lua-cli 3.32.5 → 3.33.0

package/dist/workflow-builder.js

@@ -735,6 +735,23 @@ function modelUnresolvedMessage(r) {
 }
 __name(modelUnresolvedMessage, "modelUnresolvedMessage");
 __name2(modelUnresolvedMessage, "modelUnresolvedMessage");
+function providerModelId(code) {
+  const requested = typeof code === "string" ? code.trim() : "";
+  if (!requested || isModelIdSentinel(requested)) return requested;
+  const slash = requested.indexOf("/");
+  if (slash <= 0) return requested;
+  const provider = requested.slice(0, slash).toLowerCase();
+  if (MODEL_ID_BYOK_PROVIDERS.includes(provider)) return requested;
+  return requested.slice(slash + 1);
+}
+__name(providerModelId, "providerModelId");
+__name2(providerModelId, "providerModelId");
+var MODEL_SNAPSHOT_SUFFIX = /(?:[-@](?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])|-(?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01]))$/;
+function providerModelFamily(code) {
+  return providerModelId(code).toLowerCase().replace(MODEL_SNAPSHOT_SUFFIX, "");
+}
+__name(providerModelFamily, "providerModelFamily");
+__name2(providerModelFamily, "providerModelFamily");
 var IMPLICIT_MODEL_SELECTION_SOURCES = [
   "workspace-default",
   "platform-default"
@@ -1196,6 +1213,10 @@ function triggerUrlEnvKey(triggerKey) {
 }
 __name(triggerUrlEnvKey, "triggerUrlEnvKey");
 __name2(triggerUrlEnvKey, "triggerUrlEnvKey");
+var TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES = Object.freeze([
+  "single",
+  "multiple"
+]);
 var SUBJECT_TYPES = [
   "user",
   "apiKey",
@@ -1708,6 +1729,15 @@ var WORKFLOW_RUN_STATUSES = [
   ...WORKFLOW_RUN_IDLE,
   ...WORKFLOW_RUN_TERMINAL
 ];
+var WORKFLOW_RUN_GATE_KINDS = [
+  "start-consent",
+  "quota",
+  "billing",
+  "org_archived",
+  "disabled",
+  "exception",
+  "budget"
+];
 var WORKFLOW_STEP_STATUSES = [
   "pending",
   "ready",
@@ -1729,6 +1759,16 @@ var WORKFLOW_STEP_IN_FLIGHT = [
   "running",
   "cancellation_requested"
 ];
+var WORKFLOW_SIGNAL_EVENT_SITES = [
+  "webhook",
+  "trigger",
+  "device-trigger"
+];
+function isWorkflowSignalEventSite(value3) {
+  return typeof value3 === "string" && WORKFLOW_SIGNAL_EVENT_SITES.includes(value3);
+}
+__name(isWorkflowSignalEventSite, "isWorkflowSignalEventSite");
+__name2(isWorkflowSignalEventSite, "isWorkflowSignalEventSite");
 var ARCHIVE_WINDOW_MARGIN_DAYS = 7;
 function shouldSkipArchive(run, manifestSha256, sinkSha256) {
   if (!run.completedAt || !run.exportedAt || run.exportedAt < run.completedAt) return false;
@@ -1841,6 +1881,16 @@ function scheduledWorkflowRunIdForTime(jobId, scheduledTime) {
 }
 __name(scheduledWorkflowRunIdForTime, "scheduledWorkflowRunIdForTime");
 __name2(scheduledWorkflowRunIdForTime, "scheduledWorkflowRunIdForTime");
+var WORKFLOW_SUSPEND_KINDS = [
+  "input",
+  "approval",
+  "signal",
+  "gate"
+];
+var WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS = [
+  ...WORKFLOW_SUSPEND_KINDS,
+  ...WORKFLOW_RUN_GATE_KINDS
+];
 var WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES = 64 * 1024;
 var WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES = 256 * 1024;
 var WORKFLOW_RETRY_BACKOFFS = [
@@ -2032,6 +2082,30 @@ var WORKFLOW_BUDGET_MAX_DURATION_SECONDS = Object.freeze({
   min: 60,
   max: 2592e3
 });
+var WORKFLOW_GOAL_JUDGE_SELF = "$self";
+function workflowGoalJudgeKind(judge) {
+  return judge && typeof judge === "object" && judge.predicate !== void 0 ? "predicate" : "agent";
+}
+__name(workflowGoalJudgeKind, "workflowGoalJudgeKind");
+__name2(workflowGoalJudgeKind, "workflowGoalJudgeKind");
+function isWorkflowGoalJudgeComplete(judge) {
+  if (workflowGoalJudgeKind(judge) === "predicate") return true;
+  return typeof judge.agentId === "string" && judge.agentId.length > 0 && !!judge.schema && typeof judge.schema === "object" && !Array.isArray(judge.schema);
+}
+__name(isWorkflowGoalJudgeComplete, "isWorkflowGoalJudgeComplete");
+__name2(isWorkflowGoalJudgeComplete, "isWorkflowGoalJudgeComplete");
+function normalizeWorkflowGoalJudge(judge) {
+  if (workflowGoalJudgeKind(judge) === "agent") return judge;
+  return {
+    agentId: judge.agentId ?? WORKFLOW_GOAL_JUDGE_SELF,
+    predicate: judge.predicate,
+    ...judge.schema ? {
+      schema: judge.schema
+    } : {}
+  };
+}
+__name(normalizeWorkflowGoalJudge, "normalizeWorkflowGoalJudge");
+__name2(normalizeWorkflowGoalJudge, "normalizeWorkflowGoalJudge");
 var REDACTED_PLACEHOLDER = "[REDACTED]";
 var PROVIDER_MESSAGE_MAX_CHARS = 300;
 var ERROR_MESSAGE_MAX_CHARS = 2e3;
@@ -2595,21 +2669,31 @@ function resolveEffectiveFeature(row, catalogDefault) {
 }
 __name(resolveEffectiveFeature, "resolveEffectiveFeature");
 __name2(resolveEffectiveFeature, "resolveEffectiveFeature");
-function isFeatureRow(value3) {
-  return typeof value3 === "object" && value3 !== null;
+function asFeatureRow(value3) {
+  if (value3 === false) return {
+    active: false
+  };
+  return typeof value3 === "object" && value3 !== null && !Array.isArray(value3) ? value3 : void 0;
+}
+__name(asFeatureRow, "asFeatureRow");
+__name2(asFeatureRow, "asFeatureRow");
+function agentFeatureBagCarries(bag, name) {
+  return bag != null && Object.prototype.hasOwnProperty.call(bag, name) && asFeatureRow(bag[name]) !== void 0;
 }
-__name(isFeatureRow, "isFeatureRow");
-__name2(isFeatureRow, "isFeatureRow");
+__name(agentFeatureBagCarries, "agentFeatureBagCarries");
+__name2(agentFeatureBagCarries, "agentFeatureBagCarries");
 function effectiveAgentFeatureRows(base, override) {
   const merged = /* @__PURE__ */ new Map();
-  for (const [name, row] of Object.entries(base ?? {})) {
-    if (isFeatureRow(row)) merged.set(name, {
+  for (const [name, value3] of Object.entries(base ?? {})) {
+    const row = asFeatureRow(value3);
+    if (row) merged.set(name, {
       row,
       origin: "baseAgent"
     });
   }
-  for (const [name, row] of Object.entries(override ?? {})) {
-    if (isFeatureRow(row)) merged.set(name, {
+  for (const [name, value3] of Object.entries(override ?? {})) {
+    const row = asFeatureRow(value3);
+    if (row) merged.set(name, {
       row,
       origin: "subAgent"
     });
@@ -2631,20 +2715,83 @@ function effectiveAgentFeatureRows(base, override) {
 }
 __name(effectiveAgentFeatureRows, "effectiveAgentFeatureRows");
 __name2(effectiveAgentFeatureRows, "effectiveAgentFeatureRows");
+var SUBAGENT_PER_KEY_FLAG_ENV = "LUA_SUBAGENT_FEATURES_PER_KEY";
+var PER_KEY_FLAG_VALUES = /* @__PURE__ */ new Set([
+  "1",
+  "true",
+  "on",
+  "yes"
+]);
+function agentFeatureMergeRuleFromEnv(env) {
+  const raw = env[SUBAGENT_PER_KEY_FLAG_ENV];
+  return typeof raw === "string" && PER_KEY_FLAG_VALUES.has(raw.trim().toLowerCase()) ? "per-key" : "wholesale";
+}
+__name(agentFeatureMergeRuleFromEnv, "agentFeatureMergeRuleFromEnv");
+__name2(agentFeatureMergeRuleFromEnv, "agentFeatureMergeRuleFromEnv");
+function effectiveAgentFeatures(base, override, rule) {
+  if (rule === "wholesale") return override || base || void 0;
+  return effectiveAgentFeatureRows(base, override).rows;
+}
+__name(effectiveAgentFeatures, "effectiveAgentFeatures");
+__name2(effectiveAgentFeatures, "effectiveAgentFeatures");
 
 // ../workflow-graph/dist/index.mjs
 import { createHash } from "crypto";
 import { z as z4 } from "zod";
 import { z as z22 } from "zod";
-import { createHash as createHash2 } from "crypto";
+
+// ../shared-types/dist/workflow-job-tools.mjs
 var __defProp3 = Object.defineProperty;
-var __name3 = /* @__PURE__ */ __name((target, value22) => __defProp3(target, "name", { value: value22, configurable: true }), "__name");
+var __name3 = /* @__PURE__ */ __name((target, value3) => __defProp3(target, "name", { value: value3, configurable: true }), "__name");
+var WORKFLOW_JOB_TOOLS = [
+  "shell",
+  "read",
+  "write",
+  "edit",
+  "glob",
+  "grep",
+  "git",
+  "gh",
+  "fetch",
+  "ripwire"
+];
+var WORKFLOW_JOB_READ_ONLY_DROPPED = [
+  "write",
+  "edit",
+  "git",
+  "shell"
+];
+var WORKFLOW_JOB_DEFAULT_TOOLS = [
+  "shell",
+  "read",
+  "write",
+  "edit",
+  "glob",
+  "grep",
+  "git"
+];
+function effectiveJobTools(jobTools, readOnly) {
+  const base = jobTools?.length ? jobTools : WORKFLOW_JOB_DEFAULT_TOOLS;
+  const out = [];
+  for (const id of base) {
+    if (readOnly && WORKFLOW_JOB_READ_ONLY_DROPPED.includes(id)) continue;
+    if (!out.includes(id)) out.push(id);
+  }
+  return out;
+}
+__name(effectiveJobTools, "effectiveJobTools");
+__name3(effectiveJobTools, "effectiveJobTools");
+
+// ../workflow-graph/dist/index.mjs
+import { createHash as createHash2 } from "crypto";
+var __defProp4 = Object.defineProperty;
+var __name4 = /* @__PURE__ */ __name((target, value22) => __defProp4(target, "name", { value: value22, configurable: true }), "__name");
 var WorkflowTemplateError = class extends Error {
   static {
     __name(this, "WorkflowTemplateError");
   }
   static {
-    __name3(this, "WorkflowTemplateError");
+    __name4(this, "WorkflowTemplateError");
   }
   placeholder;
   constructor(message, placeholder) {
@@ -2656,7 +2803,7 @@ function isMapConfigObject(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 __name(isMapConfigObject, "isMapConfigObject");
-__name3(isMapConfigObject, "isMapConfigObject");
+__name4(isMapConfigObject, "isMapConfigObject");
 function parseMapConfig(raw, stepId) {
   if (isMapConfigObject(raw)) return raw;
   if (typeof raw !== "string") {
