lua-cli 3.32.4 → 3.32.5

package/dist/api-exports.d.ts

@@ -7314,11 +7314,21 @@ declare interface WorkflowRun {
     parentRunId?: string;
     correlationKey?: string;
     tags?: string[];
+    /** R4 `gate` (02 §2.4). LUA-788: a `kind:'billing'` gate names the wallet's refusal (`code`), the held step and its expiry. */
     gate?: {
         kind: string;
         reason?: string;
-        since?: string;
+        since?: string | number;
+        code?: string;
+        stepId?: string;
+        expiresAt?: number;
     };
+    /**
+     * Server-decided (09 §9.6): `raise_budget` on a budget gate (LUA-665), `top_up` on a billing gate (LUA-788 — the
+     * wallet clears it; the engine re-checks and resumes on its own), `cancel_again` / `force` under a pending cancel,
+     * else `none`. Absent on an older server.
+     */
+    nextAction?: 'cancel_again' | 'force' | 'none' | 'raise_budget' | 'top_up';
     /**
      * The pending / audited cancel request (`runCancelView`): who asked and when; `wall` when it was the run wall's
      * own (LUA-686); LUA-704: `forcedBy` / `forcedAt` / `forceReason` on a forced terminal (`abandoned`, or

package/dist/api-exports.js

@@ -544,6 +544,11 @@ function isDeviceCredentialPrincipal(context) {
 function hasDeviceCredentialType(value3) {
   return DeviceCredentialClaimSchema.safeParse(value3).success;
 }
+function sessionAuthTime(context) {
+  if (!context || context.credential.type !== "firstPartySession") return void 0;
+  const authTime = context.authTime;
+  return typeof authTime === "number" && Number.isInteger(authTime) && authTime >= 0 && authTime <= SESSION_AUTH_TIME_MAX_S ? authTime : void 0;
+}
 function isTypedApiKeyPrincipal(context) {
   return context?.subject.subjectType === "apiKey" && context.credential.type === "apiKey" && !context.compatibility;
 }
@@ -716,6 +721,39 @@ function scheduledWorkflowRunId(jobId, scheduledTime) {
   const key = typeof scheduledTime === "number" ? String(scheduledTime) : scheduledTimeKey(scheduledTime);
   return `${WORKFLOW_SCHEDULED_RUN_ID_PREFIX}${jobId}_${key}`;
 }
+function renderWorkflowScheduleKeyTemplate(template3, ctx) {
+  if (!template3) return void 0;
+  const read = /* @__PURE__ */ __name2((path3) => path3.split(".").reduce((o, k) => o && typeof o === "object" ? o[k] : void 0, ctx.input), "read");
+  let unresolved = false;
+  const out = template3.replace(/\$\{\s*([a-zA-Z0-9_.]+)\s*\}/g, (_m, expr) => {
+    let v = "";
+    if (expr === "scheduledTime") v = ctx.scheduledTime ?? "";
+    else if (expr.startsWith("input.")) v = read(expr.slice("input.".length));
+    const s = v === void 0 || v === null ? "" : String(v);
+    if (s === "") unresolved = true;
+    return s;
+  });
+  if (unresolved) return void 0;
+  const key = out.slice(0, WORKFLOW_SCHEDULE_KEY_MAX);
+  return key && /^[A-Za-z0-9:_\-.\/]+$/.test(key) ? key : void 0;
+}
+function scheduledWorkflowIdempotencyKey(jobId, rendered) {
+  const head = `${WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX}${jobId}:`;
+  if (head.length + rendered.length <= WORKFLOW_SCHEDULE_KEY_MAX) return `${head}${rendered}`;
+  const digest = stableKeyDigest(rendered);
+  const room = WORKFLOW_SCHEDULE_KEY_MAX - head.length - digest.length - 1;
+  return `${head}${rendered.slice(0, Math.max(0, room))}~${digest}`;
+}
+function stableKeyDigest(s) {
+  let a = 2166136261;
+  let b = 84696351;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    a = Math.imul(a ^ c, 16777619);
+    b = Math.imul(b ^ c, 16777619) ^ b >>> 13;
+  }
+  return (a >>> 0).toString(16).padStart(8, "0") + (b >>> 0).toString(16).padStart(8, "0");
+}
 function workflowOperationId(runId, stepId, billingEpoch) {
   return `${WORKFLOW_OPERATION_ID_PREFIX}${runId}:${stepId}:${billingEpoch}`;
 }
@@ -1019,7 +1057,59 @@ function extractSingleJsonValue(text) {
     };
   }
 }
-var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, MODEL_ID_BYOK_PROVIDERS, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE;
+function agentFeatureCatalogDefault(featureName) {
+  return DEFAULT_ON_AGENT_FEATURES.includes(featureName);
