lua-cli 3.32.4 → 3.32.6

package/dist/workflow-builder.d.ts

@@ -72,6 +72,11 @@ export declare interface ApprovalOptions {
     /** default 'continue' (denial is data unless 'fail') */
     onDeny?: WorkflowApprovalOnDeny;
     businessHours?: WorkflowBusinessHours;
+    /**
+     * Optional — inferred `true` from a non-empty `editablePaths` (LUA-808 / LUA-825: the validator's `approvalEditable`
+     * rule, applied by the builder too); an explicit `false` beside paths is refused as contradictory. Absent with no
+     * paths ⇒ `false` (the approver decides, never edits).
+     */
     editable?: boolean;
     /** grammar: `drafts`, `drafts[*]`, `drafts[*].body`, `drafts[3].body`, `summary.title` */
     editablePaths?: string[];

package/dist/workflow-builder.js

@@ -735,6 +735,23 @@ function modelUnresolvedMessage(r) {
 }
 __name(modelUnresolvedMessage, "modelUnresolvedMessage");
 __name2(modelUnresolvedMessage, "modelUnresolvedMessage");
+function providerModelId(code) {
+  const requested = typeof code === "string" ? code.trim() : "";
+  if (!requested || isModelIdSentinel(requested)) return requested;
+  const slash = requested.indexOf("/");
+  if (slash <= 0) return requested;
+  const provider = requested.slice(0, slash).toLowerCase();
+  if (MODEL_ID_BYOK_PROVIDERS.includes(provider)) return requested;
+  return requested.slice(slash + 1);
+}
+__name(providerModelId, "providerModelId");
+__name2(providerModelId, "providerModelId");
+var MODEL_SNAPSHOT_SUFFIX = /(?:[-@](?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])|-(?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01]))$/;
+function providerModelFamily(code) {
+  return providerModelId(code).toLowerCase().replace(MODEL_SNAPSHOT_SUFFIX, "");
+}
+__name(providerModelFamily, "providerModelFamily");
+__name2(providerModelFamily, "providerModelFamily");
 var IMPLICIT_MODEL_SELECTION_SOURCES = [
   "workspace-default",
   "platform-default"
@@ -1248,6 +1265,7 @@ var DeviceBindingSchema = z2.object({
   }
 });
 var IdSchema = z2.string().min(1).max(256);
+var SESSION_AUTH_TIME_MAX_S = 4102444800;
 var PrincipalDescriptorSchema = z2.object({
   subjectType: SubjectTypeSchema,
   subjectId: IdSchema
@@ -1296,7 +1314,8 @@ var GeneralPrincipalContextSchema = z2.object({
   owner: PrincipalOwnerSchema.optional(),
   compatibility: z2.object({
     mode: z2.literal("legacy-owner-delegation")
-  }).strict().optional()
+  }).strict().optional(),
+  authTime: z2.number().int().nonnegative().max(SESSION_AUTH_TIME_MAX_S).optional()
 }).strict();
 var DeviceCredentialPrincipalContextSchema = z2.object({
   version: z2.literal(1),
@@ -1362,6 +1381,13 @@ function hasDeviceCredentialType(value3) {
 }
 __name(hasDeviceCredentialType, "hasDeviceCredentialType");
 __name2(hasDeviceCredentialType, "hasDeviceCredentialType");
+function sessionAuthTime(context) {
+  if (!context || context.credential.type !== "firstPartySession") return void 0;
+  const authTime = context.authTime;
+  return typeof authTime === "number" && Number.isInteger(authTime) && authTime >= 0 && authTime <= SESSION_AUTH_TIME_MAX_S ? authTime : void 0;
+}
+__name(sessionAuthTime, "sessionAuthTime");
+__name2(sessionAuthTime, "sessionAuthTime");
 function isTypedApiKeyPrincipal(context) {
   return context?.subject.subjectType === "apiKey" && context.credential.type === "apiKey" && !context.compatibility;
 }
@@ -1764,6 +1790,47 @@ function scheduledWorkflowRunId(jobId, scheduledTime) {
 }
 __name(scheduledWorkflowRunId, "scheduledWorkflowRunId");
 __name2(scheduledWorkflowRunId, "scheduledWorkflowRunId");
+var WORKFLOW_SCHEDULE_KEY_MAX = 128;
+function renderWorkflowScheduleKeyTemplate(template3, ctx) {
+  if (!template3) return void 0;
+  const read = /* @__PURE__ */ __name2((path) => path.split(".").reduce((o, k) => o && typeof o === "object" ? o[k] : void 0, ctx.input), "read");
+  let unresolved = false;
