(run) {
+function isPricedStepReceipt(receipt) {
+  return typeof receipt?.multiplier === "number" && Number.isFinite(receipt.multiplier);
+}
+function receiptEngine(engine) {
+  if (engine === "actions") return "seat";
+  if (engine === "credits") return "legacy";
+  return void 0;
+}
+function receiptTier(tier) {
+  return tier === "light" || tier === "standard" || tier === "heavy" ? tier : void 0;
+}
+function stepBillingView(receipt) {
+  const engine = receiptEngine(receipt?.engine);
+  if (!receipt || engine === void 0) return void 0;
+  return pruneUndefined({
+    engine,
+    attempt: typeof receipt.attempt === "number" ? receipt.attempt : void 0,
+    credits: typeof receipt.credits === "number" ? receipt.credits : void 0,
+    actions: typeof receipt.actionsEstimate === "number" ? receipt.actionsEstimate : void 0,
+    model: typeof receipt.model === "string" ? receipt.model : void 0,
+    tier: receiptTier(receipt.tier),
+    multiplier: typeof receipt.multiplier === "number" ? receipt.multiplier : void 0,
+    byok: typeof receipt.byok === "boolean" ? receipt.byok : void 0,
+    calibrated: typeof receipt.calibrated === "boolean" ? receipt.calibrated : void 0
+  });
+}
+function runUsage(run, receipts) {
+  const actions = n(run.budget?.spent?.actionsEstimate);
+  const stamped = run.budget?.engine;
+  const priced = (receipts ?? []).filter(isPricedStepReceipt);
+  const engine = stamped === "seat" || stamped === "legacy" ? stamped : actions > 0 || priced.some((r) => r.engine === "actions") ? "seat" : priced.some((r) => r.engine === "credits") ? "legacy" : void 0;
+  const seat = engine === "seat";
+  const metering = engine ? "priced" : "flat";
   return {
     creditsUsed: run.budget?.spent?.credits ?? 0,
     actionsEstimate: run.budget?.spent?.actionsEstimate ?? 0,
+    ...seat ? {
+      actionsUsed: actions
+    } : {},
+    metering,
+    ...engine ? {
+      engine
+    } : {},
     steps: run.budget?.spent?.steps ?? 0,
     inputTokens: run.usage?.inputTokens ?? 0,
     outputTokens: run.usage?.outputTokens ?? 0
   };
 }
+function runBudgetCap(budget) {
+  const cap = budget?.maxCredits;
+  return typeof cap === "number" && Number.isFinite(cap) && cap > 0 ? cap : void 0;
+}
+function runBudgetRemaining(budget) {
+  const cap = runBudgetCap(budget);
+  if (cap === void 0) return void 0;
+  const spent = budget?.spent;
+  return Math.max(0, cap - n(spent?.credits) - n(spent?.actionsEstimate) - n(budget?.reserved));
+}
 function runCancelView(cancel) {
   if (!cancel) return void 0;
   return {
@@ -5245,7 +5560,7 @@ function needsInheritedWorkspace(graph) {
   }
   return false;
 }
-var __defProp3, __name3, SideEffectsSchema, JobResourcesSchema, WORKFLOW_ARM_SUBRUN_ID, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
+var __defProp3, __name3, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_ARM_SUBRUN_ID, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
@@ -5258,6 +5573,94 @@ var init_dist2 = __esm({
     init_dist();
     __defProp3 = Object.defineProperty;
     __name3 = /* @__PURE__ */ __name((target, value22) => __defProp3(target, "name", { value: value22, configurable: true }), "__name");
+    WorkflowTemplateError = class extends Error {
+      static {
+        __name(this, "WorkflowTemplateError");
+      }
+      static {
+        __name3(this, "WorkflowTemplateError");
+      }
+      placeholder;
+      constructor(message, placeholder) {
+        super(message), this.placeholder = placeholder;
+        this.name = "WorkflowTemplateError";
+      }
+    };
+    __name(isMapConfigObject, "isMapConfigObject");
+    __name3(isMapConfigObject, "isMapConfigObject");
+    __name(parseMapConfig, "parseMapConfig");