+}
+function hasExplicitFeatureActive(row) {
+  return typeof row?.active === "boolean";
+}
+function effectiveFeatureActive(row, catalogDefault) {
+  return hasExplicitFeatureActive(row) ? row.active : catalogDefault;
+}
+function resolveEffectiveFeature(row, catalogDefault) {
+  return hasExplicitFeatureActive(row) ? {
+    active: row.active,
+    source: "agent",
+    default: catalogDefault
+  } : {
+    active: catalogDefault,
+    source: "default",
+    default: catalogDefault
+  };
+}
+function isFeatureRow(value3) {
+  return typeof value3 === "object" && value3 !== null;
+}
+function effectiveAgentFeatureRows(base, override) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const [name, row] of Object.entries(base ?? {})) {
+    if (isFeatureRow(row)) merged.set(name, {
+      row,
+      origin: "baseAgent"
+    });
+  }
+  for (const [name, row] of Object.entries(override ?? {})) {
+    if (isFeatureRow(row)) merged.set(name, {
+      row,
+      origin: "subAgent"
+    });
+  }
+  return {
+    rows: Object.fromEntries([
+      ...merged
+    ].map(([name, e]) => [
+      name,
+      e.row
+    ])),
+    origins: Object.fromEntries([
+      ...merged
+    ].map(([name, e]) => [
+      name,
+      e.origin
+    ]))
+  };
+}
+var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, MODEL_ID_BYOK_PROVIDERS, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1764,6 +1854,7 @@ This text is who you are for this person. As you learn them, their name, their w
       }
     });
     IdSchema = z2.string().min(1).max(256);
+    SESSION_AUTH_TIME_MAX_S = 4102444800;
     PrincipalDescriptorSchema = z2.object({
       subjectType: SubjectTypeSchema,
       subjectId: IdSchema
@@ -1812,7 +1903,8 @@ This text is who you are for this person. As you learn them, their name, their w
       owner: PrincipalOwnerSchema.optional(),
       compatibility: z2.object({
         mode: z2.literal("legacy-owner-delegation")
-      }).strict().optional()
+      }).strict().optional(),
+      authTime: z2.number().int().nonnegative().max(SESSION_AUTH_TIME_MAX_S).optional()
     }).strict();
     DeviceCredentialPrincipalContextSchema = z2.object({
       version: z2.literal(1),
@@ -1868,6 +1960,8 @@ This text is who you are for this person. As you learn them, their name, their w
     }).passthrough();
     __name(hasDeviceCredentialType, "hasDeviceCredentialType");
     __name2(hasDeviceCredentialType, "hasDeviceCredentialType");
+    __name(sessionAuthTime, "sessionAuthTime");
+    __name2(sessionAuthTime, "sessionAuthTime");
     __name(isTypedApiKeyPrincipal, "isTypedApiKeyPrincipal");
     __name2(isTypedApiKeyPrincipal, "isTypedApiKeyPrincipal");
     __name(typedApiKeyPrincipalId, "typedApiKeyPrincipalId");
@@ -2099,6 +2193,14 @@ This text is who you are for this person. As you learn them, their name, their w
     __name2(isScheduledWorkflowRunId, "isScheduledWorkflowRunId");
     __name(scheduledWorkflowRunId, "scheduledWorkflowRunId");
     __name2(scheduledWorkflowRunId, "scheduledWorkflowRunId");
+    WORKFLOW_SCHEDULE_KEY_MAX = 128;
+    __name(renderWorkflowScheduleKeyTemplate, "renderWorkflowScheduleKeyTemplate");
+    __name2(renderWorkflowScheduleKeyTemplate, "renderWorkflowScheduleKeyTemplate");
+    WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX = "sched:";
+    __name(scheduledWorkflowIdempotencyKey, "scheduledWorkflowIdempotencyKey");
+    __name2(scheduledWorkflowIdempotencyKey, "scheduledWorkflowIdempotencyKey");
+    __name(stableKeyDigest, "stableKeyDigest");
+    __name2(stableKeyDigest, "stableKeyDigest");
     WORKFLOW_OPERATION_ID_PREFIX = "wf:";
     __name(workflowOperationId, "workflowOperationId");
     __name2(workflowOperationId, "workflowOperationId");
@@ -2544,6 +2646,23 @@ listed here; never invent a target.`;
     JSON_FENCE_RE = /```(?:json)?[ \t]*\r?\n([\s\S]*?)\r?\n?```/g;
     __name(extractSingleJsonValue, "extractSingleJsonValue");
     __name2(extractSingleJsonValue, "extractSingleJsonValue");
+    DEFAULT_ON_AGENT_FEATURES = [
+      "workflows",
+      "workflowCompose",