@@ -2669,14 +2816,14 @@ function parseMapConfig(raw, stepId) {
   }
 }
 __name(parseMapConfig, "parseMapConfig");
-__name3(parseMapConfig, "parseMapConfig");
+__name4(parseMapConfig, "parseMapConfig");
 function mapConfigWire(raw) {
   if (typeof raw === "string") return raw;
   if (isMapConfigObject(raw)) return canonicalJson(raw);
   return void 0;
 }
 __name(mapConfigWire, "mapConfigWire");
-__name3(mapConfigWire, "mapConfigWire");
+__name4(mapConfigWire, "mapConfigWire");
 var TEMPLATE_PLACEHOLDER = /\$\{([^}]*)\}/g;
 var TEMPLATE_NAMESPACES = [
   "initData",
@@ -2688,7 +2835,7 @@ function describeBadPlaceholder(template22, idx, rawExpr) {
   return `Template placeholder #${idx} (\${${rawExpr}}) in '${template22}'`;
 }
 __name(describeBadPlaceholder, "describeBadPlaceholder");
-__name3(describeBadPlaceholder, "describeBadPlaceholder");
+__name4(describeBadPlaceholder, "describeBadPlaceholder");
 function parseTemplatePlaceholder(rawExpr) {
   const dot = rawExpr.indexOf(".");
   return {
@@ -2697,7 +2844,7 @@ function parseTemplatePlaceholder(rawExpr) {
   };
 }
 __name(parseTemplatePlaceholder, "parseTemplatePlaceholder");
-__name3(parseTemplatePlaceholder, "parseTemplatePlaceholder");
+__name4(parseTemplatePlaceholder, "parseTemplatePlaceholder");
 function traverseMappingPath(root, path, errorLabel) {
   if (path === "" || path === ".") return root;
   const parts = path.split(".");
@@ -2709,7 +2856,7 @@ function traverseMappingPath(root, path, errorLabel) {
   return value22;
 }
 __name(traverseMappingPath, "traverseMappingPath");
-__name3(traverseMappingPath, "traverseMappingPath");
+__name4(traverseMappingPath, "traverseMappingPath");
 function stringifyTemplateValue(v, template22, idx, rawExpr) {
   if (v === null || v === void 0) return "";
   if (typeof v === "object") {
@@ -2722,17 +2869,17 @@ function stringifyTemplateValue(v, template22, idx, rawExpr) {
   return String(v);
 }
 __name(stringifyTemplateValue, "stringifyTemplateValue");
-__name3(stringifyTemplateValue, "stringifyTemplateValue");
+__name4(stringifyTemplateValue, "stringifyTemplateValue");
 function escapeFence(content) {
   return content.replace(/<\/lua-data/g, "<\\/lua-data");
 }
 __name(escapeFence, "escapeFence");
-__name3(escapeFence, "escapeFence");
+__name4(escapeFence, "escapeFence");
 function fenceBlock(name, source, content) {
   return `<lua-data name="${name}" source="${source}" untrusted="true">${escapeFence(content)}</lua-data>`;
 }
 __name(fenceBlock, "fenceBlock");
-__name3(fenceBlock, "fenceBlock");
+__name4(fenceBlock, "fenceBlock");
 function renderTemplate(template22, ctx, opts) {
   let idx = 0;
   return template22.replace(TEMPLATE_PLACEHOLDER, (_match, rawExpr) => {
@@ -2773,12 +2920,12 @@ function renderTemplate(template22, ctx, opts) {
   });
 }
 __name(renderTemplate, "renderTemplate");
-__name3(renderTemplate, "renderTemplate");
+__name4(renderTemplate, "renderTemplate");
 function isMapDescriptor(v) {
   if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
   const d = v;
   const keys = Object.keys(d);
-  const only = /* @__PURE__ */ __name3((...allowed) => keys.every((k) => allowed.includes(k)), "only");
+  const only = /* @__PURE__ */ __name4((...allowed) => keys.every((k) => allowed.includes(k)), "only");
   if ("value" in d) return keys.length === 1;
   if ("template" in d) return keys.length === 1 && typeof d.template === "string";
   if ("requestContextPath" in d) return keys.length === 1 && typeof d.requestContextPath === "string";
@@ -2791,7 +2938,7 @@ function isMapDescriptor(v) {
   return false;
 }
 __name(isMapDescriptor, "isMapDescriptor");
-__name3(isMapDescriptor, "isMapDescriptor");
+__name4(isMapDescriptor, "isMapDescriptor");
 var MAP_DESCRIPTOR_KEYS = [
   "step",
   "path",
@@ -2816,13 +2963,13 @@ function malformedMapMembers(cfg) {
   return out;
 }
 __name(malformedMapMembers, "malformedMapMembers");
-__name3(malformedMapMembers, "malformedMapMembers");
+__name4(malformedMapMembers, "malformedMapMembers");
 function mapMemberMalformedMessage(id, m) {
   const keys = m.keys.map((k) => `\`${k}\``).join(", ");
   return `"${id}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
 }
 __name(mapMemberMalformedMessage, "mapMemberMalformedMessage");
-__name3(mapMemberMalformedMessage, "mapMemberMalformedMessage");
+__name4(mapMemberMalformedMessage, "mapMemberMalformedMessage");
 function resolveDescriptor(key, m, ctx) {
   if (!isMapDescriptor(m)) return {
     value: m
@@ -2883,7 +3030,7 @@ function resolveDescriptor(key, m, ctx) {
   }
 }
 __name(resolveDescriptor, "resolveDescriptor");
-__name3(resolveDescriptor, "resolveDescriptor");
+__name4(resolveDescriptor, "resolveDescriptor");
 function resolveMapping(cfg, ctx) {
   const keys = Object.keys(cfg);
   if (keys.length === 1 && keys[0] === "") {
@@ -2900,33 +3047,33 @@ function resolveMapping(cfg, ctx) {
   };
 }
 __name(resolveMapping, "resolveMapping");
-__name3(resolveMapping, "resolveMapping");
-var fromInit = /* @__PURE__ */ __name3((path) => ({
+__name4(resolveMapping, "resolveMapping");
+var fromInit = /* @__PURE__ */ __name4((path) => ({
   initData: true,
   path
 }), "fromInit");
-var fromStep = /* @__PURE__ */ __name3((s, path = "") => {
-  const idOf = /* @__PURE__ */ __name3((x) => typeof x === "string" ? x : x.id, "idOf");
+var fromStep = /* @__PURE__ */ __name4((s, path = "") => {
+  const idOf = /* @__PURE__ */ __name4((x) => typeof x === "string" ? x : x.id, "idOf");
   return {
     step: Array.isArray(s) ? s.map(idOf) : idOf(s),
     path
   };
 }, "fromStep");
-var value = /* @__PURE__ */ __name3((v) => ({
+var value = /* @__PURE__ */ __name4((v) => ({
   value: v
 }), "value");
-var template = /* @__PURE__ */ __name3((s) => ({
+var template = /* @__PURE__ */ __name4((s) => ({
   template: s
 }), "template");
-var fromRequest = /* @__PURE__ */ __name3((path) => ({
+var fromRequest = /* @__PURE__ */ __name4((path) => ({
   requestContextPath: path
 }), "fromRequest");
-var rows = /* @__PURE__ */ __name3((s, path, page) => ({
+var rows = /* @__PURE__ */ __name4((s, path, page) => ({
   step: typeof s === "string" ? s : s.id,
   path,
   rows: page
 }), "rows");
-var fromKnowledge = /* @__PURE__ */ __name3((k) => ({
+var fromKnowledge = /* @__PURE__ */ __name4((k) => ({
   knowledge: k
 }), "fromKnowledge");
 var SideEffectsSchema = z4.enum(WORKFLOW_SIDE_EFFECTS);
@@ -3012,7 +3159,7 @@ function describeApproverSpecRefusal(spec) {
   };
 }
 __name(describeApproverSpecRefusal, "describeApproverSpecRefusal");
-__name3(describeApproverSpecRefusal, "describeApproverSpecRefusal");
+__name4(describeApproverSpecRefusal, "describeApproverSpecRefusal");
 var BINDING_ROOTS = [
   "initData",
   "stepResults",
@@ -3026,30 +3173,30 @@ function bindingRootsOk(template22) {
   return refs.length > 0 && refs.every((r) => BINDING_ROOTS.includes(r));
 }
 __name(bindingRootsOk, "bindingRootsOk");
-__name3(bindingRootsOk, "bindingRootsOk");
+__name4(bindingRootsOk, "bindingRootsOk");
 function isTemplateBinding(v) {
   return typeof v === "object" && v !== null && typeof v.template === "string";
 }
 __name(isTemplateBinding, "isTemplateBinding");
-__name3(isTemplateBinding, "isTemplateBinding");
+__name4(isTemplateBinding, "isTemplateBinding");
 function approvalEditable(node) {
   if (node.editable === true) return true;
   if (node.editable === false) return false;
   return Array.isArray(node.editablePaths) && node.editablePaths.length > 0;
 }
 __name(approvalEditable, "approvalEditable");
-__name3(approvalEditable, "approvalEditable");
+__name4(approvalEditable, "approvalEditable");
 function validateApproverBlock(node, opts = {
   path: "approval"
 }) {
   const issues = [];
-  const push = /* @__PURE__ */ __name3((code, path, message, severity = "error") => issues.push({
+  const push = /* @__PURE__ */ __name4((code, path, message, severity = "error") => issues.push({
     code,
     path,
     severity,
     message
   }), "push");
-  const checkSpec = /* @__PURE__ */ __name3((spec, path) => {
+  const checkSpec = /* @__PURE__ */ __name4((spec, path) => {
     const r = ApproverSpecSchema.safeParse(spec);
     if (!r.success) {
       const users = spec?.users;
@@ -3106,7 +3253,7 @@ function validateApproverBlock(node, opts = {
   return issues;
 }
 __name(validateApproverBlock, "validateApproverBlock");
-__name3(validateApproverBlock, "validateApproverBlock");
+__name4(validateApproverBlock, "validateApproverBlock");
 function liftRenderedApprover(row, rendered) {
   const text = (rendered ?? "").trim();
   if (!text) return null;
@@ -3135,7 +3282,7 @@ function liftRenderedApprover(row, rendered) {
   };
 }
 __name(liftRenderedApprover, "liftRenderedApprover");
-__name3(liftRenderedApprover, "liftRenderedApprover");
+__name4(liftRenderedApprover, "liftRenderedApprover");
 var WORKSPACE_TEMPLATE_EXPR_RE = /^\$\{\s*(?:initData|input)\.([^}]+?)\s*\}$/;
 function workspaceTemplatePath(template22) {
   const key = template22.trim();
@@ -3145,7 +3292,7 @@ function workspaceTemplatePath(template22) {
   return key.replace(/^(?:input|initData)\./, "").split(".");
 }
 __name(workspaceTemplatePath, "workspaceTemplatePath");
-__name3(workspaceTemplatePath, "workspaceTemplatePath");
+__name4(workspaceTemplatePath, "workspaceTemplatePath");
 function retryBackoffs() {
   if (!Array.isArray(WORKFLOW_RETRY_BACKOFFS)) {
