lua-cli 3.32.3 → 3.32.4

package/dist/index.js

@@ -65,6 +65,20 @@ var init_auth_error = __esm({
 });
 
 // src/errors/cli.error.ts
+function isTypedCliError(error) {
+  return CliError.isCliError(error) || AuthenticationError.isAuthenticationError(error);
+}
+function listHint(title, items, bullet = "- ") {
+  if (items.length === 0) return void 0;
+  return [
+    title,
+    ...items.map((item) => `  ${bullet}${item}`)
+  ].join("\n");
+}
+function joinHint(...parts) {
+  const lines = parts.filter((part) => typeof part === "string" && part.length > 0);
+  return lines.length > 0 ? lines.join("\n") : void 0;
+}
 function isAccessDeniedError(error) {
   if (CliError.isCliError(error)) return error.statusCode === 403;
   return error instanceof Error && error.message.startsWith("Access denied (403)");
@@ -265,10 +279,31 @@ var init_cli_error = __esm({
           statusCode: 403
         });
       }
+      /**
+      * An API refusal the site already holds the status of (LUA-766) — classified by the same table the top-level
+      * classifier applies to an untyped error: 401 auth · 403 forbidden · 404 not_found · other 4xx `http_<status>`
+      * (10) · 5xx / 0 unavailable (11, with the network hint unless the site gives its own) · no status `error` (1).
+      * A command that reads `response.error.statusCode` throws through here, so `lua logs` on a 503 exits 11 like
+      * every other verb instead of printing the message itself and then throwing an exit-1 `Error`.
+      */
+      static fromStatus(statusCode, message, hint) {
+        const reported = classifyCliError(Object.assign(new Error(message), {
+          statusCode
+        }));
+        const classHint = reported.exitCode === CLI_EXIT.UNAVAILABLE ? UNAVAILABLE_HINT : reported.hint;
+        return new _CliError(reported.code, message, {
+          exitCode: reported.exitCode,
+          hint: hint ?? classHint,
+          statusCode
+        });
+      }
       static isCliError(error) {
         return error instanceof _CliError || typeof error === "object" && error !== null && error.isCliError === true;
       }
     };
+    __name(isTypedCliError, "isTypedCliError");
+    __name(listHint, "listHint");
+    __name(joinHint, "joinHint");
     __name(isAccessDeniedError, "isAccessDeniedError");
     HandledCliError = class extends Error {
       static {
@@ -953,6 +988,84 @@ function isDesktopFileCommandName(value3) {
 function isDesktopFileSessionId(value3) {
   return typeof value3 === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value3);
 }
+function isModelIdSentinel(input) {
+  const lower = (input ?? "").trim().toLowerCase();
+  return lower === "auto" || lower.startsWith("auto/");
+}
+function normalizeModelId(input, registry) {
+  const requested = typeof input === "string" ? input.trim() : "";
+  if (!requested) return {
+    ok: false,
+    reason: "empty",
+    requested,
+    candidates: []
+  };
+  const lower = requested.toLowerCase();
+  if (isModelIdSentinel(lower)) return {
+    ok: true,
+    id: lower,
+    form: "sentinel"
+  };
+  const slash = requested.indexOf("/");
+  const malformed = slash === 0;
+  const provider = slash > 0 ? lower.slice(0, slash) : void 0;
+  if (provider && MODEL_ID_BYOK_PROVIDERS.includes(provider)) {
+    return {
+      ok: true,
+      id: requested,
+      form: "byok"
+    };
+  }
+  const bareId = slash >= 0 ? lower.slice(slash + 1) : lower;
+  const lastSegment = bareId.slice(bareId.lastIndexOf("/") + 1);
+  const exact = /* @__PURE__ */ new Set();
+  const hints = /* @__PURE__ */ new Set();
+  for (const code of registry) {
+    if (typeof code !== "string" || !code) continue;
+    const codeLower = code.toLowerCase();
+    if (!malformed && codeLower === lower) return {
+      ok: true,
+      id: code,
+      form: provider ? "canonical" : "bare"
+    };
+    const i = codeLower.indexOf("/");
+    if (i < 0) continue;
+    const codeBare = codeLower.slice(i + 1);
+    if (bareId && codeBare === bareId) exact.add(code);
+    else if (lastSegment && codeBare.slice(codeBare.lastIndexOf("/") + 1) === lastSegment) hints.add(code);
+  }
+  const sorted = [
+    ...exact
+  ].sort();
+  if (!provider && !malformed && sorted.length === 1) return {
+    ok: true,
+    id: sorted[0],
+    form: "bare"
+  };
+  if (!provider && !malformed && sorted.length > 1) {
+    return {
+      ok: false,
+      reason: "ambiguous",
+      requested,
+      candidates: sorted
+    };
+  }
+  return {
+    ok: false,
+    reason: "unknown",
+    requested,
+    candidates: sorted.length ? sorted : [
+      ...hints
+    ].sort()
+  };
+}
+function modelUnresolvedMessage(r) {
+  if (r.reason === "empty") return "model pin is empty \u2014 pin an approved model (provider/model) or omit `model`";
+  if (r.reason === "ambiguous") {
+    return `model "${r.requested}" does not resolve to one approved model \u2014 it names ${r.candidates.length}; pin one of: ${r.candidates.join(", ")}`;
+  }
+  return r.candidates.length ? `model "${r.requested}" does not resolve to an approved model \u2014 accepted forms: ${r.candidates.join(", ")}` : `model "${r.requested}" does not resolve to an approved model \u2014 accepted forms are the registry's provider-prefixed ids (provider/model) or a bare id that names exactly one of them`;
+}
 function isImplicitModelSelectionSource(source) {
   return source !== void 0 && IMPLICIT_MODEL_SELECTION_SOURCES.includes(source);
 }
@@ -1541,7 +1654,7 @@ function extractSingleJsonValue(text) {
     };
   }
 }
-var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE;
+var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, MODEL_ID_BYOK_PROVIDERS, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1849,6 +1962,16 @@ var init_dist = __esm({
     __name2(isDesktopFileCommandName, "isDesktopFileCommandName");
     __name(isDesktopFileSessionId, "isDesktopFileSessionId");
     __name2(isDesktopFileSessionId, "isDesktopFileSessionId");
+    MODEL_ID_BYOK_PROVIDERS = [
+      "azure",
+      "bedrock"
+    ];
+    __name(isModelIdSentinel, "isModelIdSentinel");
+    __name2(isModelIdSentinel, "isModelIdSentinel");
+    __name(normalizeModelId, "normalizeModelId");
+    __name2(normalizeModelId, "normalizeModelId");
+    __name(modelUnresolvedMessage, "modelUnresolvedMessage");
+    __name2(modelUnresolvedMessage, "modelUnresolvedMessage");
     REASONING_EFFORT_VALUES = [
       "off",
       "minimal",
@@ -3797,6 +3920,129 @@ function resolveMapping(cfg, ctx) {
     value: result
   };
 }
+function describeApproverSpecRefusal(spec) {
+  const raw = spec === void 0 ? "undefined" : JSON.stringify(spec) ?? String(spec);
+  const written = raw.length > APPROVER_WRITTEN_MAX ? `${raw.slice(0, APPROVER_WRITTEN_MAX - 1)}\u2026` : raw;
+  const users = typeof spec === "object" && spec !== null ? spec.users : void 0;
+  const approver = typeof users === "string" && USER_ID_SHAPED_RE.test(users) ? {
+    users: [
+      users
+    ]
+  } : "creator";
+  const message = `approver ${written} is not an approver \u2014 legal: ${APPROVER_SPEC_SHAPES.join(" | ")}. 'creator' is the person who started the run: write approver:'creator' for "ask me" / "I approve"; {users:[\u2026]} takes user ids, never emails, names or {type:'user'}` + (approver === "creator" ? "" : `; here: approver:${JSON.stringify(approver)}`);
+  return {
+    approver,
+    written,
+    message
+  };
+}
+function bindingRootsOk(template22) {
+  const refs = [
+    ...template22.matchAll(/\$\{\s*([A-Za-z_$][\w$]*)/g)
+  ].map((m) => m[1]);
+  return refs.length > 0 && refs.every((r) => BINDING_ROOTS.includes(r));
+}
+function isTemplateBinding(v) {
+  return typeof v === "object" && v !== null && typeof v.template === "string";
+}
+function approvalEditable(node) {
+  if (node.editable === true) return true;
+  if (node.editable === false) return false;
+  return Array.isArray(node.editablePaths) && node.editablePaths.length > 0;
+}
+function validateApproverBlock(node, opts = {
+  path: "approval"
+}) {
+  const issues = [];
+  const push = /* @__PURE__ */ __name3((code, path25, message, severity = "error") => issues.push({
+    code,
+    path: path25,
+    severity,
+    message
+  }), "push");
+  const checkSpec = /* @__PURE__ */ __name3((spec, path25) => {
+    const r = ApproverSpecSchema.safeParse(spec);
+    if (!r.success) {
+      const users = spec?.users;
+      if (Array.isArray(users) && users.length > APPROVER_SPEC_MAX_USERS) push("cap-exceeded", path25, `at most ${APPROVER_SPEC_MAX_USERS} users`);
+      else {
+        const refusal = describeApproverSpecRefusal(spec);
+        issues.push({
+          code: "approver-invalid",
+          path: path25,
+          severity: "error",
+          message: refusal.message,
+          repair: {
+            approver: refusal.approver,
+            written: refusal.written
+          }
+        });
+      }
+      return;
+    }
+    const s = r.data;
+    if (typeof s === "object") {
+      if ("governance" in s && !opts.governanceEnabled) push("approver-governance-unavailable", path25, "governance reviewer routing is not enabled for this deployment");
+      if ("group" in s && typeof s.group === "string" && !opts.scimEnabled && opts.idpGroups?.includes(s.group)) push("approver-idp-group-unavailable", path25, "IdP-group approvers are not enabled for this deployment");
+      const binding = "users" in s ? s.users : "role" in s ? s.role : "group" in s ? s.group : void 0;
+      if (isTemplateBinding(binding)) {
+        if (!bindingRootsOk(binding.template)) push("approver-binding-invalid", `${path25}.template`, "binding root must be initData / stepResults / requestContext / state");
+        if ("users" in s && opts.customerReachable) push("approver-binding-customer-reachable", `${path25}.users`, "a customer-reachable workflow may not bind its approver list");
+      }
+    }
+  }, "checkSpec");
+  if (node.approver !== void 0) checkSpec(node.approver, `${opts.path}.approver`);
+  if (node.fourEyes !== void 0) {
+    const r = FourEyesSchema.safeParse(node.fourEyes);
+    if (!r.success) push("approver-invalid", `${opts.path}.fourEyes`, "fourEyes needs { edit, approve } approver specs");
+    else {
+      checkSpec(r.data.edit, `${opts.path}.fourEyes.edit`);
+      checkSpec(r.data.approve, `${opts.path}.fourEyes.approve`);
+    }
+    if (!approvalEditable(node)) push("four-eyes-requires-editable", `${opts.path}.fourEyes`, "fourEyes requires editable:true");
+    if (node.approver !== void 0) push("four-eyes-overrides-approver", `${opts.path}.approver`, "fourEyes replaces approver", "warning");
+    if (node.itemsPath) push("four-eyes-items-unsupported", `${opts.path}.fourEyes`, "fourEyes cannot combine with itemsPath");
+  }
+  if (node.excludeInitiator && (node.approver === void 0 || node.approver === "creator") && !node.fourEyes) push("approver-excludes-only-candidate", `${opts.path}.excludeInitiator`, "'creator' with excludeInitiator leaves no approver");
+  if (Array.isArray(node.onTimeout)) {
+    const chain = node.onTimeout;
+    const hops = chain.filter((m) => typeof m === "object" && m !== null && "escalateTo" in m);
+    if (hops.length > ESCALATION_MAX_HOPS) push("escalation-chain-too-long", `${opts.path}.onTimeout`, `at most ${ESCALATION_MAX_HOPS} hops`);
+    const last = chain[chain.length - 1];
+    if (typeof last === "object" && last !== null) push("escalation-chain-not-terminal", `${opts.path}.onTimeout`, "a chain must end in deny | cancel-run | fail");
+    hops.forEach((h, i) => checkSpec(h.escalateTo, `${opts.path}.onTimeout[${i}].escalateTo`));
+  } else if (typeof node.onTimeout === "object" && node.onTimeout !== null) {
+    checkSpec(node.onTimeout.escalateTo, `${opts.path}.onTimeout.escalateTo`);
+  }
+  return issues;
+}
+function liftRenderedApprover(row2, rendered) {
+  const text = (rendered ?? "").trim();
+  if (!text) return null;
+  if (row2 === "users") {
+    let members = null;
+    if (text.startsWith("[")) {
+      try {
+        members = JSON.parse(text);
+      } catch {
+        return null;
+      }
+    } else members = text.split(",").map((s) => s.trim());
+    if (!Array.isArray(members) || members.length === 0 || members.length > APPROVER_SPEC_MAX_USERS) return null;
+    if (!members.every((m) => typeof m === "string" && m.length > 0 && m.length <= 128)) return null;
+    return {
+      users: [
+        ...new Set(members)
+      ].sort()
+    };
+  }
+  if (text.length > 128 || text.startsWith("[") || text.startsWith("{")) return null;
+  return row2 === "role" ? {
+    role: text
+  } : {
+    group: text
+  };
+}
 function workspaceTemplatePath(template22) {
   const key = template22.trim();
   const expr = WORKSPACE_TEMPLATE_EXPR_RE.exec(key);
@@ -3813,6 +4059,9 @@ function retryBackoffs() {
 function sleepUntilUnsupportedMessage(id) {
   return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
 }
+function armSubrunUnsupportedMessage(id, workflowId) {
+  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
+}
 function fillPolicy(node, defaultTimeout) {
   if (node.tier === void 0 && node.workspace !== void 0 && node.workspace !== "inherit") node.tier = "job";
   if (node.timeoutSeconds === void 0) node.timeoutSeconds = node.tier === "job" ? WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS : defaultTimeout;
@@ -3838,7 +4087,6 @@ function fillSingle(node) {
       fillPolicy(node, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS);
       return;
     case "workflow":
-      if (node.workflowId === WORKFLOW_ARM_SUBRUN_ID && Array.isArray(node.graph) && node.graph[1]) fillSingle(node.graph[1]);
       return;
   }
 }
@@ -3970,8 +4218,14 @@ function nodeStepRefs(entry) {
     case "agent": {
       const a = entry;
       const p = a.promptTemplate;
-      return typeof p === "string" ? templateStepRefs(p) : p && "template" in p ? templateStepRefs(p.template) : [];
+      const prompt = typeof p === "string" ? templateStepRefs(p) : p && "template" in p ? templateStepRefs(p.template) : [];
+      return [
+        ...prompt,
+        ...mapConfigStepRefs(a.input)
+      ];
     }
+    case "step":
+      return mapConfigStepRefs(entry.input);
     case "tool":
       return mapConfigStepRefs(entry.input);
     case "workflow":
@@ -4188,6 +4442,21 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path25}.model`, id);
     }
   }, "checkTier");
+  const checkModel = /* @__PURE__ */ __name3((node, path25) => {
+    if (node.type !== "agent" || typeof node.model !== "string") return;
+    const registry = opts.approvedModels;
+    if (registry === void 0) return;
+    const id = singleId(node);
+    if (registry === "unavailable") {
+      const pin = node.model.trim();
+      if (pin && !normalizeModelId(pin, []).ok) {
+        warn("model-unresolved", `model "${pin}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`, `${path25}.model`, id);
+      }
+      return;
+    }
+    const resolved = normalizeModelId(node.model, registry);
+    if (!resolved.ok) err("model-unresolved", modelUnresolvedMessage(resolved), `${path25}.model`, id);
+  }, "checkModel");
   const checkWorkspace = /* @__PURE__ */ __name3((node, path25) => {
     const id = singleId(node);
     const ws = workspaceOf(node);
@@ -4240,38 +4509,29 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
   }, "checkMapMembers");
   const checkInputShape = /* @__PURE__ */ __name3((node, path25) => {
-    if (node.type !== "tool" && node.type !== "workflow") return;
     const input = node.input;
     if (input === void 0) return;
+    const id = singleId(node);
     if (input !== null && typeof input === "object" && !Array.isArray(input)) {
-      checkMapMembers(input, `${path25}.input`, node.id);
+      checkMapMembers(input, `${path25}.input`, id);
       return;
     }
-    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path25}.input`, node.id);
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path25}.input`, id);
   }, "checkInputShape");
+  const checkBodyInput = /* @__PURE__ */ __name3((body, path25, container) => {
+    if (body.type === "workflow" || body.input === void 0) return;
+    err("arm-input-unsupported", container === "foreach" ? `a foreach body receives each item as its input \u2014 drop \`input\` on "${singleId(body)}" and map the items before the foreach instead` : `a loop body receives the previous output as its input \u2014 drop \`input\` on "${singleId(body)}" and put the map before the loop instead`, `${path25}.input`, singleId(body));
+  }, "checkBodyInput");
   const checkSingle = /* @__PURE__ */ __name3((node, path25, depth) => {
     recordOutputSchema(node);
-    if (node.type === "workflow" && node.workflowId === WORKFLOW_ARM_SUBRUN_ID) {
+    if (node.type === "workflow" && (typeof node.workflowId !== "string" || node.workflowId.length === 0)) {
       checkId(node.id, path25);
-      const body = node.graph;
-      if (!Array.isArray(body) || body.length !== 2 || body[0]?.type !== "mapping" || !body[1]) {
-        err("container-arm-empty", "an implicit arm subrun needs a [mapping, step] body", `${path25}.graph`, node.id);
-        return;
-      }
-      if (body[1].type === "mapping") {
-        err("container-arm-empty", "a bare mapping arm has nothing to run", `${path25}.graph.1`, node.id);
-        return;
-      }
-      const inner = body[1];
-      if (isHitlNode(inner)) {
-        err("node-type-unsupported-in-container", workflowHitlArmShapeMessage(inner.type, inner.id, "mapped-arm"), `${path25}.graph.1`, inner.id);
-        return;
-      }
-      upstream.add(singleId(body[1]));
-      checkArm(body[0], `${path25}.graph.0`, depth, "parallel");
-      checkSingle(body[1], `${path25}.graph.1`, depth);
-      upstream.add(body[0].id);
-      upstream.add(singleId(body[1]));
+      err("invalid-envelope", `\`workflowId\` must be a non-empty string naming the workflow to start (got ${JSON.stringify(node.workflowId)})`, `${path25}.workflowId`, node.id);
+      return;
+    }
+    if (node.type === "workflow" && (node.workflowId.startsWith("$") || Array.isArray(node.graph))) {
+      checkId(node.id, path25);
+      err("node-type-unsupported-by-engine", armSubrunUnsupportedMessage(node.id, node.workflowId), path25, node.id);
       return;
     }
     checkId(singleId(node), path25);
@@ -4279,6 +4539,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     checkInputShape(node, path25);
     checkTimeout(node, path25);
     checkTier(node, path25);
+    checkModel(node, path25);
     checkRetry(node, path25);
     checkWorkspace(node, path25);
     if (!opts.static) {
@@ -4301,7 +4562,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (node.type === "workflow" && node.kind === "subrun" && depth > caps.maxNestingDepth) {
       err("cap-exceeded", `nesting depth ${depth} exceeds ${caps.maxNestingDepth}`, path25, node.id);
     }
-    if (node.type === "workflow" && node.workflowId !== WORKFLOW_ARM_SUBRUN_ID && typeof g.definition?.id === "string" && node.workflowId === g.definition.id) {
+    if (node.type === "workflow" && typeof g.definition?.id === "string" && node.workflowId === g.definition.id) {
       err("subrun-cycle", `"${node.id}" starts "${node.workflowId}", which is this workflow itself`, path25, node.id);
     }
     for (const ref of nodeStepRefs(node)) {
@@ -4322,11 +4583,14 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (a.approver === "creator" && a.excludeInitiator === true) {
       err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path25, a.id);
     }
-    if (a.fourEyes !== void 0 && a.editable !== true) {
+    const editable = approvalEditable(a);
+    if (a.fourEyes !== void 0 && !editable) {
       err("four-eyes-requires-editable", "`fourEyes` requires editable:true", `${path25}.fourEyes`, a.id);
     }
-    if ((a.editablePaths !== void 0 || a.editedPayloadSchema !== void 0) && a.editable !== true) {
-      err("editable-path-invalid", "`editablePaths` / `editedPayloadSchema` require editable:true", `${path25}.editablePaths`, a.id);
+    if (a.editable === false && Array.isArray(a.editablePaths) && a.editablePaths.length > 0) {
+      err("editable-path-invalid", "`editablePaths` beside editable:false is contradictory \u2014 drop the paths or set editable:true", `${path25}.editablePaths`, a.id);
+    } else if ((a.editablePaths !== void 0 || a.editedPayloadSchema !== void 0) && !editable) {
+      err("editable-path-invalid", "`editablePaths` / `editedPayloadSchema` require editable:true (a non-empty editablePaths implies it)", `${path25}.editablePaths`, a.id);
     }
     for (const p of a.editablePaths ?? []) {
       if (!EDITABLE_PATH_RE.test(p)) err("editable-path-invalid", `editablePaths entry "${p}" is outside the seg(.seg)*[*]/[n] grammar`, `${path25}.editablePaths`, a.id);
@@ -4507,6 +4771,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
           } else checkHitlArm(f.step, `${path25}.step`, "foreach");
           declared.push(f.step.id);
         } else {
+          checkBodyInput(f.step, `${path25}.step`, "foreach");
           checkSingle(f.step, `${path25}.step`, o.chunk ? 2 : 1);
           declared.push(singleId(f.step));
         }
@@ -4527,6 +4792,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
           checkHitlArm(l.step, `${path25}.step`, "loop");
           declared.push(l.step.id);
         } else {
+          checkBodyInput(l.step, `${path25}.step`, "loop");
           checkSingle(l.step, `${path25}.step`, 1);
           declared.push(singleId(l.step));
         }
@@ -5000,17 +5266,10 @@ function isContinuedFailureValue(v) {
   const err = o.error;
   return o.__lua_workflow === CONTINUED_FAILURE_TAG && o.failed === true && o.text === "" && err !== null && typeof err === "object" && typeof err.code === "string" && typeof err.message === "string";
 }
-function lowerContainerArm(mapping, step22) {
-  const stepId = nodeIdOf(step22);
+function inlineContainerArm(mapping, step22) {
   return {
-    type: "workflow",
-    id: `${stepId}_arm`,
-    workflowId: WORKFLOW_ARM_SUBRUN_ID,
-    kind: "subrun",
-    graph: [
-      mapping,
-      step22
-    ]
+    ...step22,
+    input: parseMapConfig(mapping.mapConfig, mapping.id)
   };
 }
 function entryIds(entry) {
@@ -5080,6 +5339,27 @@ function resolvePlacements(calls) {
         break;
     }
   });
+  const armMapPlacementIssue = /* @__PURE__ */ __name3((node, ref, i, container) => {
+    if (!ref.armMap || node.type === "mapping" || isHitlNode2(node)) return void 0;
+    const id = nodeIdOf(node);
+    if ((container === "foreach" || container === "loop") && node.type !== "workflow") {
+      return {
+        code: "mapping-placement",
+        message: container === "foreach" ? `foreach body "${id}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
+        callIndex: i,
+        stepId: id
+      };
+    }
+    if (node.input !== void 0) {
+      return {
+        code: "mapping-placement",
+        message: `"${id}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
+        callIndex: i,
+        stepId: id
+      };
+    }
+    return void 0;
+  }, "armMapPlacementIssue");
   const hitlPlacementIssue = /* @__PURE__ */ __name3((node, ref, i, container) => {
     if (!isHitlNode2(node)) return void 0;
     const id = node.id;
@@ -5106,7 +5386,7 @@ function resolvePlacements(calls) {
       if (ref.node.type === "mapping" && !allowMapping) {
         issues.push({
           code: "mapping-placement",
-          message: `mapping "${ref.node.id}" cannot be a container arm \u2014 chain it as [map, step]`,
+          message: `mapping "${ref.node.id}" cannot be a container arm \u2014 chain it as [map, step] in a parallel / conditional arm, or place the .map() before the container`,
           callIndex: i,
           stepId: ref.node.id
         });
@@ -5127,7 +5407,7 @@ function resolvePlacements(calls) {
     if (d.node.type === "mapping" && !allowMapping) {
       issues.push({
         code: "mapping-placement",
-        message: `map "${ref.ref}" cannot be a parallel/foreach/loop arm \u2014 chain it as [map, step]`,
+        message: `map "${ref.ref}" cannot be a parallel/foreach/loop arm \u2014 chain it as [map, step] in a parallel arm, or place the .map() before the container`,
         callIndex: i,
         stepId: ref.ref
       });
@@ -5138,6 +5418,11 @@ function resolvePlacements(calls) {
       issues.push(hitl);
       return void 0;
     }
+    const mapped = armMapPlacementIssue(d.node, ref, i, container);
+    if (mapped) {
+      issues.push(mapped);
+      return void 0;
+    }
     const prior = placedBy.get(ref.ref);
     if (prior !== void 0 && prior !== i) {
       issues.push({
@@ -5158,6 +5443,10 @@ function resolvePlacements(calls) {
     }
     const hitl = hitlPlacementIssue(ref.node, ref, i, container);
     if (hitl) issues.push(hitl);
+    else {
+      const mapped = armMapPlacementIssue(ref.node, ref, i, container);
+      if (mapped) issues.push(mapped);
+    }
   }, "claim");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -5185,7 +5474,7 @@ function resolvePlacements(calls) {
   const lookup = /* @__PURE__ */ __name3((ref) => {
     const n2 = "node" in ref ? ref.node : declared.get(ref.ref)?.node;
     if (!n2 || !ref.armMap || n2.type === "mapping" || isHitlNode2(n2)) return n2;
-    return lowerContainerArm(ref.armMap, n2);
+    return inlineContainerArm(ref.armMap, n2);
   }, "lookup");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -5570,6 +5859,27 @@ function isTerminalRunStatus(status) {
 function pruneUndefined(o) {
   return Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
 }
+function runOrigin(run) {
+  if (run.goalId) return "goal";
+  if (run.jobId || run.trigger === "schedule") return "schedule";
+  if (run.dynamic === true) return run.tags?.includes(WORKFLOW_INLINE_RUN_TAG) ? "inline" : "compose";
+  return "definition";
+}
+function runErrorIssues(issues) {
+  if (!Array.isArray(issues)) return void 0;
+  const out = [];
+  for (const raw of issues.slice(0, RUN_ERROR_ISSUES_MAX)) {
+    if (!raw || typeof raw !== "object") continue;
+    const o = raw;
+    if (typeof o.code !== "string" || !o.code) continue;
+    out.push(pruneUndefined({
+      code: o.code,
+      path: typeof o.path === "string" ? o.path : void 0,
+      message: typeof o.message === "string" ? o.message : void 0
+    }));
+  }
+  return out.length ? out : void 0;
+}
 function runNextAction(run) {
   if (isTerminalRunStatus(run.status)) return "none";
   if (run.status === "suspended" && run.gate?.kind === "budget") return "raise_budget";
@@ -5739,6 +6049,7 @@ function toWorkflowRunSummary(run) {
     repairOf: run.repairOf,
     repairRunIds: run.repairRunIds,
     trigger: run.trigger ?? "api",
+    origin: runOrigin(run),
     createdBy: {
       subjectType: principal?.subjectType ?? "system",
       subjectId: principal?.subjectId ?? run.userId ?? ""
@@ -5756,11 +6067,13 @@ function toWorkflowRunSummary(run) {
     usage: runUsage(run),
     // LUA-697: a row persisted before the write seams (#2406 / #2465 / the script tier) leaves scrubbed here too —
     // idempotent on a scrubbed message, bounded input; an empty message falls back to the code.
-    error: run.error ? {
+    error: run.error ? pruneUndefined({
       code: run.error.code ?? "error",
       message: scrubStepErrorMessage(run.error.message) ?? run.error.code ?? "error",
-      stepId: run.error.stepId
-    } : void 0,
+      stepId: run.error.stepId,
+      // LUA-784 (item 3): the unattended pre-start failure's refusal rows (`input_schema_invalid` and kin).
+      issues: runErrorIssues(run.error.issues)
+    }) : void 0,
     kind: "run",
     aclHash: run.aclHash,
     migration: run.migration,
@@ -6283,124 +6596,6 @@ function rebaseItemPointer(pointer, itemsPath, index) {
   const base = `/${itemsPath.split(".").map(escapePointer).join("/")}/${index}`;
   return pointer === "/" || pointer === "" ? base : `${base}${pointer}`;
 }
-function describeApproverSpecRefusal(spec) {
-  const raw = spec === void 0 ? "undefined" : JSON.stringify(spec) ?? String(spec);
-  const written = raw.length > APPROVER_WRITTEN_MAX ? `${raw.slice(0, APPROVER_WRITTEN_MAX - 1)}\u2026` : raw;
-  const users = typeof spec === "object" && spec !== null ? spec.users : void 0;
-  const approver = typeof users === "string" && USER_ID_SHAPED_RE.test(users) ? {
-    users: [
-      users
-    ]
-  } : "creator";
-  const message = `approver ${written} is not an approver \u2014 legal: ${APPROVER_SPEC_SHAPES.join(" | ")}. 'creator' is the person who started the run: write approver:'creator' for "ask me" / "I approve"; {users:[\u2026]} takes user ids, never emails, names or {type:'user'}` + (approver === "creator" ? "" : `; here: approver:${JSON.stringify(approver)}`);
-  return {
-    approver,
-    written,
-    message
-  };
-}
-function bindingRootsOk(template22) {
-  const refs = [
-    ...template22.matchAll(/\$\{\s*([A-Za-z_$][\w$]*)/g)
-  ].map((m) => m[1]);
-  return refs.length > 0 && refs.every((r) => BINDING_ROOTS.includes(r));
-}
-function isTemplateBinding(v) {
-  return typeof v === "object" && v !== null && typeof v.template === "string";
-}
-function validateApproverBlock(node, opts = {
-  path: "approval"
-}) {
-  const issues = [];
-  const push = /* @__PURE__ */ __name3((code, path25, message, severity = "error") => issues.push({
-    code,
-    path: path25,
-    severity,
-    message
-  }), "push");
-  const checkSpec = /* @__PURE__ */ __name3((spec, path25) => {
-    const r = ApproverSpecSchema.safeParse(spec);
-    if (!r.success) {
-      const users = spec?.users;
-      if (Array.isArray(users) && users.length > APPROVER_SPEC_MAX_USERS) push("cap-exceeded", path25, `at most ${APPROVER_SPEC_MAX_USERS} users`);
-      else {
-        const refusal = describeApproverSpecRefusal(spec);
-        issues.push({
-          code: "approver-invalid",
-          path: path25,
-          severity: "error",
-          message: refusal.message,
-          repair: {
-            approver: refusal.approver,
-            written: refusal.written
-          }
-        });
-      }
-      return;
-    }
-    const s = r.data;
-    if (typeof s === "object") {
-      if ("governance" in s && !opts.governanceEnabled) push("approver-governance-unavailable", path25, "governance reviewer routing is not enabled for this deployment");
-      if ("group" in s && typeof s.group === "string" && !opts.scimEnabled && opts.idpGroups?.includes(s.group)) push("approver-idp-group-unavailable", path25, "IdP-group approvers are not enabled for this deployment");
-      const binding = "users" in s ? s.users : "role" in s ? s.role : "group" in s ? s.group : void 0;
-      if (isTemplateBinding(binding)) {
-        if (!bindingRootsOk(binding.template)) push("approver-binding-invalid", `${path25}.template`, "binding root must be initData / stepResults / requestContext / state");
-        if ("users" in s && opts.customerReachable) push("approver-binding-customer-reachable", `${path25}.users`, "a customer-reachable workflow may not bind its approver list");
-      }
-    }
-  }, "checkSpec");
-  if (node.approver !== void 0) checkSpec(node.approver, `${opts.path}.approver`);
-  if (node.fourEyes !== void 0) {
-    const r = FourEyesSchema.safeParse(node.fourEyes);
-    if (!r.success) push("approver-invalid", `${opts.path}.fourEyes`, "fourEyes needs { edit, approve } approver specs");
-    else {
-      checkSpec(r.data.edit, `${opts.path}.fourEyes.edit`);
-      checkSpec(r.data.approve, `${opts.path}.fourEyes.approve`);
-    }
-    if (!node.editable) push("four-eyes-requires-editable", `${opts.path}.fourEyes`, "fourEyes requires editable:true");
-    if (node.approver !== void 0) push("four-eyes-overrides-approver", `${opts.path}.approver`, "fourEyes replaces approver", "warning");
-    if (node.itemsPath) push("four-eyes-items-unsupported", `${opts.path}.fourEyes`, "fourEyes cannot combine with itemsPath");
-  }
-  if (node.excludeInitiator && (node.approver === void 0 || node.approver === "creator") && !node.fourEyes) push("approver-excludes-only-candidate", `${opts.path}.excludeInitiator`, "'creator' with excludeInitiator leaves no approver");
-  if (Array.isArray(node.onTimeout)) {
-    const chain = node.onTimeout;
-    const hops = chain.filter((m) => typeof m === "object" && m !== null && "escalateTo" in m);
-    if (hops.length > ESCALATION_MAX_HOPS) push("escalation-chain-too-long", `${opts.path}.onTimeout`, `at most ${ESCALATION_MAX_HOPS} hops`);
-    const last = chain[chain.length - 1];
-    if (typeof last === "object" && last !== null) push("escalation-chain-not-terminal", `${opts.path}.onTimeout`, "a chain must end in deny | cancel-run | fail");
-    hops.forEach((h, i) => checkSpec(h.escalateTo, `${opts.path}.onTimeout[${i}].escalateTo`));
-  } else if (typeof node.onTimeout === "object" && node.onTimeout !== null) {
-    checkSpec(node.onTimeout.escalateTo, `${opts.path}.onTimeout.escalateTo`);
-  }
-  return issues;
-}
-function liftRenderedApprover(row2, rendered) {
-  const text = (rendered ?? "").trim();
-  if (!text) return null;
-  if (row2 === "users") {
-    let members = null;
-    if (text.startsWith("[")) {
-      try {
-        members = JSON.parse(text);
-      } catch {
-        return null;
-      }
-    } else members = text.split(",").map((s) => s.trim());
-    if (!Array.isArray(members) || members.length === 0 || members.length > APPROVER_SPEC_MAX_USERS) return null;
-    if (!members.every((m) => typeof m === "string" && m.length > 0 && m.length <= 128)) return null;
-    return {
-      users: [
-        ...new Set(members)
-      ].sort()
-    };
-  }
-  if (text.length > 128 || text.startsWith("[") || text.startsWith("{")) return null;
-  return row2 === "role" ? {
-    role: text
-  } : {
-    group: text
-  };
-}
 function collectEnvTemplateKeys(value22) {
   const keys = /* @__PURE__ */ new Set();
   const walk22 = /* @__PURE__ */ __name3((v) => {
@@ -6649,7 +6844,6 @@ function* singleStepsOf(entry) {
       return;
     case "workflow":
       yield entry;
-      if (Array.isArray(entry.graph)) yield* singleStepsOf(entry.graph[1]);
       return;
     case "parallel":
     case "conditional":
@@ -6691,7 +6885,7 @@ function needsInheritedWorkspace(graph) {
   }
   return false;
 }
-var __defProp3, __name3, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_ARM_SUBRUN_ID, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
+var __defProp3, __name3, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
@@ -6794,7 +6988,88 @@ var init_dist2 = __esm({
     }), "fromKnowledge");
     SideEffectsSchema = z6.enum(WORKFLOW_SIDE_EFFECTS);
     JobResourcesSchema = z6.enum(WORKFLOW_JOB_RESOURCES);
-    WORKFLOW_ARM_SUBRUN_ID = "$arm";
+    APPROVER_SPEC_MAX_USERS = 20;
+    ESCALATION_MAX_HOPS = 3;
+    TemplateBindingSchema = z22.object({
+      template: z22.string().min(1).max(2048)
+    }).strict();
+    ApproverSpecSchema = z22.union([
+      z22.literal("creator"),
+      z22.literal("org-admins"),
+      z22.object({
+        users: z22.union([
+          z22.array(z22.string().min(1).max(128)).min(1).max(APPROVER_SPEC_MAX_USERS),
+          TemplateBindingSchema
+        ])
+      }).strict(),
+      z22.object({
+        role: z22.union([
+          z22.string().min(1).max(128),
+          TemplateBindingSchema
+        ])
+      }).strict(),
+      z22.object({
+        group: z22.union([
+          z22.string().min(1).max(128),
+          TemplateBindingSchema
+        ])
+      }).strict(),
+      z22.object({
+        governance: z22.object({
+          policyId: z22.string().min(1).max(128)
+        }).strict()
+      }).strict()
+    ]);
+    FourEyesSchema = z22.object({
+      edit: ApproverSpecSchema,
+      approve: ApproverSpecSchema
+    }).strict();
+    EscalationHopSchema = z22.object({
+      escalateTo: ApproverSpecSchema,
+      timeoutHours: z22.number().finite().min(1).max(720)
+    }).strict();
+    TerminalOutcomeSchema = z22.enum([
+      "deny",
+      "cancel-run",
+      "fail",
+      "continue"
+    ]);
+    ApprovalOnTimeoutSchema = z22.union([
+      TerminalOutcomeSchema,
+      EscalationHopSchema,
+      z22.array(z22.union([
+        TerminalOutcomeSchema,
+        EscalationHopSchema
+      ])).min(1).max(ESCALATION_MAX_HOPS + 1)
+    ]);
+    APPROVER_SPEC_SHAPES = [
+      "'creator'",
+      "'org-admins'",
+      "{users:[userId, \u2026]}",
+      "{role:roleName}",
+      "{group:groupName}",
+      "{governance:{policyId}}"
+    ];
+    APPROVER_WRITTEN_MAX = 120;
+    USER_ID_SHAPED_RE = /^[^\s@]{1,128}$/;
+    __name(describeApproverSpecRefusal, "describeApproverSpecRefusal");
+    __name3(describeApproverSpecRefusal, "describeApproverSpecRefusal");
+    BINDING_ROOTS = [
+      "initData",
+      "stepResults",
+      "requestContext",
+      "state"
+    ];
+    __name(bindingRootsOk, "bindingRootsOk");
+    __name3(bindingRootsOk, "bindingRootsOk");
+    __name(isTemplateBinding, "isTemplateBinding");
+    __name3(isTemplateBinding, "isTemplateBinding");
+    __name(approvalEditable, "approvalEditable");
+    __name3(approvalEditable, "approvalEditable");
+    __name(validateApproverBlock, "validateApproverBlock");
+    __name3(validateApproverBlock, "validateApproverBlock");
+    __name(liftRenderedApprover, "liftRenderedApprover");
+    __name3(liftRenderedApprover, "liftRenderedApprover");
     WORKSPACE_TEMPLATE_EXPR_RE = /^\$\{\s*(?:initData|input)\.([^}]+?)\s*\}$/;
     __name(workspaceTemplatePath, "workspaceTemplatePath");
     __name3(workspaceTemplatePath, "workspaceTemplatePath");
@@ -6806,6 +7081,8 @@ var init_dist2 = __esm({
     });
     __name(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
     __name3(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
+    __name(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
+    __name3(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
     WORKFLOW_CAPS_DEFAULT = Object.freeze({
       maxParallelArms: 16,
       maxForeachConcurrency: 16,
@@ -7087,8 +7364,8 @@ var init_dist2 = __esm({
     __name(isContinuedFailureValue, "isContinuedFailureValue");
     __name3(isContinuedFailureValue, "isContinuedFailureValue");
     isHitlNode2 = /* @__PURE__ */ __name3((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
-    __name(lowerContainerArm, "lowerContainerArm");
-    __name3(lowerContainerArm, "lowerContainerArm");
+    __name(inlineContainerArm, "inlineContainerArm");
+    __name3(inlineContainerArm, "inlineContainerArm");
     nodeIdOf = /* @__PURE__ */ __name3((n2) => n2.type === "step" ? n2.step.id : n2.id, "nodeIdOf");
     __name(entryIds, "entryIds");
     __name3(entryIds, "entryIds");
@@ -7148,6 +7425,12 @@ var init_dist2 = __esm({
     __name3(isTerminalRunStatus, "isTerminalRunStatus");
     __name(pruneUndefined, "pruneUndefined");
     __name3(pruneUndefined, "pruneUndefined");
+    WORKFLOW_INLINE_RUN_TAG = "inline";
+    __name(runOrigin, "runOrigin");
+    __name3(runOrigin, "runOrigin");
+    RUN_ERROR_ISSUES_MAX = 20;
+    __name(runErrorIssues, "runErrorIssues");
+    __name3(runErrorIssues, "runErrorIssues");
     __name(runNextAction, "runNextAction");
     __name3(runNextAction, "runNextAction");
     IN_FLIGHT = new Set(WORKFLOW_STEP_IN_FLIGHT);
@@ -7308,86 +7591,6 @@ var init_dist2 = __esm({
     __name3(applyJsonPatch, "applyJsonPatch");
     __name(rebaseItemPointer, "rebaseItemPointer");
     __name3(rebaseItemPointer, "rebaseItemPointer");
-    APPROVER_SPEC_MAX_USERS = 20;
-    ESCALATION_MAX_HOPS = 3;
-    TemplateBindingSchema = z22.object({
-      template: z22.string().min(1).max(2048)
-    }).strict();
-    ApproverSpecSchema = z22.union([
-      z22.literal("creator"),
-      z22.literal("org-admins"),
-      z22.object({
-        users: z22.union([
-          z22.array(z22.string().min(1).max(128)).min(1).max(APPROVER_SPEC_MAX_USERS),
-          TemplateBindingSchema
-        ])
-      }).strict(),
-      z22.object({
-        role: z22.union([
-          z22.string().min(1).max(128),
-          TemplateBindingSchema
-        ])
-      }).strict(),
-      z22.object({
-        group: z22.union([
-          z22.string().min(1).max(128),
-          TemplateBindingSchema
-        ])
-      }).strict(),
-      z22.object({
-        governance: z22.object({
-          policyId: z22.string().min(1).max(128)
-        }).strict()
-      }).strict()
-    ]);
-    FourEyesSchema = z22.object({
-      edit: ApproverSpecSchema,
-      approve: ApproverSpecSchema
-    }).strict();
-    EscalationHopSchema = z22.object({
-      escalateTo: ApproverSpecSchema,
-      timeoutHours: z22.number().finite().min(1).max(720)
-    }).strict();
-    TerminalOutcomeSchema = z22.enum([
-      "deny",
-      "cancel-run",
-      "fail",
-      "continue"
-    ]);
-    ApprovalOnTimeoutSchema = z22.union([
-      TerminalOutcomeSchema,
-      EscalationHopSchema,
-      z22.array(z22.union([
-        TerminalOutcomeSchema,
-        EscalationHopSchema
-      ])).min(1).max(ESCALATION_MAX_HOPS + 1)
-    ]);
-    APPROVER_SPEC_SHAPES = [
-      "'creator'",
-      "'org-admins'",
-      "{users:[userId, \u2026]}",
-      "{role:roleName}",
-      "{group:groupName}",
-      "{governance:{policyId}}"
-    ];
-    APPROVER_WRITTEN_MAX = 120;
-    USER_ID_SHAPED_RE = /^[^\s@]{1,128}$/;
-    __name(describeApproverSpecRefusal, "describeApproverSpecRefusal");
-    __name3(describeApproverSpecRefusal, "describeApproverSpecRefusal");
-    BINDING_ROOTS = [
-      "initData",
-      "stepResults",
-      "requestContext",
-      "state"
-    ];
-    __name(bindingRootsOk, "bindingRootsOk");
-    __name3(bindingRootsOk, "bindingRootsOk");
-    __name(isTemplateBinding, "isTemplateBinding");
-    __name3(isTemplateBinding, "isTemplateBinding");
-    __name(validateApproverBlock, "validateApproverBlock");
-    __name3(validateApproverBlock, "validateApproverBlock");
-    __name(liftRenderedApprover, "liftRenderedApprover");
-    __name3(liftRenderedApprover, "liftRenderedApprover");
     WORKFLOW_ENV_OVERLAY_MAX_KEYS = 64;
     WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES = 4096;
     WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE = /(SECRET|TOKEN|KEY|PASSWORD)$/;
@@ -7490,14 +7693,13 @@ function stepNodeOf(s) {
 }
 function materializeEntry(entry, steps) {
   const single = /* @__PURE__ */ __name((n2) => {
-    if (n2.type === "step" && steps[n2.step.id]) return stepNodeOf(steps[n2.step.id]);
-    if (n2.type === "workflow" && n2.workflowId === WORKFLOW_ARM_SUBRUN_ID && n2.graph) return {
-      ...n2,
-      graph: [
-        n2.graph[0],
-        single(n2.graph[1])
-      ]
-    };
+    if (n2.type === "step" && steps[n2.step.id]) {
+      const node = stepNodeOf(steps[n2.step.id]);
+      return n2.input !== void 0 ? {
+        ...node,
+        input: n2.input
+      } : node;
+    }
     return n2;
   }, "single");
   switch (entry.type) {
@@ -7658,7 +7860,10 @@ var init_workflow = __esm({
     }, "assertPredicate");
     assertRetry = /* @__PURE__ */ __name((r, id) => {
       if (!r) return;
-      if (typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS) throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
+      if (r.maxAttempts !== void 0 && !isWithinWorkflowRetryAttempts(r.maxAttempts)) {
+        const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
+        throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
+      }
       if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
       if (r.maxBackoffSeconds !== void 0) {
         if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
@@ -11790,6 +11995,17 @@ function resolveIdentifier(node, maxDepth = 10) {
   }
   return identNode;
 }
+function unwrapExpression(node) {
+  let cur = node;
+  while (cur) {
+    if (Node.isAsExpression(cur) || Node.isSatisfiesExpression(cur) || Node.isParenthesizedExpression(cur) || Node.isNonNullExpression(cur) || Node.isTypeAssertion(cur)) {
+      cur = cur.getExpression();
+      continue;
+    }
+    return cur;
+  }
+  return void 0;
+}
 function findImportSource(identifier, sourceFile, resolveImportPath) {
   for (const importDecl of sourceFile.getImportDeclarations()) {
     const defaultImport = importDecl.getDefaultImport();
@@ -11824,6 +12040,7 @@ var init_ast_helpers = __esm({
     __name(isFunction, "isFunction");
     __name(getFunctionBody, "getFunctionBody");
     __name(resolveIdentifier, "resolveIdentifier");
+    __name(unwrapExpression, "unwrapExpression");
     __name(findImportSource, "findImportSource");
   }
 });
@@ -12519,6 +12736,19 @@ var init_schema_converter = __esm({
 
