lua-cli 3.32.5 → 3.32.6

package/dist/api-exports.d.ts

@@ -582,6 +582,13 @@ declare interface ApiResponse<T = any> {
         stepId?: string;
         /** the live step status on 409 NOT_SUSPENDED (LUA-644) */
         status?: string;
+        /** LUA-810 — 503 UPSTREAM_UNAVAILABLE: the internal Lua service behind the API that answered a fault or did
+         *  not answer (`lua-agents`, `lua-core`, …), and the id on the server's matching error log line. */
+        upstream?: string;
+        requestId?: string;
+        /** LUA-812 — 503 VENDOR_UNAVAILABLE: the third-party vendor behind the API that failed (`unified` | `github` |
+         *  `pusher` | `google`); `retryAfterSeconds` above is present only when a blind retry is safe. */
+        vendor?: string;
     };
 }
 
@@ -599,6 +606,11 @@ export declare interface ApprovalOptions {
     /** default 'continue' (denial is data unless 'fail') */
     onDeny?: WorkflowApprovalOnDeny;
     businessHours?: WorkflowBusinessHours;
+    /**
+     * Optional — inferred `true` from a non-empty `editablePaths` (LUA-808 / LUA-825: the validator's `approvalEditable`
+     * rule, applied by the builder too); an explicit `false` beside paths is refused as contradictory. Absent with no
+     * paths ⇒ `false` (the approver decides, never edits).
+     */
     editable?: boolean;
     /** grammar: `drafts`, `drafts[*]`, `drafts[*].body`, `drafts[3].body`, `summary.title` */
     editablePaths?: string[];
@@ -2229,6 +2241,15 @@ declare abstract class HttpClient {
      * @private
      */
     private calculateBackoff;
+    /**
+     * The wait before the next attempt: the client's jittered exponential backoff, floored by the server's
+     * `retryAfterSeconds` on a 429 (the limiter's word is final) and on an idempotent read (GET / HEAD). LUA-810: a
+     * POST / PUT / PATCH / DELETE that met a 5xx keeps the client's own backoff — every 503 body carries
+     * `retryAfterSeconds: 5` (`CONTROL_UNAVAILABLE`, `UPSTREAM_UNAVAILABLE`), which floored all three waits at 5 s:
+     * a ≥15 s stall on a write that may already have landed, and retrying an ambiguous write harder does not make
+     * it less ambiguous. The client's own schedule is ≤1 s + ≤2 s + ≤4 s.
+     */
+    private retryDelayMs;
     /**
      * Wraps request with retry logic for transient failures
      * @param url - The full URL to request

package/dist/api-exports.js

@@ -431,6 +431,18 @@ function modelUnresolvedMessage(r) {
   }
   return r.candidates.length ? `model "${r.requested}" does not resolve to an approved model \u2014 accepted forms: ${r.candidates.join(", ")}` : `model "${r.requested}" does not resolve to an approved model \u2014 accepted forms are the registry's provider-prefixed ids (provider/model) or a bare id that names exactly one of them`;
 }
+function providerModelId(code) {
+  const requested = typeof code === "string" ? code.trim() : "";
+  if (!requested || isModelIdSentinel(requested)) return requested;
+  const slash = requested.indexOf("/");
+  if (slash <= 0) return requested;
+  const provider = requested.slice(0, slash).toLowerCase();
+  if (MODEL_ID_BYOK_PROVIDERS.includes(provider)) return requested;
+  return requested.slice(slash + 1);
+}
+function providerModelFamily(code) {
+  return providerModelId(code).toLowerCase().replace(MODEL_SNAPSHOT_SUFFIX, "");
+}
 function isImplicitModelSelectionSource(source) {
   return source !== void 0 && IMPLICIT_MODEL_SELECTION_SOURCES.includes(source);
 }
@@ -1109,7 +1121,7 @@ function effectiveAgentFeatureRows(base, override) {
     ]))
   };
 }
-var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, MODEL_ID_BYOK_PROVIDERS, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES;
+var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, MODEL_ID_BYOK_PROVIDERS, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1436,6 +1448,11 @@ var init_dist = __esm({
     __name2(normalizeModelId, "normalizeModelId");
     __name(modelUnresolvedMessage, "modelUnresolvedMessage");
     __name2(modelUnresolvedMessage, "modelUnresolvedMessage");
+    __name(providerModelId, "providerModelId");
+    __name2(providerModelId, "providerModelId");
+    MODEL_SNAPSHOT_SUFFIX = /(?:[-@](?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])|-(?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01]))$/;