     throw new Error("@lua/shared-types.WORKFLOW_RETRY_BACKOFFS is not a tuple \u2014 a jest.mock('@lua/shared-types') must spread jest.requireActual('@lua/shared-types')");
@@ -3153,7 +3300,7 @@ function retryBackoffs() {
   return WORKFLOW_RETRY_BACKOFFS;
 }
 __name(retryBackoffs, "retryBackoffs");
-__name3(retryBackoffs, "retryBackoffs");
+__name4(retryBackoffs, "retryBackoffs");
 var SLEEP_UNTIL_REPLACEMENT = Object.freeze({
   type: "sleep",
   duration: 6e4
@@ -3162,12 +3309,12 @@ function sleepUntilUnsupportedMessage(id) {
   return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
 }
 __name(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
-__name3(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
+__name4(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
 function armSubrunUnsupportedMessage(id, workflowId) {
   return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
 }
 __name(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
-__name3(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
+__name4(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
 var WORKFLOW_CAPS_DEFAULT = Object.freeze({
   maxParallelArms: 16,
   maxForeachConcurrency: 16,
@@ -3192,7 +3339,7 @@ var WORKFLOW_SIGNAL_DEFAULT_SOURCES = [
   "api",
   "user"
 ];
-var clone = /* @__PURE__ */ __name3((v) => JSON.parse(JSON.stringify(v)), "clone");
+var clone = /* @__PURE__ */ __name4((v) => JSON.parse(JSON.stringify(v)), "clone");
 function fillPolicy(node, defaultTimeout) {
   if (node.tier === void 0 && node.workspace !== void 0 && node.workspace !== "inherit") node.tier = "job";
   if (node.timeoutSeconds === void 0) node.timeoutSeconds = node.tier === "job" ? WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS : defaultTimeout;
@@ -3203,7 +3350,7 @@ function fillPolicy(node, defaultTimeout) {
   if ((node.type === "step" || node.type === "tool") && node.sideEffects === void 0) node.sideEffects = "none";
 }
 __name(fillPolicy, "fillPolicy");
-__name3(fillPolicy, "fillPolicy");
+__name4(fillPolicy, "fillPolicy");
 function fillSingle(node) {
   switch (node.type) {
     case "step": {
@@ -3224,7 +3371,7 @@ function fillSingle(node) {
   }
 }
 __name(fillSingle, "fillSingle");
-__name3(fillSingle, "fillSingle");
+__name4(fillSingle, "fillSingle");
 function fillHitl(node) {
   if (node.type === "approval") {
     const a = node;
@@ -3233,7 +3380,7 @@ function fillHitl(node) {
     if (a.onTimeout === void 0) a.onTimeout = "deny";
     if (a.onDeny === void 0) a.onDeny = "continue";
     if (a.excludeInitiator === void 0) a.excludeInitiator = false;
-    if (a.editable === void 0) a.editable = false;
+    if (a.editable === void 0) a.editable = approvalEditable(a);
     return;
   }
   const w = node;
@@ -3244,14 +3391,14 @@ function fillHitl(node) {
   ];
 }
 __name(fillHitl, "fillHitl");
-__name3(fillHitl, "fillHitl");
+__name4(fillHitl, "fillHitl");
 function fillArm(arm) {
   if (arm.type === "mapping") return;
   if (isHitlNode(arm)) fillHitl(arm);
   else fillSingle(arm);
 }
 __name(fillArm, "fillArm");
-__name3(fillArm, "fillArm");
+__name4(fillArm, "fillArm");
 function fillEntry(entry) {
   switch (entry.type) {
     case "step":
@@ -3295,36 +3442,25 @@ function fillEntry(entry) {
   }
 }
 __name(fillEntry, "fillEntry");
-__name3(fillEntry, "fillEntry");
+__name4(fillEntry, "fillEntry");
 function withDefaultsFilled(g) {
   const out = clone(g);
   out.definition.graph.forEach(fillEntry);
   return out;
 }
 __name(withDefaultsFilled, "withDefaultsFilled");
-__name3(withDefaultsFilled, "withDefaultsFilled");
+__name4(withDefaultsFilled, "withDefaultsFilled");
 var CONNECTION_ID_HEX_RE = /^[0-9a-f]{24}$/;
 function isConnectionKeyShaped(value22) {
   return WORKFLOW_CONNECTION_KEY_RE.test(value22) && !CONNECTION_ID_HEX_RE.test(value22);
 }
 __name(isConnectionKeyShaped, "isConnectionKeyShaped");
-__name3(isConnectionKeyShaped, "isConnectionKeyShaped");
+__name4(isConnectionKeyShaped, "isConnectionKeyShaped");
 function connectionKeyUndeclaredMessage(path, key) {
   return `${path} '${key}' is neither a connection id nor a declared connections[].key \u2014 declare it: connections: [{ key: '${key}', integrationType: '<catalog slug, e.g. github>' }] and it resolves on any agent`;
 }
 __name(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
-__name3(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
-var WORKFLOW_JOB_TOOLS = [
-  "shell",
-  "read",
-  "write",
-  "edit",
-  "glob",
-  "grep",
-  "git",
-  "gh",
-  "fetch"
-];
+__name4(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
 var WORKFLOW_JOB_MAX_WORKTREE_ARMS = 8;
 function classifyModelProvider(model) {
   const m = (model ?? "").trim().toLowerCase();
@@ -3335,14 +3471,14 @@ function classifyModelProvider(model) {
   return null;
 }
 __name(classifyModelProvider, "classifyModelProvider");
-__name3(classifyModelProvider, "classifyModelProvider");
-var workspaceOf = /* @__PURE__ */ __name3((node) => node.workspace, "workspaceOf");
-var mountsWorkspace = /* @__PURE__ */ __name3((node) => {
+__name4(classifyModelProvider, "classifyModelProvider");
+var workspaceOf = /* @__PURE__ */ __name4((node) => node.workspace, "workspaceOf");
+var mountsWorkspace = /* @__PURE__ */ __name4((node) => {
   const w = workspaceOf(node);
   return w !== void 0 && w !== "inherit";
 }, "mountsWorkspace");
-var isJobTier = /* @__PURE__ */ __name3((node) => node.tier === "job" || mountsWorkspace(node), "isJobTier");
-var jobToolsOf = /* @__PURE__ */ __name3((node) => {
+var isJobTier = /* @__PURE__ */ __name4((node) => node.tier === "job" || mountsWorkspace(node), "isJobTier");
+var jobToolsOf = /* @__PURE__ */ __name4((node) => {
   if (node.type === "agent") return node.toolScope?.jobTools;
   return node.jobTools;
 }, "jobToolsOf");
@@ -3358,17 +3494,17 @@ function schemaAtPath(schema, path) {
   return cur;
 }
 __name(schemaAtPath, "schemaAtPath");
-__name3(schemaAtPath, "schemaAtPath");
-var schemaIsArray = /* @__PURE__ */ __name3((schema) => {
+__name4(schemaAtPath, "schemaAtPath");
+var schemaIsArray = /* @__PURE__ */ __name4((schema) => {
   if (!schema) return void 0;
   const t = schema.type;
   if (t === void 0) return void 0;
   return Array.isArray(t) ? t.includes("array") : t === "array";
 }, "schemaIsArray");
-var isHitlNode = /* @__PURE__ */ __name3((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
-var isSingleStep = /* @__PURE__ */ __name3((n2) => !isHitlNode(n2), "isSingleStep");
-var singleId = /* @__PURE__ */ __name3((s) => s.type === "step" ? s.step.id : s.id, "singleId");
-var armId = /* @__PURE__ */ __name3((a) => a.type === "mapping" ? a.id : singleId(a), "armId");
+var isHitlNode = /* @__PURE__ */ __name4((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
+var isSingleStep = /* @__PURE__ */ __name4((n2) => !isHitlNode(n2), "isSingleStep");
+var singleId = /* @__PURE__ */ __name4((s) => s.type === "step" ? s.step.id : s.id, "singleId");
+var armId = /* @__PURE__ */ __name4((a) => a.type === "mapping" ? a.id : singleId(a), "armId");
 var TEMPLATE_STEP_REF = /\$\{\s*stepResults\.([A-Za-z0-9_\-]+)/g;
 function templateStepRefs(text) {
   const ids = [];
@@ -3376,7 +3512,7 @@ function templateStepRefs(text) {
   return ids;
 }
 __name(templateStepRefs, "templateStepRefs");
-__name3(templateStepRefs, "templateStepRefs");
+__name4(templateStepRefs, "templateStepRefs");
 function readMapConfig(raw) {
   if (!raw) return void 0;
   if (typeof raw !== "string") return raw;
@@ -3388,7 +3524,7 @@ function readMapConfig(raw) {
   }
 }
 __name(readMapConfig, "readMapConfig");
-__name3(readMapConfig, "readMapConfig");
+__name4(readMapConfig, "readMapConfig");
 function mapConfigStepRefs(raw) {
   const cfg = readMapConfig(raw);
   if (!cfg) return [];
@@ -3403,7 +3539,7 @@ function mapConfigStepRefs(raw) {
   return ids;
 }
 __name(mapConfigStepRefs, "mapConfigStepRefs");
-__name3(mapConfigStepRefs, "mapConfigStepRefs");
+__name4(mapConfigStepRefs, "mapConfigStepRefs");
 function nodeStepRefs(entry) {
   switch (entry.type) {
     case "agent": {
@@ -3432,12 +3568,12 @@ function nodeStepRefs(entry) {
   }
 }
 __name(nodeStepRefs, "nodeStepRefs");
-__name3(nodeStepRefs, "nodeStepRefs");
+__name4(nodeStepRefs, "nodeStepRefs");
 function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   static: true
 }) {
   const issues = [];
-  const err = /* @__PURE__ */ __name3((code, message, path, stepId) => {
+  const err = /* @__PURE__ */ __name4((code, message, path, stepId) => {
     issues.push({
       code,
       message,
@@ -3446,7 +3582,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       stepId
     });
   }, "err");
-  const warn = /* @__PURE__ */ __name3((code, message, path, stepId) => {
+  const warn = /* @__PURE__ */ __name4((code, message, path, stepId) => {
     issues.push({
       code,
       message,
@@ -3503,7 +3639,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     declaredKeys.add(key);
   });
-  const undeclaredKey = /* @__PURE__ */ __name3((ref) => typeof ref === "string" && !declaredKeys.has(ref) && isConnectionKeyShaped(ref) && opts.connectionIds?.has(ref) !== true, "undeclaredKey");
+  const undeclaredKey = /* @__PURE__ */ __name4((ref) => typeof ref === "string" && !declaredKeys.has(ref) && isConnectionKeyShaped(ref) && opts.connectionIds?.has(ref) !== true, "undeclaredKey");
   const credentialsRef = envelopeWorkspace?.credentialsRef;
   if (undeclaredKey(credentialsRef)) {