+  const out = template3.replace(/\$\{\s*([a-zA-Z0-9_.]+)\s*\}/g, (_m, expr) => {
+    let v = "";
+    if (expr === "scheduledTime") v = ctx.scheduledTime ?? "";
+    else if (expr.startsWith("input.")) v = read(expr.slice("input.".length));
+    const s = v === void 0 || v === null ? "" : String(v);
+    if (s === "") unresolved = true;
+    return s;
+  });
+  if (unresolved) return void 0;
+  const key = out.slice(0, WORKFLOW_SCHEDULE_KEY_MAX);
+  return key && /^[A-Za-z0-9:_\-.\/]+$/.test(key) ? key : void 0;
+}
+__name(renderWorkflowScheduleKeyTemplate, "renderWorkflowScheduleKeyTemplate");
+__name2(renderWorkflowScheduleKeyTemplate, "renderWorkflowScheduleKeyTemplate");
+var WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX = "sched:";
+function scheduledWorkflowIdempotencyKey(jobId, rendered) {
+  const head = `${WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX}${jobId}:`;
+  if (head.length + rendered.length <= WORKFLOW_SCHEDULE_KEY_MAX) return `${head}${rendered}`;
+  const digest = stableKeyDigest(rendered);
+  const room = WORKFLOW_SCHEDULE_KEY_MAX - head.length - digest.length - 1;
+  return `${head}${rendered.slice(0, Math.max(0, room))}~${digest}`;
+}
+__name(scheduledWorkflowIdempotencyKey, "scheduledWorkflowIdempotencyKey");
+__name2(scheduledWorkflowIdempotencyKey, "scheduledWorkflowIdempotencyKey");
+function stableKeyDigest(s) {
+  let a = 2166136261;
+  let b = 84696351;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    a = Math.imul(a ^ c, 16777619);
+    b = Math.imul(b ^ c, 16777619) ^ b >>> 13;
+  }
+  return (a >>> 0).toString(16).padStart(8, "0") + (b >>> 0).toString(16).padStart(8, "0");
+}
+__name(stableKeyDigest, "stableKeyDigest");
+__name2(stableKeyDigest, "stableKeyDigest");
 var WORKFLOW_OPERATION_ID_PREFIX = "wf:";
 function workflowOperationId(runId, stepId, billingEpoch) {
   return `${WORKFLOW_OPERATION_ID_PREFIX}${runId}:${stepId}:${billingEpoch}`;
@@ -2512,6 +2579,75 @@ function extractSingleJsonValue(text) {
 }
 __name(extractSingleJsonValue, "extractSingleJsonValue");
 __name2(extractSingleJsonValue, "extractSingleJsonValue");
+var DEFAULT_ON_AGENT_FEATURES = [
+  "workflows",
+  "workflowCompose",
+  "observationalMemory"
+];
+function agentFeatureCatalogDefault(featureName) {
+  return DEFAULT_ON_AGENT_FEATURES.includes(featureName);
+}
+__name(agentFeatureCatalogDefault, "agentFeatureCatalogDefault");
+__name2(agentFeatureCatalogDefault, "agentFeatureCatalogDefault");
+function hasExplicitFeatureActive(row) {
+  return typeof row?.active === "boolean";
+}
+__name(hasExplicitFeatureActive, "hasExplicitFeatureActive");
+__name2(hasExplicitFeatureActive, "hasExplicitFeatureActive");
+function effectiveFeatureActive(row, catalogDefault) {
+  return hasExplicitFeatureActive(row) ? row.active : catalogDefault;
+}
+__name(effectiveFeatureActive, "effectiveFeatureActive");
+__name2(effectiveFeatureActive, "effectiveFeatureActive");
+function resolveEffectiveFeature(row, catalogDefault) {
+  return hasExplicitFeatureActive(row) ? {
+    active: row.active,
+    source: "agent",
+    default: catalogDefault
+  } : {
+    active: catalogDefault,
+    source: "default",
+    default: catalogDefault
+  };
+}
+__name(resolveEffectiveFeature, "resolveEffectiveFeature");
+__name2(resolveEffectiveFeature, "resolveEffectiveFeature");
+function isFeatureRow(value3) {
+  return typeof value3 === "object" && value3 !== null;
+}
+__name(isFeatureRow, "isFeatureRow");
+__name2(isFeatureRow, "isFeatureRow");
+function effectiveAgentFeatureRows(base, override) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const [name, row] of Object.entries(base ?? {})) {
+    if (isFeatureRow(row)) merged.set(name, {
+      row,
+      origin: "baseAgent"
+    });
+  }
+  for (const [name, row] of Object.entries(override ?? {})) {
+    if (isFeatureRow(row)) merged.set(name, {
+      row,