+      "observationalMemory"
+    ];
+    __name(agentFeatureCatalogDefault, "agentFeatureCatalogDefault");
+    __name2(agentFeatureCatalogDefault, "agentFeatureCatalogDefault");
+    __name(hasExplicitFeatureActive, "hasExplicitFeatureActive");
+    __name2(hasExplicitFeatureActive, "hasExplicitFeatureActive");
+    __name(effectiveFeatureActive, "effectiveFeatureActive");
+    __name2(effectiveFeatureActive, "effectiveFeatureActive");
+    __name(resolveEffectiveFeature, "resolveEffectiveFeature");
+    __name2(resolveEffectiveFeature, "resolveEffectiveFeature");
+    __name(isFeatureRow, "isFeatureRow");
+    __name2(isFeatureRow, "isFeatureRow");
+    __name(effectiveAgentFeatureRows, "effectiveAgentFeatureRows");
+    __name2(effectiveAgentFeatureRows, "effectiveAgentFeatureRows");
   }
 });
 
@@ -3176,7 +3295,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const id = singleId(node);
     const unknown = unknownWorkflowRetryMembers(r);
     if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path3}.retry`, id);
-    if (r.maxAttempts !== void 0 && !isWithinWorkflowRetryAttempts(r.maxAttempts)) {
+    if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
       const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
       err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path3}.retry.maxAttempts`, id);
     }
@@ -4717,6 +4836,7 @@ function runErrorIssues(issues) {
 function runNextAction(run) {
   if (isTerminalRunStatus(run.status)) return "none";
   if (run.status === "suspended" && run.gate?.kind === "budget") return "raise_budget";
+  if (run.status === "suspended" && run.gate?.kind === "billing") return "top_up";
   if (!run.cancel?.requestedAt) return "none";
   const forceAt = run.cancel.forceAfter ?? run.cancel.requestedAt + FORCE_CANCEL_STALE_MS;
   return Date.now() >= forceAt ? "force" : "cancel_again";
@@ -4744,6 +4864,12 @@ function runCountsFromStepStatuses(statuses) {
   for (const s of statuses) tally[s] = (tally[s] ?? 0) + 1;
   return runCountsFromStatusTally(tally);
 }
+function isBillingHeldStep(row) {
+  return row.status === "ready" && row.billingHold === true;
+}
+function stepEffectiveStatus(row) {
+  return isBillingHeldStep(row) ? "suspended" : row.status;
+}
 function runCounts(counts) {
   const c = counts ?? {};
   const rawInFlight = c.dispatched !== void 0 || c.claimed !== void 0 || c.running !== void 0 || c.cancellation_requested !== void 0;
@@ -6274,6 +6400,10 @@ var init_dist2 = __esm({
     __name3(runCountsFromStatusTally, "runCountsFromStatusTally");
     __name(runCountsFromStepStatuses, "runCountsFromStepStatuses");
     __name3(runCountsFromStepStatuses, "runCountsFromStepStatuses");
+    __name(isBillingHeldStep, "isBillingHeldStep");
+    __name3(isBillingHeldStep, "isBillingHeldStep");
+    __name(stepEffectiveStatus, "stepEffectiveStatus");
+    __name3(stepEffectiveStatus, "stepEffectiveStatus");
     n = /* @__PURE__ */ __name3((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
     __name(runCounts, "runCounts");
     __name3(runCounts, "runCounts");
@@ -6691,7 +6821,7 @@ var init_workflow = __esm({
     }, "assertPredicate");
     assertRetry = /* @__PURE__ */ __name((r, id) => {
       if (!r) return;
-      if (r.maxAttempts !== void 0 && !isWithinWorkflowRetryAttempts(r.maxAttempts)) {
+      if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
         const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
         throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
       }
@@ -7492,7 +7622,10 @@ function classifyCliError(error) {
       code: error.code,
       exitCode: error.exitCode,
       message: error.message,
-      hint: error.hint
+      hint: error.hint,
+      statusCode: error.statusCode,
+      serverCode: error.serverCode,
+      issues: error.issues
     };
   }
   if (AuthenticationError.isAuthenticationError(error)) {
@@ -7514,30 +7647,36 @@ function classifyCliError(error) {
   }
   const status = numericStatus(e);
   if (status !== void 0) {
+    const statusCode = status;
     if (status === 401) return {
       code: "auth",