 // src/compiler/plugins/tool.plugin.ts
 import { Node as Node4 } from "ts-morph";
+function isToolShapedLiteral(literal, typeAnnotation, initializerText) {
+  if (!extractStringProperty(literal, "name")) return false;
+  const execute = literal.getProperty("execute");
+  if (!execute) return false;
+  const executeIsCallable = Node4.isMethodDeclaration(execute) || Node4.isShorthandPropertyAssignment(execute) || Node4.isPropertyAssignment(execute) && (() => {
+    const init3 = unwrapExpression(execute.getInitializer());
+    return !!init3 && (Node4.isArrowFunction(init3) || Node4.isFunctionExpression(init3) || Node4.isIdentifier(init3) || Node4.isPropertyAccessExpression(init3) || Node4.isCallExpression(init3));
+  })();
+  if (!executeIsCallable) return false;
+  if (literal.getProperty("description") || literal.getProperty("inputSchema")) return true;
+  const annotated = /* @__PURE__ */ __name((text) => !!text && /\bLua(Voice)?Tool\b/.test(text), "annotated");
+  return annotated(typeAnnotation) || annotated(initializerText);
+}
 var ToolPlugin;
 var init_tool_plugin = __esm({
   "src/compiler/plugins/tool.plugin.ts"() {
@@ -12542,6 +12772,34 @@ var init_tool_plugin = __esm({
         copyAllFields: true
       };
       supportsClassDefinition = true;
+      /** The three call / class shapes, then (LUA-781) the object-literal shape for the identifiers they did not claim. */
+      detect(sourceFile) {
+        const primitives = super.detect(sourceFile);
+        this.detectObjectLiterals(sourceFile, primitives);
+        return primitives;
+      }
+      /**
+      * LUA-781: `const t = { name: 'x', description, inputSchema, execute }` (any export form; the initializer may sit
+      * under `as` / `satisfies` / parentheses). The export IS the tool object, exactly like a `defineTool({...})`
+      * result, so it compiles as the `function` pattern: the entry point imports it and the runtime validation asserts
+      * `execute`. A literal counts when it carries a string `name`, an `execute` member and — so a random
+      * `{ name, execute }` registry entry is not mistaken for one — a `description`, an `inputSchema` or a `LuaTool`
+      * type annotation (`const t: LuaTool = …`, `… as LuaTool`, `… satisfies LuaTool`).
+      */
+      detectObjectLiterals(sourceFile, primitives) {
+        const claimed = new Set(primitives.map((p) => p.exportName));
+        for (const varDecl of sourceFile.getVariableDeclarations()) {
+          const exportName = varDecl.getName();
+          if (claimed.has(exportName)) continue;
+          const initializer = varDecl.getInitializer();
+          const literal = unwrapExpression(initializer);
+          if (!literal || !Node4.isObjectLiteralExpression(literal)) continue;
+          if (!isToolShapedLiteral(literal, varDecl.getTypeNode()?.getText(), initializer?.getText())) continue;
+          const pos = sourceFile.getLineAndColumnAtPos(varDecl.getStart());
+          const metadata = this.extractFromConfig(literal, exportName, sourceFile.getFilePath(), pos, "function");
+          if (metadata) primitives.push(metadata);
+        }
+      }
       /**
       * Extract metadata from a `defineTool({...})` / `new LuaTool({...})`
       * config object literal. (Class-definition shape is handled by the
@@ -12663,12 +12921,12 @@ var init_tool_plugin = __esm({
         } else {
           const varDecl = sourceFile.getVariableDeclaration(metadata.exportName);
           if (!varDecl) return void 0;
-          const initializer = varDecl.getInitializer();
-          if (!initializer || !Node4.isCallExpression(initializer)) return void 0;
-          const args2 = initializer.getArguments();
-          if (args2.length === 0) return void 0;
-          const config = args2[0];
-          if (!Node4.isObjectLiteralExpression(config)) return void 0;
+          const initializer = unwrapExpression(varDecl.getInitializer());
+          if (!initializer) return void 0;
+          let config;
+          if (Node4.isObjectLiteralExpression(initializer)) config = initializer;
+          else if (Node4.isCallExpression(initializer)) config = initializer.getArguments()[0];
+          if (!config || !Node4.isObjectLiteralExpression(config)) return void 0;
           schemaNode = extractSchemaProperty(config, "inputSchema");
         }
         if (!schemaNode) return void 0;
@@ -12693,6 +12951,7 @@ var init_tool_plugin = __esm({
         };
       }
     };
+    __name(isToolShapedLiteral, "isToolShapedLiteral");
   }
 });
 