+    __name3(parseMapConfig, "parseMapConfig");
+    __name(mapConfigWire, "mapConfigWire");
+    __name3(mapConfigWire, "mapConfigWire");
+    TEMPLATE_PLACEHOLDER = /\$\{([^}]*)\}/g;
+    TEMPLATE_NAMESPACES = [
+      "initData",
+      "state",
+      "requestContext",
+      "stepResults"
+    ];
+    __name(describeBadPlaceholder, "describeBadPlaceholder");
+    __name3(describeBadPlaceholder, "describeBadPlaceholder");
+    __name(parseTemplatePlaceholder, "parseTemplatePlaceholder");
+    __name3(parseTemplatePlaceholder, "parseTemplatePlaceholder");
+    __name(traverseMappingPath, "traverseMappingPath");
+    __name3(traverseMappingPath, "traverseMappingPath");
+    __name(stringifyTemplateValue, "stringifyTemplateValue");
+    __name3(stringifyTemplateValue, "stringifyTemplateValue");
+    __name(escapeFence, "escapeFence");
+    __name3(escapeFence, "escapeFence");
+    __name(fenceBlock, "fenceBlock");
+    __name3(fenceBlock, "fenceBlock");
+    __name(renderTemplate, "renderTemplate");
+    __name3(renderTemplate, "renderTemplate");
+    __name(isMapDescriptor, "isMapDescriptor");
+    __name3(isMapDescriptor, "isMapDescriptor");
+    MAP_DESCRIPTOR_KEYS = [
+      "step",
+      "path",
+      "initData",
+      "value",
+      "template",
+      "requestContextPath",
+      "knowledge"
+    ];
+    MAP_MEMBER_MALFORMED_CODE = "map-member-malformed";
+    __name(malformedMapMembers, "malformedMapMembers");
+    __name3(malformedMapMembers, "malformedMapMembers");
+    __name(mapMemberMalformedMessage, "mapMemberMalformedMessage");
+    __name3(mapMemberMalformedMessage, "mapMemberMalformedMessage");
+    __name(resolveDescriptor, "resolveDescriptor");
+    __name3(resolveDescriptor, "resolveDescriptor");
+    __name(resolveMapping, "resolveMapping");
+    __name3(resolveMapping, "resolveMapping");
+    fromInit = /* @__PURE__ */ __name3((path3) => ({
+      initData: true,
+      path: path3
+    }), "fromInit");
+    fromStep = /* @__PURE__ */ __name3((s, path3 = "") => {
+      const idOf = /* @__PURE__ */ __name3((x) => typeof x === "string" ? x : x.id, "idOf");
+      return {
+        step: Array.isArray(s) ? s.map(idOf) : idOf(s),
+        path: path3
+      };
+    }, "fromStep");
+    value = /* @__PURE__ */ __name3((v) => ({
+      value: v
+    }), "value");
+    template = /* @__PURE__ */ __name3((s) => ({
+      template: s
+    }), "template");
+    fromRequest = /* @__PURE__ */ __name3((path3) => ({
+      requestContextPath: path3
+    }), "fromRequest");
+    rows = /* @__PURE__ */ __name3((s, path3, page) => ({
+      step: typeof s === "string" ? s : s.id,
+      path: path3,
+      rows: page
+    }), "rows");
+    fromKnowledge = /* @__PURE__ */ __name3((k) => ({
+      knowledge: k
+    }), "fromKnowledge");
     SideEffectsSchema = z4.enum(WORKFLOW_SIDE_EFFECTS);
     JobResourcesSchema = z4.enum(WORKFLOW_JOB_RESOURCES);
     WORKFLOW_ARM_SUBRUN_ID = "$arm";
@@ -5501,78 +5904,6 @@ var init_dist2 = __esm({
       op: "not",
       arg
     }), "not");
-    WorkflowTemplateError = class extends Error {
-      static {
-        __name(this, "WorkflowTemplateError");
-      }
-      static {
-        __name3(this, "WorkflowTemplateError");
-      }
-      placeholder;
-      constructor(message, placeholder) {
-        super(message), this.placeholder = placeholder;
-        this.name = "WorkflowTemplateError";
-      }
-    };
-    __name(isMapConfigObject, "isMapConfigObject");
-    __name3(isMapConfigObject, "isMapConfigObject");
-    __name(parseMapConfig, "parseMapConfig");
-    __name3(parseMapConfig, "parseMapConfig");
-    __name(mapConfigWire, "mapConfigWire");
-    __name3(mapConfigWire, "mapConfigWire");
