lua-cli 3.32.2 → 3.32.4

package/dist/workflow-builder.js

@@ -647,6 +647,94 @@ function isDesktopFileSessionId(value3) {
 }
 __name(isDesktopFileSessionId, "isDesktopFileSessionId");
 __name2(isDesktopFileSessionId, "isDesktopFileSessionId");
+var MODEL_ID_BYOK_PROVIDERS = [
+  "azure",
+  "bedrock"
+];
+function isModelIdSentinel(input) {
+  const lower = (input ?? "").trim().toLowerCase();
+  return lower === "auto" || lower.startsWith("auto/");
+}
+__name(isModelIdSentinel, "isModelIdSentinel");
+__name2(isModelIdSentinel, "isModelIdSentinel");
+function normalizeModelId(input, registry) {
+  const requested = typeof input === "string" ? input.trim() : "";
+  if (!requested) return {
+    ok: false,
+    reason: "empty",
+    requested,
+    candidates: []
+  };
+  const lower = requested.toLowerCase();
+  if (isModelIdSentinel(lower)) return {
+    ok: true,
+    id: lower,
+    form: "sentinel"
+  };
+  const slash = requested.indexOf("/");
+  const malformed = slash === 0;
+  const provider = slash > 0 ? lower.slice(0, slash) : void 0;
+  if (provider && MODEL_ID_BYOK_PROVIDERS.includes(provider)) {
+    return {
+      ok: true,
+      id: requested,
+      form: "byok"
+    };
+  }
+  const bareId = slash >= 0 ? lower.slice(slash + 1) : lower;
+  const lastSegment = bareId.slice(bareId.lastIndexOf("/") + 1);
+  const exact = /* @__PURE__ */ new Set();
+  const hints = /* @__PURE__ */ new Set();
+  for (const code of registry) {
+    if (typeof code !== "string" || !code) continue;
+    const codeLower = code.toLowerCase();
+    if (!malformed && codeLower === lower) return {
+      ok: true,
+      id: code,
+      form: provider ? "canonical" : "bare"
+    };
+    const i = codeLower.indexOf("/");
+    if (i < 0) continue;
+    const codeBare = codeLower.slice(i + 1);
+    if (bareId && codeBare === bareId) exact.add(code);
+    else if (lastSegment && codeBare.slice(codeBare.lastIndexOf("/") + 1) === lastSegment) hints.add(code);
+  }
+  const sorted = [
+    ...exact
+  ].sort();
+  if (!provider && !malformed && sorted.length === 1) return {
+    ok: true,
+    id: sorted[0],
+    form: "bare"
+  };
+  if (!provider && !malformed && sorted.length > 1) {
+    return {
+      ok: false,
+      reason: "ambiguous",
+      requested,
+      candidates: sorted
+    };
+  }
+  return {
+    ok: false,
+    reason: "unknown",
+    requested,
+    candidates: sorted.length ? sorted : [
+      ...hints
+    ].sort()
+  };
+}
+__name(normalizeModelId, "normalizeModelId");
+__name2(normalizeModelId, "normalizeModelId");
+function modelUnresolvedMessage(r) {
+  if (r.reason === "empty") return "model pin is empty \u2014 pin an approved model (provider/model) or omit `model`";
+  if (r.reason === "ambiguous") {
+    return `model "${r.requested}" does not resolve to one approved model \u2014 it names ${r.candidates.length}; pin one of: ${r.candidates.join(", ")}`;
+  }
+  return r.candidates.length ? `model "${r.requested}" does not resolve to an approved model \u2014 accepted forms: ${r.candidates.join(", ")}` : `model "${r.requested}" does not resolve to an approved model \u2014 accepted forms are the registry's provider-prefixed ids (provider/model) or a bare id that names exactly one of them`;
+}
+__name(modelUnresolvedMessage, "modelUnresolvedMessage");
+__name2(modelUnresolvedMessage, "modelUnresolvedMessage");
 var IMPLICIT_MODEL_SELECTION_SOURCES = [
   "workspace-default",
   "platform-default"
@@ -1709,6 +1797,79 @@ var WORKFLOW_RETRY_BACKOFFS = [
   "fixed",
   "exponential"
 ];
+var WORKFLOW_RETRY_MIN_ATTEMPTS = 1;
+var WORKFLOW_RETRY_POLICY_KEYS = [
+  "maxAttempts",
+  "backoffSeconds",
+  "backoff",
+  "maxBackoffSeconds"
+];
+var WORKFLOW_RETRY_MAX_ATTEMPTS = 20;
+function workflowRetryMaxAttemptsMessage(got) {
+  const tail = got === void 0 ? "" : ` (got ${JSON.stringify(got)})`;
+  return `\`retry.maxAttempts\` must be an integer ${WORKFLOW_RETRY_MIN_ATTEMPTS}..${WORKFLOW_RETRY_MAX_ATTEMPTS}${tail}`;
+}
+__name(workflowRetryMaxAttemptsMessage, "workflowRetryMaxAttemptsMessage");
+__name2(workflowRetryMaxAttemptsMessage, "workflowRetryMaxAttemptsMessage");
+function isWithinWorkflowRetryAttempts(value3) {
+  return typeof value3 === "number" && Number.isInteger(value3) && value3 >= WORKFLOW_RETRY_MIN_ATTEMPTS && value3 <= WORKFLOW_RETRY_MAX_ATTEMPTS;
+}
+__name(isWithinWorkflowRetryAttempts, "isWithinWorkflowRetryAttempts");
+__name2(isWithinWorkflowRetryAttempts, "isWithinWorkflowRetryAttempts");
+var WORKFLOW_RETRY_ENGINE_KEYS = [
+  "budgetBaseAttempt"
+];
+function workflowRetryUnknownMembersMessage(keys) {
+  const named = keys.map((k) => {
+    const engine = WORKFLOW_RETRY_ENGINE_KEYS.includes(k);
+    return `\`${k}\`${engine ? " (engine-owned \u2014 stamped by resetAttempts, never authored)" : ""}`;
+  });
+  return `\`retry\` has no member ${named.join(", ")}; members: ${WORKFLOW_RETRY_POLICY_KEYS.join(", ")}`;
+}
+__name(workflowRetryUnknownMembersMessage, "workflowRetryUnknownMembersMessage");
+__name2(workflowRetryUnknownMembersMessage, "workflowRetryUnknownMembersMessage");
+function unknownWorkflowRetryMembers(retry) {
+  if (!retry || typeof retry !== "object" || Array.isArray(retry)) return [];
+  return Object.keys(retry).filter((k) => !WORKFLOW_RETRY_POLICY_KEYS.includes(k));
+}
+__name(unknownWorkflowRetryMembers, "unknownWorkflowRetryMembers");
+__name2(unknownWorkflowRetryMembers, "unknownWorkflowRetryMembers");
+function authoredRetryPolicy(retry) {
+  if (!retry || typeof retry !== "object" || Array.isArray(retry)) return void 0;
+  const src = retry;
+  const out = {};
+  for (const k of WORKFLOW_RETRY_POLICY_KEYS) if (src[k] !== void 0) out[k] = src[k];
+  return Object.keys(out).length ? out : void 0;
+}
+__name(authoredRetryPolicy, "authoredRetryPolicy");
+__name2(authoredRetryPolicy, "authoredRetryPolicy");
+function retryBudgetBaseAttempt(row) {
+  const base = row.retry?.budgetBaseAttempt;
+  return typeof base === "number" && Number.isSafeInteger(base) && base > 0 ? base : 0;
+}
+__name(retryBudgetBaseAttempt, "retryBudgetBaseAttempt");
+__name2(retryBudgetBaseAttempt, "retryBudgetBaseAttempt");
+function retryBudgetAttempt(row) {
+  return Math.max(0, row.attempt - retryBudgetBaseAttempt(row));
+}
+__name(retryBudgetAttempt, "retryBudgetAttempt");
+__name2(retryBudgetAttempt, "retryBudgetAttempt");
+function retryBudgetMaxAttempts(row) {
+  const max = row.retry?.maxAttempts;
+  return typeof max === "number" && Number.isFinite(max) && max >= 1 ? max : 1;
+}
+__name(retryBudgetMaxAttempts, "retryBudgetMaxAttempts");
+__name2(retryBudgetMaxAttempts, "retryBudgetMaxAttempts");
+function retryBudgetRemaining(row) {
+  return retryBudgetAttempt(row) < retryBudgetMaxAttempts(row);
+}
+__name(retryBudgetRemaining, "retryBudgetRemaining");
+__name2(retryBudgetRemaining, "retryBudgetRemaining");
+function retriesRemaining(row) {
+  return Math.max(0, retryBudgetMaxAttempts(row) - retryBudgetAttempt(row));
+}
+__name(retriesRemaining, "retriesRemaining");
+__name2(retriesRemaining, "retriesRemaining");
 var WORKFLOW_JOB_RESOURCES = [
   "small",
   "medium",
@@ -2074,6 +2235,8 @@ var WORKFLOW_AUDIT_EVENTS = [
   "workflow.goal.resumed",
   "workflow.goal.done",
   "workflow.goal.closed",
+  // LUA-760: an ended goal's cadence Job retired (deleted) — inline on done / closed, by R21 / R28, or by sweep #30
+  "workflow.goal.job_retired",
   // --- org policy (02 §2.10 / 09 R23) ---
   "workflow.policy.retention_changed",
   "workflow.policy.pacing_changed",
@@ -2217,6 +2380,138 @@ ${items.join("\n\n")}`;
 }
 __name(renderTargetsBlock, "renderTargetsBlock");
 __name2(renderTargetsBlock, "renderTargetsBlock");
+var WORKFLOW_APPROVAL_OUTPUT_DECISIONS = [
+  "approved",
+  "denied",
+  "timed_out"
+];
+var WORKFLOW_APPROVAL_OUTPUT_SCHEMA = {
+  type: "object",
+  properties: {
+    approved: {
+      type: "boolean"
+    },
+    decision: {
+      type: "string",
+      enum: [
+        ...WORKFLOW_APPROVAL_OUTPUT_DECISIONS
+      ]
+    },
+    /** the approver's note when given, else the decision word — what `${stepResults.<id>.text}` reads */
+    text: {
+      type: "string"
+    },
+    note: {
+      type: "string"
+    },
+    editedPayload: {},
+    editRevision: {
+      type: "integer"
+    },
+    decidedBy: {
+      type: "object",
+      properties: {
+        id: {
+          type: "string"
+        },
+        kind: {
+          type: "string"
+        }
+      }
+    },
+    timedOut: {
+      type: "boolean"
+    },
+    escalations: {
+      type: "integer"
+    },
+    evidence: {
+      type: "array",
+      items: {
+        type: "string"
+      }
+    },
+    items: {
+      type: "array",
+      items: {
+        type: "object"
+      }
+    }
+  },
+  required: [
+    "approved",
+    "decision",
+    "text"
+  ]
+};
+function workflowApprovalDecisionOf(resumeData) {
+  if (resumeData.timedOut === true) return "timed_out";
+  return resumeData.approved === true ? "approved" : "denied";
+}
+__name(workflowApprovalDecisionOf, "workflowApprovalDecisionOf");
+__name2(workflowApprovalDecisionOf, "workflowApprovalDecisionOf");
+function workflowApprovalOutput(resumeData) {
+  const decision = typeof resumeData.decision === "string" ? resumeData.decision : workflowApprovalDecisionOf(resumeData);
+  const note = typeof resumeData.note === "string" && resumeData.note.trim() !== "" ? resumeData.note : void 0;
+  const text = typeof resumeData.text === "string" ? resumeData.text : note ?? decision;
+  return {
+    ...resumeData,
+    decision,
+    text
+  };
+}
+__name(workflowApprovalOutput, "workflowApprovalOutput");
+__name2(workflowApprovalOutput, "workflowApprovalOutput");
+function isWorkflowApprovalOutput(value3) {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) return false;
+  const v = value3;
+  return typeof v.approved === "boolean" && WORKFLOW_APPROVAL_OUTPUT_DECISIONS.includes(v.decision) && typeof v.text === "string";
+}
+__name(isWorkflowApprovalOutput, "isWorkflowApprovalOutput");
+__name2(isWorkflowApprovalOutput, "isWorkflowApprovalOutput");
+var JSON_FENCE_RE = /```(?:json)?[ \t]*\r?\n([\s\S]*?)\r?\n?```/g;
+function extractSingleJsonValue(text) {
+  const trimmed = (text ?? "").trim();
+  if (!trimmed) return {
+    reason: "reply is empty"
+  };
+  const fenced = [
+    ...trimmed.matchAll(JSON_FENCE_RE)
+  ];
+  if (fenced.length > 1) return {
+    reason: "reply carries more than one fenced block"
+  };
+  const candidate = fenced.length === 1 ? fenced[0][1].trim() : trimmed;
+  try {
+    return {
+      value: JSON.parse(candidate)
+    };
+  } catch {