@@ -19025,6 +19284,7 @@ function computeDeferred(graph, opts = {}) {
       deferred.add("job-tier-disabled");
       deferred.add("job-tier-provider-unsupported");
     }
+    if (n2.type === "agent" && typeof n2.model === "string" && !isModelIdSentinel(n2.model)) deferred.add("model-unresolved");
     if (Array.isArray(n2.requiredConnections) && n2.requiredConnections.some(serverDecides)) deferred.add("required-connection-unknown");
     if (n2.type === "approval") {
       const a = n2.approver;
@@ -19287,22 +19547,24 @@ function collectSingleSteps(graph) {
 }
 function collectGraphIds(graph) {
   const ids = [];
-  const idOf = /* @__PURE__ */ __name((n2) => n2.type === "step" ? n2.step.id : n2.id, "idOf");
-  for (const entry of graph.definition.graph) {
-    const e = entry;
-    const own = idOf(e);
-    if (own) ids.push(own);
-    for (const child of [
-      ...e.steps ?? [],
-      e.step,
-      e.otherwise
+  const visit = /* @__PURE__ */ __name((node) => {
+    if (!node || typeof node !== "object" || Array.isArray(node)) return;
+    const n2 = node;
+    if (typeof n2.type !== "string") return;
+    const own = n2.type === "step" ? n2.step?.id : n2.id;
+    if (typeof own === "string") ids.push(own);
+    for (const key of [
+      "steps",
+      "step",
+      "otherwise",
+      "graph"
     ]) {
-      if (child) {
-        const id = idOf(child);
-        if (id) ids.push(id);
-      }
+      const child = n2[key];
+      if (Array.isArray(child)) child.forEach(visit);
+      else visit(child);
     }
-  }
+  }, "visit");
+  for (const entry of graph.definition.graph) visit(entry);
   return ids;
 }
 function stripFunctions(v) {
@@ -19347,6 +19609,8 @@ var init_workflow_plugin = __esm({
       STEP_EXECUTE_MISSING: "WORKFLOW_STEP_EXECUTE_MISSING",
       UNPLACED_STEP: "WORKFLOW_UNPLACED_STEP",
       TOOL_REF_UNRESOLVED: "WORKFLOW_TOOL_REF_UNRESOLVED",
+      /** LUA-781: a tool node whose `toolId` names no compiled tool of the project — an ERROR; the push refuses it too. */
+      TOOL_UNBUNDLED: "WORKFLOW_TOOL_UNBUNDLED",
       NESTED_NOT_REGISTERED: "WORKFLOW_NESTED_NOT_REGISTERED",
       SCHEMA_UNSUPPORTED: "WORKFLOW_SCHEMA_UNSUPPORTED",
       SKETCH_TOPOLOGY: "WORKFLOW_SKETCH_TOPOLOGY",
@@ -19425,7 +19689,7 @@ var init_workflow_plugin = __esm({
         for (const call of chain) {
           const callee = call.getExpression();
           if (Node18.isPropertyAccessExpression(callee) && callee.getName() === "toolStep") {
-            const ref = call.getArguments()[1];
+            const ref = unwrapExpression(call.getArguments()[1]);
             if (ref && Node18.isIdentifier(ref)) toolRefIdentifiers.push(ref.getText());
           }
         }
@@ -19678,7 +19942,7 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
           if (!graphIds.has(id) && tier.topology !== "sketch") {
             issues.push({
               code: WORKFLOW_COMPILE_CODES.UNPLACED_STEP,
-              message: `createStep "${id}" is declared in ${relative(rootDir, metadata.sourcePath)} but never placed in workflow "${metadata.name}" (error at push)`,
+              message: `createStep "${id}" is declared in ${relative(rootDir, metadata.sourcePath)} but placed in no workflow of the project (compiled with "${metadata.name}"; error at push \u2014 lua push workflow refuses the version: place it in a chain or delete the declaration)`,
               severity: "warning",
               stepId: id,
               source: sources.get(id)
@@ -19739,6 +20003,26 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
         const workflows = compiled.filter((p) => p.kind === PrimitiveKind.WORKFLOW && p.graph);
         const inheritTargets2 = new Set(workflows.flatMap((p) => p.graph?.inheritRefs ?? []));
         for (const p of workflows) if (p.graph && inheritTargets2.has(p.name)) p.graph = applyInheritCandidate(p.graph);
+        const placed = /* @__PURE__ */ new Set();
+        for (const p of workflows) for (const id of collectGraphIds(p.graph.graph)) placed.add(id);
+        for (const p of workflows) {
+          if (!p.graph) continue;
+          p.graph.issues = p.graph.issues.filter((i) => i.code !== WORKFLOW_COMPILE_CODES.UNPLACED_STEP || !i.stepId || !placed.has(i.stepId));
+        }
+        const bundledTools = new Set(compiled.filter((p) => p.kind === "tool").map((p) => p.name));
+        for (const p of workflows) {
+          if (!p.graph || p.graph.topology === "sketch") continue;
+          for (const node of collectSingleSteps(p.graph.graph)) {
+            if (node.type !== "tool" || bundledTools.has(node.toolId)) continue;
+            p.graph.issues.push({
+              code: WORKFLOW_COMPILE_CODES.TOOL_UNBUNDLED,
+              message: `toolStep "${node.id}" references tool "${node.toolId}" but no compiled tool artifact of that name exists in this project \u2014 the version would push without it and every run would fail the step TOOL_REF_UNRESOLVED (not_in_version_bundle). Declare the tool where the compiler sees it (defineTool({ name: '${node.toolId}', \u2026 }), a class implementing LuaTool, or an exported { name, description, inputSchema, execute } object) and pass that export to toolStep()`,
+              severity: "error",
+              stepId: node.id,
+              source: p.graph.stepMeta.find((m) => m.id === node.id)?.source
+            });
+          }
+        }
         const sketched = workflows.filter((p) => p.graph?.topology === "sketch").map((p) => p.name);
         if (sketched.length === 0) return;
         for (const p of workflows) {
@@ -19790,6 +20074,9 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
           output: d.graph.definition.outputSchema,
           state: d.graph.definition.stateSchema
         };
+        const unplacedStepIds = [
+          ...new Set(d.issues.filter((i) => i.code === WORKFLOW_COMPILE_CODES.UNPLACED_STEP && typeof i.stepId === "string").map((i) => i.stepId))
+        ].sort();
         const entry = {
           ...this.baseManifestFields(compiled),
           kind: PrimitiveKind.WORKFLOW,
@@ -19805,6 +20092,7 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
           toolRefs,
           workflowRefs: d.workflowRefs,
           mayInherit: d.mayInherit,
+          unplacedStepIds: unplacedStepIds.length > 0 ? unplacedStepIds : void 0,
           budget: cfg.budget,
           concurrencyPolicy: cfg.concurrencyPolicy,
           schedule: config.schedule,
@@ -20418,8 +20706,16 @@ var init_agent_traverser = __esm({
         }
         this.log(`\u{1F916} Found agent: ${agentConfig.name} in ${agentConfig.sourcePath}`);
         const primitives = [];
+        const seen = /* @__PURE__ */ new Set();
+        const add2 = /* @__PURE__ */ __name((p) => {
+          const key = `${p.kind}\0${p.sourcePath}\0${p.exportName}`;
+          if (seen.has(key)) return false;
+          seen.add(key);
+          primitives.push(p);
+          return true;
+        }, "add");
         const { refs: _refs, ...agentMetadata } = agentConfig;
-        primitives.push(agentMetadata);
+        add2(agentMetadata);
         for (const config of PRIMITIVE_TYPES) {
           const refs = agentConfig.refs.get(config.kind) || [];
           for (const ref of refs) {
@@ -20441,10 +20737,9 @@ var init_agent_traverser = __esm({
               viaDefaultImport: ref.viaDefaultImport === true
             });
             if (!primitive) continue;
-            primitives.push(primitive);
+            if (!add2(primitive)) continue;
             if (config.resolveNested) {
-              const nested = this.resolveReferencesForPrimitive(primitive, sourcePath);
-              primitives.push(...nested);
+              for (const nested of this.resolveReferencesForPrimitive(primitive, sourcePath)) add2(nested);
             }
           }
         }
@@ -24642,6 +24937,14 @@ var init_workflow_api_service = __esm({
       async getVersionEnvOverlay(workflowId, version) {
         return this.httpGet(`${this.base}/${workflowId}/versions/${encodeURIComponent(version)}/env-overlay`, await this.auth());
       }
+      /**
+      * WF-403 (13 §13.14; LUA-752) — `GET …/:workflowId/export?version=`: the active (or named) version as pushable
+      * files (`{ form, version, files:[{ path, contents }], warnings }`). `lua workflows export` writes them to disk.
+      */
+      async exportWorkflowFiles(workflowId, version) {
+        const qs = version ? `?version=${encodeURIComponent(version)}` : "";
+        return this.httpGet(`${this.base}/${workflowId}/export${qs}`, await this.auth());
+      }
       async getWorkflowVersions(workflowId) {
         return this.httpGet(`${this.base}/${workflowId}/versions`, await this.auth());
       }
@@ -24738,6 +25041,34 @@ var init_workflow_api_service = __esm({
       async retryStep(runId, stepId, data = {}) {
         return this.httpPost(`${this.runs}/${runId}/steps/${pathId(stepId)}/retry`, data, await this.auth());
       }
+      /**
+      * R37 (LUA-752) — a human decides a parked step: `skip` it, `complete` it with the output it would have produced,
+      * or `fail` it (the step's onError policy applies). 400 `VALIDATION_FAILED{output-required}` / `RESOLVE_OUTPUT_INVALID`,
+      * 403 `APPROVAL_REQUIRES_HUMAN` / `NOT_RUN_CREATOR`, 404 `RUN_NOT_FOUND` / `STEP_NOT_FOUND`, 409 `STEP_NOT_PARKED` /
+      * `RUN_TERMINAL`, 413 `OUTPUT_TOO_LARGE`; the CAS loser is a 200 `{ resolved:false, reason, recorded }`.
+      */
+      async resolveStep(runId, stepId, data) {
+        return this.httpPost(`${this.runs}/${runId}/steps/${pathId(stepId)}/resolve`, data, await this.auth());
+      }
+      /**
+      * R45 (LUA-752) — raise a parked run's budget (`maxCredits` / `maxSteps` / `maxJobSeconds` / `maxDurationSeconds`;
+      * increases only). 400 `VALIDATION_FAILED` / `CAP_EXCEEDED`, 403 `NOT_RUN_CREATOR`, 409 `BUDGET_NOT_RAISABLE`.
+      */
+      async raiseBudget(runId, data) {
+        return this.httpPost(`${this.runs}/${runId}/budget`, data, await this.auth());
+      }
+      /**
+      * R39 (LUA-752) — the current approval payload with its `payloadFingerprint` / `editRevision` (what
+      * `approve --edit --fingerprint` echoes). `path` pages one array of a large payload.
+      */
+      async getApprovalPayload(runId, approvalId, query = {}) {
+        const q = new URLSearchParams();
+        if (query.path) q.append("path", query.path);
+        if (query.cursor) q.append("cursor", query.cursor);
+        if (query.limit !== void 0) q.append("limit", String(query.limit));
+        const qs = q.toString();
+        return this.httpGet(`${this.runs}/${runId}/approvals/${pathId(approvalId)}/payload${qs ? `?${qs}` : ""}`, await this.auth());
+      }
       /** R13 — resolve an approval (human; `expectedFingerprint` guards against an edited payload — 409 `PAYLOAD_MISMATCH`). */
       async resolveApproval(runId, approvalId, data) {
         return this.httpPost(`${this.runs}/${runId}/approvals/${pathId(approvalId)}/resolve`, data, await this.auth());
@@ -24822,6 +25153,14 @@ var init_workflow_api_service = __esm({
       async getSchedule(jobId) {
         return this.httpGet(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
       }
+      /** R27 (LUA-752) — create or replace the plain schedule Job of a workflow (201; 400 `VALIDATION_FAILED` / `WORKFLOW_NOT_ON_AGENT`, 404 `WORKFLOW_NOT_FOUND`, 409 `SCHEDULE_CAP`). */
+      async createSchedule(data) {
+        return this.httpPost(this.schedules, data, await this.auth());
+      }
+      /** R56 (LUA-752) — pause / resume a schedule, persist `backfillOnEnable`, one-shot `backfillNow` (404 `SCHEDULE_NOT_FOUND`, 400 `VALIDATION_FAILED{issues}`). */
+      async updateSchedule(jobId, data) {
+        return this.httpPatch(`${this.schedules}/${encodeURIComponent(jobId)}`, data, await this.auth());
+      }
       /** R28 — delete a schedule Job (404 `SCHEDULE_NOT_FOUND`). The CLI refuses a LIVE goal's job BEFORE this call (`goal_schedule`); an ended goal's lingering Job is retired here (LUA-760). */
       async deleteSchedule(jobId) {
         return this.httpDelete(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
@@ -26945,6 +27284,7 @@ var AgentApi = class extends HttpClient {
 // src/utils/init-agent.ts
 init_constants();
 init_cli();
+init_cli_error();
 async function fetchAgentTypes(apiKey) {
   writeProgress("\u{1F504} Fetching agent types...");
   const agentApi = new AgentApi(BASE_URLS.API, apiKey);
@@ -27037,12 +27377,18 @@ async function fetchExistingAgentDetails(apiKey, agentId) {
   return fetchAgentDetails(agentApi, agentId);
 }
 __name(fetchExistingAgentDetails, "fetchExistingAgentDetails");
+async function fetchApprovedModelsOrThrow(apiKey, agentId, orgId) {
+  const agentApi = new AgentApi(BASE_URLS.API, apiKey);
+  const result = await agentApi.getApprovedModels(void 0, agentId, orgId);
+  if (!result.success) {
+    throw CliError.fromStatus(result.error?.statusCode, `Could not fetch models from the server: ${result.error?.message || "Unknown error"}`);
+  }
+  return result.data ?? [];
+}
+__name(fetchApprovedModelsOrThrow, "fetchApprovedModelsOrThrow");
 async function fetchApprovedModels(apiKey, agentId, orgId) {
   try {
-    const agentApi = new AgentApi(BASE_URLS.API, apiKey);
-    const result = await agentApi.getApprovedModels(void 0, agentId, orgId);
-    if (!result.success) return null;
-    return result.data ?? [];
+    return await fetchApprovedModelsOrThrow(apiKey, agentId, orgId);
   } catch {
     return null;
   }
@@ -28709,12 +29055,7 @@ async function duplicateAgentNonInteractive(apiKey, userData, mode, options) {
   if (mode.orgId) {
     const existingOrg = orgs.find((o) => o.id === mode.orgId);
     if (!existingOrg) {
-      console.error(`\u274C Organization not found: ${mode.orgId}`);
-      writeInfo("\nAvailable organizations:");
-      for (const org of orgs) {
-        writeInfo(`  - ${org.registeredName} (${org.id})`);
-      }
-      throw new Error("Operation failed");
+      throw CliError.notFound(`Organization not found: ${mode.orgId}`, availableOrgsHint(orgs));
     }
     targetOrgId = mode.orgId;
     writeProgress(`\u2705 Using target organization: ${existingOrg.registeredName}`);
@@ -28724,12 +29065,7 @@ async function duplicateAgentNonInteractive(apiKey, userData, mode, options) {
       targetOrgId = matchedOrg.id;
       writeProgress(`\u2705 Found target organization: ${matchedOrg.registeredName}`);
     } else {
-      console.error(`\u274C Organization not found: ${mode.orgName}`);
-      writeInfo("\nAvailable organizations:");
-      for (const org of orgs) {
-        writeInfo(`  - ${org.registeredName} (${org.id})`);
-      }
-      throw new Error("Operation failed");
+      throw CliError.notFound(`Organization not found: ${mode.orgName}`, availableOrgsHint(orgs));
     }
   } else {
     targetOrgId = sourceOrgId;
@@ -29210,10 +29546,13 @@ async function selectExistingAgent(orgs, apiKey) {
   };
 }
 __name(selectExistingAgent, "selectExistingAgent");
+function availableOrgsHint(orgs) {
+  return listHint("Available organizations:", orgs.map((org) => `${org.registeredName} (${org.id})`));
+}
+__name(availableOrgsHint, "availableOrgsHint");
 async function selectExistingAgentById(orgs, apiKey, agentId) {
   if (orgs.length === 0) {
-    console.error("\u274C No organizations found.");
-    throw new Error("No organizations found.");
+    throw CliError.notFound("No organizations found.");
   }
   for (const org of orgs) {
     const agent = org.agents.find((candidate) => candidate.agentId === agentId);
@@ -29235,17 +29574,14 @@ async function selectExistingAgentById(orgs, apiKey, agentId) {
       };
     }
   }
-  console.error(`\u274C Agent not found: ${agentId}`);
-  writeInfo("\nAvailable agents:");
+  const available = [];
   for (const org of orgs) {
     if (org.agents && org.agents.length > 0) {
-      writeInfo(`  ${org.registeredName ?? org.name ?? org.id}:`);
-      for (const agent of org.agents) {
-        writeInfo(`    - ${agent.name} (${agent.agentId})`);
-      }
+      available.push(`${org.registeredName ?? org.name ?? org.id}:`);
+      for (const agent of org.agents) available.push(`  - ${agent.name} (${agent.agentId})`);
     }
   }
-  throw new Error("Operation failed");
+  throw CliError.notFound(`Agent not found: ${agentId}`, listHint("Available agents:", available, ""));
 }
 __name(selectExistingAgentById, "selectExistingAgentById");
 async function createNewAgentNonInteractive(apiKey, userData, agentName, orgId, orgName, promoCode, model) {
@@ -29255,12 +29591,7 @@ async function createNewAgentNonInteractive(apiKey, userData, agentName, orgId,
     const orgs = userData.admin?.orgs || [];
     const existingOrg = orgs.find((o) => o.id === orgId);
     if (!existingOrg) {
-      console.error(`\u274C Organization not found: ${orgId}`);
-      writeInfo("\nAvailable organizations:");
-      for (const org of orgs) {
-        writeInfo(`  - ${org.registeredName} (${org.id})`);
-      }
-      throw new Error("Operation failed");
+      throw CliError.notFound(`Organization not found: ${orgId}`, availableOrgsHint(orgs));
     }
     writeProgress(`\u2705 Using organization: ${existingOrg.registeredName}`);
   } else if (orgName) {
@@ -31576,6 +31907,7 @@ var voiceHandler = new VoiceHandler();
 // src/primitives/workflow.handler.ts
 init_types();
 init_constants();
+init_cli_error();
 init_workflow_api_service();
 init_artifact_loader();
 init_bundle_upload();
@@ -32732,6 +33064,15 @@ async function runWorkflowLocallyInner(rawOpts) {
       stepResults[d]
     ]));
   }, "inputFor");
+  const nodeInputFor = /* @__PURE__ */ __name((row2, single, base) => {
+    const cfg = single.input;
+    if (!cfg || typeof cfg !== "object" || Array.isArray(cfg) || Object.keys(cfg).length === 0) return base;
+    const resolved = resolveMapping(parseMapConfig(cfg, row2.stepId), mappingCtx());
+    if ("error" in resolved) {
+      throw new StepFailure("binding_unresolved", `input map of "${row2.stepId}": ${"key" in resolved && resolved.key ? resolved.key : resolved.error}`);
+    }
+    return resolved.value;
+  }, "nodeInputFor");
   let runFailure;
   let bailed;
   const terminalize = /* @__PURE__ */ __name((row2, status, extra = {}) => {
@@ -33015,8 +33356,9 @@ async function runWorkflowLocallyInner(rawOpts) {
   const fakeObject = /* @__PURE__ */ __name((single) => single.outputSchema ? {
     object: stubFromSchema(single.outputSchema)
   } : {}, "fakeObject");
-  const executeSingle = /* @__PURE__ */ __name(async (row2, single, input) => {
+  const executeSingle = /* @__PURE__ */ __name(async (row2, single, rawInput) => {
     const id = row2.stepId;
+    const input = nodeInputFor(row2, single, rawInput);
     const drift = stepInputIssue(single, input);
     if (drift) throw drift;
     if (opts.stepOutputs && id in opts.stepOutputs) {
@@ -33077,33 +33419,6 @@ async function runWorkflowLocallyInner(rawOpts) {
         return out;
       }
       case "workflow": {
-        if (single.workflowId === WORKFLOW_ARM_SUBRUN_ID && single.graph) {
-          const [armMap, inner] = single.graph;
-          const innerId = armId2(inner);
-          const ctx = {
-            ...mappingCtx(),
-            stepResults: {
-              ...stepResults,
-              [innerId]: input,
-              [row2.stepId]: input,
-              $item: input
-            }
-          };
-          const resolved = resolveMapping(parseMapConfig(armMap.mapConfig, armMap.id), ctx);
-          if ("error" in resolved) throw new StepFailure("binding_unresolved", `arm map "${armMap.id}": ${resolved.key ?? resolved.error}`);
-          stepResults[armMap.id] = resolved.value;
-          const innerRow = {
-            ...row2,
-            stepId: innerId,
-            node: {
-              ...row2.node,
-              entry: inner
-            }
-          };
-          const out = await executeSingle(innerRow, inner, resolved.value);
-          stepResults[innerId] = out;
-          return out;
-        }
         throw new StepFailure("SUBRUN_NOT_SUPPORTED_OFFLINE", `nested workflow "${single.workflowId}" cannot run offline \u2014 supply --step-output ${id}=<json>`);
       }
     }
@@ -33576,7 +33891,13 @@ async function runWorkflowLocallyInner(rawOpts) {
     }
     const suppliedId = stepOutputIdFor(row2);
     if (opts.stepOutputs && suppliedId !== void 0) {
-      const drift = entry.type === "step" ? stepInputIssue(entry, inputFor(row2)) : void 0;
+      let drift;
+      try {
+        drift = entry.type === "step" ? stepInputIssue(entry, nodeInputFor(row2, entry, inputFor(row2))) : void 0;
+      } catch (e) {
+        if (!(e instanceof StepFailure)) throw e;
+        drift = e;
+      }
       if (drift) {
         row2.status = "running";
         row2.error = {
@@ -34584,6 +34905,7 @@ var WorkflowHandler = class extends BaseVersionedHandler {
   prepareForPush(manifest, name, projectPath = process.cwd(), bundleAccumulator) {
     const primitive = findPrimitive(manifest, name, this.kind);
     if (!primitive) return null;
+    if (primitive.unplacedStepIds?.length) throw unplacedStepError(primitive.name, primitive.unplacedStepIds);
     if (primitive.form === "script") return this.buildPushData(primitive, void 0);
     const data = super.prepareForPush(manifest, name, projectPath, bundleAccumulator);
     if (!data) return null;
@@ -34599,6 +34921,11 @@ var WorkflowHandler = class extends BaseVersionedHandler {
   * engine's claim could not resolve `toolId` and every static tool step failed `TOOL_REF_UNRESOLVED`
   * (prod 2026-09-05, kitchen-sink `armB`, 39/39 runs). Each referenced tool rides the version as
   * `tools[] = {name, code | codeS3Hash}`, through the same accumulator the workflow bundle uses.
+  *
+  * LUA-781: a reference with NO compiled artifact used to warn and push anyway (exit 0) — the version carried no
+  * `tools[]` and every run failed the node `not_in_version_bundle` (staging 2026-09-08: a `LuaTool` written as a
+  * plain object was never detected). The compile now refuses it (`WORKFLOW_TOOL_UNBUNDLED`, an error); this is the
+  * belt for a stale manifest — one typed line, exit 1, nothing sent.
   */
   toolBundlesFor(wf, manifest, projectPath, bundleAccumulator) {
     const out = [];
@@ -34606,10 +34933,7 @@ var WorkflowHandler = class extends BaseVersionedHandler {
       ...new Set(wf.toolRefs ?? [])
     ]) {
       const tool = findPrimitive(manifest, toolName, PrimitiveKind.TOOL);
-      if (!tool) {
-        console.warn(`\u26A0\uFE0F  workflow "${wf.name}" references tool "${toolName}" but the manifest carries no compiled artifact for it \u2014 the engine can only resolve it through the agent's skills (TOOL_REF_UNRESOLVED otherwise)`);
-        continue;
-      }
+      if (!tool) throw toolUnbundledError(wf.name, toolName);
       const code = loadArtifact(tool, projectPath);
       if (bundleAccumulator) {
         const rawGzip = compressForPushRaw(code);
@@ -34707,6 +35031,19 @@ var WorkflowHandler = class extends BaseVersionedHandler {
   }
 };
 var workflowHandler = new WorkflowHandler();
+function unplacedStepError(workflowName, stepIds) {
+  const list = stepIds.map((id) => `"${id}"`).join(", ");
+  return new CliError("unplaced_step", `workflow "${workflowName}" is not pushed: createStep ${list} ${stepIds.length === 1 ? "is" : "are"} declared in its source file but placed in no workflow (WORKFLOW_UNPLACED_STEP)`, {
+    hint: `place ${stepIds.length === 1 ? "it" : "them"} in a chain (.then(step) / .parallel([...])) or delete the declaration, then push again \u2014 lua compile lists every unplaced step`
+  });
+}
+__name(unplacedStepError, "unplacedStepError");
+function toolUnbundledError(workflowName, toolName) {
+  return new CliError("tool_unbundled", `workflow "${workflowName}" is not pushed: toolStep tool "${toolName}" has no compiled artifact in this project (WORKFLOW_TOOL_UNBUNDLED) \u2014 the version would carry no tools[] entry for it and every run would fail the step TOOL_REF_UNRESOLVED (not_in_version_bundle)`, {
+    hint: `declare "${toolName}" where the compiler sees it \u2014 defineTool({ name: '${toolName}', \u2026 }), a class implementing LuaTool, or an exported { name, description, inputSchema, execute } object \u2014 pass that export to toolStep(), then run lua compile (it lists every unbundled tool) and push again`
+  });
+}
+__name(toolUnbundledError, "toolUnbundledError");
 function workflowNameTakenHint(name, error) {
   if (error?.code !== "WORKFLOW_NAME_TAKEN") return null;
   const holder = error.dynamic ? "a chat-composed (dynamic) workflow" : "an existing workflow";
@@ -35354,13 +35691,19 @@ var ALIAS_MAP = {
       "cancel",
       "resume",
       "retry-step",
+      // LUA-752: the R37 / R45 / R39 verbs the park hints and the approve refusal already named (they did not exist).
+      "resolve-step",
+      "raise-budget",
       "approve",
+      "approval-payload",
       "signal",
       "replay",
       "logs",
       "delete",
       "delete-run",
       "env-overlay",
+      // LUA-752 (L6.3): WF-403 — the active / named version back as pushable files.
+      "export",
       "archive-runs",
       "workspace",
       "jobs",
@@ -35380,6 +35723,12 @@ var ALIAS_MAP = {
       env: "env-overlay",
       overlay: "env-overlay",
       archive: "archive-runs",
+      resolve: "resolve-step",
+      budget: "raise-budget",
+      raise: "raise-budget",
+      payload: "approval-payload",
+      codegen: "export",
+      "export-workflow": "export",
       show: "view",
       info: "view",
       ls: "list",
@@ -35436,12 +35785,28 @@ var ALIAS_MAP = {
     })
   },
   "workflows.schedules.action": {
+    // LUA-752: `create` (R27) · `patch` / `pause` / `resume` (R56) beside the LUA-627 reads and R28 delete.
     canonical: [
       "list",
+      "create",
+      "patch",
+      "pause",
+      "resume",
       "delete"
     ],
     aliases: lowerKeys({
       ls: "list",
+      new: "create",
+      add: "create",
+      set: "create",
+      update: "patch",
+      edit: "patch",
+      hold: "pause",
+      stop: "pause",
+      disable: "pause",
+      unpause: "resume",
+      enable: "resume",
+      continue: "resume",
       rm: "delete",
       remove: "delete",
       del: "delete",
@@ -37032,6 +37397,7 @@ function writeLedgerFile(file, value3) {
 __name(writeLedgerFile, "writeLedgerFile");
 