-    TEMPLATE_PLACEHOLDER = /\$\{([^}]*)\}/g;
-    TEMPLATE_NAMESPACES = [
-      "initData",
-      "state",
-      "requestContext",
-      "stepResults"
-    ];
-    __name(describeBadPlaceholder, "describeBadPlaceholder");
-    __name3(describeBadPlaceholder, "describeBadPlaceholder");
-    __name(parseTemplatePlaceholder, "parseTemplatePlaceholder");
-    __name3(parseTemplatePlaceholder, "parseTemplatePlaceholder");
-    __name(traverseMappingPath, "traverseMappingPath");
-    __name3(traverseMappingPath, "traverseMappingPath");
-    __name(stringifyTemplateValue, "stringifyTemplateValue");
-    __name3(stringifyTemplateValue, "stringifyTemplateValue");
-    __name(escapeFence, "escapeFence");
-    __name3(escapeFence, "escapeFence");
-    __name(fenceBlock, "fenceBlock");
-    __name3(fenceBlock, "fenceBlock");
-    __name(renderTemplate, "renderTemplate");
-    __name3(renderTemplate, "renderTemplate");
-    __name(resolveDescriptor, "resolveDescriptor");
-    __name3(resolveDescriptor, "resolveDescriptor");
-    __name(resolveMapping, "resolveMapping");
-    __name3(resolveMapping, "resolveMapping");
-    fromInit = /* @__PURE__ */ __name3((path3) => ({
-      initData: true,
-      path: path3
-    }), "fromInit");
-    fromStep = /* @__PURE__ */ __name3((s, path3 = "") => {
-      const idOf = /* @__PURE__ */ __name3((x) => typeof x === "string" ? x : x.id, "idOf");
-      return {
-        step: Array.isArray(s) ? s.map(idOf) : idOf(s),
-        path: path3
-      };
-    }, "fromStep");
-    value = /* @__PURE__ */ __name3((v) => ({
-      value: v
-    }), "value");
-    template = /* @__PURE__ */ __name3((s) => ({
-      template: s
-    }), "template");
-    fromRequest = /* @__PURE__ */ __name3((path3) => ({
-      requestContextPath: path3
-    }), "fromRequest");
-    rows = /* @__PURE__ */ __name3((s, path3, page) => ({
-      step: typeof s === "string" ? s : s.id,
-      path: path3,
-      rows: page
-    }), "rows");
-    fromKnowledge = /* @__PURE__ */ __name3((k) => ({
-      knowledge: k
-    }), "fromKnowledge");
     CONTINUED_FAILURE_TAG = "continued_failure";
     CONTINUED_FAILURE_DEFAULT_CODE = "step_failed";
     CONTINUED_FAILURE_OUTPUT_SCHEMA = Object.freeze({
@@ -5698,8 +6029,20 @@ var init_dist2 = __esm({
     n = /* @__PURE__ */ __name3((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
     __name(runCounts, "runCounts");
     __name3(runCounts, "runCounts");
+    __name(isPricedStepReceipt, "isPricedStepReceipt");
+    __name3(isPricedStepReceipt, "isPricedStepReceipt");
+    __name(receiptEngine, "receiptEngine");
+    __name3(receiptEngine, "receiptEngine");
+    __name(receiptTier, "receiptTier");
+    __name3(receiptTier, "receiptTier");
+    __name(stepBillingView, "stepBillingView");
+    __name3(stepBillingView, "stepBillingView");
     __name(runUsage, "runUsage");
     __name3(runUsage, "runUsage");
+    __name(runBudgetCap, "runBudgetCap");
+    __name3(runBudgetCap, "runBudgetCap");
+    __name(runBudgetRemaining, "runBudgetRemaining");
+    __name3(runBudgetRemaining, "runBudgetRemaining");
     __name(runCancelView, "runCancelView");
     __name3(runCancelView, "runCancelView");
     __name(runWorkspaceView, "runWorkspaceView");
@@ -6181,6 +6524,7 @@ var init_workflow = __esm({
     }, "assertPredicate");
     assertRetry = /* @__PURE__ */ __name((r, id) => {
       if (!r) return;
+      if (typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS) throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
       if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
       if (r.maxBackoffSeconds !== void 0) {
         if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
