lua-cli 3.32.5 → 3.32.6

package/dist/index.js

@@ -65,6 +65,16 @@ var init_auth_error = __esm({
 });
 
 // src/errors/cli.error.ts
+function apiErrorDetail(error) {
+  return {
+    serverCode: error?.code,
+    issues: error?.issues,
+    upstream: error?.upstream,
+    requestId: error?.requestId,
+    vendor: error?.vendor,
+    retryAfterSeconds: error?.retryAfterSeconds
+  };
+}
 function isTypedCliError(error) {
   return CliError.isCliError(error) || AuthenticationError.isAuthenticationError(error);
 }
@@ -93,6 +103,17 @@ function debugEnabled() {
   const v = process.env.LUA_DEBUG;
   return debugFlag || v === "1" || v === "true" || v === "yes";
 }
+function upstreamUnavailableHint(upstream, requestId) {
+  const service = typeof upstream === "string" && upstream ? `its ${upstream} service` : "a service behind it";
+  const ref = typeof requestId === "string" && requestId ? ` If it persists, quote request ${requestId}.` : "";
+  return `The Lua API is up, but ${service} is temporarily unavailable (503 UPSTREAM_UNAVAILABLE) \u2014 retry in a moment.${ref}`;
+}
+function vendorUnavailableHint(vendor, requestId, retryAfterSeconds) {
+  const name = typeof vendor === "string" && vendor ? VENDOR_LABELS[vendor] ?? vendor : "a vendor it depends on";
+  const ref = typeof requestId === "string" && requestId ? ` If it persists, quote request ${requestId}.` : "";
+  const retry = typeof retryAfterSeconds === "number" ? "retry in a moment" : "the request may have applied at the vendor \u2014 check before retrying";
+  return `The Lua API is up, but ${name} is temporarily unavailable (503 VENDOR_UNAVAILABLE) \u2014 ${retry}.${ref}`;
+}
 function authHint(error) {
   if (error.suppressDefaultRemediation) return void 0;
   if (error.reason === "no_agent_access") {
@@ -263,7 +284,7 @@ function reportUnhandledCliError(error) {
   process.exitCode = reported.exitCode;
   return reported.exitCode;
 }
-var CLI_EXIT, CliError, HandledCliError, debugFlag, NETWORK_ERRNO, NETWORK_MESSAGE, UNAVAILABLE_HINT, CLI_EXIT_CODE_HELP;
+var CLI_EXIT, CliError, HandledCliError, debugFlag, NETWORK_ERRNO, NETWORK_MESSAGE, UNAVAILABLE_HINT, VENDOR_LABELS, CLI_EXIT_CODE_HELP;
 var init_cli_error = __esm({
   "src/errors/cli.error.ts"() {
     "use strict";
@@ -277,6 +298,7 @@ var init_cli_error = __esm({
       FORBIDDEN: 10,
       UNAVAILABLE: 11
     };
+    __name(apiErrorDetail, "apiErrorDetail");
     CliError = class _CliError extends Error {
       static {
         __name(this, "CliError");
@@ -325,7 +347,8 @@ var init_cli_error = __esm({
       /**
       * An API refusal the site already holds the status of (LUA-766) — classified by the same table the top-level
       * classifier applies to an untyped error: 401 auth · 403 forbidden · 404 not_found · other 4xx `http_<status>`
-      * (10) · 5xx / 0 unavailable (11, with the network hint unless the site gives its own) · no status `error` (1).
+      * (10) · 5xx / 0 unavailable (11, with the network hint unless the site gives its own — or the body's code
+      * picks one: a 503 UPSTREAM_UNAVAILABLE names the Lua service behind the API, LUA-810) · no status `error` (1).
       * A command that reads `response.error.statusCode` throws through here, so `lua logs` on a 503 exits 11 like
       * every other verb instead of printing the message itself and then throwing an exit-1 `Error`.