+    if (fenced.length === 1) return {
+      reason: "fenced block is not valid JSON"
+    };
+  }
+  const opens = [
+    trimmed.indexOf("{"),
+    trimmed.indexOf("[")
+  ].filter((i) => i !== -1);
+  const start = opens.length ? Math.min(...opens) : -1;
+  const end = Math.max(trimmed.lastIndexOf("}"), trimmed.lastIndexOf("]"));
+  if (start === -1 || end <= start) return {
+    reason: "reply is not JSON"
+  };
+  try {
+    return {
+      value: JSON.parse(trimmed.slice(start, end + 1))
+    };
+  } catch {
+    return {
+      reason: "reply does not contain a single JSON value"
+    };
+  }
+}
+__name(extractSingleJsonValue, "extractSingleJsonValue");
+__name2(extractSingleJsonValue, "extractSingleJsonValue");
 
 // ../workflow-graph/dist/index.mjs
 import { createHash } from "crypto";
@@ -2225,122 +2520,620 @@ import { z as z22 } from "zod";
 import { createHash as createHash2 } from "crypto";
 var __defProp3 = Object.defineProperty;
 var __name3 = /* @__PURE__ */ __name((target, value22) => __defProp3(target, "name", { value: value22, configurable: true }), "__name");
-var SideEffectsSchema = z4.enum(WORKFLOW_SIDE_EFFECTS);
-var JobResourcesSchema = z4.enum(WORKFLOW_JOB_RESOURCES);
-var WORKFLOW_ARM_SUBRUN_ID = "$arm";
-var WORKSPACE_TEMPLATE_EXPR_RE = /^\$\{\s*(?:initData|input)\.([^}]+?)\s*\}$/;
-function workspaceTemplatePath(template22) {
-  const key = template22.trim();
-  const expr = WORKSPACE_TEMPLATE_EXPR_RE.exec(key);
-  if (expr) return expr[1].split(".");
-  if (key.includes("${")) return void 0;
-  return key.replace(/^(?:input|initData)\./, "").split(".");
+var WorkflowTemplateError = class extends Error {
+  static {
+    __name(this, "WorkflowTemplateError");
+  }
+  static {
+    __name3(this, "WorkflowTemplateError");
+  }
+  placeholder;
+  constructor(message, placeholder) {
+    super(message), this.placeholder = placeholder;
+    this.name = "WorkflowTemplateError";
+  }
+};
+function isMapConfigObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-__name(workspaceTemplatePath, "workspaceTemplatePath");
-__name3(workspaceTemplatePath, "workspaceTemplatePath");
-function retryBackoffs() {
-  if (!Array.isArray(WORKFLOW_RETRY_BACKOFFS)) {
-    throw new Error("@lua/shared-types.WORKFLOW_RETRY_BACKOFFS is not a tuple \u2014 a jest.mock('@lua/shared-types') must spread jest.requireActual('@lua/shared-types')");
+__name(isMapConfigObject, "isMapConfigObject");
+__name3(isMapConfigObject, "isMapConfigObject");
+function parseMapConfig(raw, stepId) {
+  if (isMapConfigObject(raw)) return raw;
+  if (typeof raw !== "string") {
+    throw new Error(`Stored mapping step "${stepId}" has a mapConfig that is neither a JSON string nor an object.`);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (e) {
+    throw new Error(`Stored mapping step "${stepId}" has invalid JSON mapConfig: ${e.message}`);
   }
-  return WORKFLOW_RETRY_BACKOFFS;
 }
-__name(retryBackoffs, "retryBackoffs");
-__name3(retryBackoffs, "retryBackoffs");
-var SLEEP_UNTIL_REPLACEMENT = Object.freeze({
-  type: "sleep",
-  duration: 6e4
-});
-function sleepUntilUnsupportedMessage(id) {
-  return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
+__name(parseMapConfig, "parseMapConfig");
+__name3(parseMapConfig, "parseMapConfig");
+function mapConfigWire(raw) {
+  if (typeof raw === "string") return raw;
+  if (isMapConfigObject(raw)) return canonicalJson(raw);
+  return void 0;
 }
-__name(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
-__name3(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
-var WORKFLOW_CAPS_DEFAULT = Object.freeze({
-  maxParallelArms: 16,
-  maxForeachConcurrency: 16,
-  maxForeachItems: 2e4,
-  maxNodes: 200,
-  maxNestingDepth: 3,
-  maxForeachRatePerSecond: 50,
-  maxLoopIntervalSeconds: 86400,
-  maxWorkerTimeoutSeconds: 600,
-  maxJobTimeoutSeconds: 86400,
-  maxJobSegmentSeconds: 14400
-});
-var WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS = 300;
-var WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS = 600;
-var WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS = 3600;
-var WORKFLOW_FOREACH_DEFAULT_CONCURRENCY = 4;
-var WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS = 256;
-var WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS = 100;
-var WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS = 168;
-var WORKFLOW_SIGNAL_DEFAULT_SOURCES = [
-  "webhook",
-  "api",
-  "user"
+__name(mapConfigWire, "mapConfigWire");
+__name3(mapConfigWire, "mapConfigWire");
+var TEMPLATE_PLACEHOLDER = /\$\{([^}]*)\}/g;
+var TEMPLATE_NAMESPACES = [
+  "initData",
+  "state",
+  "requestContext",
+  "stepResults"
 ];
-var clone = /* @__PURE__ */ __name3((v) => JSON.parse(JSON.stringify(v)), "clone");
-function fillPolicy(node, defaultTimeout) {
-  if (node.tier === void 0 && node.workspace !== void 0 && node.workspace !== "inherit") node.tier = "job";
-  if (node.timeoutSeconds === void 0) node.timeoutSeconds = node.tier === "job" ? WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS : defaultTimeout;
-  if (node.retry === void 0) node.retry = {
-    maxAttempts: 1
+function describeBadPlaceholder(template22, idx, rawExpr) {
+  return `Template placeholder #${idx} (\${${rawExpr}}) in '${template22}'`;
+}
+__name(describeBadPlaceholder, "describeBadPlaceholder");
+__name3(describeBadPlaceholder, "describeBadPlaceholder");
+function parseTemplatePlaceholder(rawExpr) {
+  const dot = rawExpr.indexOf(".");
+  return {
+    scope: dot === -1 ? rawExpr : rawExpr.slice(0, dot),
+    rest: dot === -1 ? "" : rawExpr.slice(dot + 1)
   };
-  if (node.onError === void 0) node.onError = "fail";
-  if ((node.type === "step" || node.type === "tool") && node.sideEffects === void 0) node.sideEffects = "none";
 }
-__name(fillPolicy, "fillPolicy");
-__name3(fillPolicy, "fillPolicy");
-function fillSingle(node) {
-  switch (node.type) {
-    case "step": {
-      fillPolicy(node, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS);
-      const s = node;
-      if (s.resumeTimeoutHours === void 0) s.resumeTimeoutHours = WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS;
-      if (s.onSuspendTimeout === void 0) s.onSuspendTimeout = "fail";
-      return;
-    }
-    case "agent":
-      fillPolicy(node, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS);
-      return;
-    case "tool":
-      fillPolicy(node, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS);
-      return;
-    case "workflow":
-      if (node.workflowId === WORKFLOW_ARM_SUBRUN_ID && Array.isArray(node.graph) && node.graph[1]) fillSingle(node.graph[1]);
-      return;
+__name(parseTemplatePlaceholder, "parseTemplatePlaceholder");
+__name3(parseTemplatePlaceholder, "parseTemplatePlaceholder");
+function traverseMappingPath(root, path, errorLabel) {
+  if (path === "" || path === ".") return root;
+  const parts = path.split(".");
+  let value22 = root;
+  for (const part of parts) {
+    if (typeof value22 === "object" && value22 !== null) value22 = value22[part];
+    else throw new WorkflowTemplateError(`Invalid path ${path} in ${errorLabel}`, path);
   }
+  return value22;
 }
-__name(fillSingle, "fillSingle");
-__name3(fillSingle, "fillSingle");
-function fillHitl(node) {
-  if (node.type === "approval") {
-    const a = node;
-    if (a.approver === void 0) a.approver = "creator";
-    if (a.timeoutHours === void 0) a.timeoutHours = WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS;
-    if (a.onTimeout === void 0) a.onTimeout = "deny";
-    if (a.onDeny === void 0) a.onDeny = "continue";
-    if (a.excludeInitiator === void 0) a.excludeInitiator = false;
-    if (a.editable === void 0) a.editable = false;
-    return;
+__name(traverseMappingPath, "traverseMappingPath");
+__name3(traverseMappingPath, "traverseMappingPath");
+function stringifyTemplateValue(v, template22, idx, rawExpr) {
+  if (v === null || v === void 0) return "";
+  if (typeof v === "object") {
+    try {
+      return JSON.stringify(v);
+    } catch (err) {
+      throw new WorkflowTemplateError(`${describeBadPlaceholder(template22, idx, rawExpr)} resolved to a value that could not be JSON-stringified (${err.message}).`, rawExpr);
+    }
   }
-  const w = node;
-  if (w.timeoutHours === void 0) w.timeoutHours = WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS;
-  if (w.onTimeout === void 0) w.onTimeout = "fail";
-  if (w.acceptedSources === void 0) w.acceptedSources = [
-    ...WORKFLOW_SIGNAL_DEFAULT_SOURCES
-  ];
+  return String(v);
 }
-__name(fillHitl, "fillHitl");
-__name3(fillHitl, "fillHitl");
-function fillArm(arm) {
-  if (arm.type === "mapping") return;
-  if (isHitlNode(arm)) fillHitl(arm);
-  else fillSingle(arm);
+__name(stringifyTemplateValue, "stringifyTemplateValue");
+__name3(stringifyTemplateValue, "stringifyTemplateValue");
+function escapeFence(content) {
+  return content.replace(/<\/lua-data/g, "<\\/lua-data");
 }
-__name(fillArm, "fillArm");
-__name3(fillArm, "fillArm");
-function fillEntry(entry) {
+__name(escapeFence, "escapeFence");
+__name3(escapeFence, "escapeFence");
+function fenceBlock(name, source, content) {
+  return `<lua-data name="${name}" source="${source}" untrusted="true">${escapeFence(content)}</lua-data>`;
+}
+__name(fenceBlock, "fenceBlock");
+__name3(fenceBlock, "fenceBlock");
+function renderTemplate(template22, ctx, opts) {
+  let idx = 0;
+  return template22.replace(TEMPLATE_PLACEHOLDER, (_match, rawExpr) => {
+    idx += 1;
+    const { scope, rest } = parseTemplatePlaceholder(rawExpr);
+    const label = describeBadPlaceholder(template22, idx, rawExpr);
+    let rendered;
+    let source;
+    switch (scope) {
+      case "initData":
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.initData, rest, label), template22, idx, rawExpr);
+        source = "initData";
+        break;
+      case "state":
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.state, rest, label), template22, idx, rawExpr);
+        source = "state";
+        break;
+      case "requestContext":
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.requestContext, rest, label), template22, idx, rawExpr);
+        source = "requestContext";
+        break;
+      case "stepResults": {
+        const innerDot = rest.indexOf(".");
+        const stepId = innerDot === -1 ? rest : rest.slice(0, innerDot);
+        const subPath = innerDot === -1 ? "" : rest.slice(innerDot + 1);
+        if (!stepId) throw new WorkflowTemplateError(`${label} must name a step: \${stepResults.<stepId>.<path>}.`, rawExpr);
+        if (!(stepId in ctx.stepResults) || ctx.stepResults[stepId] == null) {