@@ -6950,6 +7294,74 @@ var init_auth_error = __esm({
   }
 });
 
+// src/errors/cli.error.ts
+function isAccessDeniedError(error) {
+  if (CliError.isCliError(error)) return error.statusCode === 403;
+  return error instanceof Error && error.message.startsWith("Access denied (403)");
+}
+var CLI_EXIT, CliError;
+var init_cli_error = __esm({
+  "src/errors/cli.error.ts"() {
+    "use strict";
+    init_auth_error();
+    CLI_EXIT = {
+      OK: 0,
+      ERROR: 1,
+      USAGE: 2,
+      NOT_FOUND: 3,
+      AUTH: 9,
+      FORBIDDEN: 10,
+      UNAVAILABLE: 11
+    };
+    CliError = class _CliError extends Error {
+      static {
+        __name(this, "CliError");
+      }
+      isCliError = true;
+      code;
+      exitCode;
+      hint;
+      statusCode;
+      constructor(code, message, options = {}) {
+        super(message);
+        this.name = "CliError";
+        this.code = code;
+        this.exitCode = options.exitCode ?? CLI_EXIT.ERROR;
+        this.hint = options.hint;
+        this.statusCode = options.statusCode;
+        if (Error.captureStackTrace) Error.captureStackTrace(this, _CliError);
+      }
+      /** Bad arguments, an unknown action, no project — exit 2. */
+      static usage(message, hint) {
+        return new _CliError("usage", message, {
+          exitCode: CLI_EXIT.USAGE,
+          hint
+        });
+      }
+      /** The named thing does not exist — exit 3. */
+      static notFound(message, hint) {
+        return new _CliError("not_found", message, {
+          exitCode: CLI_EXIT.NOT_FOUND,
+          hint,
+          statusCode: 404
+        });
+      }
+      /** The credential may not do this — exit 10. */
+      static forbidden(message, hint) {
+        return new _CliError("forbidden", message, {
+          exitCode: CLI_EXIT.FORBIDDEN,
+          hint,
+          statusCode: 403
+        });
+      }
+      static isCliError(error) {
+        return error instanceof _CliError || typeof error === "object" && error !== null && error.isCliError === true;
+      }
+    };
+    __name(isAccessDeniedError, "isAccessDeniedError");
+  }
+});
+
 // src/utils/package-root.ts
 import { readFileSync, existsSync } from "fs";
 import { fileURLToPath, pathToFileURL } from "url";
@@ -7476,6 +7888,10 @@ async function* parseSseStream(body, signal) {
       if (frame) yield frame;
     }
   } finally {
+    try {
+      await reader.cancel();
+    } catch {
+    }
     try {
       reader.releaseLock();
     } catch {
@@ -7505,6 +7921,7 @@ var init_http_client = __esm({
     "use strict";
     init_dist();
     init_auth_error();
+    init_cli_error();
     init_lua_fetch();
     init_request_credential();
     DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
@@ -7568,7 +7985,7 @@ var init_http_client = __esm({
           if (AuthenticationError.isAuthenticationError(error)) {
             throw error;
           }
-          if (error instanceof Error && error.message.startsWith("Access denied (403)")) {
+          if (isAccessDeniedError(error)) {
             throw error;
           }
           if (error instanceof DOMException && error.name === "AbortError") {
@@ -7616,8 +8033,11 @@ var init_http_client = __esm({
         }
         if (response.status === 403) {
           const detail = errorData.message || "You do not have permission to access this resource.";
-          throw new Error(`Access denied (403): ${detail}
-Check that your Lua login has access to this agent or organization.`);
+          throw new CliError("forbidden", `Access denied (403): ${detail}`, {
+            exitCode: CLI_EXIT.FORBIDDEN,
+            statusCode: 403,
+            hint: "Check that your Lua login has access to this agent or organization."