       */
@@ -333,10 +356,11 @@ var init_cli_error = __esm({
         const reported = classifyCliError(Object.assign(new Error(message), {
           statusCode
         }));
+        const codeHint = detail.serverCode === "UPSTREAM_UNAVAILABLE" ? upstreamUnavailableHint(detail.upstream, detail.requestId) : detail.serverCode === "VENDOR_UNAVAILABLE" ? vendorUnavailableHint(detail.vendor, detail.requestId, detail.retryAfterSeconds) : void 0;
         const classHint = reported.exitCode === CLI_EXIT.UNAVAILABLE ? UNAVAILABLE_HINT : reported.hint;
         return new _CliError(reported.code, message, {
           exitCode: reported.exitCode,
-          hint: hint ?? classHint,
+          hint: hint ?? codeHint ?? classHint,
           statusCode,
           serverCode: detail.serverCode,
           issues: detail.issues
@@ -385,6 +409,14 @@ var init_cli_error = __esm({
     ]);
     NETWORK_MESSAGE = /fetch failed|socket hang up|network request failed|request timeout|ECONNREFUSED|ENOTFOUND/i;
     UNAVAILABLE_HINT = "The Lua API could not be reached \u2014 check your network and https://status.heylua.ai, then retry.";
+    __name(upstreamUnavailableHint, "upstreamUnavailableHint");
+    VENDOR_LABELS = {
+      unified: "Unified.to",
+      github: "GitHub",
+      pusher: "Pusher",
+      google: "Google"
+    };
+    __name(vendorUnavailableHint, "vendorUnavailableHint");
     __name(authHint, "authHint");
     __name(numericStatus, "numericStatus");
     __name(classifyCliError, "classifyCliError");
@@ -1113,6 +1145,18 @@ function modelUnresolvedMessage(r) {
   }
   return r.candidates.length ? `model "${r.requested}" does not resolve to an approved model \u2014 accepted forms: ${r.candidates.join(", ")}` : `model "${r.requested}" does not resolve to an approved model \u2014 accepted forms are the registry's provider-prefixed ids (provider/model) or a bare id that names exactly one of them`;
 }
+function providerModelId(code) {
+  const requested = typeof code === "string" ? code.trim() : "";
+  if (!requested || isModelIdSentinel(requested)) return requested;
+  const slash = requested.indexOf("/");
+  if (slash <= 0) return requested;
+  const provider = requested.slice(0, slash).toLowerCase();
+  if (MODEL_ID_BYOK_PROVIDERS.includes(provider)) return requested;
+  return requested.slice(slash + 1);
+}
+function providerModelFamily(code) {
+  return providerModelId(code).toLowerCase().replace(MODEL_SNAPSHOT_SUFFIX, "");
+}
 function isImplicitModelSelectionSource(source) {
   return source !== void 0 && IMPLICIT_MODEL_SELECTION_SOURCES.includes(source);
 }
@@ -1791,7 +1835,7 @@ function effectiveAgentFeatureRows(base, override) {
     ]))
   };
 }
-var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, MODEL_ID_BYOK_PROVIDERS, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES;
+var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, MODEL_ID_BYOK_PROVIDERS, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -2109,6 +2153,11 @@ var init_dist = __esm({
     __name2(normalizeModelId, "normalizeModelId");
     __name(modelUnresolvedMessage, "modelUnresolvedMessage");
     __name2(modelUnresolvedMessage, "modelUnresolvedMessage");
+    __name(providerModelId, "providerModelId");
+    __name2(providerModelId, "providerModelId");
+    MODEL_SNAPSHOT_SUFFIX = /(?:[-@](?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])|-(?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01]))$/;
+    __name(providerModelFamily, "providerModelFamily");
+    __name2(providerModelFamily, "providerModelFamily");
     REASONING_EFFORT_VALUES = [
       "off",
       "minimal",
@@ -4264,7 +4313,7 @@ function fillHitl(node) {
     if (a.onTimeout === void 0) a.onTimeout = "deny";
     if (a.onDeny === void 0) a.onDeny = "continue";
     if (a.excludeInitiator === void 0) a.excludeInitiator = false;
-    if (a.editable === void 0) a.editable = false;
+    if (a.editable === void 0) a.editable = approvalEditable(a);
     return;
   }
   const w = node;
@@ -4746,7 +4795,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     const a = node;
     checkId(a.id, path25);
-    if (a.approver === "creator" && a.excludeInitiator === true) {
+    if ((a.approver ?? "creator") === "creator" && a.excludeInitiator === true) {
       err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path25, a.id);
     }
     const editable = approvalEditable(a);
@@ -6769,6 +6818,53 @@ function rebaseItemPointer(pointer, itemsPath, index) {
   const base = `/${itemsPath.split(".").map(escapePointer).join("/")}/${index}`;
   return pointer === "/" || pointer === "" ? base : `${base}${pointer}`;
 }
+function validateWorkflowSchedule(schedule, path25 = "/schedule") {
+  if (schedule === void 0 || schedule === null) return [];
+  const issue = /* @__PURE__ */ __name3((at, detail) => [
+    {
+      code: WORKFLOW_SCHEDULE_SHAPE_ISSUE,
+      severity: "error",
+      path: at,
+      message: `${detail} \u2014 ${WORKFLOW_SCHEDULE_SHAPES_HINT}`
+    }
+  ], "issue");
+  if (!isObject(schedule)) {