+          throw new WorkflowTemplateError(`${label} references stepResults.${stepId} but step "${stepId}" has no resolvable output (not an ancestor, not run, failed, or produced no output).`, rawExpr);
+        }
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.stepResults[stepId], subPath, label), template22, idx, rawExpr);
+        source = `step:${stepId}`;
+        break;
+      }
+      default:
+        throw new WorkflowTemplateError(`${label} references unknown namespace "${scope}". Use one of: ${TEMPLATE_NAMESPACES.join(", ")}.`, rawExpr);
+    }
+    return opts.fenced ? fenceBlock(rawExpr, source, rendered) : rendered;
+  });
+}
+__name(renderTemplate, "renderTemplate");
+__name3(renderTemplate, "renderTemplate");
+function isMapDescriptor(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  const d = v;
+  const keys = Object.keys(d);
+  const only = /* @__PURE__ */ __name3((...allowed) => keys.every((k) => allowed.includes(k)), "only");
+  if ("value" in d) return keys.length === 1;
+  if ("template" in d) return keys.length === 1 && typeof d.template === "string";
+  if ("requestContextPath" in d) return keys.length === 1 && typeof d.requestContextPath === "string";
+  if ("knowledge" in d) return keys.length === 1 && typeof d.knowledge === "object" && d.knowledge !== null;
+  if ("initData" in d) return d.initData === true && typeof d.path === "string" && only("initData", "path");
+  if ("step" in d) {
+    const stepOk = typeof d.step === "string" || Array.isArray(d.step) && d.step.every((x) => typeof x === "string");
+    return stepOk && typeof d.path === "string" && only("step", "path", "rows");
+  }
+  return false;
+}
+__name(isMapDescriptor, "isMapDescriptor");
+__name3(isMapDescriptor, "isMapDescriptor");
+var MAP_DESCRIPTOR_KEYS = [
+  "step",
+  "path",
+  "initData",
+  "value",
+  "template",
+  "requestContextPath",
+  "knowledge"
+];
+var MAP_MEMBER_MALFORMED_CODE = "map-member-malformed";
+function malformedMapMembers(cfg) {
+  if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) return [];
+  const out = [];
+  for (const [member, v] of Object.entries(cfg)) {
+    if (!v || typeof v !== "object" || Array.isArray(v) || isMapDescriptor(v)) continue;
+    const keys = Object.keys(v).filter((k) => MAP_DESCRIPTOR_KEYS.includes(k));
+    if (keys.length > 0) out.push({
+      member,
+      keys
+    });
+  }
+  return out;
+}
+__name(malformedMapMembers, "malformedMapMembers");
+__name3(malformedMapMembers, "malformedMapMembers");
+function mapMemberMalformedMessage(id, m) {
+  const keys = m.keys.map((k) => `\`${k}\``).join(", ");
+  return `"${id}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
+}
+__name(mapMemberMalformedMessage, "mapMemberMalformedMessage");
+__name3(mapMemberMalformedMessage, "mapMemberMalformedMessage");
+function resolveDescriptor(key, m, ctx) {
+  if (!isMapDescriptor(m)) return {
+    value: m
+  };
+  try {
+    if ("value" in m) return {
+      value: m.value
+    };
+    if ("template" in m && typeof m.template === "string") {
+      return {
+        value: renderTemplate(m.template, ctx, {
+          fenced: false
+        })
+      };
+    }
+    if ("knowledge" in m || "rows" in m && m.rows !== void 0) {
+      return {
+        error: "binding_unresolved",
+        key
+      };
+    }
+    if ("requestContextPath" in m) {
+      const label = `requestContext path for key "${key}"`;
+      return {
+        value: traverseMappingPath(ctx.requestContext, m.requestContextPath, label)
+      };
+    }
+    if ("path" in m) {
+      const source = "initData" in m && m.initData ? "initData" : "step";
+      if (source === "initData") {
+        return {
+          value: traverseMappingPath(ctx.initData, m.path, `initData for key "${key}"`)
+        };
+      }
+      const stepRef = m.step;
+      const candidates = Array.isArray(stepRef) ? stepRef : [
+        stepRef
+      ];
+      const stepId = candidates.find((s) => ctx.stepResults[s] !== void 0 && ctx.stepResults[s] !== null);
+      if (stepId === void 0) return {
+        error: "binding_unresolved",
+        key
+      };
+      return {
+        value: traverseMappingPath(ctx.stepResults[stepId], m.path, `step ${candidates.join("|")} for key "${key}"`)
+      };
+    }
+    return {
+      error: "binding_unresolved",
+      key
+    };
+  } catch (err) {
+    if (err instanceof WorkflowTemplateError) return {
+      error: "binding_unresolved",
+      key
+    };
+    throw err;
+  }
+}
+__name(resolveDescriptor, "resolveDescriptor");
+__name3(resolveDescriptor, "resolveDescriptor");
+function resolveMapping(cfg, ctx) {
+  const keys = Object.keys(cfg);
+  if (keys.length === 1 && keys[0] === "") {
+    return resolveDescriptor("", cfg[""], ctx);
+  }
+  const result = {};
+  for (const key of keys) {
+    const resolved = resolveDescriptor(key, cfg[key], ctx);
+    if ("error" in resolved) return resolved;
+    result[key] = resolved.value;
+  }
+  return {
+    value: result
+  };
+}
+__name(resolveMapping, "resolveMapping");
+__name3(resolveMapping, "resolveMapping");
+var fromInit = /* @__PURE__ */ __name3((path) => ({
+  initData: true,
+  path
+}), "fromInit");
+var fromStep = /* @__PURE__ */ __name3((s, path = "") => {
+  const idOf = /* @__PURE__ */ __name3((x) => typeof x === "string" ? x : x.id, "idOf");
+  return {
+    step: Array.isArray(s) ? s.map(idOf) : idOf(s),
+    path
+  };
+}, "fromStep");
+var value = /* @__PURE__ */ __name3((v) => ({
+  value: v
+}), "value");
+var template = /* @__PURE__ */ __name3((s) => ({
+  template: s
+}), "template");
+var fromRequest = /* @__PURE__ */ __name3((path) => ({
+  requestContextPath: path
+}), "fromRequest");
+var rows = /* @__PURE__ */ __name3((s, path, page) => ({
+  step: typeof s === "string" ? s : s.id,
+  path,
+  rows: page
+}), "rows");
+var fromKnowledge = /* @__PURE__ */ __name3((k) => ({
+  knowledge: k
+}), "fromKnowledge");
+var SideEffectsSchema = z4.enum(WORKFLOW_SIDE_EFFECTS);
+var JobResourcesSchema = z4.enum(WORKFLOW_JOB_RESOURCES);
+var APPROVER_SPEC_MAX_USERS = 20;
+var ESCALATION_MAX_HOPS = 3;
+var TemplateBindingSchema = z22.object({
+  template: z22.string().min(1).max(2048)
+}).strict();
+var ApproverSpecSchema = z22.union([
+  z22.literal("creator"),
+  z22.literal("org-admins"),
+  z22.object({
+    users: z22.union([
+      z22.array(z22.string().min(1).max(128)).min(1).max(APPROVER_SPEC_MAX_USERS),
+      TemplateBindingSchema
+    ])
+  }).strict(),
+  z22.object({
+    role: z22.union([
+      z22.string().min(1).max(128),
+      TemplateBindingSchema
+    ])
+  }).strict(),
+  z22.object({
+    group: z22.union([
+      z22.string().min(1).max(128),
+      TemplateBindingSchema
+    ])
+  }).strict(),
+  z22.object({
+    governance: z22.object({
+      policyId: z22.string().min(1).max(128)
+    }).strict()
+  }).strict()
+]);
+var FourEyesSchema = z22.object({
+  edit: ApproverSpecSchema,
+  approve: ApproverSpecSchema
+}).strict();
+var EscalationHopSchema = z22.object({
+  escalateTo: ApproverSpecSchema,
+  timeoutHours: z22.number().finite().min(1).max(720)
+}).strict();
+var TerminalOutcomeSchema = z22.enum([
+  "deny",
+  "cancel-run",
+  "fail",
+  "continue"
+]);
+var ApprovalOnTimeoutSchema = z22.union([
+  TerminalOutcomeSchema,
+  EscalationHopSchema,
+  z22.array(z22.union([
+    TerminalOutcomeSchema,
+    EscalationHopSchema
+  ])).min(1).max(ESCALATION_MAX_HOPS + 1)
+]);
+var APPROVER_SPEC_SHAPES = [
+  "'creator'",
+  "'org-admins'",
+  "{users:[userId, \u2026]}",
+  "{role:roleName}",
+  "{group:groupName}",
+  "{governance:{policyId}}"
+];
+var APPROVER_WRITTEN_MAX = 120;
+var USER_ID_SHAPED_RE = /^[^\s@]{1,128}$/;
+function describeApproverSpecRefusal(spec) {
+  const raw = spec === void 0 ? "undefined" : JSON.stringify(spec) ?? String(spec);
+  const written = raw.length > APPROVER_WRITTEN_MAX ? `${raw.slice(0, APPROVER_WRITTEN_MAX - 1)}\u2026` : raw;
+  const users = typeof spec === "object" && spec !== null ? spec.users : void 0;
+  const approver = typeof users === "string" && USER_ID_SHAPED_RE.test(users) ? {
+    users: [
+      users
+    ]
+  } : "creator";
+  const message = `approver ${written} is not an approver \u2014 legal: ${APPROVER_SPEC_SHAPES.join(" | ")}. 'creator' is the person who started the run: write approver:'creator' for "ask me" / "I approve"; {users:[\u2026]} takes user ids, never emails, names or {type:'user'}` + (approver === "creator" ? "" : `; here: approver:${JSON.stringify(approver)}`);
+  return {
+    approver,
+    written,
+    message
+  };
+}
+__name(describeApproverSpecRefusal, "describeApproverSpecRefusal");
+__name3(describeApproverSpecRefusal, "describeApproverSpecRefusal");
+var BINDING_ROOTS = [
+  "initData",
+  "stepResults",
+  "requestContext",
+  "state"
+];
+function bindingRootsOk(template22) {
+  const refs = [
+    ...template22.matchAll(/\$\{\s*([A-Za-z_$][\w$]*)/g)
+  ].map((m) => m[1]);
+  return refs.length > 0 && refs.every((r) => BINDING_ROOTS.includes(r));
+}
+__name(bindingRootsOk, "bindingRootsOk");
+__name3(bindingRootsOk, "bindingRootsOk");
+function isTemplateBinding(v) {
+  return typeof v === "object" && v !== null && typeof v.template === "string";
+}
+__name(isTemplateBinding, "isTemplateBinding");
+__name3(isTemplateBinding, "isTemplateBinding");
+function approvalEditable(node) {
+  if (node.editable === true) return true;
+  if (node.editable === false) return false;
+  return Array.isArray(node.editablePaths) && node.editablePaths.length > 0;
+}
+__name(approvalEditable, "approvalEditable");
+__name3(approvalEditable, "approvalEditable");
+function validateApproverBlock(node, opts = {
+  path: "approval"
+}) {
+  const issues = [];
+  const push = /* @__PURE__ */ __name3((code, path, message, severity = "error") => issues.push({
+    code,
+    path,
+    severity,
+    message
+  }), "push");
+  const checkSpec = /* @__PURE__ */ __name3((spec, path) => {
+    const r = ApproverSpecSchema.safeParse(spec);
+    if (!r.success) {
+      const users = spec?.users;
+      if (Array.isArray(users) && users.length > APPROVER_SPEC_MAX_USERS) push("cap-exceeded", path, `at most ${APPROVER_SPEC_MAX_USERS} users`);
+      else {
+        const refusal = describeApproverSpecRefusal(spec);
+        issues.push({
+          code: "approver-invalid",
+          path,
+          severity: "error",
+          message: refusal.message,
+          repair: {
+            approver: refusal.approver,
+            written: refusal.written
+          }
+        });
+      }
+      return;
+    }
+    const s = r.data;
+    if (typeof s === "object") {