+    __name(providerModelFamily, "providerModelFamily");
+    __name2(providerModelFamily, "providerModelFamily");
     REASONING_EFFORT_VALUES = [
       "off",
       "minimal",
@@ -3051,7 +3068,7 @@ function fillHitl(node) {
     if (a.onTimeout === void 0) a.onTimeout = "deny";
     if (a.onDeny === void 0) a.onDeny = "continue";
     if (a.excludeInitiator === void 0) a.excludeInitiator = false;
-    if (a.editable === void 0) a.editable = false;
+    if (a.editable === void 0) a.editable = approvalEditable(a);
     return;
   }
   const w = node;
@@ -3533,7 +3550,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     const a = node;
     checkId(a.id, path3);
-    if (a.approver === "creator" && a.excludeInitiator === true) {
+    if ((a.approver ?? "creator") === "creator" && a.excludeInitiator === true) {
       err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path3, a.id);
     }
     const editable = approvalEditable(a);
@@ -5556,6 +5573,53 @@ function rebaseItemPointer(pointer, itemsPath, index) {
   const base = `/${itemsPath.split(".").map(escapePointer).join("/")}/${index}`;
   return pointer === "/" || pointer === "" ? base : `${base}${pointer}`;
 }
+function validateWorkflowSchedule(schedule, path3 = "/schedule") {
+  if (schedule === void 0 || schedule === null) return [];
+  const issue = /* @__PURE__ */ __name3((at, detail) => [
+    {
+      code: WORKFLOW_SCHEDULE_SHAPE_ISSUE,
+      severity: "error",
+      path: at,
+      message: `${detail} \u2014 ${WORKFLOW_SCHEDULE_SHAPES_HINT}`
+    }
+  ], "issue");
+  if (!isObject(schedule)) {
+    return issue(path3, `\`schedule\` is ${Array.isArray(schedule) ? "an array" : `a ${typeof schedule}`}, not a typed schedule object`);
+  }
+  const type = schedule.type;
+  if (type === void 0) {
+    const keys = Object.keys(schedule);
+    const seen = keys.length ? ` (got { ${keys.join(", ")} })` : " (got {})";
+    return issue(path3, `\`schedule\` carries no \`type\` discriminator${seen}`);
+  }
+  if (typeof type !== "string" || !WORKFLOW_SCHEDULE_TYPES.includes(type)) {
+    return issue(path3, `\`schedule.type\` ${JSON.stringify(type)} is not one of ${WORKFLOW_SCHEDULE_TYPES.map((t) => `'${t}'`).join(" | ")}`);
+  }
+  switch (type) {
+    case "cron": {
+      if (typeof schedule.expression !== "string" || schedule.expression.trim().length === 0) {
+        return issue(`${path3}/expression`, "a { type: 'cron' } schedule needs a non-empty string `expression`");
+      }
+      if (schedule.timezone !== void 0 && (typeof schedule.timezone !== "string" || schedule.timezone.length === 0)) {
+        return issue(`${path3}/timezone`, "a { type: 'cron' } schedule's `timezone`, when given, is a non-empty IANA string");
+      }
+      return [];
+    }
+    case "interval": {
+      const s = schedule.seconds;
+      if (typeof s !== "number" || !Number.isFinite(s) || s <= 0) {
+        return issue(`${path3}/seconds`, "a { type: 'interval' } schedule needs a positive number `seconds`");
+      }
+      return [];
+    }
+    case "once": {
+      if (typeof schedule.executeAt !== "string" || Number.isNaN(Date.parse(schedule.executeAt))) {
+        return issue(`${path3}/executeAt`, "a { type: 'once' } schedule needs an ISO-8601 string `executeAt`");
+      }
+      return [];
+    }
+  }
+}
 function collectEnvTemplateKeys(value22) {
   const keys = /* @__PURE__ */ new Set();
   const walk22 = /* @__PURE__ */ __name3((v) => {
@@ -5845,7 +5909,7 @@ function needsInheritedWorkspace(graph) {
   }
   return false;
 }
-var __defProp3, __name3, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
+var __defProp3, __name3, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_SCHEDULE_TYPES, WORKFLOW_SCHEDULE_SHAPE_ISSUE, WORKFLOW_SCHEDULE_SHAPES_HINT, isObject, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
@@ -6555,6 +6619,16 @@ var init_dist2 = __esm({
     __name3(applyJsonPatch, "applyJsonPatch");
     __name(rebaseItemPointer, "rebaseItemPointer");
     __name3(rebaseItemPointer, "rebaseItemPointer");
+    WORKFLOW_SCHEDULE_TYPES = [
+      "cron",
+      "interval",
+      "once"
+    ];
+    WORKFLOW_SCHEDULE_SHAPE_ISSUE = "schedule-shape-invalid";
+    WORKFLOW_SCHEDULE_SHAPES_HINT = "`schedule` must be one of { type: 'cron', expression: '<5-field cron>', timezone?: '<IANA tz>' } | { type: 'interval', seconds: <n> } | { type: 'once', executeAt: '<ISO-8601>' }";