     err("connection-key-undeclared", connectionKeyUndeclaredMessage("workspace.credentialsRef", credentialsRef), "workspace.credentialsRef");
@@ -3511,7 +3647,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
-  const checkId = /* @__PURE__ */ __name3((id, path) => {
+  const checkId = /* @__PURE__ */ __name4((id, path) => {
     nodeCount += 1;
     if (seen.has(id)) {
       err("duplicate-step-id", `step id "${id}" is declared twice (first at ${seen.get(id)})`, path, id);
@@ -3519,9 +3655,9 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       seen.set(id, path);
     }
   }, "checkId");
-  const checkPolicyEnums = /* @__PURE__ */ __name3((node, path) => {
+  const checkPolicyEnums = /* @__PURE__ */ __name4((node, path) => {
     const id = singleId(node);
-    const check = /* @__PURE__ */ __name3((member, allowed) => {
+    const check = /* @__PURE__ */ __name4((member, allowed) => {
       const value22 = node[member];
       if (value22 === void 0 || typeof value22 === "string" && allowed.includes(value22)) return;
       err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path}.${member}`, id);
@@ -3529,7 +3665,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     check("sideEffects", WORKFLOW_SIDE_EFFECTS);
     check("jobResources", WORKFLOW_JOB_RESOURCES);
   }, "checkPolicyEnums");
-  const checkRetry = /* @__PURE__ */ __name3((node, path) => {
+  const checkRetry = /* @__PURE__ */ __name4((node, path) => {
     const r = node.retry;
     if (!r) return;
     const id = singleId(node);
@@ -3555,7 +3691,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       }
     }
   }, "checkRetry");
-  const checkTimeout = /* @__PURE__ */ __name3((node, path) => {
+  const checkTimeout = /* @__PURE__ */ __name4((node, path) => {
     const t = node.timeoutSeconds;
     if (t === void 0) return;
     const id = singleId(node);
@@ -3574,7 +3710,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path}.timeoutSeconds`, id);
     }
   }, "checkTimeout");
-  const checkSpecialistRole = /* @__PURE__ */ __name3((node, path) => {
+  const checkSpecialistRole = /* @__PURE__ */ __name4((node, path) => {
     const role = node.role;
     const hasRef = typeof role.ref === "string";
     const hasInline = role.name !== void 0 || role.instructions !== void 0 || Array.isArray(role.tools) && role.tools.length > 0;
@@ -3606,7 +3742,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       }
     }
   }, "checkSpecialistRole");
-  const checkRequiredConnections = /* @__PURE__ */ __name3((node, path) => {
+  const checkRequiredConnections = /* @__PURE__ */ __name4((node, path) => {
     const required = node.requiredConnections;
     if (!Array.isArray(required)) return;
     const undeclared = required.filter(undeclaredKey);
@@ -3619,7 +3755,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are neither declared connections[].key values nor connections the owner can mount`, `${path}.requiredConnections`, singleId(node));
     }
   }, "checkRequiredConnections");
-  const checkTier = /* @__PURE__ */ __name3((node, path) => {
+  const checkTier = /* @__PURE__ */ __name4((node, path) => {
     const id = singleId(node);
     if (node.workspace && node.workspace !== "inherit" && node.tier !== void 0 && node.tier !== "job") {
       err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path}.workspace`, id);
@@ -3635,7 +3771,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path}.model`, id);
     }
   }, "checkTier");
-  const checkModel = /* @__PURE__ */ __name3((node, path) => {
+  const checkModel = /* @__PURE__ */ __name4((node, path) => {
     if (node.type !== "agent" || typeof node.model !== "string") return;
     const registry = opts.approvedModels;
     if (registry === void 0) return;
@@ -3650,7 +3786,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const resolved = normalizeModelId(node.model, registry);
     if (!resolved.ok) err("model-unresolved", modelUnresolvedMessage(resolved), `${path}.model`, id);
   }, "checkModel");
-  const checkWorkspace = /* @__PURE__ */ __name3((node, path) => {
+  const checkWorkspace = /* @__PURE__ */ __name4((node, path) => {
     const id = singleId(node);
     const ws = workspaceOf(node);
     if (isJobTier(node) && opts.policy && opts.policy.jobTier !== true) {
@@ -3673,6 +3809,9 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         warn("gh-on-coding-turn", `"${id}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path}.jobTools`, id);
       }
     }
+    if (node.type === "agent" && ws && ws !== "inherit" && ws.mount === "ro" && Array.isArray(tools) && effectiveJobTools(tools, true).length === 0) {
+      warn("ro-step-has-no-tools", `"${id}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path}.jobTools`, id);
+    }
     if (ws && ws !== "inherit") {
       if (!envelopeWorkspace && !opts.mayInherit) {
         err("workspace-not-declared", `"${id}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path}.workspace`, id);
@@ -3692,16 +3831,16 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
   }, "checkWorkspace");
   const outputSchemas = /* @__PURE__ */ new Map();
-  const recordOutputSchema = /* @__PURE__ */ __name3((node) => {
+  const recordOutputSchema = /* @__PURE__ */ __name4((node) => {
     const schema = node.type === "step" ? node.step.outputSchema : node.type === "agent" ? node.outputSchema : void 0;
     if (schema !== void 0) outputSchemas.set(singleId(node), schema);
   }, "recordOutputSchema");
-  const checkMapMembers = /* @__PURE__ */ __name3((cfg, basePath, id) => {
+  const checkMapMembers = /* @__PURE__ */ __name4((cfg, basePath, id) => {
     for (const m of malformedMapMembers(cfg)) {
       warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id, m), `${basePath}.${m.member}`, id);
     }
   }, "checkMapMembers");
-  const checkInputShape = /* @__PURE__ */ __name3((node, path) => {
+  const checkInputShape = /* @__PURE__ */ __name4((node, path) => {
     const input = node.input;
     if (input === void 0) return;
     const id = singleId(node);
@@ -3711,11 +3850,11 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path}.input`, id);
   }, "checkInputShape");
-  const checkBodyInput = /* @__PURE__ */ __name3((body, path, container) => {
+  const checkBodyInput = /* @__PURE__ */ __name4((body, path, container) => {
     if (body.type === "workflow" || body.input === void 0) return;
     err("arm-input-unsupported", container === "foreach" ? `a foreach body receives each item as its input \u2014 drop \`input\` on "${singleId(body)}" and map the items before the foreach instead` : `a loop body receives the previous output as its input \u2014 drop \`input\` on "${singleId(body)}" and put the map before the loop instead`, `${path}.input`, singleId(body));
   }, "checkBodyInput");
-  const checkSingle = /* @__PURE__ */ __name3((node, path, depth) => {
+  const checkSingle = /* @__PURE__ */ __name4((node, path, depth) => {
     recordOutputSchema(node);
     if (node.type === "workflow" && (typeof node.workflowId !== "string" || node.workflowId.length === 0)) {
       checkId(node.id, path);
@@ -3764,7 +3903,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       }
     }
   }, "checkSingle");
-  const checkHitl = /* @__PURE__ */ __name3((node, path) => {
+  const checkHitl = /* @__PURE__ */ __name4((node, path) => {
     if (node.type === "waitForSignal") {
       const w = node;
       checkId(w.id, path);
@@ -3773,7 +3912,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     const a = node;
     checkId(a.id, path);
-    if (a.approver === "creator" && a.excludeInitiator === true) {
+    if ((a.approver ?? "creator") === "creator" && a.excludeInitiator === true) {
       err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path, a.id);
     }
     const editable = approvalEditable(a);
@@ -3803,7 +3942,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       }
     }
   }, "checkHitl");
-  const checkHitlArm = /* @__PURE__ */ __name3((node, path, container) => {
+  const checkHitlArm = /* @__PURE__ */ __name4((node, path, container) => {
     if (!workflowContainerRunsHitlArm(container)) {
       checkId(node.id, path);
       err("node-type-unsupported-in-container", workflowHitlArmUnsupportedMessage(node.type, node.id, container), path, node.id);
@@ -3811,7 +3950,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     checkHitl(node, path);
   }, "checkHitlArm");
-  const checkArm = /* @__PURE__ */ __name3((arm, path, depth, container) => {
+  const checkArm = /* @__PURE__ */ __name4((arm, path, depth, container) => {
     if (arm.type === "mapping") {
       checkId(arm.id, path);
       checkMapMembers(readMapConfig(arm.mapConfig), `${path}.mapConfig`, arm.id);
@@ -4008,7 +4147,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   return issues;
 }
 __name(validateLuaExtensions, "validateLuaExtensions");
-__name3(validateLuaExtensions, "validateLuaExtensions");
+__name4(validateLuaExtensions, "validateLuaExtensions");
 var EDITABLE_PATH_RE = /^[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?(\.[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?)*$/;
 var PREDICATE_OPS = /* @__PURE__ */ new Set([
   "eq",
@@ -4031,8 +4170,8 @@ function isPredicate(p) {
   return typeof p === "object" && p !== null && typeof p.op === "string" && PREDICATE_OPS.has(p.op);
 }
 __name(isPredicate, "isPredicate");
-__name3(isPredicate, "isPredicate");