+      if ("governance" in s && !opts.governanceEnabled) push("approver-governance-unavailable", path, "governance reviewer routing is not enabled for this deployment");
+      if ("group" in s && typeof s.group === "string" && !opts.scimEnabled && opts.idpGroups?.includes(s.group)) push("approver-idp-group-unavailable", path, "IdP-group approvers are not enabled for this deployment");
+      const binding = "users" in s ? s.users : "role" in s ? s.role : "group" in s ? s.group : void 0;
+      if (isTemplateBinding(binding)) {
+        if (!bindingRootsOk(binding.template)) push("approver-binding-invalid", `${path}.template`, "binding root must be initData / stepResults / requestContext / state");
+        if ("users" in s && opts.customerReachable) push("approver-binding-customer-reachable", `${path}.users`, "a customer-reachable workflow may not bind its approver list");
+      }
+    }
+  }, "checkSpec");
+  if (node.approver !== void 0) checkSpec(node.approver, `${opts.path}.approver`);
+  if (node.fourEyes !== void 0) {
+    const r = FourEyesSchema.safeParse(node.fourEyes);
+    if (!r.success) push("approver-invalid", `${opts.path}.fourEyes`, "fourEyes needs { edit, approve } approver specs");
+    else {
+      checkSpec(r.data.edit, `${opts.path}.fourEyes.edit`);
+      checkSpec(r.data.approve, `${opts.path}.fourEyes.approve`);
+    }
+    if (!approvalEditable(node)) push("four-eyes-requires-editable", `${opts.path}.fourEyes`, "fourEyes requires editable:true");
+    if (node.approver !== void 0) push("four-eyes-overrides-approver", `${opts.path}.approver`, "fourEyes replaces approver", "warning");
+    if (node.itemsPath) push("four-eyes-items-unsupported", `${opts.path}.fourEyes`, "fourEyes cannot combine with itemsPath");
+  }
+  if (node.excludeInitiator && (node.approver === void 0 || node.approver === "creator") && !node.fourEyes) push("approver-excludes-only-candidate", `${opts.path}.excludeInitiator`, "'creator' with excludeInitiator leaves no approver");
+  if (Array.isArray(node.onTimeout)) {
+    const chain = node.onTimeout;
+    const hops = chain.filter((m) => typeof m === "object" && m !== null && "escalateTo" in m);
+    if (hops.length > ESCALATION_MAX_HOPS) push("escalation-chain-too-long", `${opts.path}.onTimeout`, `at most ${ESCALATION_MAX_HOPS} hops`);
+    const last = chain[chain.length - 1];
+    if (typeof last === "object" && last !== null) push("escalation-chain-not-terminal", `${opts.path}.onTimeout`, "a chain must end in deny | cancel-run | fail");
+    hops.forEach((h, i) => checkSpec(h.escalateTo, `${opts.path}.onTimeout[${i}].escalateTo`));
+  } else if (typeof node.onTimeout === "object" && node.onTimeout !== null) {
+    checkSpec(node.onTimeout.escalateTo, `${opts.path}.onTimeout.escalateTo`);
+  }
+  return issues;
+}
+__name(validateApproverBlock, "validateApproverBlock");
+__name3(validateApproverBlock, "validateApproverBlock");
+function liftRenderedApprover(row, rendered) {
+  const text = (rendered ?? "").trim();
+  if (!text) return null;
+  if (row === "users") {
+    let members = null;
+    if (text.startsWith("[")) {
+      try {
+        members = JSON.parse(text);
+      } catch {
+        return null;
+      }
+    } else members = text.split(",").map((s) => s.trim());
+    if (!Array.isArray(members) || members.length === 0 || members.length > APPROVER_SPEC_MAX_USERS) return null;
+    if (!members.every((m) => typeof m === "string" && m.length > 0 && m.length <= 128)) return null;
+    return {
+      users: [
+        ...new Set(members)
+      ].sort()
+    };
+  }
+  if (text.length > 128 || text.startsWith("[") || text.startsWith("{")) return null;
+  return row === "role" ? {
+    role: text
+  } : {
+    group: text
+  };
+}
+__name(liftRenderedApprover, "liftRenderedApprover");
+__name3(liftRenderedApprover, "liftRenderedApprover");
+var WORKSPACE_TEMPLATE_EXPR_RE = /^\$\{\s*(?:initData|input)\.([^}]+?)\s*\}$/;
+function workspaceTemplatePath(template22) {
+  const key = template22.trim();
+  const expr = WORKSPACE_TEMPLATE_EXPR_RE.exec(key);
+  if (expr) return expr[1].split(".");
+  if (key.includes("${")) return void 0;
+  return key.replace(/^(?:input|initData)\./, "").split(".");
+}
+__name(workspaceTemplatePath, "workspaceTemplatePath");
+__name3(workspaceTemplatePath, "workspaceTemplatePath");
+function retryBackoffs() {
+  if (!Array.isArray(WORKFLOW_RETRY_BACKOFFS)) {
+    throw new Error("@lua/shared-types.WORKFLOW_RETRY_BACKOFFS is not a tuple \u2014 a jest.mock('@lua/shared-types') must spread jest.requireActual('@lua/shared-types')");
+  }
+  return WORKFLOW_RETRY_BACKOFFS;
+}
+__name(retryBackoffs, "retryBackoffs");
+__name3(retryBackoffs, "retryBackoffs");
+var SLEEP_UNTIL_REPLACEMENT = Object.freeze({
+  type: "sleep",
+  duration: 6e4
+});
+function sleepUntilUnsupportedMessage(id) {
+  return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
+}
+__name(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
+__name3(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
+function armSubrunUnsupportedMessage(id, workflowId) {
+  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
+}
+__name(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
+__name3(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
+var WORKFLOW_CAPS_DEFAULT = Object.freeze({
+  maxParallelArms: 16,
+  maxForeachConcurrency: 16,
+  maxForeachItems: 2e4,
+  maxNodes: 200,
+  maxNestingDepth: 3,
+  maxForeachRatePerSecond: 50,
+  maxLoopIntervalSeconds: 86400,
+  maxWorkerTimeoutSeconds: 600,
+  maxJobTimeoutSeconds: 86400,
+  maxJobSegmentSeconds: 14400
+});
+var WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS = 300;
+var WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS = 600;
+var WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS = 3600;
+var WORKFLOW_FOREACH_DEFAULT_CONCURRENCY = 4;
+var WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS = 256;
+var WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS = 100;
+var WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS = 168;
+var WORKFLOW_SIGNAL_DEFAULT_SOURCES = [
+  "webhook",
+  "api",
+  "user"
+];
+var clone = /* @__PURE__ */ __name3((v) => JSON.parse(JSON.stringify(v)), "clone");
+function fillPolicy(node, defaultTimeout) {
+  if (node.tier === void 0 && node.workspace !== void 0 && node.workspace !== "inherit") node.tier = "job";
+  if (node.timeoutSeconds === void 0) node.timeoutSeconds = node.tier === "job" ? WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS : defaultTimeout;
+  if (node.retry === void 0) node.retry = {
+    maxAttempts: 1
+  };
+  if (node.onError === void 0) node.onError = "fail";
+  if ((node.type === "step" || node.type === "tool") && node.sideEffects === void 0) node.sideEffects = "none";
+}
+__name(fillPolicy, "fillPolicy");
+__name3(fillPolicy, "fillPolicy");
+function fillSingle(node) {
+  switch (node.type) {
+    case "step": {
+      fillPolicy(node, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS);
+      const s = node;
+      if (s.resumeTimeoutHours === void 0) s.resumeTimeoutHours = WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS;
+      if (s.onSuspendTimeout === void 0) s.onSuspendTimeout = "fail";
+      return;
+    }
+    case "agent":
+      fillPolicy(node, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS);
+      return;
+    case "tool":
+      fillPolicy(node, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS);
+      return;
+    case "workflow":
+      return;
+  }
+}
+__name(fillSingle, "fillSingle");
+__name3(fillSingle, "fillSingle");
+function fillHitl(node) {
+  if (node.type === "approval") {
+    const a = node;
+    if (a.approver === void 0) a.approver = "creator";
+    if (a.timeoutHours === void 0) a.timeoutHours = WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS;
+    if (a.onTimeout === void 0) a.onTimeout = "deny";
+    if (a.onDeny === void 0) a.onDeny = "continue";
+    if (a.excludeInitiator === void 0) a.excludeInitiator = false;
+    if (a.editable === void 0) a.editable = false;
+    return;
+  }
+  const w = node;
+  if (w.timeoutHours === void 0) w.timeoutHours = WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS;
+  if (w.onTimeout === void 0) w.onTimeout = "fail";
+  if (w.acceptedSources === void 0) w.acceptedSources = [
+    ...WORKFLOW_SIGNAL_DEFAULT_SOURCES
+  ];
+}
+__name(fillHitl, "fillHitl");
+__name3(fillHitl, "fillHitl");
+function fillArm(arm) {
+  if (arm.type === "mapping") return;
+  if (isHitlNode(arm)) fillHitl(arm);
+  else fillSingle(arm);
+}
+__name(fillArm, "fillArm");
+__name3(fillArm, "fillArm");
+function fillEntry(entry) {
   switch (entry.type) {
     case "step":
     case "agent":
@@ -2482,12 +3275,11 @@ function mapConfigStepRefs(raw) {
   if (!cfg) return [];
   const ids = [];
   for (const d of Object.values(cfg)) {
-    if (!d || typeof d !== "object") continue;
-    const desc = d;
-    if (desc.step !== void 0) ids.push(...Array.isArray(desc.step) ? desc.step : [
-      desc.step
+    if (!isMapDescriptor(d)) continue;
+    if ("step" in d) ids.push(...Array.isArray(d.step) ? d.step : [
+      d.step
     ]);
-    if (typeof desc.template === "string") ids.push(...templateStepRefs(desc.template));
+    if ("template" in d) ids.push(...templateStepRefs(d.template));
   }
   return ids;
 }
@@ -2498,8 +3290,14 @@ function nodeStepRefs(entry) {
     case "agent": {
       const a = entry;
       const p = a.promptTemplate;
-      return typeof p === "string" ? templateStepRefs(p) : p && "template" in p ? templateStepRefs(p.template) : [];
+      const prompt = typeof p === "string" ? templateStepRefs(p) : p && "template" in p ? templateStepRefs(p.template) : [];
+      return [
+        ...prompt,
+        ...mapConfigStepRefs(a.input)
+      ];
     }
+    case "step":
+      return mapConfigStepRefs(entry.input);
     case "tool":
       return mapConfigStepRefs(entry.input);
     case "workflow":
@@ -2616,6 +3414,12 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const r = node.retry;
     if (!r) return;
     const id = singleId(node);
+    const unknown = unknownWorkflowRetryMembers(r);
+    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path}.retry`, id);
+    if (r.maxAttempts !== void 0 && !isWithinWorkflowRetryAttempts(r.maxAttempts)) {
+      const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
+      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path}.retry.maxAttempts`, id);
+    }
     const backoffs = retryBackoffs();
     if (r.backoff !== void 0 && !backoffs.includes(r.backoff)) {
       const list = backoffs.map((b) => `'${b}'`).join(" | ");