 // src/commands/test.ts
+init_cli_error();
 async function loadAuthOrFail() {
   const { config, agentId, apiKey } = await initializeCommand({
     showProgress: false
@@ -37079,9 +37445,7 @@ function parseJsonInputOrFail(inputJson, expectedFormat) {
   try {
     return JSON.parse(inputJson);
   } catch (error) {
-    console.error(`\u274C Invalid JSON input: ${error instanceof Error ? error.message : "Unknown error"}`);
-    console.log(`Expected format: ${expectedFormat}`);
-    throw new Error(`Invalid JSON input: ${error instanceof Error ? error.message : "Unknown error"}`);
+    throw CliError.usage(`Invalid JSON input: ${error instanceof Error ? error.message : "Unknown error"}`, `Expected format: ${expectedFormat}`);
   }
 }
 __name(parseJsonInputOrFail, "parseJsonInputOrFail");
@@ -37090,8 +37454,7 @@ async function selectEntityOrPrompt(options) {
   if (entityName) {
     const selected = items.find((item) => item[idProperty] === entityName || item[nameProperty] === entityName);
     if (!selected) {
-      console.error(`\u274C ${entityType} "${entityName}" not found`);
-      throw new Error(`${entityType} "${entityName}" not found`);
+      throw CliError.notFound(`${entityType} "${entityName}" not found`);
     }
     progress(asJson ?? false, `\u2705 Selected ${entityType.toLowerCase()}: ${selected[nameProperty]}`);
     return selected;
@@ -37182,11 +37545,11 @@ async function testCommand(type, cmdObj) {
       type = validateOrSuggest("test.type", type);
       selectedType = type;
     } else if (entityName) {
-      console.error(`\u274C Type must be specified when using the --name option.`);
-      console.log("\nUsage:");
-      console.log('  lua test skill --name mySkill --input "{...}"      Test skill with JSON input');
-      console.log('  lua test webhook --name myWebhook --input "{...}"  Test webhook with JSON input');
-      throw new Error("Type must be specified when using the --name option.");
+      throw CliError.usage("Type must be specified when using the --name option.", [
+        "Usage:",
+        '  lua test skill --name mySkill --input "{...}"      Test skill with JSON input',
+        '  lua test webhook --name myWebhook --input "{...}"  Test webhook with JSON input'
+      ].join("\n"));
     } else {
       const typeAnswer = await safePrompt([
         {
@@ -37273,15 +37636,13 @@ async function testSkill(entityName, inputJson, asJson = false) {
     progress(asJson, `\u{1F4C4} Loaded environment variables from .env file`);
   }
   if (allTools.length === 0) {
-    console.error("\u274C No tools found in compiled output.");
-    throw new Error("No tools found in compiled output.");
+    throw new CliError("error", "No tools found in compiled output.");
   }
   let selectedTool;
   if (entityName) {
     selectedTool = allTools.find((t) => t.id === entityName || t.name === entityName);
     if (!selectedTool) {
-      console.error(`\u274C Tool "${entityName}" not found`);
-      throw new Error("Tool");
+      throw CliError.notFound(`Tool "${entityName}" not found`);
     }
     progress(asJson, `\u2705 Selected tool: ${selectedTool.name}`);
   } else {
@@ -41382,6 +41743,7 @@ async function probeAgentErrorsSince(apiKey, agentId, sinceISO) {
 __name(probeAgentErrorsSince, "probeAgentErrorsSince");
 
 // src/commands/chat.ts
+init_cli_error();
 async function runChatProbe(chatEnv, window) {
   if (hintsDisabled()) return;
   try {
@@ -41508,8 +41870,7 @@ async function chatCommand(cmdObj) {
           break;
         }
         case "error":
-          console.log(`\u274C ${envResolution.message}`);
-          throw new Error(`${envResolution.message}`);
+          throw CliError.usage(envResolution.message);
       }
     }
     let chatEnv = {
@@ -41890,8 +42251,6 @@ async function sendSingleMessage(chatEnv, message, probeWindow) {
     }
     await runChatProbe(chatEnv, probeWindow);
   } catch (error) {
-    console.error(`
-\u274C Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     writeHintBlock({
       headline: "Something went wrong. Debug options:",
       lines: [
@@ -41907,7 +42266,8 @@ async function sendSingleMessage(chatEnv, message, probeWindow) {
       when: "error"
     });
     await runChatProbe(chatEnv, probeWindow);
-    throw new Error("Operation failed");
+    if (isTypedCliError(error)) throw error;
+    throw new CliError("error", error instanceof Error ? error.message : "Unknown error");
   }
 }
 __name(sendSingleMessage, "sendSingleMessage");
@@ -42052,6 +42412,7 @@ import fs18 from "fs";
 import path24 from "path";
 import inquirer10 from "inquirer";
 init_analytics();
+init_cli_error();
 function resolveEnvironment(env, hasNonInteractiveFlags) {
   if (env) {
     const normalized = validateOrSuggest("env.environment", env);
@@ -42166,12 +42527,7 @@ async function envCommand(env, cmdObj) {
         selectedEnvironment = environment;
         break;
       case "error":
-        console.log(`\u274C ${envResolution.message}`);
-        if (envResolution.usage) {
-          console.log("\nUsage:");
-          envResolution.usage.forEach((line) => console.log(`  ${line}`));
-        }
-        throw new Error("Operation failed");
+        throw CliError.usage(envResolution.message, listHint("Usage:", envResolution.usage ?? [], ""));
     }
     let context = {
       environment: selectedEnvironment,
@@ -42201,12 +42557,7 @@ async function envCommand(env, cmdObj) {
         await manageEnvironmentVariables(context);
         break;
       case "error":
-        console.log(`\u274C ${mode.message}`);
-        if (mode.examples) {
-          console.log("\nExamples:");
-          mode.examples.forEach((ex) => console.log(`  ${ex}`));
-        }
-        throw new Error("Operation failed");
+        throw CliError.usage(mode.message, listHint("Examples:", mode.examples ?? [], ""));
     }
     trackEvent("cli_env_action", {
       environment: env || "interactive",
@@ -42304,8 +42655,7 @@ __name(listVariables, "listVariables");
 async function setVariable(context, key, value3) {
   const validationError2 = validateKeyFormat(key);
   if (validationError2) {
-    console.log(`\u274C ${validationError2}`);
-    throw new Error(`${validationError2}`);
+    throw CliError.usage(validationError2);
   }
   try {
     const { created } = await saveVariableCore(context, key, value3);
@@ -42319,8 +42669,8 @@ async function setVariable(context, key, value3) {
       });
     }
   } catch (error) {
-    console.log(`\u274C Error setting variable: ${error instanceof Error ? error.message : "Unknown error"}`);
-    throw new Error(`Error setting variable: ${error instanceof Error ? error.message : "Unknown error"}`);
+    if (isTypedCliError(error)) throw error;
+    throw new CliError("error", `Error setting variable: ${error instanceof Error ? error.message : "Unknown error"}`);
   }
 }
 __name(setVariable, "setVariable");
@@ -42336,8 +42686,8 @@ async function removeVariable(context, key) {
       });
     }
   } catch (error) {
-    console.log(`\u274C ${error instanceof Error ? error.message : "Unknown error"}`);
-    throw new Error(`${error instanceof Error ? error.message : "Unknown error"}`);
+    if (isTypedCliError(error)) throw error;
+    throw new CliError("error", error instanceof Error ? error.message : "Unknown error");
   }
 }
 __name(removeVariable, "removeVariable");
@@ -42604,6 +42954,7 @@ init_command_utils();
 init_compiler2();
 init_artifact_loader();
 init_analytics();
+init_cli_error();
 async function personaCommand(env, action, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -42759,39 +43110,24 @@ async function executeProductionNonInteractive(context, action, options) {
       break;
     case "deploy": {
       if (!options.personaVersion) {
-        console.error("\u274C --persona-version is required for deploy action");
-        console.log("\nUsage: lua persona production deploy --persona-version <version>");
-        console.log("       lua persona production deploy -v latest");
-        if (versions.length > 0) {
-          console.log("\nAvailable versions:");
-          versions.slice(0, 5).forEach((v) => {
-            const mark = v.isCurrent ? " (current)" : "";
-            console.log(`  - ${v.version}${mark}`);
-          });
-        }
-        throw new Error("--persona-version is required for deploy action");
+        throw CliError.usage("--persona-version is required for deploy action", joinHint("Usage: lua persona production deploy --persona-version <version>\n       lua persona production deploy -v latest", listHint("Available versions:", versions.slice(0, 5).map((v) => `${v.version}${v.isCurrent ? " (current)" : ""}`))));
       }
       let versionNumber;
       if (options.personaVersion.toLowerCase() === "latest") {
         if (versions.length === 0) {
-          console.error("\u274C No versions available to deploy");
-          throw new Error("No versions available to deploy");
+          throw CliError.notFound("No versions available to deploy");
         }
         versionNumber = versions[0].version;
         console.log(`\u2139\uFE0F  Latest version is ${versionNumber}`);
       } else {
         versionNumber = parseInt(options.personaVersion, 10);
         if (isNaN(versionNumber)) {
-          console.error(`\u274C Invalid version number: "${options.personaVersion}"`);
-          throw new Error(`Invalid version number: "${options.personaVersion}"`);
+          throw CliError.usage(`Invalid version number: "${options.personaVersion}"`);
         }
       }
       const versionExists = versions.find((v) => v.version === versionNumber);
       if (!versionExists) {
-        console.error(`\u274C Version ${versionNumber} not found`);
-        console.log("\nAvailable versions:");
-        versions.forEach((v) => console.log(`  - ${v.version}`));
-        throw new Error(`Version ${versionNumber} not found`);
+        throw CliError.notFound(`Version ${versionNumber} not found`, listHint("Available versions:", versions.map((v) => String(v.version))));
       }
       if (versionExists.isCurrent) {
         console.log(`\u2139\uFE0F  Version ${versionNumber} is already deployed.`);
@@ -43783,6 +44119,7 @@ var ResourceApi = class extends HttpClient {
 
 // src/commands/resources.ts
 init_analytics();
+init_cli_error();
 async function resourcesCommand(action, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -43902,25 +44239,11 @@ async function executeNonInteractive2(context, action, options) {
     return;
   }
   if (!options.resourceName) {
-    console.error(`\u274C --resource-name is required for action "${normalizedAction}"`);
-    console.log(`
-Usage: lua resources ${normalizedAction} --resource-name <name>`);
-    if (resources.length > 0) {
-      console.log("\nAvailable resources:");
-      resources.forEach((r) => console.log(`  - ${r.name}`));
-    }
-    throw new Error("Operation failed");
+    throw CliError.usage(`--resource-name is required for action "${normalizedAction}"`, joinHint(`Usage: lua resources ${normalizedAction} --resource-name <name>`, listHint("Available resources:", resources.map((r) => r.name))));
   }
   const selectedResource = findResource(resources, options.resourceName);
   if (!selectedResource) {
-    console.error(`\u274C Resource "${options.resourceName}" not found`);
-    if (resources.length > 0) {
-      console.log("\nAvailable resources:");
-      resources.forEach((r) => console.log(`  - ${r.name}`));
-    } else {
-      console.log("\nNo resources found.");
-    }
-    throw new Error("Operation failed");
+    throw CliError.notFound(`Resource "${options.resourceName}" not found`, listHint("Available resources:", resources.map((r) => r.name)) ?? "No resources found.");
   }
   switch (normalizedAction) {
     case "view":
@@ -44681,6 +45004,7 @@ __name(doRelease, "doRelease");
 // src/commands/channels.ts
 init_constants();
 init_analytics();
+init_cli_error();
 async function channelsCommand(action) {
   return withErrorHandling(async () => {
     const { config, agentId, apiKey } = await initializeCommand();
@@ -44697,6 +45021,14 @@ async function channelsCommand(action) {
   }, "channels management");
 }
 __name(channelsCommand, "channelsCommand");
+function channelCreateError(error, alreadyConnected) {
+  if (error?.statusCode === 400 && error?.message?.includes("already exists")) {
+    return CliError.fromStatus(400, "Channel already exists", `${alreadyConnected}
+Use 'lua channels' to list existing channels.`);
+  }
+  return CliError.fromStatus(error?.statusCode, error?.message || "Unknown error", error?.error);
+}
+__name(channelCreateError, "channelCreateError");
 async function fetchChannelsCore(agentApi, agentId) {
   const response = await agentApi.getAgentChannels(agentId);
   if (!response.success) {
@@ -45108,22 +45440,7 @@ async function createWhatsAppChannel(agentApi, agentId) {
   writeInfo("\n\u{1F4E1} Creating WhatsApp channel...");
   const response = await agentApi.createWhatsAppChannel(agentId, channelData);
   if (!response.success) {
-    const error = response.error;
-    if (error?.statusCode === 400 && error?.message?.includes("already exists")) {
-      console.error(`
-\u274C Channel already exists`);
-      console.error(`\u{1F4A1} This WhatsApp number is already connected to this agent.`);
-      console.error(`   Use 'lua channels' to list existing channels.
-`);
-    } else {
-      console.error(`
-\u274C Error: ${error?.message || "Unknown error"}`);
-      if (error?.error) {
-        console.error(`   ${error.error}
-`);
-      }
-    }
-    throw new Error("Operation failed");
+    throw channelCreateError(response.error, "This WhatsApp number is already connected to this agent.");
   }
   const data = response.data;
   writeSuccess("\n\u2705 WhatsApp channel created successfully!\n");
@@ -45165,22 +45482,7 @@ async function createFacebookChannel(agentApi, agentId) {
   writeInfo("\n\u{1F4E1} Creating Facebook channel...");
   const response = await agentApi.createFacebookChannel(agentId, channelData);
   if (!response.success) {
-    const error = response.error;
-    if (error?.statusCode === 400 && error?.message?.includes("already exists")) {
-      console.error(`
-\u274C Channel already exists`);
-      console.error(`\u{1F4A1} This Facebook page is already connected to this agent.`);
-      console.error(`   Use 'lua channels' to list existing channels.
-`);
-    } else {
-      console.error(`
-\u274C Error: ${error?.message || "Unknown error"}`);
-      if (error?.error) {
-        console.error(`   ${error.error}
-`);
-      }
-    }
-    throw new Error("Operation failed");
+    throw channelCreateError(response.error, "This Facebook page is already connected to this agent.");
   }
   const data = response.data;
   writeSuccess("\n\u2705 Facebook channel created successfully!\n");
@@ -45251,22 +45553,7 @@ async function createEmailChannel(agentApi, agentId) {
   writeInfo("\n\u{1F4E1} Creating Email channel...");
   const response = await agentApi.createEmailChannel(agentId, channelData);
   if (!response.success) {
-    const error = response.error;
-    if (error?.statusCode === 400 && error?.message?.includes("already exists")) {
-      console.error(`
-\u274C Channel already exists`);
-      console.error(`\u{1F4A1} This email address is already connected to this agent.`);
-      console.error(`   Use 'lua channels' to list existing channels.
-`);
-    } else {
-      console.error(`
-\u274C Error: ${error?.message || "Unknown error"}`);
-      if (error?.error) {
-        console.error(`   ${error.error}
-`);
-      }
-    }
-    throw new Error("Operation failed");
+    throw channelCreateError(response.error, "This email address is already connected to this agent.");
   }
   const data = response.data;
   writeSuccess("\n\u2705 Email channel created successfully!\n");
@@ -45339,22 +45626,7 @@ async function createSlackPrivateChannel(agentApi, agentId) {
   writeInfo("\n\u{1F4E1} Creating Slack private channel...");
   const response = await agentApi.createSlackChannel(agentId, channelData);
   if (!response.success) {
-    const error = response.error;
-    if (error?.statusCode === 400 && error?.message?.includes("already exists")) {
-      console.error(`
-\u274C Channel already exists`);
-      console.error(`\u{1F4A1} This Slack workspace is already connected to this agent.`);
-      console.error(`   Use 'lua channels' to list existing channels.
-`);
-    } else {
-      console.error(`
-\u274C Error: ${error?.message || "Unknown error"}`);
-      if (error?.error) {
-        console.error(`   ${error.error}
-`);
-      }
-    }
-    throw new Error("Operation failed");
+    throw channelCreateError(response.error, "This Slack workspace is already connected to this agent.");
   }
   const data = response.data;
   if ("slack" in data && "botName" in data.slack) {
@@ -45409,22 +45681,7 @@ async function createSlackPublicChannel(agentApi, agentId) {
   writeInfo("\n\u{1F4E1} Creating Slack public channel...");
   const response = await agentApi.createSlackChannel(agentId, channelData);
   if (!response.success) {
-    const error = response.error;
-    if (error?.statusCode === 400 && error?.message?.includes("already exists")) {
-      console.error(`
-\u274C Channel already exists`);
-      console.error(`\u{1F4A1} This Slack app is already connected to this agent.`);
-      console.error(`   Use 'lua channels' to list existing channels.
-`);
-    } else {
-      console.error(`
-\u274C Error: ${error?.message || "Unknown error"}`);
-      if (error?.error) {
-        console.error(`   ${error.error}
-`);
-      }
-    }
-    throw new Error("Operation failed");
+    throw channelCreateError(response.error, "This Slack app is already connected to this agent.");
   }
   const data = response.data;
   if ("redirectUri" in data) {
@@ -45481,6 +45738,7 @@ var CallMetricsApi = class extends HttpClient {
 };
 