+          });
         }
         return {
           success: false,
@@ -7859,6 +8279,7 @@ var init_auth = __esm({
     init_auth_api_service();
     init_constants();
     init_auth_error();
+    init_cli_error();
   }
 });
 
@@ -8086,6 +8507,9 @@ function buildSourceArchive(files) {
   const gz = zlib.gzipSync(Buffer.from(json, "utf-8"));
   return gz.toString("base64");
 }
+function getPrimitivesByKind(manifest, kind) {
+  return manifest.primitives.filter((p) => p.kind === kind);
+}
 function findPrimitive(manifest, name, kind) {
   return manifest.primitives.find((p) => {
     if (kind && p.kind !== kind) return false;
@@ -8106,6 +8530,7 @@ var init_artifact_loader = __esm({
     __name(loadOriginalSource, "loadOriginalSource");
     __name(normalizeEntryFile, "normalizeEntryFile");
     __name(buildSourceArchive, "buildSourceArchive");
+    __name(getPrimitivesByKind, "getPrimitivesByKind");
     __name(findPrimitive, "findPrimitive");
   }
 });
@@ -8752,6 +9177,7 @@ var init_base_handler = __esm({
     init_bundle_upload();
     init_semver();
     init_auth_error();
+    init_cli_error();
     DEFAULT_VERSION = SKILL_DEFAULTS.VERSION;
     BaseVersionedHandler = class {
       static {
@@ -8833,7 +9259,7 @@ var init_base_handler = __esm({
             serverItems
           };
         } catch (error) {
-          if (AuthenticationError.isAuthenticationError(error)) throw error;
+          if (AuthenticationError.isAuthenticationError(error) || isAccessDeniedError(error)) throw error;
           return {
             serverItems: null,
             fetchError: error instanceof Error ? error.message : String(error)
@@ -8863,13 +9289,24 @@ var init_base_handler = __esm({
           }
           const yamlItems = this.getFromYaml(config);
           const { yamlById, yamlByName, serverByName } = this.buildMaps(serverData.serverItems, yamlItems);
+          const idField = this.yamlConfig.idField;
+          const manifestNames = manifest ? new Set(getPrimitivesByKind(manifest, this.kind).map((p) => p.name)) : /* @__PURE__ */ new Set();
+          for (const stale of this.staleYamlRows(yamlItems, serverData.serverItems, manifestNames)) {
+            const idx = yamlItems.indexOf(stale);
+            if (idx < 0) continue;
+            const { [idField]: goneId, ...rest } = stale;
+            yamlItems[idx] = rest;
+            yamlUpdated = true;
+            const msg = `\u2139\uFE0F  ${this.displayName} "${stale.name}" (${goneId}) no longer exists on the server \u2014 re-registering it`;
+            messages.push(msg);
+            console.log(msg);
+          }
           const orphans = serverData.serverItems.filter((item) => {
             const id = item.id;
             const name = item.name;
             return !yamlById.has(id) && !yamlByName.has(name) && this.isActive(item) && this.shouldConsiderForOrphan(item);
           });
           if (orphans.length > 0) {
-            const idField = this.yamlConfig.idField;
             const stubs = orphans.map((item) => this.cleanItem({
               name: item.name,
               version: this.getActiveVersion(item) || DEFAULT_VERSION,
@@ -8912,6 +9349,7 @@ var init_base_handler = __esm({
             console.log(`\u2705 Server ${this.displayNamePlural} and YAML are fully in sync`);
           }
         } catch (error) {
+          if (AuthenticationError.isAuthenticationError(error) || isAccessDeniedError(error)) throw error;
           console.error(`\u274C Error syncing server ${this.displayNamePlural}:`, error);
         }
         return {
@@ -8968,6 +9406,7 @@ var init_base_handler = __esm({
               console.error(`   \u274C Failed to create "${item.name}" - no ID returned`);
             }
           } catch (error) {
+            if (AuthenticationError.isAuthenticationError(error) || isAccessDeniedError(error)) throw error;
             console.error(`   \u274C Failed to create "${item.name}": ${error instanceof Error ? error.message : error}`);
           }
         }
@@ -9102,6 +9541,15 @@ var init_base_handler = __esm({
       getItemId(item) {
         return item[this.yamlConfig.idField] || "";
       }
+      /**
+      * LUA-750: the yaml rows whose server id is gone (deleted server-side) and which `applySyncToYaml` should
+      * re-register. Default none — a handler whose `fetchFromServer` lists EVERY live row of its kind for the
+      * agent overrides this (a kind whose list omits inactive rows must not, or it would duplicate them).