@@ -2712,6 +3516,21 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path}.model`, id);
     }
   }, "checkTier");
+  const checkModel = /* @__PURE__ */ __name3((node, path) => {
+    if (node.type !== "agent" || typeof node.model !== "string") return;
+    const registry = opts.approvedModels;
+    if (registry === void 0) return;
+    const id = singleId(node);
+    if (registry === "unavailable") {
+      const pin = node.model.trim();
+      if (pin && !normalizeModelId(pin, []).ok) {
+        warn("model-unresolved", `model "${pin}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`, `${path}.model`, id);
+      }
+      return;
+    }
+    const resolved = normalizeModelId(node.model, registry);
+    if (!resolved.ok) err("model-unresolved", modelUnresolvedMessage(resolved), `${path}.model`, id);
+  }, "checkModel");
   const checkWorkspace = /* @__PURE__ */ __name3((node, path) => {
     const id = singleId(node);
     const ws = workspaceOf(node);
@@ -2758,35 +3577,43 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const schema = node.type === "step" ? node.step.outputSchema : node.type === "agent" ? node.outputSchema : void 0;
     if (schema !== void 0) outputSchemas.set(singleId(node), schema);
   }, "recordOutputSchema");
+  const checkMapMembers = /* @__PURE__ */ __name3((cfg, basePath, id) => {
+    for (const m of malformedMapMembers(cfg)) {
+      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id, m), `${basePath}.${m.member}`, id);
+    }
+  }, "checkMapMembers");
+  const checkInputShape = /* @__PURE__ */ __name3((node, path) => {
+    const input = node.input;
+    if (input === void 0) return;
+    const id = singleId(node);
+    if (input !== null && typeof input === "object" && !Array.isArray(input)) {
+      checkMapMembers(input, `${path}.input`, id);
+      return;
+    }
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path}.input`, id);
+  }, "checkInputShape");
+  const checkBodyInput = /* @__PURE__ */ __name3((body, path, container) => {
+    if (body.type === "workflow" || body.input === void 0) return;
+    err("arm-input-unsupported", container === "foreach" ? `a foreach body receives each item as its input \u2014 drop \`input\` on "${singleId(body)}" and map the items before the foreach instead` : `a loop body receives the previous output as its input \u2014 drop \`input\` on "${singleId(body)}" and put the map before the loop instead`, `${path}.input`, singleId(body));
+  }, "checkBodyInput");
   const checkSingle = /* @__PURE__ */ __name3((node, path, depth) => {
     recordOutputSchema(node);
-    if (node.type === "workflow" && node.workflowId === WORKFLOW_ARM_SUBRUN_ID) {
+    if (node.type === "workflow" && (typeof node.workflowId !== "string" || node.workflowId.length === 0)) {
       checkId(node.id, path);
-      const body = node.graph;
-      if (!Array.isArray(body) || body.length !== 2 || body[0]?.type !== "mapping" || !body[1]) {
-        err("container-arm-empty", "an implicit arm subrun needs a [mapping, step] body", `${path}.graph`, node.id);
-        return;
-      }
-      if (body[1].type === "mapping") {
-        err("container-arm-empty", "a bare mapping arm has nothing to run", `${path}.graph.1`, node.id);
-        return;
-      }
-      const inner = body[1];
-      if (isHitlNode(inner)) {
-        err("node-type-unsupported-in-container", workflowHitlArmShapeMessage(inner.type, inner.id, "mapped-arm"), `${path}.graph.1`, inner.id);
-        return;
-      }
-      upstream.add(singleId(body[1]));
-      checkArm(body[0], `${path}.graph.0`, depth, "parallel");
-      checkSingle(body[1], `${path}.graph.1`, depth);
-      upstream.add(body[0].id);
-      upstream.add(singleId(body[1]));
+      err("invalid-envelope", `\`workflowId\` must be a non-empty string naming the workflow to start (got ${JSON.stringify(node.workflowId)})`, `${path}.workflowId`, node.id);
+      return;
+    }
+    if (node.type === "workflow" && (node.workflowId.startsWith("$") || Array.isArray(node.graph))) {
+      checkId(node.id, path);
+      err("node-type-unsupported-by-engine", armSubrunUnsupportedMessage(node.id, node.workflowId), path, node.id);
       return;
     }
     checkId(singleId(node), path);
     checkPolicyEnums(node, path);
+    checkInputShape(node, path);
     checkTimeout(node, path);
     checkTier(node, path);
+    checkModel(node, path);
     checkRetry(node, path);
     checkWorkspace(node, path);
     if (!opts.static) {
@@ -2809,7 +3636,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (node.type === "workflow" && node.kind === "subrun" && depth > caps.maxNestingDepth) {
       err("cap-exceeded", `nesting depth ${depth} exceeds ${caps.maxNestingDepth}`, path, node.id);
     }
-    if (node.type === "workflow" && node.workflowId !== WORKFLOW_ARM_SUBRUN_ID && typeof g.definition?.id === "string" && node.workflowId === g.definition.id) {
+    if (node.type === "workflow" && typeof g.definition?.id === "string" && node.workflowId === g.definition.id) {
       err("subrun-cycle", `"${node.id}" starts "${node.workflowId}", which is this workflow itself`, path, node.id);
     }
     for (const ref of nodeStepRefs(node)) {
@@ -2830,11 +3657,14 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (a.approver === "creator" && a.excludeInitiator === true) {
       err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path, a.id);
     }
-    if (a.fourEyes !== void 0 && a.editable !== true) {
+    const editable = approvalEditable(a);
+    if (a.fourEyes !== void 0 && !editable) {
       err("four-eyes-requires-editable", "`fourEyes` requires editable:true", `${path}.fourEyes`, a.id);
     }
-    if ((a.editablePaths !== void 0 || a.editedPayloadSchema !== void 0) && a.editable !== true) {
-      err("editable-path-invalid", "`editablePaths` / `editedPayloadSchema` require editable:true", `${path}.editablePaths`, a.id);
+    if (a.editable === false && Array.isArray(a.editablePaths) && a.editablePaths.length > 0) {
+      err("editable-path-invalid", "`editablePaths` beside editable:false is contradictory \u2014 drop the paths or set editable:true", `${path}.editablePaths`, a.id);
+    } else if ((a.editablePaths !== void 0 || a.editedPayloadSchema !== void 0) && !editable) {
+      err("editable-path-invalid", "`editablePaths` / `editedPayloadSchema` require editable:true (a non-empty editablePaths implies it)", `${path}.editablePaths`, a.id);
     }
     for (const p of a.editablePaths ?? []) {
       if (!EDITABLE_PATH_RE.test(p)) err("editable-path-invalid", `editablePaths entry "${p}" is outside the seg(.seg)*[*]/[n] grammar`, `${path}.editablePaths`, a.id);
@@ -2865,6 +3695,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const checkArm = /* @__PURE__ */ __name3((arm, path, depth, container) => {
     if (arm.type === "mapping") {
       checkId(arm.id, path);
+      checkMapMembers(readMapConfig(arm.mapConfig), `${path}.mapConfig`, arm.id);
       for (const ref of nodeStepRefs(arm)) {
         if (!upstream.has(ref)) err("template-reference-unresolved", `"${arm.id}" references stepResults.${ref}, which is not upstream`, path, arm.id);
       }
@@ -2889,6 +3720,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         break;
       case "mapping":
         checkId(entry.id, path);
+        checkMapMembers(readMapConfig(entry.mapConfig), `${path}.mapConfig`, entry.id);
         for (const ref of nodeStepRefs(entry)) {
           if (!upstream.has(ref)) err("template-reference-unresolved", `"${entry.id}" references stepResults.${ref}, which is not upstream`, path, entry.id);
         }
@@ -3013,6 +3845,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
           } else checkHitlArm(f.step, `${path}.step`, "foreach");
           declared.push(f.step.id);
         } else {
+          checkBodyInput(f.step, `${path}.step`, "foreach");
           checkSingle(f.step, `${path}.step`, o.chunk ? 2 : 1);
           declared.push(singleId(f.step));
         }
@@ -3033,6 +3866,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
           checkHitlArm(l.step, `${path}.step`, "loop");
           declared.push(l.step.id);
         } else {
+          checkBodyInput(l.step, `${path}.step`, "loop");
           checkSingle(l.step, `${path}.step`, 1);
           declared.push(singleId(l.step));
         }
@@ -3512,361 +4346,123 @@ __name3(renderPredicate, "renderPredicate");
 function wrapLabel(child, rendered) {
   return child.op === "and" || child.op === "or" || child.op === "not" ? `(${rendered})` : rendered;
 }
-__name(wrapLabel, "wrapLabel");
-__name3(wrapLabel, "wrapLabel");
-function renderRef(ref) {
-  if ("literal" in ref) return JSON.stringify(ref.literal);
-  return ref.path;
-}
-__name(renderRef, "renderRef");
-__name3(renderRef, "renderRef");
-var stepIdOf = /* @__PURE__ */ __name3((s) => typeof s === "string" ? s : s.id, "stepIdOf");
-function step(s) {
-  const id = stepIdOf(s);
-  return {
-    path: /* @__PURE__ */ __name3((p) => ({
-      path: p === "" ? `stepResults.${id}` : `stepResults.${id}.${p}`
-    }), "path")
-  };
-}
-__name(step, "step");
-__name3(step, "step");
-function stepOf(id) {
-  return step(id);
-}
-__name(stepOf, "stepOf");
-__name3(stepOf, "stepOf");
-function init(path) {
-  return {
-    path: path === "" ? "initData" : `initData.${path}`
-  };
-}
-__name(init, "init");
-__name3(init, "init");
-function state(path) {
-  return {
-    path: path === "" ? "state" : `state.${path}`
-  };
-}
-__name(state, "state");
-__name3(state, "state");
-function lit(v) {
-  return {
-    literal: v
-  };
-}
-__name(lit, "lit");
-__name3(lit, "lit");
-function toPathOrLiteral(v) {
-  if (typeof v === "object" && v !== null) {
-    if ("path" in v) return {
-      path: v.path
-    };
-    if ("literal" in v) return {
-      literal: v.literal
-    };
-  }
-  return {
-    literal: v
-  };
-}
-__name(toPathOrLiteral, "toPathOrLiteral");
-__name3(toPathOrLiteral, "toPathOrLiteral");
-var cmp = /* @__PURE__ */ __name3((op) => (l, r) => ({
-  op,
-  left: toPathOrLiteral(l),
-  right: toPathOrLiteral(r)
-}), "cmp");
-var eq = cmp("eq");
-var ne = cmp("ne");
-var gt = cmp("gt");
-var gte = cmp("gte");
-var lt = cmp("lt");
-var lte = cmp("lte");
-var inSet = /* @__PURE__ */ __name3((v, set) => ({
-  op: "in",
-  value: {
-    path: v.path
-  },
-  set
-}), "inSet");
-var notIn = /* @__PURE__ */ __name3((v, set) => ({
-  op: "notIn",
-  value: {
-    path: v.path
-  },
-  set
-}), "notIn");
-var exists = /* @__PURE__ */ __name3((ref) => ({
-  op: "exists",
-  path: ref.path
-}), "exists");
-var notExists = /* @__PURE__ */ __name3((ref) => ({
-  op: "notExists",
-  path: ref.path