 // src/commands/logs.ts
+init_cli_error();
 var ALL_VALID_SOURCES = AGENT_LOG_SOURCES;
 var ENTITY_SOURCES = /* @__PURE__ */ new Set([
   "skill",
@@ -45688,20 +45946,14 @@ async function nonInteractiveLogs(logsApi, agentId, apiKey, options) {
   }
   if (options.name) {
     if (!filters.logSource) {
-      console.error("\u274C --type is required when using --name");
-      console.log("\nUsage: lua logs --type skill --name mySkill");
-      throw new Error("--type is required when using --name");
+      throw CliError.usage("--type is required when using --name", "Usage: lua logs --type skill --name mySkill");
     }
     if (NON_ENTITY_SOURCES.has(filters.logSource)) {
-      console.error(`\u274C --name is not applicable for ${filters.logSource} type`);
-      console.log(`
-Usage: lua logs --type ${filters.logSource} (no --name needed)`);
-      throw new Error("--name is not applicable for ${filters.logSource} type");
+      throw CliError.usage(`--name is not applicable for ${filters.logSource} type`, `Usage: lua logs --type ${filters.logSource} (no --name needed)`);
     }
     const entityId = await resolveEntityId(apiKey, agentId, filters.logSource, options.name);
     if (!entityId) {
-      console.error(`\u274C ${capitalize(filters.logSource ?? "")} "${options.name}" not found`);
-      throw new Error(`${capitalize(filters.logSource ?? "")} "${options.name}" not found`);
+      throw CliError.notFound(`${capitalize(filters.logSource ?? "")} "${options.name}" not found`);
     }
     filters.primitiveId = entityId;
   }
@@ -45710,8 +45962,7 @@ Usage: lua logs --type ${filters.logSource} (no --name needed)`);
   }
   const response = await logsApi.getAgentLogs(agentId, options.limit || 20, options.page || 1, filters);
   if (!response.success) {
-    console.error(`\u274C Error: ${response.error?.message || "Unknown error"}`);
-    throw new Error(`Error: ${response.error?.message || "Unknown error"}`);
+    throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Unknown error");
   }
   const data = response.data;
   if (options.json) {
@@ -45923,8 +46174,7 @@ async function viewAgentLogsInteractive(logsApi, agentId, filters = {}) {
   while (keepViewing) {
     const response = await logsApi.getAgentLogs(agentId, limit, currentPage, filters);
     if (!response.success) {
-      writeError(`\u274C Error: ${response.error?.message || "Unknown error"}`);
-      throw new Error("Operation failed");
+      throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Unknown error");
     }
     const data = response.data;
     displayLogsCore(data.logs, data.pagination, "All Agent Logs", true);
@@ -46300,6 +46550,7 @@ __name(localVersionLine, "localVersionLine");
 init_skills_api_service();
 init_skill_handler();
 init_analytics();
+init_cli_error();
 async function skillsCommand(actionOrEnv, actionArg, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -46580,10 +46831,7 @@ async function executeNonInteractive4(context, config, action, options) {
     return;
   }
   if (!options.skillName) {
-    console.error(`\u274C --skill-name is required for action "${action}"`);
-    console.log(`
-Usage: lua skills ${action} --skill-name <name>`);
-    throw new Error(`--skill-name is required for action "${action}"`);
+    throw CliError.usage(`--skill-name is required for action "${action}"`, `Usage: lua skills ${action} --skill-name <name>`);
   }
   let selectedSkill = skills.find((s) => s.skillId === options.skillName || s.name === options.skillName);
   if (!selectedSkill && action === "delete") {
@@ -46602,13 +46850,7 @@ Usage: lua skills ${action} --skill-name <name>`);
     }
   }
   if (!selectedSkill) {
-    console.error(`\u274C Skill "${options.skillName}" not found`);
-    console.log("\nAvailable skills in local config:");
-    skills.forEach((s) => console.log(`  - ${s.name} (${s.skillId})`));
-    if (action === "delete") {
-      console.log("\n\u{1F4A1} Tip: The skill may have already been deleted from the server.");
-    }
-    throw new Error(`Skill "${options.skillName}" not found`);
+    throw CliError.notFound(`Skill "${options.skillName}" not found`, joinHint(listHint("Available skills in local config:", skills.map((s) => `${s.name} (${s.skillId})`)), action === "delete" && "Tip: The skill may have already been deleted from the server."));
   }
   switch (action) {
     case "versions": {
@@ -46624,17 +46866,12 @@ Usage: lua skills ${action} --skill-name <name>`);
     }
     case "deploy": {
       if (!options.skillVersion) {
-        console.error("\u274C --skill-version is required for deploy action");
-        console.log("\nUsage: lua skills deploy --skill-name mySkill --skill-version 1.0.3");
-        console.log("       lua skills deploy -i mySkill -v latest");
-        throw new Error("--skill-version is required for deploy action");
+        throw CliError.usage("--skill-version is required for deploy action", "Usage: lua skills deploy --skill-name mySkill --skill-version 1.0.3\n       lua skills deploy -i mySkill -v latest");
       }
       const data = await fetchVersionsCore2(context, selectedSkill);
       if (!data) throw new Error("Failed to fetch skill versions");
       if (data.versions.length === 0) {
-        console.error(`\u274C No versions found for ${selectedSkill.name}.`);
-        console.log("\u{1F4A1} Push a version first using 'lua push skill'.");
-        throw new Error(`No versions found for ${selectedSkill.name}`);
+        throw CliError.notFound(`No versions found for ${selectedSkill.name}.`, "Push a version first using 'lua push skill'.");
       }
       const resolvedVersion = resolveVersion(data.versions, options.skillVersion);
       if (!resolvedVersion) throw new Error("Failed to resolve skill version");
@@ -47727,6 +47964,7 @@ init_command_utils();
 init_webhook_api_service();
 init_analytics();
 init_dist();
+init_cli_error();
 var AVAILABLE_EVENT_TYPES = Object.values(EventType).filter((event) => event.startsWith("message."));
 async function webhooksCommand(action, cmdObj) {
   return withErrorHandling(async () => {
@@ -48055,10 +48293,7 @@ async function executeNonInteractive5(context, config, action, options) {
     return;
   }
   if (!options.webhookName) {
-    console.error(`\u274C --webhook-name is required for action "${normalizedAction}"`);
-    console.log(`
-Usage: lua webhooks ${normalizedAction} --webhook-name <name>`);
-    throw new Error(`--webhook-name is required for action "${normalizedAction}"`);
+    throw CliError.usage(`--webhook-name is required for action "${normalizedAction}"`, `Usage: lua webhooks ${normalizedAction} --webhook-name <name>`);
   }
   let selectedWebhook = webhooks.find((w) => w.webhookId === options.webhookName || w.name === options.webhookName);
   if (!selectedWebhook && normalizedAction === "delete") {
@@ -48077,13 +48312,7 @@ Usage: lua webhooks ${normalizedAction} --webhook-name <name>`);
     }
   }
   if (!selectedWebhook) {
-    console.error(`\u274C Webhook "${options.webhookName}" not found`);
-    console.log("\nAvailable webhooks in local config:");
-    webhooks.forEach((w) => console.log(`  - ${w.name} (${w.webhookId})`));
-    if (normalizedAction === "delete") {
-      console.log("\n\u{1F4A1} Tip: The webhook may have already been deleted from the server.");
-    }
-    throw new Error(`Webhook "${options.webhookName}" not found`);
+    throw CliError.notFound(`Webhook "${options.webhookName}" not found`, joinHint(listHint("Available webhooks in local config:", webhooks.map((w) => `${w.name} (${w.webhookId})`)), normalizedAction === "delete" && "Tip: The webhook may have already been deleted from the server."));
   }
   switch (normalizedAction) {
     case "versions": {
@@ -48099,17 +48328,12 @@ Usage: lua webhooks ${normalizedAction} --webhook-name <name>`);
     }
     case "deploy": {
       if (!options.webhookVersion) {
-        console.error("\u274C --webhook-version is required for deploy action");
-        console.log("\nUsage: lua webhooks deploy --webhook-name myWebhook --webhook-version 1.0.3");
-        console.log("       lua webhooks deploy -i myWebhook -v latest");
-        throw new Error("--webhook-version is required for deploy action");
+        throw CliError.usage("--webhook-version is required for deploy action", "Usage: lua webhooks deploy --webhook-name myWebhook --webhook-version 1.0.3\n       lua webhooks deploy -i myWebhook -v latest");
       }
       const data = await fetchVersionsCore3(context, selectedWebhook);
       if (!data) throw new Error("Failed to fetch webhook versions");
       if (data.versions.length === 0) {
-        console.error(`\u274C No versions found for ${selectedWebhook.name}.`);
-        console.log("\u{1F4A1} Push a version first using 'lua push webhook'.");
-        throw new Error(`No versions found for ${selectedWebhook.name}`);
+        throw CliError.notFound(`No versions found for ${selectedWebhook.name}.`, "Push a version first using 'lua push webhook'.");
       }
       const resolvedVersion = resolveVersion2(data.versions, options.webhookVersion);
       if (!resolvedVersion) throw new Error("Failed to resolve webhook version");
@@ -48134,11 +48358,7 @@ Usage: lua webhooks ${normalizedAction} --webhook-name <name>`);
     }
     case "subscribe": {
       if (!options.event) {
-        console.error("\u274C --event is required for subscribe action");
-        console.log("\nUsage: lua webhooks subscribe --webhook-name myWebhook --event message.delivered");
-        console.log("\nAvailable events:");
-        AVAILABLE_EVENT_TYPES.forEach((e) => console.log(`  \u2022 ${e}`));
-        throw new Error("--event is required for subscribe action");
+        throw CliError.usage("--event is required for subscribe action", joinHint("Usage: lua webhooks subscribe --webhook-name myWebhook --event message.delivered", listHint("Available events:", AVAILABLE_EVENT_TYPES)));
       }
       const success2 = await subscribeCore(context, selectedWebhook.webhookId, selectedWebhook.name, options.event);
       if (!success2) throw new Error("Failed to subscribe webhook to event");
@@ -48146,9 +48366,7 @@ Usage: lua webhooks ${normalizedAction} --webhook-name <name>`);
     }
     case "unsubscribe": {
       if (!options.event) {
-        console.error("\u274C --event is required for unsubscribe action");
-        console.log("\nUsage: lua webhooks unsubscribe --webhook-name myWebhook --event message.delivered");
-        throw new Error("--event is required for unsubscribe action");
+        throw CliError.usage("--event is required for unsubscribe action", "Usage: lua webhooks unsubscribe --webhook-name myWebhook --event message.delivered");
       }
       const success2 = await unsubscribeCore(context, selectedWebhook.webhookId, selectedWebhook.name, options.event);
       if (!success2) throw new Error("Failed to unsubscribe webhook from event");
@@ -48483,6 +48701,7 @@ init_cli();
 init_constants();
 init_command_utils();
 init_analytics();
+init_cli_error();
 var ACCEPTED_TIMEOUT_MS = 12e4;
 var DEFAULT_LOGS_LIMIT = 20;
 function parseLimitOption(raw) {
@@ -48866,19 +49085,14 @@ async function executeNonInteractive6(context, action, options) {
   }
   if (normalizedAction === "create") {
     if (!options.name) {
-      console.error("\u274C --name is required for create action");
-      console.log('\nUsage: lua triggers create --name order-created [--description "Fires on new orders"] [--instruction "Reply with the current date and time"]');
-      throw new Error("--name is required for create action");
+      throw CliError.usage("--name is required for create action", 'Usage: lua triggers create --name order-created [--description "Fires on new orders"] [--instruction "Reply with the current date and time"]');
     }
     const success2 = await createTriggerCore(context, options.name, options.description, options.instruction);
     if (!success2) throw new Error("Failed to create trigger");
     return;
   }
   if (!options.trigger) {
-    console.error(`\u274C --trigger is required for action "${normalizedAction}"`);
-    console.log(`
-Usage: lua triggers ${normalizedAction} --trigger <name|id>`);
-    throw new Error(`--trigger is required for action "${normalizedAction}"`);
+    throw CliError.usage(`--trigger is required for action "${normalizedAction}"`, `Usage: lua triggers ${normalizedAction} --trigger <name|id>`);
   }
   const triggers = await fetchTriggersCore(context);
   if (!triggers) throw new Error("Failed to fetch triggers");
@@ -49461,6 +49675,7 @@ init_constants();
 init_command_utils();
 init_job_api_service();
 init_analytics();
+init_cli_error();
 async function jobsCommand(action, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -49783,10 +49998,7 @@ async function executeNonInteractive7(context, config, action, options) {
     return;
   }
   if (!options.jobName) {
-    console.error(`\u274C --job-name is required for action "${normalizedAction}"`);
-    console.log(`
-Usage: lua jobs ${normalizedAction} --job-name <name>`);
-    throw new Error(`--job-name is required for action "${normalizedAction}"`);
+    throw CliError.usage(`--job-name is required for action "${normalizedAction}"`, `Usage: lua jobs ${normalizedAction} --job-name <name>`);
   }
   let selectedJob = jobs.find((j) => j.jobId === options.jobName || j.name === options.jobName);
   if (!selectedJob && (normalizedAction === "delete" || normalizedAction === "trigger")) {
@@ -49805,13 +50017,7 @@ Usage: lua jobs ${normalizedAction} --job-name <name>`);
     }
   }
   if (!selectedJob) {
-    console.error(`\u274C Job "${options.jobName}" not found`);
-    console.log("\nAvailable jobs in local config:");
-    jobs.forEach((j) => console.log(`  - ${j.name} (${j.jobId})`));
-    if (normalizedAction === "delete" || normalizedAction === "trigger") {
-      console.log("\n\u{1F4A1} Tip: The job may have already been deleted from the server.");
-    }
-    throw new Error(`Job "${options.jobName}" not found`);
+    throw CliError.notFound(`Job "${options.jobName}" not found`, joinHint(listHint("Available jobs in local config:", jobs.map((j) => `${j.name} (${j.jobId})`)), (normalizedAction === "delete" || normalizedAction === "trigger") && "Tip: The job may have already been deleted from the server."));
   }
   switch (normalizedAction) {
     case "versions": {
@@ -49827,17 +50033,12 @@ Usage: lua jobs ${normalizedAction} --job-name <name>`);
     }
     case "deploy": {
       if (!options.jobVersion) {
-        console.error("\u274C --job-version is required for deploy action");
-        console.log("\nUsage: lua jobs deploy --job-name myJob --job-version 1.0.3");
-        console.log("       lua jobs deploy -i myJob -v latest");
-        throw new Error("--job-version is required for deploy action");
+        throw CliError.usage("--job-version is required for deploy action", "Usage: lua jobs deploy --job-name myJob --job-version 1.0.3\n       lua jobs deploy -i myJob -v latest");
       }
       const dData = await fetchVersionsCore4(context, selectedJob);
       if (!dData) throw new Error("Failed to fetch job versions");
       if (dData.versions.length === 0) {
-        console.error(`\u274C No versions found for ${selectedJob.name}.`);
-        console.log("\u{1F4A1} Push a version first using 'lua push job'.");
-        throw new Error(`No versions found for ${selectedJob.name}`);
+        throw CliError.notFound(`No versions found for ${selectedJob.name}.`, "Push a version first using 'lua push job'.");
       }
       const resolvedVersion = resolveVersion3(dData.versions, options.jobVersion);
       if (!resolvedVersion) throw new Error("Failed to resolve job version");
@@ -50408,9 +50609,18 @@ async function executeAction(ctx, action, target, extra, o) {
     // ── retry-step ──
     case "retry-step":
       return requireRun(runId, "retry-step", () => retryStepCore(ctx, runId, o));
+    // ── resolve-step (LUA-752 — R37; L2.6) ──
+    case "resolve-step":
+      return requireRun(runId, "resolve-step", () => resolveStepCore(ctx, runId, o));
+    // ── raise-budget (LUA-752 — R45; the verb every budget-park hint named) ──
+    case "raise-budget":
+      return requireRun(runId, "raise-budget", () => raiseBudgetCore(ctx, runId, o));
     // ── approve ──
     case "approve":
       return requireRun(runId, "approve", () => approveCore(ctx, runId, o));
+    // ── approval-payload (LUA-752 — R39; the fingerprint `approve --edit` needs) ──
+    case "approval-payload":
+      return requireRun(runId, "approval-payload", () => approvalPayloadCore(ctx, runId, o));
     // ── signal ──
     case "signal":
       return requireRun(runId, "signal", () => signalCore(ctx, runId, extra, o));
@@ -50429,6 +50639,9 @@ async function executeAction(ctx, action, target, extra, o) {
     // ── env-overlay (Cluster K, B33 — WF-543; R69) ──
     case "env-overlay":
       return requireName(name, "env-overlay", () => envOverlayCore(ctx, name, o));
+    // ── export (LUA-752 — WF-403; L6.3): the version back as pushable files ──
+    case "export":
+      return requireName(name, "export", () => exportCore(ctx, name, o));
     // ── archive-runs (WF-443 retention hop — client half; R2 → R50 → R51) ──
     case "archive-runs":
       return archiveRunsCore(ctx, o);
@@ -50442,7 +50655,7 @@ async function executeAction(ctx, action, target, extra, o) {
     // ── goals <list|get|create|pause|resume|close> (LUA-627 — R57–R62) ──
     case "goals":
       return goalsCore(ctx, target, extra, o);
-    // ── schedules <list|delete> (LUA-627 — R4-MF-2 reads, R28 delete; goal-owned rows refuse) ──
+    // ── schedules <list|create|patch|pause|resume|delete> (LUA-627 reads + R28; LUA-752 R27 / R56; goal-owned rows refuse) ──
     case "schedules":
       return schedulesCore(ctx, target, extra, o);
     case "run":
@@ -50475,12 +50688,12 @@ function apiFailure(ctx, res, verb) {
   const err = res.error;
   const status = err?.statusCode;
   const code = err?.code ?? err?.error;
-  if (!ctx.json) {
-    if (status === 503 && code === "CONTROL_UNAVAILABLE") console.error(`\u274C ${verb}: ${CONTROL_UNAVAILABLE_HINT}`);
-    else console.error(`\u274C ${verb} failed${code ? ` (${code})` : ""}: ${err?.message ?? "Unknown error"}`);
+  const message = `${verb} failed${code ? ` (${code})` : ""}: ${err?.message ?? "Unknown error"}`;
+  if (status === 0 || status !== void 0 && status >= 500) {
+    throw CliError.fromStatus(status, message, status === 503 && code === "CONTROL_UNAVAILABLE" ? CONTROL_UNAVAILABLE_HINT : void 0);
   }
+  if (!ctx.json) console.error(`\u274C ${message}`);
   if (status === 404) return WORKFLOW_EXIT.NOT_FOUND;
-  if (status === 0 || status !== void 0 && status >= 500) return WORKFLOW_EXIT.UNAVAILABLE;
   return WORKFLOW_EXIT.API;
 }
 __name(apiFailure, "apiFailure");
@@ -50716,7 +50929,9 @@ async function startCore(ctx, name, o) {
   try {
     if (o.input) input = parseJsonOrFile(o.input, "--input");
     waitSeconds = parseIntFlag(o.wait, "--wait");
-    budgetCredits = parseIntFlag(o.budgetCredits, "--budget-credits");
+    budgetCredits = parseIntegerFlag(o.budgetCredits, "--budget-credits", {
+      min: 1
+    });
   } catch (e) {
     if (e instanceof WorkflowLocalUsageError) {
       console.error(`\u274C ${e.message}`);
@@ -50939,7 +51154,8 @@ function printRun(run, withSteps) {
     if (kind === "exception") {
       console.log(run.status === "running" ? "\n\u26A0\uFE0F  Needs a decision \u2014 a step is parked on an exception gate (the run continues past it):" : "\n\u26A0\uFE0F  Needs a decision \u2014 the run is parked on an exception gate:");
       console.log(`   lua workflows retry-step ${id} --step <id>`);
-      console.log("   To skip, complete or fail the step, or start a repair run, decide it from the desktop run page.");
+      console.log(`   lua workflows resolve-step ${id} --step <id> --outcome skip|complete|fail [--output <json|@file>]`);
+      console.log("   To start a repair run instead, decide it from the desktop run page.");
     } else if (kind === "budget") {
       console.log(`
 \u23F8\uFE0F  Paused \u2014 run budget reached (${budgetCopy(run)}):`);
@@ -51257,7 +51473,8 @@ async function cancelCore(ctx, runId, o) {
   emitJson(ctx, res);
   if (!ctx.json) {
     const v = res.data;
-    if (v.state === "terminal" || v.cancelRequested === false && v.transitioned === false && TERMINAL2.has(v.status)) {
+    const alreadyTerminal = v.transitioned !== true && (v.state === "terminal" || v.state === "abandoned" || TERMINAL2.has(v.status));
+    if (alreadyTerminal) {
       writeInfo(`\u2139\uFE0F  run ${runId} was already ${v.status} \u2014 nothing to cancel`);
       return WORKFLOW_EXIT.OK;
     }
@@ -51337,6 +51554,13 @@ async function retryStepCore(ctx, runId, o) {
     } else if (res.error?.statusCode === 409 && !ctx.json) {
       if (code === "STEP_NOT_PARKED" || code === "step_not_parked") console.error(`\u274C step "${o.step}" is not parked (running, pending or already re-armed) \u2014 nothing to retry`);
       else if (code === "RUN_TERMINAL" || code === "run_terminal") console.error(`\u274C run ${runId} is terminal \u2014 start a new run instead`);
+      else if (code === "STEP_RETRY_CAP" || code === "step_retry_cap") {
+        const cap = res.error;
+        const at = typeof cap?.attempt === "number" && typeof cap?.maxAttempts === "number" ? ` (attempt ${cap.attempt} of ${cap.maxAttempts})` : "";
+        console.error(`\u274C step "${o.step}" has reached the retry cap${at} \u2014 resolve it or repair the run:
+   lua workflows resolve-step ${runId} --step ${o.step} --outcome skip|complete|fail
+   to start a repair run instead, decide it from the desktop run page`);
+      }
     }
     return apiFailure(ctx, res, "retry-step");
   }
@@ -51354,6 +51578,165 @@ async function retryStepCore(ctx, runId, o) {
   return WORKFLOW_EXIT.OK;
 }
 __name(retryStepCore, "retryStepCore");
+function refusalIssues(err) {
+  return err?.issues ?? [];
+}
+__name(refusalIssues, "refusalIssues");
+async function resolveStepCore(ctx, runId, o) {
+  const usage = "lua workflows resolve-step <runId> --step <id> --outcome skip|complete|fail [--output <json|@file>] [--note <text>]";
+  if (!o.step) {
+    console.error(`\u274C --step <id> is required: ${usage}`);
+    return WORKFLOW_EXIT.USAGE;
+  }
+  const raw = (o.outcome ?? o.action)?.trim().toLowerCase();
+  if (raw !== "skip" && raw !== "complete" && raw !== "fail") {
+    console.error(`\u274C --outcome must be skip|complete|fail${raw ? ` (got "${raw}")` : ""}: ${usage}`);
+    return WORKFLOW_EXIT.USAGE;
+  }
+  const outcome = raw;
+  let output;
+  try {
+    if (o.output !== void 0) output = parseJsonOrFile(o.output, "--output");
+  } catch (e) {
+    console.error(`\u274C ${e.message}`);
+    return WORKFLOW_EXIT.USAGE;
+  }
+  if (outcome === "complete" && output === void 0) {
+    console.error(`\u274C --outcome complete needs --output <json|@file> (the output the step would have produced): ${usage}`);
+    return WORKFLOW_EXIT.USAGE;
+  }
+  if (outcome !== "complete" && output !== void 0) {
+    console.error(`\u274C --output rides with --outcome complete only (a ${outcome} carries no output)`);
+    return WORKFLOW_EXIT.USAGE;
+  }
+  const dto = {
+    outcome,
+    ...output !== void 0 ? {
+      output
+    } : {},
+    ...o.note ? {
+      note: o.note
+    } : {}
+  };
+  const res = await ctx.api.resolveStep(runId, o.step, dto);
+  if (!res.success || !res.data) {
+    const err = res.error;
+    const code = err?.code ?? err?.error;
+    const status = err?.statusCode;
+    if (!ctx.json && err) {
+      if (status === 404 && code === "STEP_NOT_FOUND") {
+        console.error(`\u274C step "${o.step}" does not exist on run ${runId} \u2014 list its steps: lua workflows status ${runId} --steps`);
+      } else if (status === 409 && (code === "STEP_NOT_PARKED" || code === "step_not_parked")) {
+        console.error(`\u274C step "${o.step}" is not parked (running, pending or already decided) \u2014 nothing to resolve`);
+      } else if (status === 409 && (code === "RUN_TERMINAL" || code === "run_terminal")) {
+        console.error(`\u274C run ${runId} is terminal \u2014 start a new run instead`);
+      } else if (status === 400 && code === "RESOLVE_OUTPUT_INVALID") {
+        console.error(`\u274C --output does not satisfy the outputSchema of step "${o.step}":`);
+        for (const i of refusalIssues(err)) console.error(`   \u2022 ${i.path ?? "$"}: ${i.message ?? i.code}`);
+      } else if (status === 403 && code === "APPROVAL_REQUIRES_HUMAN") {
+        console.error("\u274C resolve-step is a person's decision \u2014 sign in (lua login) instead of an API key");
+      } else if (status === 413 && code === "OUTPUT_TOO_LARGE") {
+        const { bytes, maxBytes } = err;
+        console.error(`\u274C --output is over the cap (${bytes ?? "?"} of ${maxBytes ?? 262144} bytes serialized)`);
+      }
+    }
+    return apiFailure(ctx, res, "resolve-step");
+  }
+  emitJson(ctx, res);
+  if (!ctx.json) {
+    const d = res.data;
+    if (d.resolved) {
+      const past = d.outcome === "complete" ? "completed" : d.outcome === "skip" ? "skipped" : "failed";
+      writeSuccess(`\u2705 ${past} ${o.step} \xB7 run is ${d.runStatus}` + (d.remainingParks ? ` \xB7 ${d.remainingParks} other parked step(s)` : ""));
+    } else {
+      const standing = d.reason === "already_retried" ? "retried" : `resolved${d.recorded?.outcome ? ` (${d.recorded.outcome})` : ""}`;
+      const by = actorLabel(d.recorded?.by);
+      writeInfo(`\u2139\uFE0F  step "${o.step}" was already ${standing}` + (by ? ` by ${by}` : "") + (d.recorded?.at ? ` at ${when(d.recorded.at)}` : "") + ` \xB7 run is ${d.runStatus}`);
+    }
+  }
+  return WORKFLOW_EXIT.OK;
+}
+__name(resolveStepCore, "resolveStepCore");
+function budgetCapFlag(cap) {
+  if (cap === "maxSteps") return "--max-steps";
+  if (cap === "maxJobSeconds") return "--max-job-seconds";
+  if (cap === "maxDurationSeconds") return "--max-duration-seconds";
+  return "--credits";
+}
+__name(budgetCapFlag, "budgetCapFlag");
+function budgetCapsLabel(b) {
+  if (!b) return "";
+  const parts = [];
+  if (b.maxCredits !== void 0) parts.push(`${b.maxCredits} credits`);
+  if (b.maxSteps !== void 0) parts.push(`${b.maxSteps} steps`);
+  if (b.maxJobSeconds !== void 0) parts.push(`${b.maxJobSeconds}s job`);
+  if (b.maxDurationSeconds !== void 0) parts.push(`${b.maxDurationSeconds}s wall`);
+  return parts.join(" \xB7 ");
+}
+__name(budgetCapsLabel, "budgetCapsLabel");
+async function raiseBudgetCore(ctx, runId, o) {
+  let dto;
+  try {
+    dto = {};
+    const credits = parseIntegerFlag(o.credits, "--credits", {
+      min: 1
+    });
+    if (credits !== void 0) dto.maxCredits = credits;
+    const steps = parseIntegerFlag(o.maxSteps, "--max-steps", {
+      min: 1
+    });
+    if (steps !== void 0) dto.maxSteps = steps;
+    const jobSeconds = parseIntegerFlag(o.maxJobSeconds, "--max-job-seconds", {
+      min: 1
+    });
+    if (jobSeconds !== void 0) dto.maxJobSeconds = jobSeconds;
+    const duration = parseIntegerFlag(o.maxDurationSeconds, "--max-duration-seconds", {
+      min: 1
+    });
+    if (duration !== void 0) dto.maxDurationSeconds = duration;
+    if (Object.keys(dto).length === 0) throw new WorkflowLocalUsageError("usage", `--credits <n> (or --max-steps / --max-job-seconds / --max-duration-seconds) is required \u2014 the new cap, above the current one (lua workflows status ${runId} shows it)`);
+    if (o.note) dto.note = o.note;
+  } catch (e) {
+    if (e instanceof WorkflowLocalUsageError) throw CliError.usage(`raise-budget: ${e.message}`);
+    throw e;
+  }
+  const res = await ctx.api.raiseBudget(runId, dto);
+  if (!res.success || !res.data) {
+    const err = res.error;
+    const code = err?.code ?? err?.error;
+    const status = err?.statusCode;
+    if (!ctx.json && err) {
+      if (status === 400 && code === "CAP_EXCEEDED") {
+        const { cap, value: value3, ceiling } = err;
+        console.error(`\u274C ${budgetCapFlag(cap)} ${value3 ?? "?"} is above the org ceiling${ceiling !== void 0 ? ` (${ceiling})` : ""} \u2014 ask an org admin to raise the org cap, or cancel the run`);
+      } else if (status === 400 && code === "VALIDATION_FAILED") {
+        for (const i of refusalIssues(err)) console.error(`   ${i.code}${i.path ? ` at ${i.path}` : ""}${i.message ? ` \u2014 ${i.message}` : ""}`);
+        console.error(`   the raise must be above the current cap \u2014 lua workflows status ${runId} shows it`);
+      } else if (status === 409 && code === "BUDGET_NOT_RAISABLE") {
+        const { status: runStatus, notRaisableReason } = err;
+        console.error(notRaisableReason === "raise_cap" ? `\u274C run ${runId} has reached its raise cap \u2014 cancel it, or start a new run with a larger --budget-credits` : `\u274C run ${runId} is ${runStatus ?? "not parked on its budget"} \u2014 only a run parked on its budget takes a raise`);
+      } else if (status === 403 && code === "NOT_RUN_CREATOR") {
+        console.error("\u274C only the run creator or an org admin can raise a run budget");
+      }
+    }
+    return apiFailure(ctx, res, "raise-budget");
+  }
+  emitJson(ctx, res);
+  if (!ctx.json) {
+    const d = res.data;
+    const caps = budgetCapsLabel(d.budget ?? d.to);
+    if (d.raised) {
+      const delta = d.from && d.to ? ` (${budgetCapsLabel(d.from)} \u2192 ${budgetCapsLabel(d.to)})` : caps ? ` to ${caps}` : "";
+      writeSuccess(`\u2705 budget raised${delta}${d.runStatus ? ` \xB7 run is ${d.runStatus}` : ""}`);
+      if (d.resumed === false) writeInfo(`\u2139\uFE0F  the run did not resume on this raise \u2014 the next step's reserve is still short (raise again), or nothing was parked: lua workflows status ${runId}`);
+      else if (d.resumed) writeInfo(`\u{1F4A1} Follow it: lua workflows watch ${runId}`);
+    } else {
+      writeInfo(`\u2139\uFE0F  budget unchanged (${d.reason ?? "already_raised"})${caps ? ` \xB7 ${caps}` : ""}${d.runStatus ? ` \xB7 run is ${d.runStatus}` : ""}`);
+    }
+  }
+  return WORKFLOW_EXIT.OK;
+}
+__name(raiseBudgetCore, "raiseBudgetCore");
 function approveResultLine(d) {
   if (d.resolved) return `\u2705 ${d.outcome} \xB7 run is ${d.runStatus}`;
   const ref = d.decidedBy;
@@ -51407,6 +51790,73 @@ async function approveCore(ctx, runId, o) {
   return WORKFLOW_EXIT.OK;
 }
 __name(approveCore, "approveCore");
+var indentBlock = /* @__PURE__ */ __name((text, pad2 = "     ") => text.split("\n").map((l) => `${pad2}${l}`).join("\n"), "indentBlock");
+var APPROVAL_PAYLOAD_PAGE_MAX = 100;
+async function approvalPayloadCore(ctx, runId, o) {
+  if (!o.approval) {
+    console.error("\u274C approval-payload: --approval <id> is required \u2014 lua workflows approval-payload <runId> --approval <wfa_\u2026> [--path <array.path>]");
+    return WORKFLOW_EXIT.USAGE;
+  }
+  let limit;
+  try {
+    limit = parseIntegerFlag(o.limit, "--limit", {
+      min: 1,
+      max: APPROVAL_PAYLOAD_PAGE_MAX
+    });
+  } catch (e) {
+    if (e instanceof WorkflowLocalUsageError) throw CliError.usage(`approval-payload: ${e.message}`);
+    throw e;
+  }
+  if ((o.cursor || limit !== void 0) && !o.path) {
+    console.error("\u274C approval-payload: --cursor / --limit page one array \u2014 pass --path <array.path> with them");
+    return WORKFLOW_EXIT.USAGE;
+  }
+  const res = await ctx.api.getApprovalPayload(runId, o.approval, {
+    path: o.path,
+    cursor: o.cursor,
+    limit
+  });
+  if (!res.success || !res.data) {
+    const code = res.error?.code ?? res.error?.error;
+    if (!ctx.json && res.error?.statusCode === 404 && code === "APPROVAL_NOT_FOUND") {
+      console.error(`\u274C approval "${o.approval}" not found on run ${runId} \u2014 lua workflows status ${runId} --steps --json shows the suspended step's suspend.approvalId`);
+    } else if (!ctx.json && res.error?.statusCode === 413 && code === "PAYLOAD_PAGE_REQUIRED") {
+      console.error("\u274C the payload is too large to read whole \u2014 page an array with --path <array.path> [--limit <n>] [--cursor <c>]");
+    }
+    return apiFailure(ctx, res, "approval-payload");
+  }
+  emitJson(ctx, res);
+  if (!ctx.json) {
+    const v = res.data;
+    console.log(`
+\u{1F9FE} Approval ${v.approvalId} \xB7 revision ${v.editRevision} \xB7 fingerprint ${v.payloadFingerprint ?? "(none)"}`);
+    console.log(`   Editable: ${v.editable ? `yes \u2014 ${v.editablePaths.length ? v.editablePaths.join(", ") : "any path"}` : "no"}${v.size !== void 0 ? ` \xB7 ${v.size} bytes` : ""}`);
+    if (v.kind === "whole") {
+      console.log(`   Payload:
+${indentBlock(JSON.stringify(v.payload, null, 2))}`);
+    } else if (v.kind === "paged") {
+      console.log("   Payload: paged \u2014 read one array at a time with --path <array.path>:");
+      for (const [p, a] of Object.entries(v.arrays)) console.log(`     ${p} (${a.totalItems} items)`);
+    } else {
+      console.log(`   ${v.path}: ${v.items.length} of ${v.totalItems} item(s)${v.nextCursor ? ` \xB7 next page: --cursor ${v.nextCursor}` : ""}`);
+      for (const it of v.items) console.log(`     [${it.index}] ${JSON.stringify(it.value)}`);
+    }
+    if (v.editable && v.payloadFingerprint) {
+      writeHintBlock({
+        headline: "Edit and approve against this revision:",
+        lines: [
+          {
+            label: "Approve:",
+            command: `lua workflows approve ${runId} --approval ${v.approvalId} --edit @edited.json --fingerprint ${v.payloadFingerprint}`
+          }
+        ],
+        when: "success"
+      });
+    }
+  }
+  return WORKFLOW_EXIT.OK;
+}
+__name(approvalPayloadCore, "approvalPayloadCore");
 function actorLabel(by, now = Date.now()) {
   if (by === void 0 || by === null) return void 0;
   if (typeof by === "string") return by;
@@ -51790,6 +52240,51 @@ async function envOverlayCore(ctx, name, o) {
   return missing.length > 0 ? WORKFLOW_EXIT.API : WORKFLOW_EXIT.OK;
 }
 __name(envOverlayCore, "envOverlayCore");
+async function exportCore(ctx, name, o) {
+  const wf = await resolveWorkflow(ctx, name);
+  if (!wf) return WORKFLOW_EXIT.NOT_FOUND;
+  let version;
+  if (o.workflowVersion) {
+    const ref = await resolveVersionRef(ctx, wf, o.workflowVersion, "export");
+    if ("exit" in ref) return ref.exit;
+    version = ref.version.id;
+  }
+  const res = await ctx.api.exportWorkflowFiles(wf.id, version);
+  if (!res.success || !res.data) {
+    const code = res.error?.code ?? res.error?.error;
+    if (!ctx.json && res.error?.statusCode === 404 && code === "VERSION_NOT_FOUND") console.error(`\u274C "${wf.name}" has no active version to export \u2014 pass -v <version|latest>`);
+    return apiFailure(ctx, res, "export");
+  }
+  emitJson(ctx, res);
+  if (ctx.json) return WORKFLOW_EXIT.OK;
+  const fs19 = await import("fs");
+  const path25 = await import("path");
+  const outDir = path25.resolve(o.out ?? ".");
+  const d = res.data;
+  const escaping = d.files.filter((f) => !path25.resolve(outDir, f.path).startsWith(outDir + path25.sep));
+  if (escaping.length > 0) {
+    console.error(`\u274C EXPORT_PATH_ESCAPES: the server named ${escaping.map((f) => JSON.stringify(f.path)).join(", ")} \u2014 outside --out ${outDir}; nothing written`);
+    return WORKFLOW_EXIT.API;
+  }
+  const clash = d.files.filter((f) => fs19.existsSync(path25.join(outDir, f.path)));
+  if (clash.length > 0 && !o.force) {
+    console.error(`\u274C export: ${clash.map((f) => f.path).join(", ")} already exist${clash.length === 1 ? "s" : ""} under ${outDir} \u2014 pass --force to overwrite, or --out <dir>`);
+    return WORKFLOW_EXIT.API;
+  }
+  for (const f of d.files) {
+    const target = path25.join(outDir, f.path);
+    fs19.mkdirSync(path25.dirname(target), {
+      recursive: true
+    });
+    fs19.writeFileSync(target, f.contents);
+    console.log(`   ${f.path}`);
+  }
+  writeSuccess(`\u2705 exported "${wf.name}" v${d.version} (${d.form} form) \u2014 ${d.files.length} file(s) under ${outDir}`);
+  for (const w of d.warnings ?? []) console.warn(`\u26A0\uFE0F  ${w.code}${w.path ? ` at ${w.path}` : ""}: ${w.message}`);
+  if (d.warnings?.length) writeInfo("\u{1F4A1} Review the TODOs the warnings name; `lua push workflow` then mints a static version from the file.");
+  return WORKFLOW_EXIT.OK;
+}
+__name(exportCore, "exportCore");
 function parseSinceFlag(raw, now = Date.now()) {
   if (!raw) return NaN;
   const m = /^(\d+)([dhm])$/i.exec(raw.trim());
@@ -51802,6 +52297,9 @@ function parseSinceFlag(raw, now = Date.now()) {
 }
 __name(parseSinceFlag, "parseSinceFlag");
 var ARCHIVE_EXPORT_TTL_DAYS = 7;
+var ARCHIVE_TERMINAL_STATUS_FILTER = [
+  ...TERMINAL2
+].join(",");
 var ARCHIVE_DEFAULT_RETENTION_DAYS = 90;
 var archiveDownload = {
   fetchBytes: /* @__PURE__ */ __name(async (url) => {
@@ -51865,8 +52363,8 @@ async function archiveRunsCore(ctx, o) {
   let cursor;
   do {
     const res = await ctx.api.getRuns({
-      status: "terminal",
-      since: new Date(since).toISOString(),
+      status: ARCHIVE_TERMINAL_STATUS_FILTER,
+      since: String(since),
       workflowId,
       tag: o.tag,
       cursor,
@@ -52238,6 +52736,10 @@ var GOAL_VERBS = [
 ];
 var SCHEDULE_VERBS = [
   "list",
+  "create",
+  "patch",
+  "pause",
+  "resume",
   "delete"
 ];
 var GOAL_STATUSES = [
@@ -52920,11 +53422,13 @@ async function schedulesCore(ctx, target, extra, o) {
   const verb = subVerb("workflows.schedules.action", "schedules", target, SCHEDULE_VERBS);
   if (!verb) return WORKFLOW_EXIT.USAGE;
   if (verb === "list") return schedulesListCore(ctx, o);
+  if (verb === "create") return schedulesCreateCore(ctx, o, extra);
   if (!extra) {
-    console.error("\u274C schedules delete: a schedule (job) id is required \u2014 lua workflows schedules delete <jobId>");
+    console.error(`\u274C schedules ${verb}: a schedule (job) id is required \u2014 lua workflows schedules ${verb} <jobId>`);
     return WORKFLOW_EXIT.USAGE;
   }
-  return schedulesDeleteCore(ctx, extra, o);
+  if (verb === "delete") return schedulesDeleteCore(ctx, extra, o);
+  return schedulesPatchCore(ctx, extra, verb, o);
 }
 __name(schedulesCore, "schedulesCore");
 async function schedulesListCore(ctx, o) {
@@ -53028,12 +53532,183 @@ async function schedulesDeleteCore(ctx, jobId, o) {
   return WORKFLOW_EXIT.OK;
 }
 __name(schedulesDeleteCore, "schedulesDeleteCore");
+var SCHEDULE_NOTIFY = [
+  "emailApp",
+  "email",
+  "app",
+  "off"
+];
+async function schedulesCreateCore(ctx, o, positional) {
+  const target = positional ?? o.workflowName ?? o.workflow;
+  if (!target) {
+    console.error('\u274C schedules create: a workflow is required \u2014 lua workflows schedules create <workflow> --cadence "0 9 * * 1" --timezone Europe/London');
+    return WORKFLOW_EXIT.USAGE;
+  }
+  let draft;
+  try {
+    const usage = /* @__PURE__ */ __name((m) => new WorkflowLocalUsageError("usage", m), "usage");
+    if (o.every && o.cadence?.length) throw usage("--every and --cadence are alternatives \u2014 pass one");
+    const schedules = o.every ? parseEveryFlag(o.every) : parseCadenceFlag(o.cadence, o.timezone);
+    if (schedules.length === 0) throw usage("--cadence <cron|json|@file> (repeatable, \u2264 5) or --every <interval> is required");
+    draft = {
+      schedules
+    };
+    if (o.input) draft.input = parseJsonOrFile(o.input, "--input");
+    if (o.tag?.length) {
+      if (o.tag.length > 10) throw usage("--tag: at most 10");
+      draft.tags = o.tag;
+    }
+    if (o.notify !== void 0) {
+      if (!SCHEDULE_NOTIFY.includes(o.notify)) throw usage(`--notify: expected ${SCHEDULE_NOTIFY.join("|")} (got "${o.notify}")`);
+      draft.notify = o.notify;
+    }
+    const credits = parseIntegerFlag(o.budgetCredits, "--budget-credits", {
+      min: 1
+    });
+    if (credits !== void 0) draft.budget = {
+      maxCredits: credits
+    };
+    const backfill = parseIntegerFlag(o.backfillOnEnable, "--backfill-on-enable", {
+      min: 1
+    });
+    if (backfill !== void 0) draft.backfillOnEnable = {
+      maxOccurrences: backfill
+    };
+  } catch (e) {
+    if (e instanceof WorkflowLocalUsageError) throw CliError.usage(`schedules create: ${e.message}`);
+    throw e;
+  }
+  const wf = await resolveWorkflow(ctx, target);
+  if (!wf) return WORKFLOW_EXIT.NOT_FOUND;
+  const dto = {
+    workflowId: wf.id,
+    ...draft
+  };
+  if (o.workflowVersion) {
+    const ref = await resolveVersionRef(ctx, wf, o.workflowVersion, "schedules create");
+    if ("exit" in ref) return ref.exit;
+    dto.workflowVersionId = ref.version.id;
+  }
+  const res = await ctx.api.createSchedule(dto);
+  if (!res.success || !res.data) {
+    const code = res.error?.code ?? res.error?.error;
+    if (!ctx.json && res.error?.statusCode === 409 && code === "SCHEDULE_CAP") console.error("\u274C a schedule takes at most 5 trigger slots (SCHEDULE_CAP) \u2014 fewer --cadence entries");
+    return goalFailure(ctx, res, "schedules create", wf.name);
+  }
+  emitJson(ctx, res);
+  if (!ctx.json) {
+    const s = res.data;
+    const slots = (s.schedules ?? []).map((t) => triggerLabel(t)).join(" \xB7 ") || cadenceLabel(dto.schedules);
+    writeSuccess(`\u2705 schedule ${s.jobId} on "${wf.name}" \xB7 ${slots} \xB7 next ${when(s.nextRunAt ?? void 0)}${s.notify ? ` \xB7 notify ${s.notify}` : ""}`);
+    writeHintBlock({
+      headline: "Manage it:",
+      lines: [
+        {
+          label: "List:",
+          command: `lua workflows schedules list -i ${wf.name}`
+        },
+        {
+          label: "Pause:",
+          command: `lua workflows schedules pause ${s.jobId}`
+        },
+        {
+          label: "Delete:",
+          command: `lua workflows schedules delete ${s.jobId}`
+        }
+      ],
+      when: "success"
+    });
+  }
+  return WORKFLOW_EXIT.OK;
+}
+__name(schedulesCreateCore, "schedulesCreateCore");
+async function scheduleGoalOwner(ctx, row2) {
+  if (row2.goalId) return {
+    goalId: row2.goalId
+  };
+  const goals = await loadGoals(ctx, row2.workflowId);
+  if (goals.error) return {
+    error: goals.error
+  };
+  return {
+    goalId: goals.items.find((g) => g.jobId === row2.jobId)?.goalId
+  };
+}
+__name(scheduleGoalOwner, "scheduleGoalOwner");
+async function schedulesPatchCore(ctx, jobId, verb, o) {
+  const label = `schedules ${verb}`;
+  let dto;
+  try {
+    const usage = /* @__PURE__ */ __name((m) => new WorkflowLocalUsageError("usage", m), "usage");
+    dto = {};
+    if (verb === "pause") dto.paused = true;
+    else if (verb === "resume") dto.paused = false;
+    else if (o.paused !== void 0) {
+      const v = String(o.paused).trim().toLowerCase();
+      if (v !== "true" && v !== "false") throw usage(`--paused: expected true|false (got "${o.paused}")`);
+      dto.paused = v === "true";
+    }
+    if (o.backfillOnEnable !== void 0) {
+      if (String(o.backfillOnEnable).trim().toLowerCase() === "none") dto.backfillOnEnable = null;
+      else dto.backfillOnEnable = {
+        maxOccurrences: parseIntegerFlag(o.backfillOnEnable, "--backfill-on-enable", {
+          min: 1
+        })
+      };
+    }
+    if (o.backfillNow) {
+      if (dto.paused !== false) throw usage("--backfill-now rides a re-enable only \u2014 lua workflows schedules resume <jobId> --backfill-now (or patch --paused false)");
+      dto.backfillNow = true;
+    }
+    if (Object.keys(dto).length === 0) throw usage("nothing to change \u2014 pass --paused true|false, --backfill-on-enable <n|none> and/or --backfill-now");
+  } catch (e) {
+    if (e instanceof WorkflowLocalUsageError) throw CliError.usage(`${label}: ${e.message}`);
+    throw e;
+  }
+  const rowRes = await ctx.api.getSchedule(jobId);
+  if (!rowRes.success || !rowRes.data) return apiFailure(ctx, rowRes, label);
+  const owner = await scheduleGoalOwner(ctx, rowRes.data);
+  if (owner.error) {
+    if (!ctx.json) console.error(`\u274C cannot prove ${jobId} is not a goal's cadence (goals unavailable) \u2014 refusing to ${verb}`);
+    return apiFailure(ctx, {
+      success: false,
+      error: owner.error
+    }, label);
+  }
+  if (owner.goalId) {
+    const message = `Schedule ${jobId} is the cadence of goal ${owner.goalId} and was NOT changed. Pause or resume the goal instead: lua workflows goals pause ${owner.goalId} / lua workflows goals resume ${owner.goalId} \u2014 a goal's Job follows its goal, never the other way round.`;
+    if (ctx.json) console.log(JSON.stringify({
+      success: false,
+      error: {
+        code: "goal_schedule",
+        statusCode: 409,
+        message,
+        jobId,
+        goalId: owner.goalId
+      }
+    }, null, 2));
+    else console.error(`\u274C goal_schedule: ${message}`);
+    return WORKFLOW_EXIT.API;
+  }
+  const res = await ctx.api.updateSchedule(jobId, dto);
+  if (!res.success || !res.data) return goalFailure(ctx, res, label, jobId);
+  emitJson(ctx, res);
+  if (!ctx.json) {
+    const s = res.data;
+    writeSuccess(`\u2705 schedule ${s.jobId} ${s.status}${s.backfillOnEnable ? ` \xB7 backfill on enable \u2264 ${s.backfillOnEnable.maxOccurrences}` : ""}`);
+    if (s.backfill) writeInfo(`\u2139\uFE0F  backfill on this re-enable: ${JSON.stringify(s.backfill)}`);
+    if (dto.paused === false && s.status !== "active") writeInfo(`\u2139\uFE0F  the schedule reads ${s.status} after the re-enable \u2014 lua workflows schedules list shows why (strikes / autoDisabled)`);
+  }
+  return WORKFLOW_EXIT.OK;
+}
+__name(schedulesPatchCore, "schedulesPatchCore");
 