+    isObject = /* @__PURE__ */ __name3((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObject");
+    __name(validateWorkflowSchedule, "validateWorkflowSchedule");
+    __name3(validateWorkflowSchedule, "validateWorkflowSchedule");
     WORKFLOW_ENV_OVERLAY_MAX_KEYS = 64;
     WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES = 4096;
     WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE = /(SECRET|TOKEN|KEY|PASSWORD)$/;
@@ -7342,9 +7416,12 @@ var init_workflow = __esm({
         if (opts.approver === "creator" && opts.excludeInitiator === true) {
           throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
         }
-        if (opts.fourEyes !== void 0 && opts.editable !== true) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": fourEyes requires editable:true`);
-        if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && opts.editable !== true) {
-          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths / editedPayloadSchema require editable:true`);
+        const editable = approvalEditable(opts);
+        if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": \`fourEyes\` requires editable:true`);
+        if (opts.editable === false && Array.isArray(opts.editablePaths) && opts.editablePaths.length > 0) {
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
+        } else if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && !editable) {
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
         }
         for (const p of opts.editablePaths ?? []) {
           if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
@@ -7595,10 +7672,31 @@ var init_auth_error = __esm({
 });
 
 // src/errors/cli.error.ts
+function apiErrorDetail(error) {
+  return {
+    serverCode: error?.code,
+    issues: error?.issues,
+    upstream: error?.upstream,
+    requestId: error?.requestId,
+    vendor: error?.vendor,
+    retryAfterSeconds: error?.retryAfterSeconds
+  };
+}
 function isAccessDeniedError(error) {
   if (CliError.isCliError(error)) return error.statusCode === 403;
   return error instanceof Error && error.message.startsWith("Access denied (403)");
 }
+function upstreamUnavailableHint(upstream, requestId) {
+  const service = typeof upstream === "string" && upstream ? `its ${upstream} service` : "a service behind it";
+  const ref = typeof requestId === "string" && requestId ? ` If it persists, quote request ${requestId}.` : "";
+  return `The Lua API is up, but ${service} is temporarily unavailable (503 UPSTREAM_UNAVAILABLE) \u2014 retry in a moment.${ref}`;
+}
+function vendorUnavailableHint(vendor, requestId, retryAfterSeconds) {
+  const name = typeof vendor === "string" && vendor ? VENDOR_LABELS[vendor] ?? vendor : "a vendor it depends on";
+  const ref = typeof requestId === "string" && requestId ? ` If it persists, quote request ${requestId}.` : "";
+  const retry = typeof retryAfterSeconds === "number" ? "retry in a moment" : "the request may have applied at the vendor \u2014 check before retrying";
+  return `The Lua API is up, but ${name} is temporarily unavailable (503 VENDOR_UNAVAILABLE) \u2014 ${retry}.${ref}`;
+}
 function authHint(error) {
   if (error.suppressDefaultRemediation) return void 0;
   if (error.reason === "no_agent_access") {
@@ -7694,7 +7792,7 @@ function classifyCliError(error) {
     message
   };
 }
-var CLI_EXIT, CliError, NETWORK_ERRNO, NETWORK_MESSAGE, UNAVAILABLE_HINT;
+var CLI_EXIT, CliError, NETWORK_ERRNO, NETWORK_MESSAGE, UNAVAILABLE_HINT, VENDOR_LABELS;
 var init_cli_error = __esm({
   "src/errors/cli.error.ts"() {
     "use strict";
@@ -7708,6 +7806,7 @@ var init_cli_error = __esm({
       FORBIDDEN: 10,
       UNAVAILABLE: 11
     };
+    __name(apiErrorDetail, "apiErrorDetail");
     CliError = class _CliError extends Error {
       static {
         __name(this, "CliError");
@@ -7756,7 +7855,8 @@ var init_cli_error = __esm({
       /**
       * An API refusal the site already holds the status of (LUA-766) — classified by the same table the top-level
       * classifier applies to an untyped error: 401 auth · 403 forbidden · 404 not_found · other 4xx `http_<status>`
-      * (10) · 5xx / 0 unavailable (11, with the network hint unless the site gives its own) · no status `error` (1).