-}), "notExists");
-var truthy = /* @__PURE__ */ __name3((ref) => ({
-  op: "truthy",
-  value: {
-    path: ref.path
-  }
-}), "truthy");
-var falsy = /* @__PURE__ */ __name3((ref) => ({
-  op: "falsy",
-  value: {
-    path: ref.path
-  }
-}), "falsy");
-var and = /* @__PURE__ */ __name3((...args) => ({
-  op: "and",
-  args
-}), "and");
-var or = /* @__PURE__ */ __name3((...args) => ({
-  op: "or",
-  args
-}), "or");
-var not = /* @__PURE__ */ __name3((arg) => ({
-  op: "not",
-  arg
-}), "not");
-var WorkflowTemplateError = class extends Error {
-  static {
-    __name(this, "WorkflowTemplateError");
-  }
-  static {
-    __name3(this, "WorkflowTemplateError");
-  }
-  placeholder;
-  constructor(message, placeholder) {
-    super(message), this.placeholder = placeholder;
-    this.name = "WorkflowTemplateError";
-  }
-};
-function isMapConfigObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-__name(isMapConfigObject, "isMapConfigObject");
-__name3(isMapConfigObject, "isMapConfigObject");
-function parseMapConfig(raw, stepId) {
-  if (isMapConfigObject(raw)) return raw;
-  if (typeof raw !== "string") {
-    throw new Error(`Stored mapping step "${stepId}" has a mapConfig that is neither a JSON string nor an object.`);
-  }
-  try {
-    return JSON.parse(raw);
-  } catch (e) {
-    throw new Error(`Stored mapping step "${stepId}" has invalid JSON mapConfig: ${e.message}`);
-  }
-}
-__name(parseMapConfig, "parseMapConfig");
-__name3(parseMapConfig, "parseMapConfig");
-function mapConfigWire(raw) {
-  if (typeof raw === "string") return raw;
-  if (isMapConfigObject(raw)) return canonicalJson(raw);
-  return void 0;
-}
-__name(mapConfigWire, "mapConfigWire");
-__name3(mapConfigWire, "mapConfigWire");
-var TEMPLATE_PLACEHOLDER = /\$\{([^}]*)\}/g;
-var TEMPLATE_NAMESPACES = [
-  "initData",
-  "state",
-  "requestContext",
-  "stepResults"
-];
-function describeBadPlaceholder(template22, idx, rawExpr) {
-  return `Template placeholder #${idx} (\${${rawExpr}}) in '${template22}'`;
-}
-__name(describeBadPlaceholder, "describeBadPlaceholder");
-__name3(describeBadPlaceholder, "describeBadPlaceholder");
-function parseTemplatePlaceholder(rawExpr) {
-  const dot = rawExpr.indexOf(".");
+__name(wrapLabel, "wrapLabel");
+__name3(wrapLabel, "wrapLabel");
+function renderRef(ref) {
+  if ("literal" in ref) return JSON.stringify(ref.literal);
+  return ref.path;
+}
+__name(renderRef, "renderRef");
+__name3(renderRef, "renderRef");
+var stepIdOf = /* @__PURE__ */ __name3((s) => typeof s === "string" ? s : s.id, "stepIdOf");
+function step(s) {
+  const id = stepIdOf(s);
   return {
-    scope: dot === -1 ? rawExpr : rawExpr.slice(0, dot),
-    rest: dot === -1 ? "" : rawExpr.slice(dot + 1)
+    path: /* @__PURE__ */ __name3((p) => ({
+      path: p === "" ? `stepResults.${id}` : `stepResults.${id}.${p}`
+    }), "path")
   };
 }
-__name(parseTemplatePlaceholder, "parseTemplatePlaceholder");
-__name3(parseTemplatePlaceholder, "parseTemplatePlaceholder");
-function traverseMappingPath(root, path, errorLabel) {
-  if (path === "" || path === ".") return root;
-  const parts = path.split(".");
-  let value22 = root;
-  for (const part of parts) {
-    if (typeof value22 === "object" && value22 !== null) value22 = value22[part];
-    else throw new WorkflowTemplateError(`Invalid path ${path} in ${errorLabel}`, path);
-  }
-  return value22;
-}
-__name(traverseMappingPath, "traverseMappingPath");
-__name3(traverseMappingPath, "traverseMappingPath");
-function stringifyTemplateValue(v, template22, idx, rawExpr) {
-  if (v === null || v === void 0) return "";
-  if (typeof v === "object") {
-    try {
-      return JSON.stringify(v);
-    } catch (err) {
-      throw new WorkflowTemplateError(`${describeBadPlaceholder(template22, idx, rawExpr)} resolved to a value that could not be JSON-stringified (${err.message}).`, rawExpr);
-    }
-  }
-  return String(v);
+__name(step, "step");
+__name3(step, "step");
+function stepOf(id) {
+  return step(id);
 }
-__name(stringifyTemplateValue, "stringifyTemplateValue");
-__name3(stringifyTemplateValue, "stringifyTemplateValue");
-function escapeFence(content) {
-  return content.replace(/<\/lua-data/g, "<\\/lua-data");
+__name(stepOf, "stepOf");
+__name3(stepOf, "stepOf");
+function init(path) {
+  return {
+    path: path === "" ? "initData" : `initData.${path}`
+  };
 }
-__name(escapeFence, "escapeFence");
-__name3(escapeFence, "escapeFence");
-function fenceBlock(name, source, content) {
-  return `<lua-data name="${name}" source="${source}" untrusted="true">${escapeFence(content)}</lua-data>`;
+__name(init, "init");
+__name3(init, "init");
+function state(path) {
+  return {
+    path: path === "" ? "state" : `state.${path}`
+  };
 }
-__name(fenceBlock, "fenceBlock");
-__name3(fenceBlock, "fenceBlock");
-function renderTemplate(template22, ctx, opts) {
-  let idx = 0;
-  return template22.replace(TEMPLATE_PLACEHOLDER, (_match, rawExpr) => {
-    idx += 1;
-    const { scope, rest } = parseTemplatePlaceholder(rawExpr);
-    const label = describeBadPlaceholder(template22, idx, rawExpr);
-    let rendered;
-    let source;
-    switch (scope) {
-      case "initData":
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.initData, rest, label), template22, idx, rawExpr);
-        source = "initData";
-        break;
-      case "state":
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.state, rest, label), template22, idx, rawExpr);
-        source = "state";
-        break;
-      case "requestContext":
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.requestContext, rest, label), template22, idx, rawExpr);
-        source = "requestContext";
-        break;
-      case "stepResults": {
-        const innerDot = rest.indexOf(".");
-        const stepId = innerDot === -1 ? rest : rest.slice(0, innerDot);
-        const subPath = innerDot === -1 ? "" : rest.slice(innerDot + 1);
-        if (!stepId) throw new WorkflowTemplateError(`${label} must name a step: \${stepResults.<stepId>.<path>}.`, rawExpr);
-        if (!(stepId in ctx.stepResults) || ctx.stepResults[stepId] == null) {
-          throw new WorkflowTemplateError(`${label} references stepResults.${stepId} but step "${stepId}" has no resolvable output (not an ancestor, not run, failed, or produced no output).`, rawExpr);
-        }
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.stepResults[stepId], subPath, label), template22, idx, rawExpr);
-        source = `step:${stepId}`;
-        break;
-      }
-      default:
-        throw new WorkflowTemplateError(`${label} references unknown namespace "${scope}". Use one of: ${TEMPLATE_NAMESPACES.join(", ")}.`, rawExpr);
-    }
-    return opts.fenced ? fenceBlock(rawExpr, source, rendered) : rendered;
-  });
+__name(state, "state");
+__name3(state, "state");
+function lit(v) {
+  return {
+    literal: v
+  };
 }
-__name(renderTemplate, "renderTemplate");
-__name3(renderTemplate, "renderTemplate");
-function resolveDescriptor(key, m, ctx) {
-  try {
-    if ("value" in m) return {
-      value: m.value
-    };
-    if ("template" in m && typeof m.template === "string") {
-      return {
-        value: renderTemplate(m.template, ctx, {
-          fenced: false
-        })
-      };
-    }
-    if ("knowledge" in m || "rows" in m && m.rows !== void 0) {
-      return {
-        error: "binding_unresolved",
-        key
-      };
-    }
-    if ("requestContextPath" in m) {
-      const label = `requestContext path for key "${key}"`;
-      return {
-        value: traverseMappingPath(ctx.requestContext, m.requestContextPath, label)
-      };
-    }
-    if ("path" in m) {
-      const source = "initData" in m && m.initData ? "initData" : "step";
-      if (source === "initData") {
-        return {
-          value: traverseMappingPath(ctx.initData, m.path, `initData for key "${key}"`)
-        };
-      }
-      const stepRef = m.step;
-      const candidates = Array.isArray(stepRef) ? stepRef : [
-        stepRef
-      ];
-      const stepId = candidates.find((s) => ctx.stepResults[s] !== void 0 && ctx.stepResults[s] !== null);
-      if (stepId === void 0) return {
-        error: "binding_unresolved",
-        key
-      };
-      return {
-        value: traverseMappingPath(ctx.stepResults[stepId], m.path, `step ${candidates.join("|")} for key "${key}"`)
-      };
-    }
-    return {
-      error: "binding_unresolved",
-      key
+__name(lit, "lit");
+__name3(lit, "lit");
+function toPathOrLiteral(v) {
+  if (typeof v === "object" && v !== null) {
+    if ("path" in v) return {
+      path: v.path
     };
-  } catch (err) {
-    if (err instanceof WorkflowTemplateError) return {
-      error: "binding_unresolved",
-      key
+    if ("literal" in v) return {
+      literal: v.literal
     };
-    throw err;
-  }
-}
-__name(resolveDescriptor, "resolveDescriptor");
-__name3(resolveDescriptor, "resolveDescriptor");
-function resolveMapping(cfg, ctx) {
-  const keys = Object.keys(cfg);
-  if (keys.length === 1 && keys[0] === "") {
-    return resolveDescriptor("", cfg[""], ctx);
-  }
-  const result = {};
-  for (const key of keys) {
-    const resolved = resolveDescriptor(key, cfg[key], ctx);
-    if ("error" in resolved) return resolved;
-    result[key] = resolved.value;
   }
   return {
-    value: result
+    literal: v
   };
 }
-__name(resolveMapping, "resolveMapping");
-__name3(resolveMapping, "resolveMapping");
-var fromInit = /* @__PURE__ */ __name3((path) => ({
-  initData: true,
-  path
-}), "fromInit");
-var fromStep = /* @__PURE__ */ __name3((s, path = "") => {
-  const idOf = /* @__PURE__ */ __name3((x) => typeof x === "string" ? x : x.id, "idOf");
-  return {
-    step: Array.isArray(s) ? s.map(idOf) : idOf(s),
-    path
-  };
-}, "fromStep");
-var value = /* @__PURE__ */ __name3((v) => ({
-  value: v
-}), "value");
-var template = /* @__PURE__ */ __name3((s) => ({
-  template: s
-}), "template");
-var fromRequest = /* @__PURE__ */ __name3((path) => ({
-  requestContextPath: path
-}), "fromRequest");
-var rows = /* @__PURE__ */ __name3((s, path, page) => ({
-  step: typeof s === "string" ? s : s.id,
-  path,
-  rows: page
-}), "rows");
-var fromKnowledge = /* @__PURE__ */ __name3((k) => ({
-  knowledge: k
-}), "fromKnowledge");
+__name(toPathOrLiteral, "toPathOrLiteral");
+__name3(toPathOrLiteral, "toPathOrLiteral");
+var cmp = /* @__PURE__ */ __name3((op) => (l, r) => ({
+  op,
+  left: toPathOrLiteral(l),
+  right: toPathOrLiteral(r)
+}), "cmp");
+var eq = cmp("eq");
+var ne = cmp("ne");
+var gt = cmp("gt");
+var gte = cmp("gte");
+var lt = cmp("lt");
+var lte = cmp("lte");