+    return issue(path25, `\`schedule\` is ${Array.isArray(schedule) ? "an array" : `a ${typeof schedule}`}, not a typed schedule object`);
+  }
+  const type = schedule.type;
+  if (type === void 0) {
+    const keys = Object.keys(schedule);
+    const seen = keys.length ? ` (got { ${keys.join(", ")} })` : " (got {})";
+    return issue(path25, `\`schedule\` carries no \`type\` discriminator${seen}`);
+  }
+  if (typeof type !== "string" || !WORKFLOW_SCHEDULE_TYPES.includes(type)) {
+    return issue(path25, `\`schedule.type\` ${JSON.stringify(type)} is not one of ${WORKFLOW_SCHEDULE_TYPES.map((t) => `'${t}'`).join(" | ")}`);
+  }
+  switch (type) {
+    case "cron": {
+      if (typeof schedule.expression !== "string" || schedule.expression.trim().length === 0) {
+        return issue(`${path25}/expression`, "a { type: 'cron' } schedule needs a non-empty string `expression`");
+      }
+      if (schedule.timezone !== void 0 && (typeof schedule.timezone !== "string" || schedule.timezone.length === 0)) {
+        return issue(`${path25}/timezone`, "a { type: 'cron' } schedule's `timezone`, when given, is a non-empty IANA string");
+      }
+      return [];
+    }
+    case "interval": {
+      const s = schedule.seconds;
+      if (typeof s !== "number" || !Number.isFinite(s) || s <= 0) {
+        return issue(`${path25}/seconds`, "a { type: 'interval' } schedule needs a positive number `seconds`");
+      }
+      return [];
+    }
+    case "once": {
+      if (typeof schedule.executeAt !== "string" || Number.isNaN(Date.parse(schedule.executeAt))) {
+        return issue(`${path25}/executeAt`, "a { type: 'once' } schedule needs an ISO-8601 string `executeAt`");
+      }
+      return [];
+    }
+  }
+}
 function collectEnvTemplateKeys(value22) {
   const keys = /* @__PURE__ */ new Set();
   const walk22 = /* @__PURE__ */ __name3((v) => {
@@ -7058,7 +7154,7 @@ function needsInheritedWorkspace(graph) {
   }
   return false;
 }
-var __defProp3, __name3, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
+var __defProp3, __name3, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_SCHEDULE_TYPES, WORKFLOW_SCHEDULE_SHAPE_ISSUE, WORKFLOW_SCHEDULE_SHAPES_HINT, isObject, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
@@ -7768,6 +7864,16 @@ var init_dist2 = __esm({
     __name3(applyJsonPatch, "applyJsonPatch");
     __name(rebaseItemPointer, "rebaseItemPointer");
     __name3(rebaseItemPointer, "rebaseItemPointer");
+    WORKFLOW_SCHEDULE_TYPES = [
+      "cron",
+      "interval",
+      "once"
+    ];
+    WORKFLOW_SCHEDULE_SHAPE_ISSUE = "schedule-shape-invalid";
+    WORKFLOW_SCHEDULE_SHAPES_HINT = "`schedule` must be one of { type: 'cron', expression: '<5-field cron>', timezone?: '<IANA tz>' } | { type: 'interval', seconds: <n> } | { type: 'once', executeAt: '<ISO-8601>' }";
+    isObject = /* @__PURE__ */ __name3((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObject");
+    __name(validateWorkflowSchedule, "validateWorkflowSchedule");
+    __name3(validateWorkflowSchedule, "validateWorkflowSchedule");
     WORKFLOW_ENV_OVERLAY_MAX_KEYS = 64;
     WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES = 4096;
     WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE = /(SECRET|TOKEN|KEY|PASSWORD)$/;
@@ -8558,9 +8664,12 @@ var init_workflow = __esm({
         if (opts.approver === "creator" && opts.excludeInitiator === true) {
           throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
         }
-        if (opts.fourEyes !== void 0 && opts.editable !== true) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": fourEyes requires editable:true`);
-        if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && opts.editable !== true) {
-          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths / editedPayloadSchema require editable:true`);
+        const editable = approvalEditable(opts);
+        if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": \`fourEyes\` requires editable:true`);
+        if (opts.editable === false && Array.isArray(opts.editablePaths) && opts.editablePaths.length > 0) {
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
+        } else if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && !editable) {
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
         }
         for (const p of opts.editablePaths ?? []) {
           if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
@@ -8944,10 +9053,22 @@ function serverCodeOf(code, error) {
 }
 async function refusalFromResponse(response) {
   const { error } = await classifyErrorResponse(response);
-  return CliError.fromStatus(error?.statusCode ?? response.status, error?.message ?? `HTTP ${response.status}: ${response.statusText}`, void 0, {
-    serverCode: serverCodeOf(error?.code, error?.error),
-    issues: error?.issues
-  });
+  const serverCode = serverCodeOf(error?.code, error?.error);
+  return CliError.fromStatus(
+    error?.statusCode ?? response.status,
+    error?.message ?? `HTTP ${response.status}: ${response.statusText}`,
+    void 0,
+    // LUA-810: `fromStatus` picks the UPSTREAM_UNAVAILABLE hint from the body's `upstream` / `requestId`.