+      origin: "subAgent"
+    });
+  }
+  return {
+    rows: Object.fromEntries([
+      ...merged
+    ].map(([name, e]) => [
+      name,
+      e.row
+    ])),
+    origins: Object.fromEntries([
+      ...merged
+    ].map(([name, e]) => [
+      name,
+      e.origin
+    ]))
+  };
+}
+__name(effectiveAgentFeatureRows, "effectiveAgentFeatureRows");
+__name2(effectiveAgentFeatureRows, "effectiveAgentFeatureRows");
 
 // ../workflow-graph/dist/index.mjs
 import { createHash } from "crypto";
@@ -3114,7 +3250,7 @@ function fillHitl(node) {
     if (a.onTimeout === void 0) a.onTimeout = "deny";
     if (a.onDeny === void 0) a.onDeny = "continue";
     if (a.excludeInitiator === void 0) a.excludeInitiator = false;
-    if (a.editable === void 0) a.editable = false;
+    if (a.editable === void 0) a.editable = approvalEditable(a);
     return;
   }
   const w = node;
@@ -3416,7 +3552,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const id = singleId(node);
     const unknown = unknownWorkflowRetryMembers(r);
     if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path}.retry`, id);
-    if (r.maxAttempts !== void 0 && !isWithinWorkflowRetryAttempts(r.maxAttempts)) {
+    if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
       const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
       err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path}.retry.maxAttempts`, id);
     }
@@ -3654,7 +3790,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     const a = node;
     checkId(a.id, path);
-    if (a.approver === "creator" && a.excludeInitiator === true) {
+    if ((a.approver ?? "creator") === "creator" && a.excludeInitiator === true) {
       err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path, a.id);
     }
     const editable = approvalEditable(a);
@@ -5218,6 +5354,7 @@ __name3(runErrorIssues, "runErrorIssues");
 function runNextAction(run) {
   if (isTerminalRunStatus(run.status)) return "none";
   if (run.status === "suspended" && run.gate?.kind === "budget") return "raise_budget";
+  if (run.status === "suspended" && run.gate?.kind === "billing") return "top_up";
   if (!run.cancel?.requestedAt) return "none";
   const forceAt = run.cancel.forceAfter ?? run.cancel.requestedAt + FORCE_CANCEL_STALE_MS;
   return Date.now() >= forceAt ? "force" : "cancel_again";
@@ -5254,6 +5391,16 @@ function runCountsFromStepStatuses(statuses) {
 }
 __name(runCountsFromStepStatuses, "runCountsFromStepStatuses");
 __name3(runCountsFromStepStatuses, "runCountsFromStepStatuses");
+function isBillingHeldStep(row) {
+  return row.status === "ready" && row.billingHold === true;
+}
+__name(isBillingHeldStep, "isBillingHeldStep");
+__name3(isBillingHeldStep, "isBillingHeldStep");
+function stepEffectiveStatus(row) {
+  return isBillingHeldStep(row) ? "suspended" : row.status;
+}
+__name(stepEffectiveStatus, "stepEffectiveStatus");
+__name3(stepEffectiveStatus, "stepEffectiveStatus");
 var n = /* @__PURE__ */ __name3((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
 function runCounts(counts) {
   const c = counts ?? {};
@@ -6091,6 +6238,63 @@ function rebaseItemPointer(pointer, itemsPath, index) {
 }
 __name(rebaseItemPointer, "rebaseItemPointer");
 __name3(rebaseItemPointer, "rebaseItemPointer");
+var WORKFLOW_SCHEDULE_TYPES = [
+  "cron",
+  "interval",
+  "once"
+];
+var WORKFLOW_SCHEDULE_SHAPE_ISSUE = "schedule-shape-invalid";
+var WORKFLOW_SCHEDULE_SHAPES_HINT = "`schedule` must be one of { type: 'cron', expression: '<5-field cron>', timezone?: '<IANA tz>' } | { type: 'interval', seconds: <n> } | { type: 'once', executeAt: '<ISO-8601>' }";
+var isObject = /* @__PURE__ */ __name3((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObject");
+function validateWorkflowSchedule(schedule, path = "/schedule") {
+  if (schedule === void 0 || schedule === null) return [];
+  const issue = /* @__PURE__ */ __name3((at, detail) => [