+var inSet = /* @__PURE__ */ __name3((v, set) => ({
+  op: "in",
+  value: {
+    path: v.path
+  },
+  set
+}), "inSet");
+var notIn = /* @__PURE__ */ __name3((v, set) => ({
+  op: "notIn",
+  value: {
+    path: v.path
+  },
+  set
+}), "notIn");
+var exists = /* @__PURE__ */ __name3((ref) => ({
+  op: "exists",
+  path: ref.path
+}), "exists");
+var notExists = /* @__PURE__ */ __name3((ref) => ({
+  op: "notExists",
+  path: ref.path
+}), "notExists");
+var truthy = /* @__PURE__ */ __name3((ref) => ({
+  op: "truthy",
+  value: {
+    path: ref.path
+  }
+}), "truthy");
+var falsy = /* @__PURE__ */ __name3((ref) => ({
+  op: "falsy",
+  value: {
+    path: ref.path
+  }
+}), "falsy");
+var and = /* @__PURE__ */ __name3((...args) => ({
+  op: "and",
+  args
+}), "and");
+var or = /* @__PURE__ */ __name3((...args) => ({
+  op: "or",
+  args
+}), "or");
+var not = /* @__PURE__ */ __name3((arg) => ({
+  op: "not",
+  arg
+}), "not");
 var CONTINUED_FAILURE_TAG = "continued_failure";
 var CONTINUED_FAILURE_DEFAULT_CODE = "step_failed";
 var CONTINUED_FAILURE_OUTPUT_SCHEMA = Object.freeze({
@@ -3938,21 +4534,14 @@ function isContinuedFailureValue(v) {
 __name(isContinuedFailureValue, "isContinuedFailureValue");
 __name3(isContinuedFailureValue, "isContinuedFailureValue");
 var isHitlNode2 = /* @__PURE__ */ __name3((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
-function lowerContainerArm(mapping, step22) {
-  const stepId = nodeIdOf(step22);
+function inlineContainerArm(mapping, step22) {
   return {
-    type: "workflow",
-    id: `${stepId}_arm`,
-    workflowId: WORKFLOW_ARM_SUBRUN_ID,
-    kind: "subrun",
-    graph: [
-      mapping,
-      step22
-    ]
+    ...step22,
+    input: parseMapConfig(mapping.mapConfig, mapping.id)
   };
 }
-__name(lowerContainerArm, "lowerContainerArm");
-__name3(lowerContainerArm, "lowerContainerArm");
+__name(inlineContainerArm, "inlineContainerArm");
+__name3(inlineContainerArm, "inlineContainerArm");
 var nodeIdOf = /* @__PURE__ */ __name3((n2) => n2.type === "step" ? n2.step.id : n2.id, "nodeIdOf");
 function entryIds(entry) {
   switch (entry.type) {
@@ -4023,6 +4612,27 @@ function resolvePlacements(calls) {
         break;
     }
   });
+  const armMapPlacementIssue = /* @__PURE__ */ __name3((node, ref, i, container) => {
+    if (!ref.armMap || node.type === "mapping" || isHitlNode2(node)) return void 0;
+    const id = nodeIdOf(node);
+    if ((container === "foreach" || container === "loop") && node.type !== "workflow") {
+      return {
+        code: "mapping-placement",
+        message: container === "foreach" ? `foreach body "${id}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
+        callIndex: i,
+        stepId: id
+      };
+    }
+    if (node.input !== void 0) {
+      return {
+        code: "mapping-placement",
+        message: `"${id}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
+        callIndex: i,
+        stepId: id
+      };
+    }
+    return void 0;
+  }, "armMapPlacementIssue");
   const hitlPlacementIssue = /* @__PURE__ */ __name3((node, ref, i, container) => {
     if (!isHitlNode2(node)) return void 0;
     const id = node.id;
@@ -4049,7 +4659,7 @@ function resolvePlacements(calls) {
       if (ref.node.type === "mapping" && !allowMapping) {
         issues.push({
           code: "mapping-placement",
-          message: `mapping "${ref.node.id}" cannot be a container arm \u2014 chain it as [map, step]`,
+          message: `mapping "${ref.node.id}" cannot be a container arm \u2014 chain it as [map, step] in a parallel / conditional arm, or place the .map() before the container`,
           callIndex: i,
           stepId: ref.node.id
         });
@@ -4070,7 +4680,7 @@ function resolvePlacements(calls) {
     if (d.node.type === "mapping" && !allowMapping) {
       issues.push({
         code: "mapping-placement",
-        message: `map "${ref.ref}" cannot be a parallel/foreach/loop arm \u2014 chain it as [map, step]`,
+        message: `map "${ref.ref}" cannot be a parallel/foreach/loop arm \u2014 chain it as [map, step] in a parallel arm, or place the .map() before the container`,
         callIndex: i,
         stepId: ref.ref
       });
@@ -4081,6 +4691,11 @@ function resolvePlacements(calls) {
       issues.push(hitl);
       return void 0;
     }
+    const mapped = armMapPlacementIssue(d.node, ref, i, container);
+    if (mapped) {
+      issues.push(mapped);
+      return void 0;
+    }
     const prior = placedBy.get(ref.ref);
     if (prior !== void 0 && prior !== i) {
       issues.push({
@@ -4101,6 +4716,10 @@ function resolvePlacements(calls) {
     }
     const hitl = hitlPlacementIssue(ref.node, ref, i, container);
     if (hitl) issues.push(hitl);
+    else {
+      const mapped = armMapPlacementIssue(ref.node, ref, i, container);
+      if (mapped) issues.push(mapped);
+    }
   }, "claim");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -4128,7 +4747,7 @@ function resolvePlacements(calls) {
   const lookup = /* @__PURE__ */ __name3((ref) => {
     const n2 = "node" in ref ? ref.node : declared.get(ref.ref)?.node;
     if (!n2 || !ref.armMap || n2.type === "mapping" || isHitlNode2(n2)) return n2;
-    return lowerContainerArm(ref.armMap, n2);
+    return inlineContainerArm(ref.armMap, n2);
   }, "lookup");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -4569,6 +5188,33 @@ function pruneUndefined(o) {
 }
 __name(pruneUndefined, "pruneUndefined");
 __name3(pruneUndefined, "pruneUndefined");
+var WORKFLOW_INLINE_RUN_TAG = "inline";
+function runOrigin(run) {
+  if (run.goalId) return "goal";
+  if (run.jobId || run.trigger === "schedule") return "schedule";
+  if (run.dynamic === true) return run.tags?.includes(WORKFLOW_INLINE_RUN_TAG) ? "inline" : "compose";
+  return "definition";
+}
+__name(runOrigin, "runOrigin");
+__name3(runOrigin, "runOrigin");
+var RUN_ERROR_ISSUES_MAX = 20;
+function runErrorIssues(issues) {
+  if (!Array.isArray(issues)) return void 0;
+  const out = [];
+  for (const raw of issues.slice(0, RUN_ERROR_ISSUES_MAX)) {
+    if (!raw || typeof raw !== "object") continue;
+    const o = raw;
+    if (typeof o.code !== "string" || !o.code) continue;
+    out.push(pruneUndefined({
+      code: o.code,
+      path: typeof o.path === "string" ? o.path : void 0,
+      message: typeof o.message === "string" ? o.message : void 0
+    }));
+  }
+  return out.length ? out : void 0;
+}
+__name(runErrorIssues, "runErrorIssues");
+__name3(runErrorIssues, "runErrorIssues");
 function runNextAction(run) {
   if (isTerminalRunStatus(run.status)) return "none";
   if (run.status === "suspended" && run.gate?.kind === "budget") return "raise_budget";
@@ -4626,10 +5272,57 @@ function runCounts(counts) {
 }
 __name(runCounts, "runCounts");
 __name3(runCounts, "runCounts");
-function runUsage(run) {
+function isPricedStepReceipt(receipt) {
+  return typeof receipt?.multiplier === "number" && Number.isFinite(receipt.multiplier);
+}
+__name(isPricedStepReceipt, "isPricedStepReceipt");
+__name3(isPricedStepReceipt, "isPricedStepReceipt");
+function receiptEngine(engine) {
+  if (engine === "actions") return "seat";
+  if (engine === "credits") return "legacy";
+  return void 0;
+}
+__name(receiptEngine, "receiptEngine");
+__name3(receiptEngine, "receiptEngine");
+function receiptTier(tier) {
+  return tier === "light" || tier === "standard" || tier === "heavy" ? tier : void 0;
+}
+__name(receiptTier, "receiptTier");
+__name3(receiptTier, "receiptTier");
+function stepBillingView(receipt) {
+  const engine = receiptEngine(receipt?.engine);
+  if (!receipt || engine === void 0) return void 0;
+  return pruneUndefined({
+    engine,
+    attempt: typeof receipt.attempt === "number" ? receipt.attempt : void 0,
+    credits: typeof receipt.credits === "number" ? receipt.credits : void 0,
+    actions: typeof receipt.actionsEstimate === "number" ? receipt.actionsEstimate : void 0,
+    model: typeof receipt.model === "string" ? receipt.model : void 0,
+    tier: receiptTier(receipt.tier),
+    multiplier: typeof receipt.multiplier === "number" ? receipt.multiplier : void 0,
+    byok: typeof receipt.byok === "boolean" ? receipt.byok : void 0,
+    calibrated: typeof receipt.calibrated === "boolean" ? receipt.calibrated : void 0
+  });
+}
+__name(stepBillingView, "stepBillingView");
+__name3(stepBillingView, "stepBillingView");
+function runUsage(run, receipts) {
+  const actions = n(run.budget?.spent?.actionsEstimate);
+  const stamped = run.budget?.engine;
+  const priced = (receipts ?? []).filter(isPricedStepReceipt);
+  const engine = stamped === "seat" || stamped === "legacy" ? stamped : actions > 0 || priced.some((r) => r.engine === "actions") ? "seat" : priced.some((r) => r.engine === "credits") ? "legacy" : void 0;
+  const seat = engine === "seat";
+  const metering = engine ? "priced" : "flat";
   return {
     creditsUsed: run.budget?.spent?.credits ?? 0,
     actionsEstimate: run.budget?.spent?.actionsEstimate ?? 0,
+    ...seat ? {
+      actionsUsed: actions
+    } : {},
+    metering,
+    ...engine ? {
+      engine
+    } : {},
     steps: run.budget?.spent?.steps ?? 0,
     inputTokens: run.usage?.inputTokens ?? 0,
     outputTokens: run.usage?.outputTokens ?? 0
@@ -4637,6 +5330,20 @@ function runUsage(run) {
 }
 __name(runUsage, "runUsage");
 __name3(runUsage, "runUsage");
+function runBudgetCap(budget) {
+  const cap = budget?.maxCredits;
+  return typeof cap === "number" && Number.isFinite(cap) && cap > 0 ? cap : void 0;
+}
+__name(runBudgetCap, "runBudgetCap");
+__name3(runBudgetCap, "runBudgetCap");
+function runBudgetRemaining(budget) {
+  const cap = runBudgetCap(budget);
+  if (cap === void 0) return void 0;
+  const spent = budget?.spent;
+  return Math.max(0, cap - n(spent?.credits) - n(spent?.actionsEstimate) - n(budget?.reserved));
+}
+__name(runBudgetRemaining, "runBudgetRemaining");
+__name3(runBudgetRemaining, "runBudgetRemaining");
 function runCancelView(cancel) {
   if (!cancel) return void 0;
   return {
@@ -4707,6 +5414,7 @@ function toWorkflowRunSummary(run) {
     repairOf: run.repairOf,
     repairRunIds: run.repairRunIds,
     trigger: run.trigger ?? "api",
+    origin: runOrigin(run),
     createdBy: {
       subjectType: principal?.subjectType ?? "system",
       subjectId: principal?.subjectId ?? run.userId ?? ""
@@ -4724,11 +5432,13 @@ function toWorkflowRunSummary(run) {
     usage: runUsage(run),
     // LUA-697: a row persisted before the write seams (#2406 / #2465 / the script tier) leaves scrubbed here too —
     // idempotent on a scrubbed message, bounded input; an empty message falls back to the code.