-var isPredicateScalar = /* @__PURE__ */ __name3((v) => v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean", "isPredicateScalar");
+__name4(isPredicate, "isPredicate");
+var isPredicateScalar = /* @__PURE__ */ __name4((v) => v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean", "isPredicateScalar");
 function isPathOrLiteral(v) {
   if (typeof v !== "object" || v === null) return false;
   const r = v;
@@ -4040,7 +4179,7 @@ function isPathOrLiteral(v) {
   return "literal" in r && isPredicateScalar(r.literal);
 }
 __name(isPathOrLiteral, "isPathOrLiteral");
-__name3(isPathOrLiteral, "isPathOrLiteral");
+__name4(isPathOrLiteral, "isPathOrLiteral");
 function isWellFormedPredicate(p) {
   if (!isPredicate(p)) return false;
   const r = p;
@@ -4071,11 +4210,11 @@ function isWellFormedPredicate(p) {
   }
 }
 __name(isWellFormedPredicate, "isWellFormedPredicate");
-__name3(isWellFormedPredicate, "isWellFormedPredicate");
+__name4(isWellFormedPredicate, "isWellFormedPredicate");
 var GRAPH_HASH_PREFIX = "sha256-cj1:";
 function canonicalJson(value22) {
   const seen = /* @__PURE__ */ new WeakSet();
-  const encode = /* @__PURE__ */ __name3((v) => {
+  const encode = /* @__PURE__ */ __name4((v) => {
     if (v === null || typeof v === "number" || typeof v === "boolean") return JSON.stringify(v);
     if (typeof v === "string") return JSON.stringify(v);
     if (typeof v === "bigint") return JSON.stringify(`${v}n`);
@@ -4096,19 +4235,19 @@ function canonicalJson(value22) {
   return encode(value22);
 }
 __name(canonicalJson, "canonicalJson");
-__name3(canonicalJson, "canonicalJson");
+__name4(canonicalJson, "canonicalJson");
 function hashGraph(g) {
   const { metadata: _provenance, ...definition } = withDefaultsFilled(g).definition;
   return GRAPH_HASH_PREFIX + createHash("sha256").update(canonicalJson(definition)).digest("hex");
 }
 __name(hashGraph, "hashGraph");
-__name3(hashGraph, "hashGraph");
+__name4(hashGraph, "hashGraph");
 var WorkflowPlanError = class extends Error {
   static {
     __name(this, "WorkflowPlanError");
   }
   static {
-    __name3(this, "WorkflowPlanError");
+    __name4(this, "WorkflowPlanError");
   }
   code;
   constructor(code, message) {
@@ -4116,15 +4255,15 @@ var WorkflowPlanError = class extends Error {
     this.name = "WorkflowPlanError";
   }
 };
-var isArmStep = /* @__PURE__ */ __name3((e) => isWorkflowArmEntryType(e.type), "isArmStep");
-var armStepId = /* @__PURE__ */ __name3((e) => e.type === "step" ? e.step.id : e.id, "armStepId");
-var armStepKind = /* @__PURE__ */ __name3((e) => WORKFLOW_ARM_ENTRY_STEP_KINDS[e.type], "armStepKind");
-var joinIdOf = /* @__PURE__ */ __name3((entryId) => `${entryId}.join`, "joinIdOf");
-var containerIdOf = /* @__PURE__ */ __name3((type, entryIndex) => `${type}@${entryIndex}`, "containerIdOf");
+var isArmStep = /* @__PURE__ */ __name4((e) => isWorkflowArmEntryType(e.type), "isArmStep");
+var armStepId = /* @__PURE__ */ __name4((e) => e.type === "step" ? e.step.id : e.id, "armStepId");
+var armStepKind = /* @__PURE__ */ __name4((e) => WORKFLOW_ARM_ENTRY_STEP_KINDS[e.type], "armStepKind");
+var joinIdOf = /* @__PURE__ */ __name4((entryId) => `${entryId}.join`, "joinIdOf");
+var containerIdOf = /* @__PURE__ */ __name4((type, entryIndex) => `${type}@${entryIndex}`, "containerIdOf");
 function compilePlan(g) {
   const steps = {};
   const order = [];
-  const addNode = /* @__PURE__ */ __name3((id, node) => {
+  const addNode = /* @__PURE__ */ __name4((id, node) => {
     if (id in steps) {
       throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id}" in definition.graph`);
     }
@@ -4295,7 +4434,7 @@ function compilePlan(g) {
   };
 }
 __name(compilePlan, "compilePlan");
-__name3(compilePlan, "compilePlan");
+__name4(compilePlan, "compilePlan");
 var PATH_PLACEHOLDER = /^\$\{([^}]+)\}$/;
 var MISSING = /* @__PURE__ */ Symbol("predicate.missing");
 function resolvePath(rawPath, ctx) {
@@ -4339,7 +4478,7 @@ function resolvePath(rawPath, ctx) {
   return walk(root, rest);
 }
 __name(resolvePath, "resolvePath");
-__name3(resolvePath, "resolvePath");
+__name4(resolvePath, "resolvePath");
 function walk(root, path) {
   if (path === "") return root;
   const parts = path.split(".");
@@ -4354,13 +4493,13 @@ function walk(root, path) {
   return value22;
 }
 __name(walk, "walk");
-__name3(walk, "walk");
+__name4(walk, "walk");
 function resolveValue(ref, ctx) {
   if ("literal" in ref) return ref.literal;
   return resolvePath(ref.path, ctx);
 }
 __name(resolveValue, "resolveValue");
-__name3(resolveValue, "resolveValue");
+__name4(resolveValue, "resolveValue");
 function evaluatePredicate(pred, ctx) {
   switch (pred.op) {
     case "and":
@@ -4400,7 +4539,7 @@ function evaluatePredicate(pred, ctx) {
   }
 }
 __name(evaluatePredicate, "evaluatePredicate");
-__name3(evaluatePredicate, "evaluatePredicate");
+__name4(evaluatePredicate, "evaluatePredicate");
 function compare(op, left, right) {
   if (op === "eq") return left === right;
   if (op === "ne") return left !== right;
@@ -4419,14 +4558,14 @@ function compare(op, left, right) {
   return false;
 }
 __name(compare, "compare");
-__name3(compare, "compare");
+__name4(compare, "compare");
 function derivePredicateLabel(pred, maxLength = 80) {
   const raw = renderPredicate(pred);
   if (raw.length <= maxLength) return raw;
   return raw.slice(0, maxLength - 1) + "\u2026";
 }
 __name(derivePredicateLabel, "derivePredicateLabel");
-__name3(derivePredicateLabel, "derivePredicateLabel");
+__name4(derivePredicateLabel, "derivePredicateLabel");
 function renderPredicate(pred) {
   switch (pred.op) {
     case "and":
@@ -4461,55 +4600,55 @@ function renderPredicate(pred) {
   }
 }
 __name(renderPredicate, "renderPredicate");
-__name3(renderPredicate, "renderPredicate");
+__name4(renderPredicate, "renderPredicate");
 function wrapLabel(child, rendered) {
   return child.op === "and" || child.op === "or" || child.op === "not" ? `(${rendered})` : rendered;
 }
 __name(wrapLabel, "wrapLabel");
-__name3(wrapLabel, "wrapLabel");
+__name4(wrapLabel, "wrapLabel");
 function renderRef(ref) {
   if ("literal" in ref) return JSON.stringify(ref.literal);
   return ref.path;
 }
 __name(renderRef, "renderRef");
-__name3(renderRef, "renderRef");
-var stepIdOf = /* @__PURE__ */ __name3((s) => typeof s === "string" ? s : s.id, "stepIdOf");
+__name4(renderRef, "renderRef");
+var stepIdOf = /* @__PURE__ */ __name4((s) => typeof s === "string" ? s : s.id, "stepIdOf");
 function step(s) {
   const id = stepIdOf(s);
   return {
-    path: /* @__PURE__ */ __name3((p) => ({
+    path: /* @__PURE__ */ __name4((p) => ({
       path: p === "" ? `stepResults.${id}` : `stepResults.${id}.${p}`
     }), "path")
   };
 }
 __name(step, "step");
-__name3(step, "step");
+__name4(step, "step");
 function stepOf(id) {
   return step(id);
 }
 __name(stepOf, "stepOf");
-__name3(stepOf, "stepOf");
+__name4(stepOf, "stepOf");
 function init(path) {
   return {
     path: path === "" ? "initData" : `initData.${path}`
   };
 }
 __name(init, "init");
-__name3(init, "init");
+__name4(init, "init");
 function state(path) {
   return {
     path: path === "" ? "state" : `state.${path}`
   };
 }
 __name(state, "state");
-__name3(state, "state");
+__name4(state, "state");
 function lit(v) {
   return {
     literal: v
   };
 }
 __name(lit, "lit");
-__name3(lit, "lit");
+__name4(lit, "lit");
 function toPathOrLiteral(v) {
   if (typeof v === "object" && v !== null) {
     if ("path" in v) return {
@@ -4524,8 +4663,8 @@ function toPathOrLiteral(v) {
   };
 }
 __name(toPathOrLiteral, "toPathOrLiteral");
-__name3(toPathOrLiteral, "toPathOrLiteral");
-var cmp = /* @__PURE__ */ __name3((op) => (l, r) => ({
+__name4(toPathOrLiteral, "toPathOrLiteral");
+var cmp = /* @__PURE__ */ __name4((op) => (l, r) => ({
   op,
   left: toPathOrLiteral(l),
   right: toPathOrLiteral(r)
@@ -4536,49 +4675,49 @@ var gt = cmp("gt");
 var gte = cmp("gte");
 var lt = cmp("lt");
 var lte = cmp("lte");
-var inSet = /* @__PURE__ */ __name3((v, set) => ({
+var inSet = /* @__PURE__ */ __name4((v, set) => ({
   op: "in",
   value: {
     path: v.path
   },
   set
 }), "inSet");
-var notIn = /* @__PURE__ */ __name3((v, set) => ({
+var notIn = /* @__PURE__ */ __name4((v, set) => ({
   op: "notIn",
   value: {
     path: v.path
   },
   set
 }), "notIn");
-var exists = /* @__PURE__ */ __name3((ref) => ({
+var exists = /* @__PURE__ */ __name4((ref) => ({
   op: "exists",
   path: ref.path
 }), "exists");
-var notExists = /* @__PURE__ */ __name3((ref) => ({
+var notExists = /* @__PURE__ */ __name4((ref) => ({
   op: "notExists",
   path: ref.path
 }), "notExists");
-var truthy = /* @__PURE__ */ __name3((ref) => ({
+var truthy = /* @__PURE__ */ __name4((ref) => ({
   op: "truthy",
   value: {
     path: ref.path
   }
 }), "truthy");
-var falsy = /* @__PURE__ */ __name3((ref) => ({
+var falsy = /* @__PURE__ */ __name4((ref) => ({
   op: "falsy",
   value: {
     path: ref.path
   }
 }), "falsy");
-var and = /* @__PURE__ */ __name3((...args) => ({
+var and = /* @__PURE__ */ __name4((...args) => ({
   op: "and",
   args
 }), "and");
-var or = /* @__PURE__ */ __name3((...args) => ({
+var or = /* @__PURE__ */ __name4((...args) => ({
   op: "or",
   args
 }), "or");
-var not = /* @__PURE__ */ __name3((arg) => ({
+var not = /* @__PURE__ */ __name4((arg) => ({
   op: "not",
   arg
 }), "not");