 // src/commands/features.ts
 init_cli();
 init_constants();
 init_command_utils();
 init_analytics();
+init_cli_error();
 async function featuresCommand(action, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -53206,21 +53881,11 @@ async function executeNonInteractive8(context, action, options) {
     return;
   }
   if (!options.featureName) {
-    console.error(`\u274C --feature-name is required for action "${normalizedAction}"`);
-    console.log(`
-Usage: lua features ${normalizedAction} --feature-name <name>`);
-    if (features.length > 0) {
-      console.log("\nAvailable features:");
-      features.forEach((f) => console.log(`  - ${f.name} (${f.title})`));
-    }
-    throw new Error("Operation failed");
+    throw CliError.usage(`--feature-name is required for action "${normalizedAction}"`, joinHint(`Usage: lua features ${normalizedAction} --feature-name <name>`, listHint("Available features:", features.map((f) => `${f.name} (${f.title})`))));
   }
   const selectedFeature = findFeature(features, options.featureName);
   if (!selectedFeature) {
-    console.error(`\u274C Feature "${options.featureName}" not found`);
-    console.log("\nAvailable features:");
-    features.forEach((f) => console.log(`  - ${f.name} (${f.title})`));
-    throw new Error("Feature");
+    throw CliError.notFound(`Feature "${options.featureName}" not found`, listHint("Available features:", features.map((f) => `${f.name} (${f.title})`)));
   }
   switch (normalizedAction) {
     case "view":
@@ -53533,6 +54198,7 @@ init_cli();
 init_constants();
 init_command_utils();
 init_analytics();
+init_cli_error();
 async function preprocessorsCommand(action, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -53761,10 +54427,7 @@ async function executeNonInteractive9(context, config, action, options) {
     return;
   }
   if (!options.preprocessorName) {
-    console.error(`\u274C --preprocessor-name is required for action "${normalizedAction}"`);
-    console.log(`
-Usage: lua preprocessors ${normalizedAction} --preprocessor-name <name>`);
-    throw new Error(`--preprocessor-name is required for action "${normalizedAction}"`);
+    throw CliError.usage(`--preprocessor-name is required for action "${normalizedAction}"`, `Usage: lua preprocessors ${normalizedAction} --preprocessor-name <name>`);
   }
   let selected = preprocessors.find((p) => p.preprocessorId === options.preprocessorName || p.name === options.preprocessorName);
   if (!selected && normalizedAction === "delete") {
@@ -53783,10 +54446,7 @@ Usage: lua preprocessors ${normalizedAction} --preprocessor-name <name>`);
     }
   }
   if (!selected) {
-    console.error(`\u274C PreProcessor "${options.preprocessorName}" not found`);
-    console.log("\nAvailable preprocessors:");
-    preprocessors.forEach((p) => console.log(`  - ${p.name} (${p.preprocessorId})`));
-    throw new Error(`PreProcessor "${options.preprocessorName}" not found`);
+    throw CliError.notFound(`PreProcessor "${options.preprocessorName}" not found`, listHint("Available preprocessors:", preprocessors.map((p) => `${p.name} (${p.preprocessorId})`)));
   }
   switch (normalizedAction) {
     case "versions": {
@@ -53802,17 +54462,12 @@ Usage: lua preprocessors ${normalizedAction} --preprocessor-name <name>`);
     }
     case "deploy": {
       if (!options.preprocessorVersion) {
-        console.error("\u274C --preprocessor-version is required for deploy action");
-        console.log("\nUsage: lua preprocessors deploy --preprocessor-name myPre --preprocessor-version 1.0.3");
-        console.log("       lua preprocessors deploy -i myPre -v latest");
-        throw new Error("--preprocessor-version is required for deploy action");
+        throw CliError.usage("--preprocessor-version is required for deploy action", "Usage: lua preprocessors deploy --preprocessor-name myPre --preprocessor-version 1.0.3\n       lua preprocessors deploy -i myPre -v latest");
       }
       const data = await fetchVersionsCore5(context, selected);
       if (!data) throw new Error("Failed to fetch preprocessor versions");
       if (data.versions.length === 0) {
-        console.error(`\u274C No versions found for ${selected.name}.`);
-        console.log("\u{1F4A1} Push a version first using 'lua push preprocessor'.");
-        throw new Error(`No versions found for ${selected.name}`);
+        throw CliError.notFound(`No versions found for ${selected.name}.`, "Push a version first using 'lua push preprocessor'.");
       }
       const resolvedVersion = resolveVersion4(data.versions, options.preprocessorVersion);
       if (!resolvedVersion) throw new Error("Failed to resolve preprocessor version");
@@ -54120,6 +54775,7 @@ init_cli();
 init_constants();
 init_command_utils();
 init_analytics();
+init_cli_error();
 async function postprocessorsCommand(action, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -54348,10 +55004,7 @@ async function executeNonInteractive10(context, config, action, options) {
     return;
   }
   if (!options.postprocessorName) {
-    console.error(`\u274C --postprocessor-name is required for action "${normalizedAction}"`);
-    console.log(`
-Usage: lua postprocessors ${normalizedAction} --postprocessor-name <name>`);
-    throw new Error(`--postprocessor-name is required for action "${normalizedAction}"`);
+    throw CliError.usage(`--postprocessor-name is required for action "${normalizedAction}"`, `Usage: lua postprocessors ${normalizedAction} --postprocessor-name <name>`);
   }
   let selected = postprocessors.find((p) => p.postprocessorId === options.postprocessorName || p.name === options.postprocessorName);
   if (!selected && normalizedAction === "delete") {
@@ -54370,10 +55023,7 @@ Usage: lua postprocessors ${normalizedAction} --postprocessor-name <name>`);
     }
   }
   if (!selected) {
-    console.error(`\u274C PostProcessor "${options.postprocessorName}" not found`);
-    console.log("\nAvailable postprocessors:");
-    postprocessors.forEach((p) => console.log(`  - ${p.name} (${p.postprocessorId})`));
-    throw new Error(`PostProcessor "${options.postprocessorName}" not found`);
+    throw CliError.notFound(`PostProcessor "${options.postprocessorName}" not found`, listHint("Available postprocessors:", postprocessors.map((p) => `${p.name} (${p.postprocessorId})`)));
   }
   switch (normalizedAction) {
     case "versions": {
@@ -54389,17 +55039,12 @@ Usage: lua postprocessors ${normalizedAction} --postprocessor-name <name>`);
     }
     case "deploy": {
       if (!options.postprocessorVersion) {
-        console.error("\u274C --postprocessor-version is required for deploy action");
-        console.log("\nUsage: lua postprocessors deploy --postprocessor-name myPost --postprocessor-version 1.0.3");
-        console.log("       lua postprocessors deploy -i myPost -v latest");
-        throw new Error("--postprocessor-version is required for deploy action");
+        throw CliError.usage("--postprocessor-version is required for deploy action", "Usage: lua postprocessors deploy --postprocessor-name myPost --postprocessor-version 1.0.3\n       lua postprocessors deploy -i myPost -v latest");
       }
       const data = await fetchVersionsCore6(context, selected);
       if (!data) throw new Error("Failed to fetch postprocessor versions");
       if (data.versions.length === 0) {
-        console.error(`\u274C No versions found for ${selected.name}.`);
-        console.log("\u{1F4A1} Push a version first using 'lua push postprocessor'.");
-        throw new Error(`No versions found for ${selected.name}`);
+        throw CliError.notFound(`No versions found for ${selected.name}.`, "Push a version first using 'lua push postprocessor'.");
       }
       const resolvedVersion = resolveVersion5(data.versions, options.postprocessorVersion);
       if (!resolvedVersion) throw new Error("Failed to resolve postprocessor version");
@@ -54970,6 +55615,7 @@ var TemplateApiService = class {
 init_command_utils();
 init_analytics();
 init_files();
+init_cli_error();
 function showTemplateUsage() {
   console.log("\nUsage:");
   console.log("  lua marketplace template                       Interactive mode");
@@ -55344,6 +55990,9 @@ async function templateDraftAction(templateApi, options) {
     return;
   }
   writeSuccess("\u2705 template: section written to lua.skill.yaml");
+  for (const warning of result.warnings ?? []) {
+    console.log(`  \u26A0 ${warning.message}`);
+  }
   for (const [section2, diff] of Object.entries(result.diff)) {
     const annotations = Object.entries(diff.annotations ?? {});
     console.log(`  ${section2}: +${diff.added.length} added (${diff.added.join(", ") || "\u2014"}), ${diff.kept.length} kept`);
@@ -55546,8 +56195,7 @@ async function templateInstallAction(templateApi, config, options) {
     if (envValues && Object.keys(envValues).length > 0) {
       writeInfo(`  Env values: ${Object.keys(envValues).length} configured`);
     }
-    console.error("\n\u274C Use --force to confirm installation");
-    throw new Error("This action requires --force to confirm");
+    throw CliError.usage("This action requires --force to confirm", "Use --force to confirm installation");
   }
   if (options.skipEnvCheck) {
     writeInfo("\u26A0\uFE0F  --skip-env-check is deprecated: the env-contract check is server-enforced; use `lua env` to satisfy the contract.");
@@ -55849,9 +56497,7 @@ async function templateUninstallAction(templateApi, config, options) {
   if (!agentId) throw new Error("Agent ID not found in configuration.");
   const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to uninstall?");
   if (!options.force) {
-    console.error(`
-\u274C Use --force to confirm uninstalling template ${templateId} from this agent`);
-    throw new Error("This action requires --force to confirm");
+    throw CliError.usage("This action requires --force to confirm", `Use --force to confirm uninstalling template ${templateId} from this agent`);
   }
   writeProgress("\u{1F504} Uninstalling template...");
   await templateApi.uninstall(templateId, agentId);
@@ -55860,6 +56506,7 @@ async function templateUninstallAction(templateApi, config, options) {
 __name(templateUninstallAction, "templateUninstallAction");
 