+    // LUA-812: and the VENDOR_UNAVAILABLE hint from `vendor` / `retryAfterSeconds` (whether a blind retry is safe).
+    {
+      serverCode,
+      issues: error?.issues,
+      upstream: error?.upstream,
+      requestId: error?.requestId,
+      vendor: error?.vendor,
+      retryAfterSeconds: error?.retryAfterSeconds
+    }
+  );
 }
 async function* parseSseStream(body, signal) {
   const reader = body.getReader();
@@ -9153,6 +9274,21 @@ var init_http_client = __esm({
         return Math.max(100, Math.random() * exponential);
       }
       /**
+      * The wait before the next attempt: the client's jittered exponential backoff, floored by the server's
+      * `retryAfterSeconds` on a 429 (the limiter's word is final) and on an idempotent read (GET / HEAD). LUA-810: a
+      * POST / PUT / PATCH / DELETE that met a 5xx keeps the client's own backoff — every 503 body carries
+      * `retryAfterSeconds: 5` (`CONTROL_UNAVAILABLE`, `UPSTREAM_UNAVAILABLE`), which floored all three waits at 5 s:
+      * a ≥15 s stall on a write that may already have landed, and retrying an ambiguous write harder does not make
+      * it less ambiguous. The client's own schedule is ≤1 s + ≤2 s + ≤4 s.
+      */
+      retryDelayMs(attempt, error, method) {
+        const own = this.calculateBackoff(attempt);
+        const advised = Number(error?.retryAfterSeconds ?? 0) * 1e3;
+        const verb = (method ?? "GET").toUpperCase();
+        const honourAdvice = error?.statusCode === 429 || verb === "GET" || verb === "HEAD";
+        return honourAdvice ? Math.max(own, advised) : own;
+      }
+      /**
       * Wraps request with retry logic for transient failures
       * @param url - The full URL to request
       * @param options - Fetch API request options
@@ -9186,8 +9322,7 @@ var init_http_client = __esm({
             throw error;
           }
           if (attempt < maxRetries) {
-            const serverDelay = Number(lastResult?.error?.retryAfterSeconds ?? 0) * 1e3;
-            const backoff = Math.max(this.calculateBackoff(attempt), serverDelay);
+            const backoff = this.retryDelayMs(attempt, lastResult?.error, options.method);
             await new Promise((resolve7) => setTimeout(resolve7, backoff));
           }
         }
@@ -26111,7 +26246,7 @@ var init_job_api_service = __esm({
         if (response.success && response.data) {
           return new JobInstance(this, response.data);
         }
-        throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Failed to get job");
+        throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Failed to get job", void 0, apiErrorDetail(response.error));
       }
       /**
       * Creates a new job for the agent.