@@ -4643,7 +4782,7 @@ function continuedFailureValue(error, killReason) {
   };
 }
 __name(continuedFailureValue, "continuedFailureValue");
-__name3(continuedFailureValue, "continuedFailureValue");
+__name4(continuedFailureValue, "continuedFailureValue");
 function isContinuedFailureValue(v) {
   if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
   const o = v;
@@ -4651,8 +4790,8 @@ function isContinuedFailureValue(v) {
   return o.__lua_workflow === CONTINUED_FAILURE_TAG && o.failed === true && o.text === "" && err !== null && typeof err === "object" && typeof err.code === "string" && typeof err.message === "string";
 }
 __name(isContinuedFailureValue, "isContinuedFailureValue");
-__name3(isContinuedFailureValue, "isContinuedFailureValue");
-var isHitlNode2 = /* @__PURE__ */ __name3((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
+__name4(isContinuedFailureValue, "isContinuedFailureValue");
+var isHitlNode2 = /* @__PURE__ */ __name4((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
 function inlineContainerArm(mapping, step22) {
   return {
     ...step22,
@@ -4660,8 +4799,8 @@ function inlineContainerArm(mapping, step22) {
   };
 }
 __name(inlineContainerArm, "inlineContainerArm");
-__name3(inlineContainerArm, "inlineContainerArm");
-var nodeIdOf = /* @__PURE__ */ __name3((n2) => n2.type === "step" ? n2.step.id : n2.id, "nodeIdOf");
+__name4(inlineContainerArm, "inlineContainerArm");
+var nodeIdOf = /* @__PURE__ */ __name4((n2) => n2.type === "step" ? n2.step.id : n2.id, "nodeIdOf");
 function entryIds(entry) {
   switch (entry.type) {
     case "parallel":
@@ -4685,13 +4824,13 @@ function entryIds(entry) {
   }
 }
 __name(entryIds, "entryIds");
-__name3(entryIds, "entryIds");
+__name4(entryIds, "entryIds");
 function resolvePlacements(calls) {
   const issues = [];
   const declared = /* @__PURE__ */ new Map();
   const placedBy = /* @__PURE__ */ new Map();
   const allIds = /* @__PURE__ */ new Map();
-  const claimId = /* @__PURE__ */ __name3((id, callIndex) => {
+  const claimId = /* @__PURE__ */ __name4((id, callIndex) => {
     const first = allIds.get(id);
     if (first !== void 0 && first !== callIndex) {
       issues.push({
@@ -4731,7 +4870,7 @@ function resolvePlacements(calls) {
         break;
     }
   });
-  const armMapPlacementIssue = /* @__PURE__ */ __name3((node, ref, i, container) => {
+  const armMapPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!ref.armMap || node.type === "mapping" || isHitlNode2(node)) return void 0;
     const id = nodeIdOf(node);
     if ((container === "foreach" || container === "loop") && node.type !== "workflow") {
@@ -4752,7 +4891,7 @@ function resolvePlacements(calls) {
     }
     return void 0;
   }, "armMapPlacementIssue");
-  const hitlPlacementIssue = /* @__PURE__ */ __name3((node, ref, i, container) => {
+  const hitlPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!isHitlNode2(node)) return void 0;
     const id = node.id;
     if (ref.armMap) {
@@ -4773,7 +4912,7 @@ function resolvePlacements(calls) {
     }
     return void 0;
   }, "hitlPlacementIssue");
-  const resolve = /* @__PURE__ */ __name3((ref, i, allowMapping, container) => {
+  const resolve = /* @__PURE__ */ __name4((ref, i, allowMapping, container) => {
     if ("node" in ref) {
       if (ref.node.type === "mapping" && !allowMapping) {
         issues.push({
@@ -4828,7 +4967,7 @@ function resolvePlacements(calls) {
     placedBy.set(ref.ref, i);
     return d.node;
   }, "resolve");
-  const claim = /* @__PURE__ */ __name3((ref, i, allowMapping, container) => {
+  const claim = /* @__PURE__ */ __name4((ref, i, allowMapping, container) => {
     if ("ref" in ref) {
       resolve(ref, i, allowMapping, container);
       return;
@@ -4863,7 +5002,7 @@ function resolvePlacements(calls) {
     }
   });
   const graph = [];
-  const lookup = /* @__PURE__ */ __name3((ref) => {
+  const lookup = /* @__PURE__ */ __name4((ref) => {
     const n2 = "node" in ref ? ref.node : declared.get(ref.ref)?.node;
     if (!n2 || !ref.armMap || n2.type === "mapping" || isHitlNode2(n2)) return n2;
     return inlineContainerArm(ref.armMap, n2);
@@ -4946,7 +5085,7 @@ function resolvePlacements(calls) {
   };
 }
 __name(resolvePlacements, "resolvePlacements");
-__name3(resolvePlacements, "resolvePlacements");
+__name4(resolvePlacements, "resolvePlacements");
 var GOAL_JUDGE_STEP_ID = "__goal_judge";
 var NON_LEAF_KINDS = /* @__PURE__ */ new Set([
   "foreach",
@@ -4957,18 +5096,18 @@ function isConditionalJoinId(stepId) {
   return CONDITIONAL_JOIN_ID.test(stepId);
 }
 __name(isConditionalJoinId, "isConditionalJoinId");
-__name3(isConditionalJoinId, "isConditionalJoinId");
+__name4(isConditionalJoinId, "isConditionalJoinId");
 function isPlainObject(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 __name(isPlainObject, "isPlainObject");
-__name3(isPlainObject, "isPlainObject");
+__name4(isPlainObject, "isPlainObject");
 function leafValue(row) {
   if (row.status === "completed") return row.output === void 0 ? null : row.output;
   return continuedFailureValue(row.error, row.killReason);
 }
 __name(leafValue, "leafValue");
-__name3(leafValue, "leafValue");
+__name4(leafValue, "leafValue");
 function runOutputLeaves(steps) {
   const dependedOn = /* @__PURE__ */ new Set();
   for (const s of steps) {
@@ -4978,7 +5117,7 @@ function runOutputLeaves(steps) {
   return steps.filter((s) => s.stepId !== GOAL_JUDGE_STEP_ID && !NON_LEAF_KINDS.has(s.kind ?? "") && s.foreachIndex === void 0 && s.loopParentId === void 0 && s.status !== "skipped" && !dependedOn.has(s.stepId));
 }
 __name(runOutputLeaves, "runOutputLeaves");
-__name3(runOutputLeaves, "runOutputLeaves");
+__name4(runOutputLeaves, "runOutputLeaves");
 function deriveRunOutput(steps) {
   const leaves = runOutputLeaves(steps);
   if (leaves.length === 0) return void 0;
@@ -5009,13 +5148,13 @@ function deriveRunOutput(steps) {
   };
 }
 __name(deriveRunOutput, "deriveRunOutput");
-__name3(deriveRunOutput, "deriveRunOutput");
+__name4(deriveRunOutput, "deriveRunOutput");
 function subrunSettledOutput(child) {
   if (child.output !== void 0) return child.output;
   return deriveRunOutput(child.steps ?? [])?.output ?? null;
 }
 __name(subrunSettledOutput, "subrunSettledOutput");
-__name3(subrunSettledOutput, "subrunSettledOutput");
+__name4(subrunSettledOutput, "subrunSettledOutput");
 function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
   const byId = /* @__PURE__ */ new Map();
   for (const s of steps) {
@@ -5026,11 +5165,11 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
   const seeded = [];
   const unseeded = [];
   const known = new Set(Object.keys(targetPlan.steps));
-  const parentOf = /* @__PURE__ */ __name3((id) => {
+  const parentOf = /* @__PURE__ */ __name4((id) => {
     const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id);
     return m ? m[1] : void 0;
   }, "parentOf");
-  const dependsOf = /* @__PURE__ */ __name3((id) => {
+  const dependsOf = /* @__PURE__ */ __name4((id) => {
     const node = targetPlan.steps[id];
     if (node) return node.dependsOn;
     const parent = parentOf(id);
@@ -5076,8 +5215,8 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
   };
 }
 __name(seedLedgerFromRun, "seedLedgerFromRun");
-__name3(seedLedgerFromRun, "seedLedgerFromRun");
-var branchArmId = /* @__PURE__ */ __name3((arm) => arm.type === "step" ? arm.step.id : arm.id, "branchArmId");
+__name4(seedLedgerFromRun, "seedLedgerFromRun");
+var branchArmId = /* @__PURE__ */ __name4((arm) => arm.type === "step" ? arm.step.id : arm.id, "branchArmId");
 function branchSpecFromConditional(entry) {
   return {
     arms: entry.steps.map((arm, i) => ({
@@ -5093,7 +5232,7 @@ function branchSpecFromConditional(entry) {
   };
 }
 __name(branchSpecFromConditional, "branchSpecFromConditional");
-__name3(branchSpecFromConditional, "branchSpecFromConditional");
+__name4(branchSpecFromConditional, "branchSpecFromConditional");
 function selectBranchArms(spec, ctx) {
   const taken = [];
   for (const arm of spec.arms) {
@@ -5105,9 +5244,9 @@ function selectBranchArms(spec, ctx) {
   return taken;
 }
 __name(selectBranchArms, "selectBranchArms");
-__name3(selectBranchArms, "selectBranchArms");
-var canonical = /* @__PURE__ */ __name3((v) => JSON.stringify(sortKeys(v)), "canonical");
-var sortKeys = /* @__PURE__ */ __name3((v) => {
+__name4(selectBranchArms, "selectBranchArms");
+var canonical = /* @__PURE__ */ __name4((v) => JSON.stringify(sortKeys(v)), "canonical");
+var sortKeys = /* @__PURE__ */ __name4((v) => {
   if (Array.isArray(v)) return v.map(sortKeys);
   if (v && typeof v === "object") {
     return Object.fromEntries(Object.keys(v).sort().map((k) => [
@@ -5135,7 +5274,7 @@ function replayLedger(g, ledger) {
     startedAt: 0,
     ...ledger.requestContext
   };
-  const ctxFor = /* @__PURE__ */ __name3((id) => ({
+  const ctxFor = /* @__PURE__ */ __name4((id) => ({
     initData: ledger.initData,
     stepResults: ancestorResults(plan, id, rows22),
     state: ledger.state ?? {},
@@ -5201,9 +5340,9 @@ function replayLedger(g, ledger) {
   };
 }
 __name(replayLedger, "replayLedger");
-__name3(replayLedger, "replayLedger");
+__name4(replayLedger, "replayLedger");
 var JOIN = ".join";
-var entryOfJoin = /* @__PURE__ */ __name3((id) => id.endsWith(JOIN) ? id.slice(0, -JOIN.length) : void 0, "entryOfJoin");