+      * (10) · 5xx / 0 unavailable (11, with the network hint unless the site gives its own — or the body's code
+      * picks one: a 503 UPSTREAM_UNAVAILABLE names the Lua service behind the API, LUA-810) · no status `error` (1).
       * A command that reads `response.error.statusCode` throws through here, so `lua logs` on a 503 exits 11 like
       * every other verb instead of printing the message itself and then throwing an exit-1 `Error`.
       */
@@ -7764,10 +7864,11 @@ var init_cli_error = __esm({
         const reported = classifyCliError(Object.assign(new Error(message), {
           statusCode
         }));
+        const codeHint = detail.serverCode === "UPSTREAM_UNAVAILABLE" ? upstreamUnavailableHint(detail.upstream, detail.requestId) : detail.serverCode === "VENDOR_UNAVAILABLE" ? vendorUnavailableHint(detail.vendor, detail.requestId, detail.retryAfterSeconds) : void 0;
         const classHint = reported.exitCode === CLI_EXIT.UNAVAILABLE ? UNAVAILABLE_HINT : reported.hint;
         return new _CliError(reported.code, message, {
           exitCode: reported.exitCode,
-          hint: hint ?? classHint,
+          hint: hint ?? codeHint ?? classHint,
           statusCode,
           serverCode: detail.serverCode,
           issues: detail.issues
@@ -7794,6 +7895,14 @@ var init_cli_error = __esm({
     ]);
     NETWORK_MESSAGE = /fetch failed|socket hang up|network request failed|request timeout|ECONNREFUSED|ENOTFOUND/i;
     UNAVAILABLE_HINT = "The Lua API could not be reached \u2014 check your network and https://status.heylua.ai, then retry.";
+    __name(upstreamUnavailableHint, "upstreamUnavailableHint");
+    VENDOR_LABELS = {
+      unified: "Unified.to",
+      github: "GitHub",
+      pusher: "Pusher",
+      google: "Google"
+    };
+    __name(vendorUnavailableHint, "vendorUnavailableHint");
     __name(authHint, "authHint");
     __name(numericStatus, "numericStatus");
     __name(classifyCliError, "classifyCliError");
@@ -8521,6 +8630,21 @@ var init_http_client = __esm({
         return Math.max(100, Math.random() * exponential);
       }
       /**
+      * The wait before the next attempt: the client's jittered exponential backoff, floored by the server's
+      * `retryAfterSeconds` on a 429 (the limiter's word is final) and on an idempotent read (GET / HEAD). LUA-810: a
+      * POST / PUT / PATCH / DELETE that met a 5xx keeps the client's own backoff — every 503 body carries
+      * `retryAfterSeconds: 5` (`CONTROL_UNAVAILABLE`, `UPSTREAM_UNAVAILABLE`), which floored all three waits at 5 s:
+      * a ≥15 s stall on a write that may already have landed, and retrying an ambiguous write harder does not make
+      * it less ambiguous. The client's own schedule is ≤1 s + ≤2 s + ≤4 s.
+      */
+      retryDelayMs(attempt, error, method) {
+        const own = this.calculateBackoff(attempt);
+        const advised = Number(error?.retryAfterSeconds ?? 0) * 1e3;
+        const verb = (method ?? "GET").toUpperCase();
+        const honourAdvice = error?.statusCode === 429 || verb === "GET" || verb === "HEAD";
+        return honourAdvice ? Math.max(own, advised) : own;
+      }
+      /**
       * Wraps request with retry logic for transient failures
       * @param url - The full URL to request
       * @param options - Fetch API request options
@@ -8554,8 +8678,7 @@ var init_http_client = __esm({
             throw error;
           }
           if (attempt < maxRetries) {
-            const serverDelay = Number(lastResult?.error?.retryAfterSeconds ?? 0) * 1e3;
-            const backoff = Math.max(this.calculateBackoff(attempt), serverDelay);
+            const backoff = this.retryDelayMs(attempt, lastResult?.error, options.method);
             await new Promise((resolve3) => setTimeout(resolve3, backoff));
           }
         }
@@ -12822,7 +12945,7 @@ var init_job_api_service = __esm({
         if (response.success && response.data) {
           return new JobInstance(this, response.data);
         }
-        throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Failed to get job");
+        throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Failed to get job", void 0, apiErrorDetail(response.error));
       }
       /**
       * Creates a new job for the agent.