@@ -27586,7 +27721,7 @@ async function fetchApprovedModelsOrThrow(apiKey, agentId, orgId) {
   const agentApi = new AgentApi(BASE_URLS.API, apiKey);
   const result = await agentApi.getApprovedModels(void 0, agentId, orgId);
   if (!result.success) {
-    throw CliError.fromStatus(result.error?.statusCode, `Could not fetch models from the server: ${result.error?.message || "Unknown error"}`);
+    throw CliError.fromStatus(result.error?.statusCode, `Could not fetch models from the server: ${result.error?.message || "Unknown error"}`, void 0, apiErrorDetail(result.error));
   }
   return result.data ?? [];
 }
@@ -45240,7 +45375,7 @@ function channelCreateError(error, alreadyConnected) {
     return CliError.fromStatus(400, "Channel already exists", `${alreadyConnected}
 Use 'lua channels' to list existing channels.`);
   }
-  return CliError.fromStatus(error?.statusCode, error?.message || "Unknown error", error?.error);
+  return CliError.fromStatus(error?.statusCode, error?.message || "Unknown error", error?.error, apiErrorDetail(error));
 }
 __name(channelCreateError, "channelCreateError");
 async function fetchChannelsCore(agentApi, agentId) {
@@ -46176,7 +46311,7 @@ async function nonInteractiveLogs(logsApi, agentId, apiKey, options) {
   }
   const response = await logsApi.getAgentLogs(agentId, options.limit || 20, options.page || 1, filters);
   if (!response.success) {
-    throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Unknown error");
+    throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Unknown error", void 0, apiErrorDetail(response.error));
   }
   const data = response.data;
   if (options.json) {
@@ -46388,7 +46523,7 @@ async function viewAgentLogsInteractive(logsApi, agentId, filters = {}) {
   while (keepViewing) {
     const response = await logsApi.getAgentLogs(agentId, limit, currentPage, filters);
     if (!response.success) {
-      throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Unknown error");
+      throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Unknown error", void 0, apiErrorDetail(response.error));
     }
     const data = response.data;
     displayLogsCore(data.logs, data.pagination, "All Agent Logs", true);
@@ -50912,6 +51047,7 @@ function emitJson(ctx, res) {
   if (ctx.json) console.log(JSON.stringify(res, null, 2));
 }
 __name(emitJson, "emitJson");
+var SCHEDULE_PROVISION_FAILED_HINT = "The schedule provider (EventBridge) refused this schedule \u2014 the reason above names what to change; re-run after fixing it. This is not a connectivity problem.";
 function refusalExitCode(status) {
   if (status === 0 || status !== void 0 && status >= 500) return WORKFLOW_EXIT.UNAVAILABLE;
   if (status === 404) return WORKFLOW_EXIT.NOT_FOUND;
@@ -50922,15 +51058,27 @@ function apiRefusal(res, verb, detail = {}) {
   const err = res.error;
   const status = err?.statusCode;
   const code = err?.code ?? err?.error;
-  const serverMessage = err?.message ?? "Unknown error";
+  const reason = code === "SCHEDULE_PROVISION_FAILED" ? err?.reason : void 0;
+  const serverMessage = `${err?.message ?? "Unknown error"}${typeof reason === "string" && reason ? `: ${reason}` : ""}`;
   const message = detail.message ? code ? `${detail.message} (${code})` : detail.message : code ? serverMessage === code ? `${verb} failed (${code})` : `${verb} failed (${code}): ${serverMessage}` : `${verb} failed: ${serverMessage}`;
   const issues = detail.issues ?? err?.issues;
   const exitCode = refusalExitCode(status);
   if (exitCode === WORKFLOW_EXIT.UNAVAILABLE) {
-    return CliError.fromStatus(status, message, status === 503 && code === "CONTROL_UNAVAILABLE" ? CONTROL_UNAVAILABLE_HINT : detail.hint, {
-      serverCode: code,
-      issues
-    });
+    return CliError.fromStatus(
+      status,
+      message,
+      status === 503 && code === "CONTROL_UNAVAILABLE" ? CONTROL_UNAVAILABLE_HINT : code === "SCHEDULE_PROVISION_FAILED" ? SCHEDULE_PROVISION_FAILED_HINT : detail.hint,
+      // LUA-810: `fromStatus` picks the UPSTREAM_UNAVAILABLE hint from `upstream` / `requestId` itself.
+      // LUA-812: and the VENDOR_UNAVAILABLE hint from `vendor` / `retryAfterSeconds`.
+      {
+        serverCode: code,
+        issues,
+        upstream: err?.upstream,
+        requestId: err?.requestId,
+        vendor: err?.vendor,
+        retryAfterSeconds: err?.retryAfterSeconds
+      }
+    );
   }
   return new CliError(exitCode === WORKFLOW_EXIT.NOT_FOUND ? "not_found" : "error", message, {
     exitCode,
@@ -57123,7 +57271,7 @@ async function listSkillNonInteractive(marketplaceApi, config, apiKey, options)
   writeProgress("\u{1F504} Verifying skill...");
   const agentSkillsResponse = await skillApi.getSkills();
   if (!agentSkillsResponse.success || !agentSkillsResponse.data) {
-    throw CliError.fromStatus(agentSkillsResponse.error?.statusCode, `Failed to fetch agent skills: ${agentSkillsResponse.error?.message ?? agentSkillsResponse.message ?? "Unknown error"}`);
+    throw CliError.fromStatus(agentSkillsResponse.error?.statusCode, `Failed to fetch agent skills: ${agentSkillsResponse.error?.message ?? agentSkillsResponse.message ?? "Unknown error"}`, void 0, apiErrorDetail(agentSkillsResponse.error));
   }
   const skill = agentSkillsResponse.data.skills?.find((s) => s.name === skillName);
   if (!skill) {