 // src/commands/marketplace.ts
+init_cli_error();
 var SKILL_ACTIONS = [
   "list",
   "publish",
@@ -56075,40 +56722,29 @@ __name(executeSkillActionInteractive, "executeSkillActionInteractive");
 async function listSkillNonInteractive(marketplaceApi, config, apiKey, options) {
   const { skillName, displayName, visibility } = options;
   if (!skillName || !displayName) {
-    console.error("\u274C Missing required options");
-    console.log("\nUsage: lua marketplace skill list --skill-name <name> --display-name <name>");
-    throw new Error("Missing required options");
+    throw CliError.usage("Missing required options", "Usage: lua marketplace skill list --skill-name <name> --display-name <name>");
   }
   if (visibility && visibility !== "public" && visibility !== "private") {
-    console.error('\u274C Invalid --visibility: must be "public" or "private"');
-    throw new Error('Invalid --visibility: must be "public" or "private"');
+    throw CliError.usage('Invalid --visibility: must be "public" or "private"');
   }
   const agentId = config.agent?.agentId;
   if (!agentId) {
-    console.error("\u274C Agent ID not found in configuration.");
-    throw new Error("Agent ID not found in configuration.");
+    throw CliError.usage("Agent ID not found in configuration.", "Run `lua init` in a project directory first.");
   }
   const skillApi = new SkillApi(BASE_URLS.API, apiKey, agentId);
   writeProgress("\u{1F504} Verifying skill...");
   const agentSkillsResponse = await skillApi.getSkills();
   if (!agentSkillsResponse.success || !agentSkillsResponse.data) {
-    console.error(`\u274C Failed to fetch agent skills: ${agentSkillsResponse.message}`);
-    throw new Error("Failed to fetch agent skills: ${agentSkillsResponse.message}");
+    throw CliError.fromStatus(agentSkillsResponse.error?.statusCode, `Failed to fetch agent skills: ${agentSkillsResponse.error?.message ?? agentSkillsResponse.message ?? "Unknown error"}`);
   }
   const skill = agentSkillsResponse.data.skills?.find((s) => s.name === skillName);
   if (!skill) {
-    console.error(`\u274C Skill not found: ${skillName}`);
-    writeInfo("\nAvailable skills:");
-    agentSkillsResponse.data.skills?.forEach((s) => {
-      writeInfo(`  - ${s.name}`);
-    });
-    throw new Error("Skill not found: ${skillName}");
+    throw CliError.notFound(`Skill not found: ${skillName}`, listHint("Available skills:", (agentSkillsResponse.data.skills ?? []).map((s) => s.name)));
   }
   const creatorSkills = await marketplaceApi.getOrgSkills();
   const existingSkill = creatorSkills?.find((s) => s.sourceSkillId === skill.id);
   if (existingSkill?.listed) {
-    console.error(`\u274C Skill "${skill.name}" is already listed as "${existingSkill.displayName}".`);
-    throw new Error("Skill");
+    throw new CliError("error", `Skill "${skill.name}" is already listed as "${existingSkill.displayName}".`);
   }
   writeProgress("\u{1F504} Listing skill on marketplace...");
   const marketplaceSkill = await marketplaceApi.listSkill({
@@ -56125,17 +56761,14 @@ __name(listSkillNonInteractive, "listSkillNonInteractive");
 async function publishVersionNonInteractive(marketplaceApi, config, apiKey, options) {
   const { marketplaceId, versionId, changelog, envVarsJson } = options;
   if (!marketplaceId || !versionId) {
-    console.error("\u274C Missing required options");
-    console.log("\nUsage: lua marketplace skill publish --marketplace-id <id> --version-id <id> [--changelog <text>]");
-    throw new Error("Missing required options");
+    throw CliError.usage("Missing required options", "Usage: lua marketplace skill publish --marketplace-id <id> --version-id <id> [--changelog <text>]");
   }
   let envVars;
   if (envVarsJson) {
     try {
       envVars = JSON.parse(envVarsJson);
-    } catch (e) {
-      console.error("\u274C Invalid --env-vars-json: must be valid JSON");
-      throw new Error("Invalid --env-vars-json: must be valid JSON");
+    } catch {
+      throw CliError.usage("Invalid --env-vars-json: must be valid JSON");
     }
   }
   writeProgress("\u{1F504} Publishing version...");
@@ -56152,13 +56785,10 @@ __name(publishVersionNonInteractive, "publishVersionNonInteractive");
 async function updateMetadataNonInteractive(marketplaceApi, options) {
   const { marketplaceId, displayName } = options;
   if (!marketplaceId) {
-    console.error("\u274C Missing required option: --marketplace-id");
-    console.log("\nUsage: lua marketplace skill edit --marketplace-id <id> --display-name <name>");
-    throw new Error("Missing required option: --marketplace-id");
+    throw CliError.usage("Missing required option: --marketplace-id", "Usage: lua marketplace skill edit --marketplace-id <id> --display-name <name>");
   }
   if (!displayName) {
-    console.error("\u274C No update specified. Provide --display-name to update.");
-    throw new Error("No update specified. Provide --display-name to update.");
+    throw CliError.usage("No update specified. Provide --display-name to update.");
   }
   writeProgress("\u{1F504} Updating skill metadata...");
   await marketplaceApi.updateSkill(marketplaceId, {
@@ -56170,14 +56800,10 @@ __name(updateMetadataNonInteractive, "updateMetadataNonInteractive");
 async function unlistSkillNonInteractive(marketplaceApi, options) {
   const { marketplaceId, force } = options;
   if (!marketplaceId) {
-    console.error("\u274C Missing required option: --marketplace-id");
-    console.log("\nUsage: lua marketplace skill unlist --marketplace-id <id> [--force]");
-    throw new Error("Missing required option: --marketplace-id");
+    throw CliError.usage("Missing required option: --marketplace-id", "Usage: lua marketplace skill unlist --marketplace-id <id> [--force]");
   }
   if (!force) {
-    console.error("\u274C This action requires --force to confirm");
-    console.log("\nUsage: lua marketplace skill unlist --marketplace-id <id> --force");
-    throw new Error("This action requires --force to confirm");
+    throw CliError.usage("This action requires --force to confirm", "Usage: lua marketplace skill unlist --marketplace-id <id> --force");
   }
   writeProgress("\u{1F504} Unlisting skill...");
   await marketplaceApi.unlistSkill(marketplaceId);
@@ -56188,13 +56814,10 @@ __name(unlistSkillNonInteractive, "unlistSkillNonInteractive");
 async function unpublishVersionNonInteractive(marketplaceApi, options) {
   const { marketplaceId, versionId, force } = options;
   if (!marketplaceId || !versionId) {
-    console.error("\u274C Missing required options");
-    console.log("\nUsage: lua marketplace skill unpublish --marketplace-id <id> --version-id <id> [--force]");
-    throw new Error("Missing required options");
+    throw CliError.usage("Missing required options", "Usage: lua marketplace skill unpublish --marketplace-id <id> --version-id <id> [--force]");
   }
   if (!force) {
-    console.error("\u274C This action requires --force to confirm");
-    throw new Error("This action requires --force to confirm");
+    throw CliError.usage("This action requires --force to confirm");
   }
   writeProgress("\u{1F504} Unpublishing version...");
   await marketplaceApi.unpublishVersion(marketplaceId, versionId);
@@ -56204,8 +56827,7 @@ async function unpublishVersionNonInteractive(marketplaceApi, options) {
 __name(unpublishVersionNonInteractive, "unpublishVersionNonInteractive");
 async function transferOwnershipNonInteractive(marketplaceApi, options) {
   if (!options.marketplaceId || !options.newOrgId || !options.force) {
-    console.error("\u274C --marketplace-id, --new-org-id and --force are required");
-    throw new Error("Missing transfer options");
+    throw CliError.usage("--marketplace-id, --new-org-id and --force are required");
   }
   writeProgress("\u{1F504} Transferring organization ownership...");
   const skill = await marketplaceApi.transferSkillOwnership(options.marketplaceId, options.newOrgId);
@@ -56284,9 +56906,7 @@ __name(searchSkillsNonInteractive, "searchSkillsNonInteractive");
 async function viewSkillNonInteractive(marketplaceApi, options) {
   const { marketplaceId } = options;
   if (!marketplaceId) {
-    console.error("\u274C Missing required option: --marketplace-id");
-    console.log("\nUsage: lua marketplace skill view --marketplace-id <id>");
-    throw new Error("Missing required option: --marketplace-id");
+    throw CliError.usage("Missing required option: --marketplace-id", "Usage: lua marketplace skill view --marketplace-id <id>");
   }
   writeProgress("\u{1F504} Loading skill details...");
   const skill = await marketplaceApi.getSkillById(marketplaceId);
@@ -56328,14 +56948,11 @@ __name(viewSkillNonInteractive, "viewSkillNonInteractive");
 async function installSkillNonInteractive(marketplaceApi, config, options) {
   const { marketplaceId, versionId, envVars, force } = options;
   if (!marketplaceId || !versionId) {
-    console.error("\u274C Missing required options");
-    console.log("\nUsage: lua marketplace skill install --marketplace-id <id> --version-id <id> [--env-vars <k=v,...>]");
-    throw new Error("Missing required options");
+    throw CliError.usage("Missing required options", "Usage: lua marketplace skill install --marketplace-id <id> --version-id <id> [--env-vars <k=v,...>]");
   }
   const agentId = config.agent?.agentId;
   if (!agentId) {
-    console.error("\u274C Agent ID not found in configuration.");
-    throw new Error("Agent ID not found in configuration.");
+    throw CliError.usage("Agent ID not found in configuration.", "Run `lua init` in a project directory first.");
   }
   const envVarsConfig = {};
   if (envVars) {
@@ -56356,8 +56973,7 @@ async function installSkillNonInteractive(marketplaceApi, config, options) {
     if (Object.keys(envVarsConfig).length > 0) {
       writeInfo(`  Env vars: ${Object.keys(envVarsConfig).length} configured`);
     }
-    console.error("\n\u274C Use --force to confirm installation");
-    throw new Error("Operation failed");
+    throw CliError.usage("Use --force to confirm installation");
   }
   writeProgress("\u{1F504} Installing skill...");
   await marketplaceApi.installSkill(marketplaceId, agentId, {
@@ -56385,31 +57001,20 @@ __name(installSkillNonInteractive, "installSkillNonInteractive");
 async function updateInstalledSkillNonInteractive(marketplaceApi, config, apiKey, options) {
   const { skillName, versionId, envVars } = options;
   if (!skillName) {
-    console.error("\u274C Missing required option: --skill-name");
-    console.log("\nUsage: lua marketplace skill update --skill-name <name> [--version-id <id>] [--env-vars <k=v,...>]");
-    throw new Error("Missing required option: --skill-name");
+    throw CliError.usage("Missing required option: --skill-name", "Usage: lua marketplace skill update --skill-name <name> [--version-id <id>] [--env-vars <k=v,...>]");
   }
   const agentId = config.agent?.agentId;
   if (!agentId) {
-    console.error("\u274C Agent ID not found in configuration.");
-    throw new Error("Agent ID not found in configuration.");
+    throw CliError.usage("Agent ID not found in configuration.", "Run `lua init` in a project directory first.");
   }
   writeProgress("\u{1F504} Loading installed skills...");
   const installedSkills = await marketplaceApi.getInstalledSkills(agentId);
   const installedSkill = installedSkills?.find((s) => s.name === skillName || s.title === skillName);
   if (!installedSkill) {
-    console.error(`\u274C Installed skill not found: ${skillName}`);
-    if (installedSkills?.length) {
-      writeInfo("\nInstalled skills:");
-      installedSkills.forEach((s) => {
-        writeInfo(`  - ${s.title || s.name}`);
-      });
-    }
-    throw new Error("Operation failed");
+    throw CliError.notFound(`Installed skill not found: ${skillName}`, listHint("Installed skills:", (installedSkills ?? []).map((s) => s.title || s.name)));
   }
   if (!installedSkill.marketplaceSkillId) {
-    console.error("\u274C Skill is missing marketplace skill ID.");
-    throw new Error("Skill is missing marketplace skill ID.");
+    throw new CliError("error", "Skill is missing marketplace skill ID.");
   }
   let newEnvVars;
   if (envVars) {
@@ -56426,8 +57031,7 @@ async function updateInstalledSkillNonInteractive(marketplaceApi, config, apiKey
   if (versionId) updatePayload.versionId = versionId;
   if (newEnvVars) updatePayload.envVars = newEnvVars;
   if (!updatePayload.versionId && !updatePayload.envVars) {
-    console.error("\u274C No update specified. Provide --version-id or --env-vars.");
-    throw new Error("No update specified. Provide --version-id or --env-vars.");
+    throw CliError.usage("No update specified. Provide --version-id or --env-vars.");
   }
   writeProgress("\u{1F504} Updating installed skill...");
   await marketplaceApi.updateInstallation(installedSkill.marketplaceSkillId, agentId, updatePayload);
@@ -56437,29 +57041,23 @@ __name(updateInstalledSkillNonInteractive, "updateInstalledSkillNonInteractive")
 async function uninstallSkillNonInteractive(marketplaceApi, config, options) {
   const { skillName, force } = options;
   if (!skillName) {
-    console.error("\u274C Missing required option: --skill-name");
-    console.log("\nUsage: lua marketplace skill uninstall --skill-name <name> [--force]");
-    throw new Error("Missing required option: --skill-name");
+    throw CliError.usage("Missing required option: --skill-name", "Usage: lua marketplace skill uninstall --skill-name <name> [--force]");
   }
   const agentId = config.agent?.agentId;
   if (!agentId) {
-    console.error("\u274C Agent ID not found in configuration.");
-    throw new Error("Agent ID not found in configuration.");
+    throw CliError.usage("Agent ID not found in configuration.", "Run `lua init` in a project directory first.");
   }
   writeProgress("\u{1F504} Loading installed skills...");
   const installedSkills = await marketplaceApi.getInstalledSkills(agentId);
   const installedSkill = installedSkills?.find((s) => s.name === skillName || s.title === skillName);
   if (!installedSkill) {
-    console.error(`\u274C Installed skill not found: ${skillName}`);
-    throw new Error("Installed skill not found: ${skillName}");
+    throw CliError.notFound(`Installed skill not found: ${skillName}`);
   }
   if (!installedSkill.marketplaceSkillId) {
-    console.error("\u274C Skill is missing marketplace skill ID.");
-    throw new Error("Skill is missing marketplace skill ID.");
+    throw new CliError("error", "Skill is missing marketplace skill ID.");
   }
   if (!force) {
-    console.error(`\u274C Use --force to confirm uninstalling "${installedSkill.title || installedSkill.name}"`);
-    throw new Error("Use --force to confirm uninstalling");
+    throw CliError.usage(`Use --force to confirm uninstalling "${installedSkill.title || installedSkill.name}"`);
   }
   writeProgress("\u{1F504} Uninstalling skill...");
   await marketplaceApi.uninstallSkill(installedSkill.marketplaceSkillId, agentId);
@@ -56469,8 +57067,7 @@ __name(uninstallSkillNonInteractive, "uninstallSkillNonInteractive");
 async function listInstalledSkillsNonInteractive(marketplaceApi, config, options) {
   const agentId = config.agent?.agentId;
   if (!agentId) {
-    console.error("\u274C Agent ID not found in configuration.");
-    throw new Error("Agent ID not found in configuration.");
+    throw CliError.usage("Agent ID not found in configuration.", "Run `lua init` in a project directory first.");
   }
   writeProgress("\u{1F504} Loading installed marketplace skills...");
   const skills = await marketplaceApi.getInstalledSkills(agentId);
@@ -57951,6 +58548,7 @@ init_constants();
 init_command_utils();
 init_developer_api_service();
 init_analytics();
+init_cli_error();
 async function mcpCommand(action, serverNamePositional, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -58135,23 +58733,11 @@ async function executeNonInteractive11(context, action, options) {
     return;
   }
   if (!options.serverName) {
-    console.error(`\u274C --server-name is required for action "${resolvedAction}"`);
-    console.log(`
-Usage: lua mcp ${resolvedAction} --server-name <name>`);
-    if (servers.length > 0) {
-      console.log("\nAvailable servers:");
-      servers.forEach((s) => console.log(`  - ${s.name} ${s.active ? "(active)" : "(inactive)"}`));
-    }
-    throw new Error("Operation failed");
+    throw CliError.usage(`--server-name is required for action "${resolvedAction}"`, joinHint(`Usage: lua mcp ${resolvedAction} --server-name <name>`, listHint("Available servers:", servers.map((s) => `${s.name} ${s.active ? "(active)" : "(inactive)"}`))));
   }
   const selectedServer = findServer(servers, options.serverName);
   if (!selectedServer) {
-    console.error(`\u274C MCP server "${options.serverName}" not found`);
-    if (servers.length > 0) {
-      console.log("\nAvailable servers:");
-      servers.forEach((s) => console.log(`  - ${s.name}`));
-    }
-    throw new Error("Operation failed");
+    throw CliError.notFound(`MCP server "${options.serverName}" not found`, listHint("Available servers:", servers.map((s) => s.name)));
   }
   switch (resolvedAction) {
     case "activate": {
@@ -58549,6 +59135,7 @@ var UnifiedToApi = class extends HttpClient {
 