       exitCode: CLI_EXIT.AUTH,
-      message
+      message,
+      statusCode
     };
     if (status === 403) return {
       code: "forbidden",
       exitCode: CLI_EXIT.FORBIDDEN,
-      message
+      message,
+      statusCode
     };
     if (status === 404) return {
       code: "not_found",
       exitCode: CLI_EXIT.NOT_FOUND,
-      message
+      message,
+      statusCode
     };
     if (status >= 400 && status < 500) return {
       code: `http_${status}`,
       exitCode: CLI_EXIT.FORBIDDEN,
-      message
+      message,
+      statusCode
     };
     if (status >= 500 || status === 0) return {
       code: "unavailable",
       exitCode: CLI_EXIT.UNAVAILABLE,
-      message
+      message,
+      statusCode
     };
   }
   const causeCode = e.cause?.code;
@@ -7578,6 +7717,8 @@ var init_cli_error = __esm({
       exitCode;
       hint;
       statusCode;
+      serverCode;
+      issues;
       constructor(code, message, options = {}) {
         super(message);
         this.name = "CliError";
@@ -7585,6 +7726,8 @@ var init_cli_error = __esm({
         this.exitCode = options.exitCode ?? CLI_EXIT.ERROR;
         this.hint = options.hint;
         this.statusCode = options.statusCode;
+        this.serverCode = options.serverCode;
+        this.issues = options.issues?.length ? options.issues : void 0;
         if (Error.captureStackTrace) Error.captureStackTrace(this, _CliError);
       }
       /** Bad arguments, an unknown action, no project — exit 2. */
@@ -7617,7 +7760,7 @@ var init_cli_error = __esm({
       * A command that reads `response.error.statusCode` throws through here, so `lua logs` on a 503 exits 11 like
       * every other verb instead of printing the message itself and then throwing an exit-1 `Error`.
       */
-      static fromStatus(statusCode, message, hint) {
+      static fromStatus(statusCode, message, hint, detail = {}) {
         const reported = classifyCliError(Object.assign(new Error(message), {
           statusCode
         }));
@@ -7625,7 +7768,9 @@ var init_cli_error = __esm({
         return new _CliError(reported.code, message, {
           exitCode: reported.exitCode,
           hint: hint ?? classHint,
-          statusCode
+          statusCode,
+          serverCode: detail.serverCode,
+          issues: detail.issues
         });
       }
       static isCliError(error) {
@@ -8126,6 +8271,52 @@ var init_request_credential = __esm({
 
 // src/api/http.client.ts
 import { randomUUID as randomUUID2 } from "crypto";
+async function classifyErrorResponse(response) {
+  let errorData;
+  try {
+    errorData = await response.json();
+  } catch (jsonError) {
+    errorData = {};
+  }
+  if (response.status === 401) {
+    const serverMessage = typeof errorData.message === "string" ? errorData.message : void 0;
+    if (serverMessage && /not an admin/i.test(serverMessage)) {
+      throw new AuthenticationError(`Access denied for this agent: ${serverMessage}`, "no_agent_access", serverMessage);
+    }
+    const isExplicitCredential = !!serverMessage && /(invalid|expired|missing|no)\s+(api[\s_-]?key|token|credential)/i.test(serverMessage);
+    const isBareAuthRejection = !serverMessage || /^unauthorized$/i.test(serverMessage);
+    if (isExplicitCredential || isBareAuthRejection) {
+      throw new AuthenticationError("Authentication failed. Your Lua credential may be invalid or expired.", "invalid_credentials", serverMessage);
+    }
+    throw new AuthenticationError(`Authentication failed: ${serverMessage}`, "unknown", serverMessage);
+  }
+  if (response.status === 403) {
+    const detail = errorData.message || "You do not have permission to access this resource.";
+    const serverCode = serverCodeOf(errorData.code, errorData.error);
+    throw new CliError("forbidden", `Access denied (403): ${detail}${serverCode ? ` (${serverCode})` : ""}`, {
+      exitCode: CLI_EXIT.FORBIDDEN,
+      statusCode: 403,
+      serverCode,
+      issues: Array.isArray(errorData.issues) ? errorData.issues : void 0,
+      hint: "Check that your Lua login has access to this agent or organization."