-    error: run.error ? {
+    error: run.error ? pruneUndefined({
       code: run.error.code ?? "error",
       message: scrubStepErrorMessage(run.error.message) ?? run.error.code ?? "error",
-      stepId: run.error.stepId
-    } : void 0,
+      stepId: run.error.stepId,
+      // LUA-784 (item 3): the unattended pre-start failure's refusal rows (`input_schema_invalid` and kin).
+      issues: runErrorIssues(run.error.issues)
+    }) : void 0,
     kind: "run",
     aclHash: run.aclHash,
     migration: run.migration,
@@ -5381,204 +6091,6 @@ function rebaseItemPointer(pointer, itemsPath, index) {
 }
 __name(rebaseItemPointer, "rebaseItemPointer");
 __name3(rebaseItemPointer, "rebaseItemPointer");
-var APPROVER_SPEC_MAX_USERS = 20;
-var ESCALATION_MAX_HOPS = 3;
-var TemplateBindingSchema = z22.object({
-  template: z22.string().min(1).max(2048)
-}).strict();
-var ApproverSpecSchema = z22.union([
-  z22.literal("creator"),
-  z22.literal("org-admins"),
-  z22.object({
-    users: z22.union([
-      z22.array(z22.string().min(1).max(128)).min(1).max(APPROVER_SPEC_MAX_USERS),
-      TemplateBindingSchema
-    ])
-  }).strict(),
-  z22.object({
-    role: z22.union([
-      z22.string().min(1).max(128),
-      TemplateBindingSchema
-    ])
-  }).strict(),
-  z22.object({
-    group: z22.union([
-      z22.string().min(1).max(128),
-      TemplateBindingSchema
-    ])
-  }).strict(),
-  z22.object({
-    governance: z22.object({
-      policyId: z22.string().min(1).max(128)
-    }).strict()
-  }).strict()
-]);
-var FourEyesSchema = z22.object({
-  edit: ApproverSpecSchema,
-  approve: ApproverSpecSchema
-}).strict();
-var EscalationHopSchema = z22.object({
-  escalateTo: ApproverSpecSchema,
-  timeoutHours: z22.number().finite().min(1).max(720)
-}).strict();
-var TerminalOutcomeSchema = z22.enum([
-  "deny",
-  "cancel-run",
-  "fail",
-  "continue"
-]);
-var ApprovalOnTimeoutSchema = z22.union([
-  TerminalOutcomeSchema,
-  EscalationHopSchema,
-  z22.array(z22.union([
-    TerminalOutcomeSchema,
-    EscalationHopSchema
-  ])).min(1).max(ESCALATION_MAX_HOPS + 1)
-]);
-var APPROVER_SPEC_SHAPES = [
-  "'creator'",
-  "'org-admins'",
-  "{users:[userId, \u2026]}",
-  "{role:roleName}",
-  "{group:groupName}",
-  "{governance:{policyId}}"
-];
-var APPROVER_WRITTEN_MAX = 120;
-var USER_ID_SHAPED_RE = /^[^\s@]{1,128}$/;
-function describeApproverSpecRefusal(spec) {
-  const raw = spec === void 0 ? "undefined" : JSON.stringify(spec) ?? String(spec);
-  const written = raw.length > APPROVER_WRITTEN_MAX ? `${raw.slice(0, APPROVER_WRITTEN_MAX - 1)}\u2026` : raw;
-  const users = typeof spec === "object" && spec !== null ? spec.users : void 0;
-  const approver = typeof users === "string" && USER_ID_SHAPED_RE.test(users) ? {
-    users: [
-      users
-    ]
-  } : "creator";
-  const message = `approver ${written} is not an approver \u2014 legal: ${APPROVER_SPEC_SHAPES.join(" | ")}. 'creator' is the person who started the run: write approver:'creator' for "ask me" / "I approve"; {users:[\u2026]} takes user ids, never emails, names or {type:'user'}` + (approver === "creator" ? "" : `; here: approver:${JSON.stringify(approver)}`);
-  return {
-    approver,
-    written,
-    message
-  };
-}
-__name(describeApproverSpecRefusal, "describeApproverSpecRefusal");
-__name3(describeApproverSpecRefusal, "describeApproverSpecRefusal");
-var BINDING_ROOTS = [
-  "initData",
-  "stepResults",
-  "requestContext",
-  "state"
-];
-function bindingRootsOk(template22) {
-  const refs = [
-    ...template22.matchAll(/\$\{\s*([A-Za-z_$][\w$]*)/g)
-  ].map((m) => m[1]);
-  return refs.length > 0 && refs.every((r) => BINDING_ROOTS.includes(r));
-}
-__name(bindingRootsOk, "bindingRootsOk");
-__name3(bindingRootsOk, "bindingRootsOk");
-function isTemplateBinding(v) {
-  return typeof v === "object" && v !== null && typeof v.template === "string";
-}
-__name(isTemplateBinding, "isTemplateBinding");
-__name3(isTemplateBinding, "isTemplateBinding");
-function validateApproverBlock(node, opts = {
-  path: "approval"
-}) {
-  const issues = [];
-  const push = /* @__PURE__ */ __name3((code, path, message, severity = "error") => issues.push({
-    code,
-    path,
-    severity,
-    message
-  }), "push");
-  const checkSpec = /* @__PURE__ */ __name3((spec, path) => {
-    const r = ApproverSpecSchema.safeParse(spec);
-    if (!r.success) {
-      const users = spec?.users;
-      if (Array.isArray(users) && users.length > APPROVER_SPEC_MAX_USERS) push("cap-exceeded", path, `at most ${APPROVER_SPEC_MAX_USERS} users`);
-      else {
-        const refusal = describeApproverSpecRefusal(spec);
-        issues.push({
-          code: "approver-invalid",
-          path,
-          severity: "error",
-          message: refusal.message,
-          repair: {
-            approver: refusal.approver,
-            written: refusal.written
-          }
-        });
-      }
-      return;
-    }
-    const s = r.data;
-    if (typeof s === "object") {
-      if ("governance" in s && !opts.governanceEnabled) push("approver-governance-unavailable", path, "governance reviewer routing is not enabled for this deployment");
-      if ("group" in s && typeof s.group === "string" && !opts.scimEnabled && opts.idpGroups?.includes(s.group)) push("approver-idp-group-unavailable", path, "IdP-group approvers are not enabled for this deployment");
-      const binding = "users" in s ? s.users : "role" in s ? s.role : "group" in s ? s.group : void 0;
-      if (isTemplateBinding(binding)) {
-        if (!bindingRootsOk(binding.template)) push("approver-binding-invalid", `${path}.template`, "binding root must be initData / stepResults / requestContext / state");
-        if ("users" in s && opts.customerReachable) push("approver-binding-customer-reachable", `${path}.users`, "a customer-reachable workflow may not bind its approver list");
-      }
-    }
-  }, "checkSpec");
-  if (node.approver !== void 0) checkSpec(node.approver, `${opts.path}.approver`);
-  if (node.fourEyes !== void 0) {
-    const r = FourEyesSchema.safeParse(node.fourEyes);
-    if (!r.success) push("approver-invalid", `${opts.path}.fourEyes`, "fourEyes needs { edit, approve } approver specs");
-    else {
-      checkSpec(r.data.edit, `${opts.path}.fourEyes.edit`);
-      checkSpec(r.data.approve, `${opts.path}.fourEyes.approve`);
-    }
-    if (!node.editable) push("four-eyes-requires-editable", `${opts.path}.fourEyes`, "fourEyes requires editable:true");
-    if (node.approver !== void 0) push("four-eyes-overrides-approver", `${opts.path}.approver`, "fourEyes replaces approver", "warning");
-    if (node.itemsPath) push("four-eyes-items-unsupported", `${opts.path}.fourEyes`, "fourEyes cannot combine with itemsPath");
-  }
-  if (node.excludeInitiator && (node.approver === void 0 || node.approver === "creator") && !node.fourEyes) push("approver-excludes-only-candidate", `${opts.path}.excludeInitiator`, "'creator' with excludeInitiator leaves no approver");
-  if (Array.isArray(node.onTimeout)) {
-    const chain = node.onTimeout;
-    const hops = chain.filter((m) => typeof m === "object" && m !== null && "escalateTo" in m);
-    if (hops.length > ESCALATION_MAX_HOPS) push("escalation-chain-too-long", `${opts.path}.onTimeout`, `at most ${ESCALATION_MAX_HOPS} hops`);
-    const last = chain[chain.length - 1];
-    if (typeof last === "object" && last !== null) push("escalation-chain-not-terminal", `${opts.path}.onTimeout`, "a chain must end in deny | cancel-run | fail");
-    hops.forEach((h, i) => checkSpec(h.escalateTo, `${opts.path}.onTimeout[${i}].escalateTo`));
-  } else if (typeof node.onTimeout === "object" && node.onTimeout !== null) {
-    checkSpec(node.onTimeout.escalateTo, `${opts.path}.onTimeout.escalateTo`);
-  }
-  return issues;
-}
-__name(validateApproverBlock, "validateApproverBlock");
-__name3(validateApproverBlock, "validateApproverBlock");
-function liftRenderedApprover(row, rendered) {
-  const text = (rendered ?? "").trim();
-  if (!text) return null;
-  if (row === "users") {
-    let members = null;
-    if (text.startsWith("[")) {
-      try {
-        members = JSON.parse(text);
-      } catch {
-        return null;
-      }
-    } else members = text.split(",").map((s) => s.trim());
-    if (!Array.isArray(members) || members.length === 0 || members.length > APPROVER_SPEC_MAX_USERS) return null;
-    if (!members.every((m) => typeof m === "string" && m.length > 0 && m.length <= 128)) return null;
-    return {
-      users: [
-        ...new Set(members)
-      ].sort()
-    };
-  }
-  if (text.length > 128 || text.startsWith("[") || text.startsWith("{")) return null;
-  return row === "role" ? {
-    role: text
-  } : {
-    group: text
-  };
-}
-__name(liftRenderedApprover, "liftRenderedApprover");
-__name3(liftRenderedApprover, "liftRenderedApprover");
 var WORKFLOW_ENV_OVERLAY_MAX_KEYS = 64;
 var WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES = 4096;
 var WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE = /(SECRET|TOKEN|KEY|PASSWORD)$/;
@@ -5862,7 +6374,6 @@ function* singleStepsOf(entry) {
       return;
     case "workflow":
       yield entry;
-      if (Array.isArray(entry.graph)) yield* singleStepsOf(entry.graph[1]);
       return;
     case "parallel":
     case "conditional":
@@ -6021,6 +6532,10 @@ var assertPredicate = /* @__PURE__ */ __name((p, where) => {
 }, "assertPredicate");
 var assertRetry = /* @__PURE__ */ __name((r, id) => {
   if (!r) return;
+  if (r.maxAttempts !== void 0 && !isWithinWorkflowRetryAttempts(r.maxAttempts)) {
+    const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
+    throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
+  }
   if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
   if (r.maxBackoffSeconds !== void 0) {
     if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
@@ -6170,14 +6685,13 @@ function stepNodeOf(s) {
 __name(stepNodeOf, "stepNodeOf");
 function materializeEntry(entry, steps) {
   const single = /* @__PURE__ */ __name((n2) => {
-    if (n2.type === "step" && steps[n2.step.id]) return stepNodeOf(steps[n2.step.id]);
-    if (n2.type === "workflow" && n2.workflowId === WORKFLOW_ARM_SUBRUN_ID && n2.graph) return {
-      ...n2,
-      graph: [
-        n2.graph[0],
-        single(n2.graph[1])
-      ]
-    };
+    if (n2.type === "step" && steps[n2.step.id]) {
+      const node = stepNodeOf(steps[n2.step.id]);
+      return n2.input !== void 0 ? {
+        ...node,
+        input: n2.input
+      } : node;
+    }
     return n2;
   }, "single");
   switch (entry.type) {