+      * `manifestNames` is the set of primitives in local code: only those are worth re-creating.
+      */
+      staleYamlRows(_yamlItems, _serverItems, _manifestNames) {
+        return [];
+      }
       buildMaps(serverItems, yamlItems) {
         const yamlById = /* @__PURE__ */ new Map();
         const yamlByName = /* @__PURE__ */ new Map();
@@ -9500,6 +9948,7 @@ var init_cli = __esm({
   "src/utils/cli.ts"() {
     "use strict";
     init_auth_error();
+    init_cli_error();
     init_version_check();
     init_package_root();
     init_analytics();
@@ -9519,6 +9968,7 @@ var init_command_utils = __esm({
     init_request_credential();
     init_files();
     init_cli();
+    init_cli_error();
     __name(requireAuth, "requireAuth");
   }
 });
@@ -13067,7 +13517,10 @@ var init_workflow_api_service = __esm({
       async getRunReplayBundle(runId) {
         return this.httpGet(`${this.runs}/${runId}/journal?format=replay`, await this.auth());
       }
-      /** R11 — cancel (`mode:'request'` default; `'force'` after `forceAvailableAt`, 409 `FORCE_NOT_YET_AVAILABLE` before). */
+      /**
+      * R11 — cancel (`mode:'request'` default). A `'force'` before `forceAvailableAt` is the 200 verdict
+      * `{ transitioned:false, nextAction:'cancel_again', forceAvailableAt }` (PRO-979) — never a 409 (LUA-748).
+      */
       async cancelRun(runId, data = {}) {
         return this.httpPost(`${this.runs}/${runId}/cancel`, data, await this.auth());
       }
@@ -13146,6 +13599,14 @@ var init_workflow_api_service = __esm({
       async closeGoal(goalId, data = {}) {
         return this.httpPost(`${this.goals}/${encodeURIComponent(goalId)}/close`, data, await this.auth());
       }
+      /** LUA-749 R63 — edit (objective / judge / cadence / caps / note); a `budget` / `max_runs` park re-arms when the cap clears (`rearmed:true`). */
+      async updateGoal(goalId, data) {
+        return this.httpPatch(`${this.goals}/${encodeURIComponent(goalId)}`, data, await this.auth());
+      }
+      /** LUA-749 R64 — raise `maxTotalCredits` / `maxRuns` (increases only; 400 `GOAL_RAISE_BELOW_SPENT{field, value, spent}`). */
+      async raiseGoal(goalId, data) {
+        return this.httpPost(`${this.goals}/${encodeURIComponent(goalId)}/raise`, data, await this.auth());
+      }
       // ─── Schedules (R4-MF-2 list/get + R28 delete — `/workflows/:agentId/schedules`; LUA-627 stanza) ───
       /** Schedule tree (09 §9.5 — the write-only R27/R56/R28 family plus the R4-MF-2 read rows). */
       get schedules() {
@@ -13159,7 +13620,7 @@ var init_workflow_api_service = __esm({
       async getSchedule(jobId) {
         return this.httpGet(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
       }
-      /** R28 — delete a schedule Job (404 `SCHEDULE_NOT_FOUND`). The CLI refuses a goal-owned job BEFORE this call (`goal_schedule`). */
+      /** R28 — delete a schedule Job (404 `SCHEDULE_NOT_FOUND`). The CLI refuses a LIVE goal's job BEFORE this call (`goal_schedule`); an ended goal's lingering Job is retired here (LUA-760). */
       async deleteSchedule(jobId) {
         return this.httpDelete(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
       }