+    {
+      code: WORKFLOW_SCHEDULE_SHAPE_ISSUE,
+      severity: "error",
+      path: at,
+      message: `${detail} \u2014 ${WORKFLOW_SCHEDULE_SHAPES_HINT}`
+    }
+  ], "issue");
+  if (!isObject(schedule)) {
+    return issue(path, `\`schedule\` is ${Array.isArray(schedule) ? "an array" : `a ${typeof schedule}`}, not a typed schedule object`);
+  }
+  const type = schedule.type;
+  if (type === void 0) {
+    const keys = Object.keys(schedule);
+    const seen = keys.length ? ` (got { ${keys.join(", ")} })` : " (got {})";
+    return issue(path, `\`schedule\` carries no \`type\` discriminator${seen}`);
+  }
+  if (typeof type !== "string" || !WORKFLOW_SCHEDULE_TYPES.includes(type)) {
+    return issue(path, `\`schedule.type\` ${JSON.stringify(type)} is not one of ${WORKFLOW_SCHEDULE_TYPES.map((t) => `'${t}'`).join(" | ")}`);
+  }
+  switch (type) {
+    case "cron": {
+      if (typeof schedule.expression !== "string" || schedule.expression.trim().length === 0) {
+        return issue(`${path}/expression`, "a { type: 'cron' } schedule needs a non-empty string `expression`");
+      }
+      if (schedule.timezone !== void 0 && (typeof schedule.timezone !== "string" || schedule.timezone.length === 0)) {
+        return issue(`${path}/timezone`, "a { type: 'cron' } schedule's `timezone`, when given, is a non-empty IANA string");
+      }
+      return [];
+    }
+    case "interval": {
+      const s = schedule.seconds;
+      if (typeof s !== "number" || !Number.isFinite(s) || s <= 0) {
+        return issue(`${path}/seconds`, "a { type: 'interval' } schedule needs a positive number `seconds`");
+      }
+      return [];
+    }
+    case "once": {
+      if (typeof schedule.executeAt !== "string" || Number.isNaN(Date.parse(schedule.executeAt))) {
+        return issue(`${path}/executeAt`, "a { type: 'once' } schedule needs an ISO-8601 string `executeAt`");
+      }
+      return [];
+    }
+  }
+}
+__name(validateWorkflowSchedule, "validateWorkflowSchedule");
+__name3(validateWorkflowSchedule, "validateWorkflowSchedule");
 var WORKFLOW_ENV_OVERLAY_MAX_KEYS = 64;
 var WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES = 4096;
 var WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE = /(SECRET|TOKEN|KEY|PASSWORD)$/;
@@ -6532,7 +6736,7 @@ var assertPredicate = /* @__PURE__ */ __name((p, where) => {
 }, "assertPredicate");
 var assertRetry = /* @__PURE__ */ __name((r, id) => {
   if (!r) return;
-  if (r.maxAttempts !== void 0 && !isWithinWorkflowRetryAttempts(r.maxAttempts)) {
+  if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
     const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
     throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
   }
@@ -7127,9 +7331,12 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
     if (opts.approver === "creator" && opts.excludeInitiator === true) {
       throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
     }
-    if (opts.fourEyes !== void 0 && opts.editable !== true) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": fourEyes requires editable:true`);
-    if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && opts.editable !== true) {
-      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths / editedPayloadSchema require editable:true`);
+    const editable = approvalEditable(opts);
+    if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": \`fourEyes\` requires editable:true`);
+    if (opts.editable === false && Array.isArray(opts.editablePaths) && opts.editablePaths.length > 0) {
+      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
+    } else if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && !editable) {
+      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
     }
     for (const p of opts.editablePaths ?? []) {
       if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);