 // src/commands/integrations.ts
 init_analytics();
+init_cli_error();
 var CALLBACK_PORT = 19837;
 var CALLBACK_HOST = "127.0.0.1";
 var CALLBACK_URL = `http://${CALLBACK_HOST}:${CALLBACK_PORT}/callback`;
@@ -58745,9 +59332,7 @@ async function executeNonInteractive12(context, action, cmdOptions) {
       break;
     case "update":
       if (!options.integration && !options.connectionId) {
-        console.error("\u274C --connection-id (preferred) or --integration is required for update");
-        console.log("\n\u{1F4A1} Run 'lua integrations list' to see connected integrations");
-        throw new Error("--connection-id or --integration is required for update");
+        throw CliError.usage("--connection-id (preferred) or --integration is required for update", "Run 'lua integrations list' to see connected integrations");
       }
       if (options.scope === "user") {
         await updateUserConnectionFlow(context, options);
@@ -58767,9 +59352,7 @@ async function executeNonInteractive12(context, action, cmdOptions) {
       break;
     case "convert":
       if (!options.connectionId) {
-        console.error("\u274C --connection-id is required for convert");
-        console.log("\n\u{1F4A1} Run 'lua integrations list' to see connection IDs");
-        throw new Error("--connection-id is required for convert");
+        throw CliError.usage("--connection-id is required for convert", "Run 'lua integrations list' to see connection IDs");
       }
       await convertConnectionFlow(context, options.connectionId, cmdOptions?.force === true);
       break;
@@ -58779,18 +59362,13 @@ async function executeNonInteractive12(context, action, cmdOptions) {
     case "info":
       const infoIntegrationType = options.integration || cmdOptions?._?.[0];
       if (!infoIntegrationType) {
-        console.error("\u274C Integration type is required");
-        console.log("\nUsage: lua integrations info <type>");
-        console.log("       lua integrations info <type> --json");
-        throw new Error("Integration type is required");
+        throw CliError.usage("Integration type is required", "Usage: lua integrations info <type>\n       lua integrations info <type> --json");
       }
       await showIntegrationInfo(context, infoIntegrationType, jsonOutput);
       break;
     case "disconnect":
       if (!options.connectionId) {
-        console.error("\u274C --connection-id is required for disconnect");
-        console.log("\n\u{1F4A1} Run 'lua integrations list' to see connection IDs");
-        throw new Error("--connection-id is required for disconnect");
+        throw CliError.usage("--connection-id is required for disconnect", "Run 'lua integrations list' to see connection IDs");
       }
       if (options.scope === "user") {
         await disconnectUserConnection(context, options.connectionId);
@@ -58805,9 +59383,7 @@ async function executeNonInteractive12(context, action, cmdOptions) {
       await mcpSubcommand(context, cmdOptions);
       break;
     default:
-      console.error(`\u274C Invalid action: "${action}"`);
-      showUsage();
-      throw new Error("Invalid action:");
+      throw CliError.usage(`Invalid action: "${action}"`, INTEGRATIONS_USAGE.join("\n"));
   }
 }
 __name(executeNonInteractive12, "executeNonInteractive");
@@ -58936,16 +59512,7 @@ async function showIntegrationInfo(context, integrationType, jsonOutput = false)
     const integrations = await fetchAvailableIntegrations(context.unifiedToApi);
     const integration = integrations.find((i) => i.value === integrationType);
     if (!integration) {
-      if (jsonOutput) {
-        console.log(JSON.stringify({
-          error: `Integration not found: ${integrationType}`
-        }));
-      } else {
-        console.error(`\u274C Integration not found: ${integrationType}`);
-        console.log("\nAvailable integrations:");
-        integrations.forEach((i) => console.log(`  - ${i.value} (${i.name})`));
-      }
-      throw new Error("Operation failed");
+      throw CliError.notFound(`Integration not found: ${integrationType}`, listHint("Available integrations:", integrations.map((i) => `${i.value} (${i.name})`)));
     }
     let webhookEvents = [];
     try {
@@ -59028,14 +59595,11 @@ async function showIntegrationInfo(context, integrationType, jsonOutput = false)
       console.log();
     }
   } catch (error) {
-    if (jsonOutput) {
-      console.log(JSON.stringify({
-        error: error.message
-      }));
-    } else {
-      writeError(`\u274C Failed to get integration info: ${error.message}`);
-    }
-    throw new Error("Operation failed");
+    if (jsonOutput) console.log(JSON.stringify({
+      error: error.message
+    }));
+    if (isTypedCliError(error)) throw error;
+    throw new CliError("error", `Failed to get integration info: ${error.message}`);
   }
 }
 __name(showIntegrationInfo, "showIntegrationInfo");
@@ -59055,8 +59619,7 @@ function normalizeScopeFlag(raw) {
   if (!raw) return void 0;
   const normalized = raw.toLowerCase();
   if (normalized !== "agent" && normalized !== "user") {
-    console.error(`\u274C Invalid --scope: "${raw}". Use 'agent' or 'user'`);
-    throw new Error("Invalid --scope");
+    throw CliError.usage(`Invalid --scope: "${raw}". Use 'agent' or 'user'`);
   }
   return normalized;
 }
@@ -59216,22 +59779,13 @@ async function connectIntegrationFlow(context, options = {}) {
       "oauth",
       "token"
     ].includes(options.authMethod)) {
-      console.error(`\u274C Invalid --auth-method: "${options.authMethod}". Use 'oauth' or 'token'`);
-      throw new Error("Invalid --auth-method:");
+      throw CliError.usage(`Invalid --auth-method: "${options.authMethod}". Use 'oauth' or 'token'`);
     }
     if (options.authMethod === "oauth" && !canUseOAuth) {
-      console.error(`\u274C OAuth is not available for ${selectedIntegration.name}.`);
-      if (canUseToken) {
-        console.log(`\u{1F4A1} Use --auth-method token instead.`);
-      }
-      throw new Error("Operation failed");
+      throw CliError.usage(`OAuth is not available for ${selectedIntegration.name}.`, canUseToken ? "Use --auth-method token instead." : void 0);
     }
     if (options.authMethod === "token" && !canUseToken) {
-      console.error(`\u274C Token authentication is not available for ${selectedIntegration.name}.`);
-      if (canUseOAuth) {
-        console.log(`\u{1F4A1} Use --auth-method oauth instead.`);
-      }
-      throw new Error("Operation failed");
+      throw CliError.usage(`Token authentication is not available for ${selectedIntegration.name}.`, canUseOAuth ? "Use --auth-method oauth instead." : void 0);
     }
     authMethod = options.authMethod;
     writeInfo(`Using ${authMethod === "oauth" ? "OAuth 2.0" : "API Token"} authentication`);
@@ -59277,11 +59831,7 @@ async function connectIntegrationFlow(context, options = {}) {
         const requestedScopes = options.scopes.split(",").map((s) => s.trim());
         const invalidScopes = requestedScopes.filter((s) => !availableScopes.includes(s));
         if (invalidScopes.length > 0) {
-          console.error(`\u274C Invalid scopes: ${invalidScopes.join(", ")}`);
-          console.log(`
-Available scopes for ${selectedIntegration.name}:`);
-          availableScopes.forEach((s) => console.log(`  - ${s}`));
-          throw new Error("Invalid scopes: ${invalidScopes.join(");
+          throw CliError.usage(`Invalid scopes: ${invalidScopes.join(", ")}`, listHint(`Available scopes for ${selectedIntegration.name}:`, availableScopes));
         }
         selectedScopes = requestedScopes;
         writeInfo(`Using ${selectedScopes.length} specified scope(s)`);
@@ -59367,13 +59917,7 @@ Available scopes for ${selectedIntegration.name}:`);
           const [objectType, event] = trigger.split(".");
           const matchingEvent = availableEvents.find((e) => e.objectType === objectType && e.event === event);
           if (!matchingEvent) {
-            console.error(`\u274C Invalid trigger: ${trigger}`);
-            console.log(`
-Available triggers for ${selectedIntegration.name}:`);
-            availableEvents.forEach((e) => {
-              console.log(`  - ${e.objectType}.${e.event} [${e.webhookType}] - ${e.friendlyDescription}`);
-            });
-            throw new Error("Invalid trigger: ${trigger}");
+            throw CliError.usage(`Invalid trigger: ${trigger}`, listHint(`Available triggers for ${selectedIntegration.name}:`, availableEvents.map((e) => `${e.objectType}.${e.event} [${e.webhookType}] - ${e.friendlyDescription}`)));
           }
           selectedTriggers.push(matchingEvent);
         }
@@ -60001,10 +60545,7 @@ async function updateConnectionFlow(context, options = {}) {
     }
     selectedConnection = matches[0];
     if (!selectedConnection) {
-      console.error(`\u274C No connection found for integration "${options.integration}".`);
-      console.log("\nConnected integrations:");
-      connections.forEach((c) => console.log(`  - ${c.integrationType} (${c.integrationName || c.integrationType})`));
-      throw new Error("No connection found for integration");
+      throw CliError.notFound(`No connection found for integration "${options.integration}".`, listHint("Connected integrations:", connections.map((c) => `${c.integrationType} (${c.integrationName || c.integrationType})`)));
     }
     selectedIntegration = integrations.find((i) => i.value === options.integration);
   } else {
@@ -60049,11 +60590,7 @@ async function updateConnectionFlow(context, options = {}) {
       const requestedScopes = options.scopes.split(",").map((s) => s.trim());
       const invalidScopes = requestedScopes.filter((s) => !availableScopes.includes(s));
       if (invalidScopes.length > 0) {
-        console.error(`\u274C Invalid scopes: ${invalidScopes.join(", ")}`);
-        console.log(`
-Available scopes for ${selectedIntegration.name}:`);
-        availableScopes.forEach((s) => console.log(`  - ${s}`));
-        throw new Error("Invalid scopes: ${invalidScopes.join(");
+        throw CliError.usage(`Invalid scopes: ${invalidScopes.join(", ")}`, listHint(`Available scopes for ${selectedIntegration.name}:`, availableScopes));
       }
       selectedScopes = requestedScopes;
       writeInfo(`Using ${selectedScopes.length} specified scope(s)`);
@@ -60287,9 +60824,7 @@ async function webhooksSubcommand(context, cmdOptions) {
       break;
     case "delete":
       if (!options.webhookId) {
-        console.error("\u274C --webhook-id is required for delete");
-        console.log("\n\u{1F4A1} Run 'lua integrations webhooks list' to see trigger IDs");
-        throw new Error("--webhook-id is required for delete");
+        throw CliError.usage("--webhook-id is required for delete", "Run 'lua integrations webhooks list' to see trigger IDs");
       }
       await webhooksDeleteFlow(context, options.webhookId);
       break;
@@ -60299,9 +60834,7 @@ async function webhooksSubcommand(context, cmdOptions) {
       } else if (options.connectionId) {
         await connectionPauseFlow(context, options.connectionId);
       } else {
-        console.error("\u274C --webhook-id or --connection-id is required for pause");
-        console.log("\n\u{1F4A1} Run 'lua integrations webhooks list' to see trigger IDs");
-        throw new Error("--webhook-id or --connection-id is required for pause");
+        throw CliError.usage("--webhook-id or --connection-id is required for pause", "Run 'lua integrations webhooks list' to see trigger IDs");
       }
       break;
     case "resume":
@@ -60310,9 +60843,7 @@ async function webhooksSubcommand(context, cmdOptions) {
       } else if (options.connectionId) {
         await connectionResumeFlow(context, options.connectionId);
       } else {
-        console.error("\u274C --webhook-id or --connection-id is required for resume");
-        console.log("\n\u{1F4A1} Run 'lua integrations webhooks list' to see trigger IDs");
-        throw new Error("--webhook-id or --connection-id is required for resume");
+        throw CliError.usage("--webhook-id or --connection-id is required for resume", "Run 'lua integrations webhooks list' to see trigger IDs");
       }
       break;
     case "events":
@@ -60355,17 +60886,7 @@ async function webhooksEventsFlow(context, options, jsonOutput = false) {
       }
       sourceName = `integration ${options.integration}`;
     } else {
-      if (jsonOutput) {
-        console.log(JSON.stringify({
-          error: "Either --connection or --integration is required"
-        }));
-      } else {
-        console.error("\u274C Either --connection <id> or --integration <type> is required");
-        console.log("\nUsage:");
-        console.log("  lua integrations webhooks events --connection <id>");
-        console.log("  lua integrations webhooks events --integration <type>");
-      }
-      throw new Error("Operation failed");
+      throw CliError.usage("Either --connection <id> or --integration <type> is required", "Usage:\n  lua integrations webhooks events --connection <id>\n  lua integrations webhooks events --integration <type>");
     }
     if (jsonOutput) {
       const output = {
@@ -60409,14 +60930,11 @@ async function webhooksEventsFlow(context, options, jsonOutput = false) {
       }
     }
   } catch (error) {
-    if (jsonOutput) {
-      console.log(JSON.stringify({
-        error: error.message
-      }));
-    } else {
-      writeError(`\u274C Failed to get trigger events: ${error.message}`);
-    }
-    throw new Error("Operation failed");
+    if (jsonOutput) console.log(JSON.stringify({
+      error: error.message
+    }));
+    if (isTypedCliError(error)) throw error;
+    throw new CliError("error", `Failed to get trigger events: ${error.message}`);
   }
 }
 __name(webhooksEventsFlow, "webhooksEventsFlow");
@@ -60849,10 +61367,7 @@ async function webhooksCreateFlow(context, options) {
   if (options.connectionId) {
     selectedConnection = connections.find((c) => c.id === options.connectionId);
     if (!selectedConnection) {
-      console.error(`\u274C Connection "${options.connectionId}" not found.`);
-      console.log("\nAvailable connections:");
-      connections.forEach((c) => console.log(`  - ${c.id} (${c.integrationName || c.integrationType})`));
-      throw new Error("Connection");
+      throw CliError.notFound(`Connection "${options.connectionId}" not found.`, listHint("Available connections:", connections.map((c) => `${c.id} (${c.integrationName || c.integrationType})`)));
     }
   } else {
     const connectionAnswer = await safePrompt([
@@ -60891,11 +61406,7 @@ async function webhooksCreateFlow(context, options) {
   if (options.objectType && options.event) {
     selectedEvent = availableEvents.find((e) => e.objectType === options.objectType && e.event === options.event);
     if (!selectedEvent) {
-      console.error(`\u274C Event '${options.objectType}.${options.event}' is not supported.`);
-      console.log(`
-Available events for ${selectedConnection.integrationName || selectedConnection.integrationType}:`);
-      availableEvents.forEach((e) => console.log(`  - ${e.objectType}.${e.event} [${e.webhookType}]`));
-      throw new Error("Event");
+      throw CliError.usage(`Event '${options.objectType}.${options.event}' is not supported.`, listHint(`Available events for ${selectedConnection.integrationName || selectedConnection.integrationType}:`, availableEvents.map((e) => `${e.objectType}.${e.event} [${e.webhookType}]`)));
     }
   } else {
     console.log(`
@@ -61405,44 +61916,48 @@ async function mcpDeactivateInteractive(context) {
   }
 }
 __name(mcpDeactivateInteractive, "mcpDeactivateInteractive");
-function showUsage() {
-  console.log("\nUsage:");
-  console.log("  lua integrations                              Interactive integration management");
-  console.log("  lua integrations connect                      Connect a new integration (interactive)");
-  console.log("  lua integrations connect --integration <type> Connect a specific integration");
-  console.log("  lua integrations connect --integration <type> --triggers <events>  Connect with triggers");
-  console.log("  lua integrations update                       Update connection scopes (interactive)");
-  console.log("  lua integrations update --integration <type>  Update scopes for a specific integration");
-  console.log("  lua integrations list                         List connected integrations");
-  console.log("  lua integrations available                    List available integrations");
-  console.log("  lua integrations info <type>                  Show integration details (scopes, triggers)");
-  console.log("  lua integrations info <type> --json           Output as JSON for scripting");
-  console.log("  lua integrations disconnect --connection-id <id>  Disconnect an integration");
-  console.log("\nTriggers (also available as: lua triggers <action>):");
-  console.log("  lua integrations webhooks list                List all triggers");
-  console.log("  lua integrations webhooks list --json         Output as JSON");
-  console.log("  lua integrations webhooks events --connection <id>   List available events for a connection");
-  console.log("  lua integrations webhooks events --integration <type> List available events for an integration");
-  console.log("  lua integrations webhooks create              Create trigger (interactive)");
-  console.log("  lua integrations webhooks create --connection <id> --object <type> --event <event> --hook-url <url>");
-  console.log("  lua integrations webhooks delete --webhook-id <id>  Delete a trigger");
-  console.log("  lua integrations webhooks pause --webhook-id <id>   Pause a trigger");
-  console.log("  lua integrations webhooks pause --connection-id <id> Pause all triggers for a connection");
-  console.log("  lua integrations webhooks resume --webhook-id <id>  Resume a trigger");
-  console.log("  lua integrations webhooks resume --connection-id <id> Resume all triggers for a connection");
-  console.log("\nMCP Server Management:");
-  console.log("  lua integrations mcp list                     List connections with MCP status");
-  console.log("  lua integrations mcp activate --connection <id>   Activate MCP server");
-  console.log("  lua integrations mcp deactivate --connection <id> Deactivate MCP server");
-  console.log("\nTrigger Options (use with connect):");
-  console.log("  --triggers <events>       Comma-separated triggers (e.g., task_task.created,task_task.updated)");
-  console.log("                            Omit to skip triggers and add them later");
-  console.log("  --custom-webhook          Use custom URL instead of agent trigger");
-  console.log("  --hook-url <url>          Custom URL for triggers");
-  console.log("\nPause Options (use with webhooks pause):");
-  console.log("  --reason <text>           Optional reason for pausing (informational)");
-}
-__name(showUsage, "showUsage");
+var INTEGRATIONS_USAGE = [
+  "",
+  "Usage:",
+  "  lua integrations                              Interactive integration management",
+  "  lua integrations connect                      Connect a new integration (interactive)",
+  "  lua integrations connect --integration <type> Connect a specific integration",
+  "  lua integrations connect --integration <type> --triggers <events>  Connect with triggers",
+  "  lua integrations update                       Update connection scopes (interactive)",
+  "  lua integrations update --integration <type>  Update scopes for a specific integration",
+  "  lua integrations list                         List connected integrations",
+  "  lua integrations available                    List available integrations",
+  "  lua integrations info <type>                  Show integration details (scopes, triggers)",
+  "  lua integrations info <type> --json           Output as JSON for scripting",
+  "  lua integrations disconnect --connection-id <id>  Disconnect an integration",
+  "",
+  "Triggers (also available as: lua triggers <action>):",
+  "  lua integrations webhooks list                List all triggers",
+  "  lua integrations webhooks list --json         Output as JSON",
+  "  lua integrations webhooks events --connection <id>   List available events for a connection",
+  "  lua integrations webhooks events --integration <type> List available events for an integration",
+  "  lua integrations webhooks create              Create trigger (interactive)",
+  "  lua integrations webhooks create --connection <id> --object <type> --event <event> --hook-url <url>",
+  "  lua integrations webhooks delete --webhook-id <id>  Delete a trigger",
+  "  lua integrations webhooks pause --webhook-id <id>   Pause a trigger",
+  "  lua integrations webhooks pause --connection-id <id> Pause all triggers for a connection",
+  "  lua integrations webhooks resume --webhook-id <id>  Resume a trigger",
+  "  lua integrations webhooks resume --connection-id <id> Resume all triggers for a connection",
+  "",
+  "MCP Server Management:",
+  "  lua integrations mcp list                     List connections with MCP status",
+  "  lua integrations mcp activate --connection <id>   Activate MCP server",
+  "  lua integrations mcp deactivate --connection <id> Deactivate MCP server",
+  "",
+  "Trigger Options (use with connect):",
+  "  --triggers <events>       Comma-separated triggers (e.g., task_task.created,task_task.updated)",
+  "                            Omit to skip triggers and add them later",
+  "  --custom-webhook          Use custom URL instead of agent trigger",
+  "  --hook-url <url>          Custom URL for triggers",
+  "",
+  "Pause Options (use with webhooks pause):",
+  "  --reason <text>           Optional reason for pausing (informational)"
+];
 
 // src/commands/agents.ts
 init_cli();
@@ -61904,6 +62419,19 @@ init_compiler2();
 init_artifact_loader();
 init_analytics();
 init_cli_error();
+function noAgentConfigured() {
+  return CliError.usage("No agent configured.", "Run `lua init` first to set up a project.");
+}
+__name(noAgentConfigured, "noAgentConfigured");
+async function fetchModelsWithProgress(apiKey, agentId) {
+  writeProgress("\u{1F504} Fetching available models...");
+  try {
+    return await fetchApprovedModelsOrThrow(apiKey, agentId);
+  } finally {
+    writeProgress("");
+  }
+}
+__name(fetchModelsWithProgress, "fetchModelsWithProgress");
 async function resolveCurrentModel(apiKey, agentId) {
   const serverModel = await fetchServerModel(apiKey, agentId);
   if (serverModel) return serverModel;
@@ -61963,14 +62491,7 @@ async function modelsCommand(action, opts) {
     const config = readYamlConfig();
     const agentId = config?.agent?.agentId;
     if (resolvedAction === "list") {
-      writeProgress("\u{1F504} Fetching available models...");
-      const models = await fetchApprovedModels(apiKey, agentId);
-      writeProgress("");
-      if (models === null) {
-        throw new CliError("error", "Could not fetch models from the server.", {
-          hint: "Check your connection and API key, then retry."
-        });
-      }
+      const models = await fetchModelsWithProgress(apiKey, agentId);
       if (models.length === 0) {
         writeInfo("\u2139\uFE0F  No models are currently available. If your organization restricts models, an admin may need to review its excluded-models list.");
         trackEvent("cli_models_listed", {
@@ -61990,19 +62511,10 @@ async function modelsCommand(action, opts) {
       return;
     }
     if (resolvedAction === "set") {
-      if (!agentId) {
-        writeError("\u274C No agent configured. Run `lua init` first to set up a project.");
-        process.exit(1);
-      }
-      writeProgress("\u{1F504} Fetching available models...");
-      const models = await fetchApprovedModels(apiKey, agentId);
-      writeProgress("");
-      if (models === null) {
-        writeError("\u274C Could not fetch models from the server. Check your connection and API key.");
-        process.exit(1);
-      } else if (models.length === 0) {
-        writeError("\u274C No models are currently available. If your organization restricts models, an admin may need to review its excluded-models list.");
-        process.exit(1);
+      if (!agentId) throw noAgentConfigured();
+      const models = await fetchModelsWithProgress(apiKey, agentId);
+      if (models.length === 0) {
+        throw new CliError("error", "No models are currently available. If your organization restricts models, an admin may need to review its excluded-models list.");
       }
       let selectedModel;
       if (opts.model) {
@@ -62047,10 +62559,7 @@ async function modelsCommand(action, opts) {
       return;
     }
     if (resolvedAction === "unset") {
-      if (!agentId) {
-        writeError("\u274C No agent configured. Run `lua init` first to set up a project.");
-        process.exit(1);
-      }
+      if (!agentId) throw noAgentConfigured();
       const currentModel = await resolveCurrentModel(apiKey, agentId);
       if (!currentModel) {
         writeInfo("\u2139\uFE0F  No model is currently set \u2014 the platform default is already in use.");
@@ -62077,8 +62586,7 @@ async function modelsCommand(action, opts) {
       });
       return;
     }
-    writeError(`\u274C Unknown action '${resolvedAction}'. Use 'list', 'set', or 'unset'.`);
-    process.exit(1);
+    throw CliError.usage(`Unknown action '${resolvedAction}'. Use 'list', 'set', or 'unset'.`);
   }, "models");
 }
 __name(modelsCommand, "modelsCommand");
@@ -62627,15 +63135,15 @@ function renderTryPage(wsUrl, token) {
 __name(renderTryPage, "renderTryPage");
 
 // src/commands/voice.ts
+init_cli_error();
 async function voiceTestCommand(options = {}) {
   return withErrorHandling(async () => {
     const cwd = process.cwd();
     const runner = options.runner === "auto" || !options.runner ? detectRunner(cwd) : options.runner;
     if (!runner) {
-      console.error("\u274C No supported test runner found.");
-      console.log("   Install jest or vitest in this project, then re-run.");
-      console.log("   Example: pnpm add -D jest ts-jest @types/jest");
-      throw new Error("no test runner");
+      throw new CliError("error", "No supported test runner found.", {
+        hint: "Install jest or vitest in this project, then re-run.\nExample: pnpm add -D jest ts-jest @types/jest"
+      });
     }
     const pattern = options.pattern ?? (options.voice ? `${escapeRegex(options.voice)}\\.voice\\.test\\.` : "\\.voice\\.test\\.");
     const files = findVoiceTestFiles(cwd);
@@ -63775,14 +64283,18 @@ __name(versionStatusCommand, "versionStatusCommand");
 init_cli();
 init_files();
 init_analytics();
+init_cli_error();
 var NO_YAML_MESSAGE = "No lua.skill.yaml found. Please run this command from a skill directory.";
-function failConnect(status, banner, errorMessage) {
-  if (banner) writeError(banner);
+function failConnect(status, banner, errorMessage, cls = "error") {
   trackEvent("cli_git_connect_completed", {
     ...status,
     succeeded: false
   });
-  throw new Error(errorMessage);
+  const hint = banner?.split("\n").map((line) => line.replace(/^✗\s*/, "").trim()).join("\n");
+  if (cls === "usage") throw CliError.usage(errorMessage, hint);
+  throw new CliError("error", errorMessage, {
+    hint
+  });
 }
 __name(failConnect, "failConnect");
 async function gitConnectCommand(opts = {}) {
@@ -63793,7 +64305,7 @@ async function gitConnectCommand(opts = {}) {
         git_available: false,
         in_repo: false,
         user_configured: false
-      }, null, NO_YAML_MESSAGE);
+      }, null, NO_YAML_MESSAGE, "usage");
     }
     if (!await isGitAvailable()) {
       failConnect({
@@ -63862,7 +64374,7 @@ async function gitDisconnectCommand() {
   return withErrorHandling(async () => {
     const config = readYamlConfig();
     if (!config) {
-      throw new Error(NO_YAML_MESSAGE);
+      throw CliError.usage(NO_YAML_MESSAGE);
     }
     config.git = {
       enabled: false
@@ -64510,15 +65022,17 @@ Examples:
   $ lua jobs versions -i myJob                         View job versions
   $ lua jobs history -i myJob                          View execution history
 `).action(jobsCommand);
-  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, approve, signal, replay)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/goals create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list: page size").option("--cursor <c>", "runs/goals list: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/logs: step id").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve: approval id").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip)").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create: cadence entry (repeatable, \u2264 5); none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit: IANA timezone for bare cron cadences").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
+  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, retry-step, resolve-step, raise-budget, approve, signal, replay, export, schedules)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/export/goals create/schedules create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create/schedules create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs/schedules create: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start/schedules create: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list/approval-payload --path: page size").option("--cursor <c>", "runs/goals list/approval-payload --path: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/retry-step/resolve-step/logs: step id").option("--outcome <skip|complete|fail>", "resolve-step: the decision on the parked step (--action is accepted too)").option("--action <skip|complete|fail>", "resolve-step: alias of --outcome").option("--output <json|@file>", "resolve-step: the output a completed step would have produced (required with --outcome complete)").option("--credits <n>", "raise-budget: the new credit cap of a budget-parked run (above the current one)").option("--max-steps <n>", "raise-budget: the new step cap").option("--max-job-seconds <n>", "raise-budget: the new Job-tier seconds cap").option("--max-duration-seconds <n>", "raise-budget: the new wall-clock cap").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve/approval-payload: approval id").option("--path <array.path>", "approval-payload: page one array of a large payload (--cursor / --limit inside it)").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/retry-step/resolve-step/raise-budget/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph \xB7 export: overwrite files").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip) \xB7 export: target dir").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create/schedules create: cadence entry (repeatable, \u2264 5); goals: none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit/schedules create: IANA timezone for bare cron cadences").option("--notify <emailApp|email|app|off>", "schedules create: where each fire notifies").option("--backfill-on-enable <n|none>", "schedules create/patch/resume: replay \u2264 n missed fires on re-enable (patch: none clears it)").option("--backfill-now", "schedules resume (or patch --paused false): one-shot backfill on THIS re-enable").option("--paused <true|false>", "schedules patch: pause (true) or re-enable (false) the schedule").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit/schedules create: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
 Arguments:
   action    list \xB7 view \xB7 versions \xB7 deploy \xB7 activate \xB7 deactivate \xB7 start \xB7 run \xB7 runs \xB7 status \xB7
-            watch \xB7 cancel \xB7 resume \xB7 retry-step \xB7 approve \xB7 signal \xB7 replay \xB7 logs \xB7 delete \xB7 delete-run \xB7
-            env-overlay \xB7 archive-runs \xB7 workspace \xB7 jobs \xB7 job-logs \xB7
-            goals <list|get|create|edit|raise|pause|resume|close> \xB7 schedules <list|delete>
-  target    workflow name (list/view/versions/deploy/activate/deactivate/start/run/delete) or run id (the rest);
-            the sub-verb for goals / schedules
-  extra     signal name (signal <runId> <name>) \xB7 goal id (goals get/edit/raise/pause/resume/close) \xB7 job id (schedules delete)
+            watch \xB7 cancel \xB7 resume \xB7 retry-step \xB7 resolve-step \xB7 raise-budget \xB7 approve \xB7 approval-payload \xB7
+            signal \xB7 replay \xB7 logs \xB7 delete \xB7 delete-run \xB7 env-overlay \xB7 export \xB7 archive-runs \xB7
+            workspace \xB7 jobs \xB7 job-logs \xB7 goals <list|get|create|edit|raise|pause|resume|close> \xB7
+            schedules <list|create|patch|pause|resume|delete>
+  target    workflow name (list/view/versions/deploy/activate/deactivate/start/run/delete/env-overlay/export) or
+            run id (the rest); the sub-verb for goals / schedules
+  extra     signal name (signal <runId> <name>) \xB7 goal id (goals get/edit/raise/pause/resume/close) \xB7
+            workflow (schedules create) \xB7 job id (schedules patch/pause/resume/delete)
 
 Exit codes: 0 ok \xB7 1 API refusal (a 4xx other than 404) \xB7 2 usage \xB7 3 not found \xB7 4 run failed \xB7 5 run cancelled \xB7
             6 run gated (consent) \xB7 7 --timeout reached \xB7 8 run parked \u2014 waiting for a human
@@ -64545,10 +65059,16 @@ Examples:
   $ lua workflows cancel <runId> --reason "wrong input"
   $ lua workflows resume <runId> --step ask --data '{"answer":42}'
   $ lua workflows retry-step <runId> --step sendEmails --note "vendor back up"
+  $ lua workflows resolve-step <runId> --step sendEmails --outcome complete --output '{"sent":0}'
+  $ lua workflows raise-budget <runId> --credits 20
+  $ lua workflows approval-payload <runId> --approval wfa_1234
   $ lua workflows approve <runId> --approval reviewDrafts --decision approve
   $ lua workflows signal <runId> review --payload '{"ok":true}'
   $ lua workflows replay <runId> --local
   $ lua workflows deploy outreach -v latest
+  $ lua workflows export outreach --out ./exported
+  $ lua workflows schedules create outreach --cadence '0 9 * * 1' --timezone Europe/London --input '{"segment":"trial"}'
+  $ lua workflows schedules resume <jobId> --backfill-now
   $ lua workflows view outreach --json | jq '.data.schedules, .data.goals'
   $ lua workflows goals list -i outreach --status active
   $ lua workflows goals get wfg_1234