+var entryOfJoin = /* @__PURE__ */ __name4((id) => id.endsWith(JOIN) ? id.slice(0, -JOIN.length) : void 0, "entryOfJoin");
 function replayResultOf(row, node) {
   if (!row) return void 0;
   if (row.status === "completed") return {
@@ -5218,12 +5357,12 @@ function replayResultOf(row, node) {
   return void 0;
 }
 __name(replayResultOf, "replayResultOf");
-__name3(replayResultOf, "replayResultOf");
+__name4(replayResultOf, "replayResultOf");
 function ancestorResults(plan, id, rows22) {
   const out = {};
   const joinAliased = /* @__PURE__ */ new Set();
   const seen = /* @__PURE__ */ new Set();
-  const take = /* @__PURE__ */ __name3((rowId) => {
+  const take = /* @__PURE__ */ __name4((rowId) => {
     const hit = replayResultOf(rows22.get(rowId), plan.steps[rowId]);
     if (!hit) return void 0;
     if (!joinAliased.has(rowId)) out[rowId] = hit.value;
@@ -5240,7 +5379,7 @@ function ancestorResults(plan, id, rows22) {
     }
     return hit;
   }, "take");
-  const walk2 = /* @__PURE__ */ __name3((ids) => {
+  const walk2 = /* @__PURE__ */ __name4((ids) => {
     for (const dep of ids) {
       if (seen.has(dep)) continue;
       seen.add(dep);
@@ -5272,7 +5411,7 @@ function ancestorResults(plan, id, rows22) {
   return out;
 }
 __name(ancestorResults, "ancestorResults");
-__name3(ancestorResults, "ancestorResults");
+__name4(ancestorResults, "ancestorResults");
 function inferTaken(entry, rows22) {
   const arms = [
     ...entry.steps,
@@ -5286,7 +5425,7 @@ function inferTaken(entry, rows22) {
   });
 }
 __name(inferTaken, "inferTaken");
-__name3(inferTaken, "inferTaken");
+__name4(inferTaken, "inferTaken");
 function countChildren(entry, rows22) {
   const body = branchArmId(entry.step);
   let n2 = 0;
@@ -5294,19 +5433,19 @@ function countChildren(entry, rows22) {
   return n2;
 }
 __name(countChildren, "countChildren");
-__name3(countChildren, "countChildren");
+__name4(countChildren, "countChildren");
 var FORCE_CANCEL_STALE_MS = 10 * 60 * 1e3;
 var TERMINAL = new Set(WORKFLOW_RUN_TERMINAL);
 function isTerminalRunStatus(status) {
   return TERMINAL.has(status);
 }
 __name(isTerminalRunStatus, "isTerminalRunStatus");
-__name3(isTerminalRunStatus, "isTerminalRunStatus");
+__name4(isTerminalRunStatus, "isTerminalRunStatus");
 function pruneUndefined(o) {
   return Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
 }
 __name(pruneUndefined, "pruneUndefined");
-__name3(pruneUndefined, "pruneUndefined");
+__name4(pruneUndefined, "pruneUndefined");
 var WORKFLOW_INLINE_RUN_TAG = "inline";
 function runOrigin(run) {
   if (run.goalId) return "goal";
@@ -5315,7 +5454,7 @@ function runOrigin(run) {
   return "definition";
 }
 __name(runOrigin, "runOrigin");
-__name3(runOrigin, "runOrigin");
+__name4(runOrigin, "runOrigin");
 var RUN_ERROR_ISSUES_MAX = 20;
 function runErrorIssues(issues) {
   if (!Array.isArray(issues)) return void 0;
@@ -5333,7 +5472,7 @@ function runErrorIssues(issues) {
   return out.length ? out : void 0;
 }
 __name(runErrorIssues, "runErrorIssues");
-__name3(runErrorIssues, "runErrorIssues");
+__name4(runErrorIssues, "runErrorIssues");
 function runNextAction(run) {
   if (isTerminalRunStatus(run.status)) return "none";
   if (run.status === "suspended" && run.gate?.kind === "budget") return "raise_budget";
@@ -5343,7 +5482,7 @@ function runNextAction(run) {
   return Date.now() >= forceAt ? "force" : "cancel_again";
 }
 __name(runNextAction, "runNextAction");
-__name3(runNextAction, "runNextAction");
+__name4(runNextAction, "runNextAction");
 var IN_FLIGHT = new Set(WORKFLOW_STEP_IN_FLIGHT);
 function emptyRunCounts() {
   const out = {
@@ -5354,7 +5493,7 @@ function emptyRunCounts() {
   return out;
 }
 __name(emptyRunCounts, "emptyRunCounts");
-__name3(emptyRunCounts, "emptyRunCounts");
+__name4(emptyRunCounts, "emptyRunCounts");
 function runCountsFromStatusTally(tally) {
   const out = emptyRunCounts();
   for (const [status, n2] of Object.entries(tally)) {
@@ -5366,25 +5505,25 @@ function runCountsFromStatusTally(tally) {
   return out;
 }
 __name(runCountsFromStatusTally, "runCountsFromStatusTally");
-__name3(runCountsFromStatusTally, "runCountsFromStatusTally");
+__name4(runCountsFromStatusTally, "runCountsFromStatusTally");
 function runCountsFromStepStatuses(statuses) {
   const tally = {};
   for (const s of statuses) tally[s] = (tally[s] ?? 0) + 1;
   return runCountsFromStatusTally(tally);
 }
 __name(runCountsFromStepStatuses, "runCountsFromStepStatuses");
-__name3(runCountsFromStepStatuses, "runCountsFromStepStatuses");
+__name4(runCountsFromStepStatuses, "runCountsFromStepStatuses");
 function isBillingHeldStep(row) {
   return row.status === "ready" && row.billingHold === true;
 }
 __name(isBillingHeldStep, "isBillingHeldStep");
-__name3(isBillingHeldStep, "isBillingHeldStep");
+__name4(isBillingHeldStep, "isBillingHeldStep");
 function stepEffectiveStatus(row) {
   return isBillingHeldStep(row) ? "suspended" : row.status;
 }
 __name(stepEffectiveStatus, "stepEffectiveStatus");
-__name3(stepEffectiveStatus, "stepEffectiveStatus");
-var n = /* @__PURE__ */ __name3((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
+__name4(stepEffectiveStatus, "stepEffectiveStatus");
+var n = /* @__PURE__ */ __name4((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
 function runCounts(counts) {
   const c = counts ?? {};
   const rawInFlight = c.dispatched !== void 0 || c.claimed !== void 0 || c.running !== void 0 || c.cancellation_requested !== void 0;
@@ -5401,24 +5540,24 @@ function runCounts(counts) {
   };
 }
 __name(runCounts, "runCounts");
-__name3(runCounts, "runCounts");
+__name4(runCounts, "runCounts");
 function isPricedStepReceipt(receipt) {
   return typeof receipt?.multiplier === "number" && Number.isFinite(receipt.multiplier);
 }
 __name(isPricedStepReceipt, "isPricedStepReceipt");
-__name3(isPricedStepReceipt, "isPricedStepReceipt");
+__name4(isPricedStepReceipt, "isPricedStepReceipt");
 function receiptEngine(engine) {
   if (engine === "actions") return "seat";
   if (engine === "credits") return "legacy";
   return void 0;
 }
 __name(receiptEngine, "receiptEngine");
-__name3(receiptEngine, "receiptEngine");
+__name4(receiptEngine, "receiptEngine");
 function receiptTier(tier) {
   return tier === "light" || tier === "standard" || tier === "heavy" ? tier : void 0;
 }
 __name(receiptTier, "receiptTier");
-__name3(receiptTier, "receiptTier");
+__name4(receiptTier, "receiptTier");
 function stepBillingView(receipt) {
   const engine = receiptEngine(receipt?.engine);
   if (!receipt || engine === void 0) return void 0;
@@ -5435,7 +5574,7 @@ function stepBillingView(receipt) {
   });
 }
 __name(stepBillingView, "stepBillingView");
-__name3(stepBillingView, "stepBillingView");
+__name4(stepBillingView, "stepBillingView");
 function runUsage(run, receipts) {
   const actions = n(run.budget?.spent?.actionsEstimate);
   const stamped = run.budget?.engine;
@@ -5459,13 +5598,13 @@ function runUsage(run, receipts) {
   };
 }
 __name(runUsage, "runUsage");
-__name3(runUsage, "runUsage");
+__name4(runUsage, "runUsage");
 function runBudgetCap(budget) {
   const cap = budget?.maxCredits;
   return typeof cap === "number" && Number.isFinite(cap) && cap > 0 ? cap : void 0;
 }
 __name(runBudgetCap, "runBudgetCap");
-__name3(runBudgetCap, "runBudgetCap");
+__name4(runBudgetCap, "runBudgetCap");
 function runBudgetRemaining(budget) {
   const cap = runBudgetCap(budget);
   if (cap === void 0) return void 0;
@@ -5473,7 +5612,7 @@ function runBudgetRemaining(budget) {
   return Math.max(0, cap - n(spent?.credits) - n(spent?.actionsEstimate) - n(budget?.reserved));
 }
 __name(runBudgetRemaining, "runBudgetRemaining");
-__name3(runBudgetRemaining, "runBudgetRemaining");
+__name4(runBudgetRemaining, "runBudgetRemaining");
 function runCancelView(cancel) {
   if (!cancel) return void 0;
   return {
@@ -5499,7 +5638,7 @@ function runCancelView(cancel) {
   };
 }
 __name(runCancelView, "runCancelView");
-__name3(runCancelView, "runCancelView");
+__name4(runCancelView, "runCancelView");
 function runWorkspaceView(ws) {
   if (!ws) return void 0;
   const w = ws;
@@ -5514,7 +5653,7 @@ function runWorkspaceView(ws) {
   });
 }
 __name(runWorkspaceView, "runWorkspaceView");
-__name3(runWorkspaceView, "runWorkspaceView");
+__name4(runWorkspaceView, "runWorkspaceView");
 function toWorkflowRunSummary(run) {
   const status = run.status;
   const principal = run.principal?.principal;
@@ -5586,7 +5725,7 @@ function toWorkflowRunSummary(run) {
   });
 }
 __name(toWorkflowRunSummary, "toWorkflowRunSummary");
-__name3(toWorkflowRunSummary, "toWorkflowRunSummary");
+__name4(toWorkflowRunSummary, "toWorkflowRunSummary");
 var STEP_ERROR_DETAIL_KEYS = [
   "reason",
   "key",
@@ -5615,7 +5754,17 @@ var STEP_ERROR_DETAIL_KEYS = [
   "workflowId",
   // LUA-696 (review 2): the `ctx.once` key of an `effect_in_doubt` park — the step site stamps it here (scrubbed)
   // beside `park.effectKey`; a key is user text and leaves scrubbed like every other string leaf.
-  "effectKey"
+  "effectKey",
+  // LUA-833: the Job tier's `job_auth_rejected{reason}` evidence — the pod that exited and its code, the Secret the
+  // row named (a k8s object NAME, `wfs-<hash12>-a<n>`, never a value), the execution the pod was spawned for, the
+  // one its credential was minted for, and whether that credential had expired. The LUA-716 / LUA-748 spawn
+  // refusals name `secretName` too.