+    });
+  }
+  return {
+    success: false,
+    error: {
+      message: errorData.message || `HTTP ${response.status}: ${response.statusText}`,
+      statusCode: response.status,
+      error: errorData.error,
+      retryAfterSeconds: parseRetryAfter(response.headers.get("retry-after")),
+      ...errorData
+    }
+  };
+}
+function serverCodeOf(code, error) {
+  if (typeof code === "string" && code.length > 0) return code;
+  if (typeof error === "string" && /^[A-Z0-9][A-Z0-9_]*$/.test(error)) return error;
+  return void 0;
+}
 async function* parseSseStream(body, signal) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
@@ -8306,42 +8497,7 @@ var init_http_client = __esm({
       * @private
       */
       async classifyErrorResponse(response) {
-        let errorData;
-        try {
-          errorData = await response.json();
-        } catch (jsonError) {
-          errorData = {};
-        }
-        if (response.status === 401) {
-          const serverMessage = typeof errorData.message === "string" ? errorData.message : void 0;
-          if (serverMessage && /not an admin/i.test(serverMessage)) {
-            throw new AuthenticationError(`Access denied for this agent: ${serverMessage}`, "no_agent_access", serverMessage);
-          }
-          const isExplicitCredential = !!serverMessage && /(invalid|expired|missing|no)\s+(api[\s_-]?key|token|credential)/i.test(serverMessage);
-          const isBareAuthRejection = !serverMessage || /^unauthorized$/i.test(serverMessage);
-          if (isExplicitCredential || isBareAuthRejection) {
-            throw new AuthenticationError("Authentication failed. Your Lua credential may be invalid or expired.", "invalid_credentials", serverMessage);
-          }
-          throw new AuthenticationError(`Authentication failed: ${serverMessage}`, "unknown", serverMessage);
-        }
-        if (response.status === 403) {
-          const detail = errorData.message || "You do not have permission to access this resource.";
-          throw new CliError("forbidden", `Access denied (403): ${detail}`, {
-            exitCode: CLI_EXIT.FORBIDDEN,
-            statusCode: 403,
-            hint: "Check that your Lua login has access to this agent or organization."
-          });
-        }
-        return {
-          success: false,
-          error: {
-            message: errorData.message || `HTTP ${response.status}: ${response.statusText}`,
-            statusCode: response.status,
-            error: errorData.error,
-            retryAfterSeconds: parseRetryAfter(response.headers.get("retry-after")),
-            ...errorData
-          }
-        };
+        return classifyErrorResponse(response);
       }
       /**
       * Checks if an HTTP status code is retryable
@@ -8549,6 +8705,8 @@ var init_http_client = __esm({
         };
       }
     };
+    __name(classifyErrorResponse, "classifyErrorResponse");
+    __name(serverCodeOf, "serverCodeOf");
     __name(parseSseStream, "parseSseStream");
     __name(parseRetryAfter, "parseRetryAfter");
     __name(isCoreDrainApiError, "isCoreDrainApiError");
@@ -12607,6 +12765,7 @@ var init_job_api_service = __esm({
   "src/api/job.api.service.ts"() {
     "use strict";
     init_http_client();
+    init_cli_error();
     init_job_instance();
     JobApi = class extends HttpClient {
       static {
@@ -12663,7 +12822,7 @@ var init_job_api_service = __esm({
         if (response.success && response.data) {
           return new JobInstance(this, response.data);
         }
-        throw new Error(response.error?.message || "Failed to get job");
+        throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Failed to get job");
       }
       /**
       * Creates a new job for the agent.