+  "podName",
+  "exitCode",
+  "secretName",
+  "executionId",
+  "credentialsExecutionId",
+  "expired"
 ];
 var STEP_ERROR_DETAIL_MAX_BYTES = 8 * 1024;
 var DETAIL_MAX_DEPTH = 4;
@@ -5638,7 +5787,7 @@ function scrubDetailValue(value22, depth) {
   return void 0;
 }
 __name(scrubDetailValue, "scrubDetailValue");
-__name3(scrubDetailValue, "scrubDetailValue");
+__name4(scrubDetailValue, "scrubDetailValue");
 function stepErrorDetail(error) {
   if (!error || typeof error !== "object") return void 0;
   const d = error.detail;
@@ -5666,7 +5815,7 @@ function stepErrorDetail(error) {
   };
 }
 __name(stepErrorDetail, "stepErrorDetail");
-__name3(stepErrorDetail, "stepErrorDetail");
+__name4(stepErrorDetail, "stepErrorDetail");
 var MAX_HOLIDAYS = 366;
 var MAX_WALK_DAYS = 400;
 var HHMM = /^([01]\d|2[0-3]):([0-5]\d)$/;
@@ -5702,10 +5851,10 @@ function timeZoneSupported(tz) {
   }
 }
 __name(timeZoneSupported, "timeZoneSupported");
-__name3(timeZoneSupported, "timeZoneSupported");
+__name4(timeZoneSupported, "timeZoneSupported");
 function validateBusinessHours(cal, path = "businessHours") {
   const issues = [];
-  const issue = /* @__PURE__ */ __name3((p, message) => issues.push({
+  const issue = /* @__PURE__ */ __name4((p, message) => issues.push({
     code: "business-hours-invalid",
     path: p,
     message
@@ -5745,24 +5894,24 @@ function validateBusinessHours(cal, path = "businessHours") {
   return issues;
 }
 __name(validateBusinessHours, "validateBusinessHours");
-__name3(validateBusinessHours, "validateBusinessHours");
+__name4(validateBusinessHours, "validateBusinessHours");
 function toMinutes(hhmm) {
   const m = HHMM.exec(hhmm);
   return Number(m[1]) * 60 + Number(m[2]);
 }
 __name(toMinutes, "toMinutes");
-__name3(toMinutes, "toMinutes");
+__name4(toMinutes, "toMinutes");
 function resolveCalendar(cal) {
   return cal.calendar === void 0 || cal.calendar === "mon-fri" ? MON_FRI : cal.calendar;
 }
 __name(resolveCalendar, "resolveCalendar");
-__name3(resolveCalendar, "resolveCalendar");
+__name4(resolveCalendar, "resolveCalendar");
 function assertValid(cal) {
   const issues = validateBusinessHours(cal);
   if (issues.length > 0) throw new RangeError(`business-hours-invalid: ${issues.map((i) => i.path).join(", ")}`);
 }
 __name(assertValid, "assertValid");
-__name3(assertValid, "assertValid");
+__name4(assertValid, "assertValid");
 var fmtCache = /* @__PURE__ */ new Map();
 function formatter(tz) {
   let f = fmtCache.get(tz);
@@ -5782,7 +5931,7 @@ function formatter(tz) {
   return f;
 }
 __name(formatter, "formatter");
-__name3(formatter, "formatter");
+__name4(formatter, "formatter");
 var WEEKDAYS = {
   Sun: 0,
   Mon: 1,
@@ -5794,7 +5943,7 @@ var WEEKDAYS = {
 };
 function localParts(ms, tz) {
   const parts = formatter(tz).formatToParts(new Date(ms));
-  const get = /* @__PURE__ */ __name3((t) => parts.find((p) => p.type === t)?.value ?? "", "get");
+  const get = /* @__PURE__ */ __name4((t) => parts.find((p) => p.type === t)?.value ?? "", "get");
   const hour = Number(get("hour")) % 24;
   return {
     year: Number(get("year")),
@@ -5806,7 +5955,7 @@ function localParts(ms, tz) {
   };
 }
 __name(localParts, "localParts");
-__name3(localParts, "localParts");
+__name4(localParts, "localParts");
 function offsetAt(ms, tz) {
   const p = localParts(ms, tz);
   const asUtc = Date.UTC(p.year, p.month - 1, p.day, p.hour, p.minute, 0, 0);
@@ -5814,7 +5963,7 @@ function offsetAt(ms, tz) {
   return asUtc - floored;
 }
 __name(offsetAt, "offsetAt");
-__name3(offsetAt, "offsetAt");
+__name4(offsetAt, "offsetAt");
 function localToUtc(y, m, d, minutes, tz) {
   const wall = Date.UTC(y, m - 1, d, Math.floor(minutes / 60), minutes % 60, 0, 0);
   const guess = wall - offsetAt(wall, tz);
@@ -5836,18 +5985,18 @@ function localToUtc(y, m, d, minutes, tz) {
   return probe;
 }
 __name(localToUtc, "localToUtc");
-__name3(localToUtc, "localToUtc");
+__name4(localToUtc, "localToUtc");
 function sameWall(ms, y, m, d, minutes, tz) {
   const p = localParts(ms, tz);
   return p.year === y && p.month === m && p.day === d && p.hour * 60 + p.minute === minutes;
 }
 __name(sameWall, "sameWall");
-__name3(sameWall, "sameWall");
+__name4(sameWall, "sameWall");
 function ymd(p) {
   return `${p.year}-${String(p.month).padStart(2, "0")}-${String(p.day).padStart(2, "0")}`;
 }
 __name(ymd, "ymd");
-__name3(ymd, "ymd");
+__name4(ymd, "ymd");
 function windowOf(ms, tz, k, holidays) {
   const p = localParts(ms, tz);
   if (!k.days.includes(p.weekday) || holidays.has(ymd(p))) return null;
@@ -5857,14 +6006,14 @@ function windowOf(ms, tz, k, holidays) {
   };
 }
 __name(windowOf, "windowOf");
-__name3(windowOf, "windowOf");
+__name4(windowOf, "windowOf");
 function nextDayAnchor(ms, tz) {
   const p = localParts(ms, tz);
   const next = new Date(Date.UTC(p.year, p.month - 1, p.day) + MS_PER_DAY);
   return localToUtc(next.getUTCFullYear(), next.getUTCMonth() + 1, next.getUTCDate(), 0, tz);
 }
 __name(nextDayAnchor, "nextDayAnchor");
-__name3(nextDayAnchor, "nextDayAnchor");
+__name4(nextDayAnchor, "nextDayAnchor");
 function addBusinessTime(fromMs, hours, cal) {
   assertValid(cal);
   if (!Number.isFinite(fromMs) || !Number.isFinite(hours)) throw new RangeError("addBusinessTime: non-finite input");
@@ -5885,7 +6034,7 @@ function addBusinessTime(fromMs, hours, cal) {
   throw new RangeError("addBusinessTime: walk exceeded the calendar bound");
 }
 __name(addBusinessTime, "addBusinessTime");
-__name3(addBusinessTime, "addBusinessTime");
+__name4(addBusinessTime, "addBusinessTime");
 function roundToBusinessTime(atMs, cal, round = "next-open") {
   assertValid(cal);
   if (!Number.isFinite(atMs)) throw new RangeError("roundToBusinessTime: non-finite input");
@@ -5903,7 +6052,7 @@ function roundToBusinessTime(atMs, cal, round = "next-open") {
   throw new RangeError("roundToBusinessTime: walk exceeded the calendar bound");
 }
 __name(roundToBusinessTime, "roundToBusinessTime");
-__name3(roundToBusinessTime, "roundToBusinessTime");
+__name4(roundToBusinessTime, "roundToBusinessTime");
 function isBusinessTime(atMs, cal) {
   assertValid(cal);
   const k = resolveCalendar(cal);
@@ -5911,7 +6060,7 @@ function isBusinessTime(atMs, cal) {
   return !!w && atMs >= w.open && atMs < w.close;
 }
 __name(isBusinessTime, "isBusinessTime");
-__name3(isBusinessTime, "isBusinessTime");
+__name4(isBusinessTime, "isBusinessTime");
 var JSON_PATCH_OPS = [
   "replace",
   "add",
@@ -5945,12 +6094,12 @@ function parseEditablePath(entry) {
   return out;
 }
 __name(parseEditablePath, "parseEditablePath");
-__name3(parseEditablePath, "parseEditablePath");
+__name4(parseEditablePath, "parseEditablePath");
 function isEditablePathEntry(entry) {
   return typeof entry === "string" && parseEditablePath(entry) !== null;
 }
 __name(isEditablePathEntry, "isEditablePathEntry");
-__name3(isEditablePathEntry, "isEditablePathEntry");
+__name4(isEditablePathEntry, "isEditablePathEntry");
 function pointerToSegments(pointer) {
   if (typeof pointer !== "string" || pointer.length === 0 || pointer[0] !== "/") return null;
   const decoded = pointer.slice(1).split("/").map((s) => s.replace(/~1/g, "/").replace(/~0/g, "~"));
@@ -5958,7 +6107,7 @@ function pointerToSegments(pointer) {
   return decoded.map((s) => s === "-" ? "-" : /^(0|[1-9]\d*)$/.test(s) ? Number(s) : s);
 }
 __name(pointerToSegments, "pointerToSegments");
-__name3(pointerToSegments, "pointerToSegments");
+__name4(pointerToSegments, "pointerToSegments");
 function pointerToDotPath(pointer) {
   const segs = pointerToSegments(pointer);
   if (!segs) return pointer;
@@ -5971,7 +6120,7 @@ function pointerToDotPath(pointer) {
   return out;
 }
 __name(pointerToDotPath, "pointerToDotPath");
-__name3(pointerToDotPath, "pointerToDotPath");
+__name4(pointerToDotPath, "pointerToDotPath");
 function coveredBy(segs, entry, op) {
   if (segs.length < entry.length) return false;
   for (let i = 0; i < entry.length; i += 1) {
@@ -5991,7 +6140,7 @@ function coveredBy(segs, entry, op) {
   return true;
 }
 __name(coveredBy, "coveredBy");
-__name3(coveredBy, "coveredBy");
+__name4(coveredBy, "coveredBy");
 function matchesEditablePath(pointer, editablePaths, op = "replace") {
   const segs = pointerToSegments(pointer);
   if (!segs || segs.length === 0) return false;
@@ -6002,10 +6151,10 @@ function matchesEditablePath(pointer, editablePaths, op = "replace") {
   return false;
 }
 __name(matchesEditablePath, "matchesEditablePath");
-__name3(matchesEditablePath, "matchesEditablePath");
+__name4(matchesEditablePath, "matchesEditablePath");
 function changedPointers(before, after, base = "") {
   if (before === after) return [];
-  const isObj = /* @__PURE__ */ __name3((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObj");
+  const isObj = /* @__PURE__ */ __name4((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObj");
   if (Array.isArray(before) && Array.isArray(after)) {
     if (before.length !== after.length) return [
       base || "/"
@@ -6038,12 +6187,12 @@ function changedPointers(before, after, base = "") {
   ];
 }
 __name(changedPointers, "changedPointers");
-__name3(changedPointers, "changedPointers");
+__name4(changedPointers, "changedPointers");
 function escapePointer(key) {
   return key.replace(/~/g, "~0").replace(/\//g, "~1");
 }
 __name(escapePointer, "escapePointer");
-__name3(escapePointer, "escapePointer");
+__name4(escapePointer, "escapePointer");
 function validateJsonPatch(ops) {
   if (!Array.isArray(ops)) return {
     ok: false,
@@ -6113,7 +6262,7 @@ function validateJsonPatch(ops) {
   };
 }
 __name(validateJsonPatch, "validateJsonPatch");
-__name3(validateJsonPatch, "validateJsonPatch");
+__name4(validateJsonPatch, "validateJsonPatch");
 function applyJsonPatch(doc, ops) {
   let value22 = structuredClone(doc);
   for (let i = 0; i < ops.length; i += 1) {
@@ -6214,21 +6363,85 @@ function applyJsonPatch(doc, ops) {
   };
 }
 __name(applyJsonPatch, "applyJsonPatch");
-__name3(applyJsonPatch, "applyJsonPatch");
+__name4(applyJsonPatch, "applyJsonPatch");
 function rebaseItemPointer(pointer, itemsPath, index) {
   const base = `/${itemsPath.split(".").map(escapePointer).join("/")}/${index}`;
   return pointer === "/" || pointer === "" ? base : `${base}${pointer}`;
 }
 __name(rebaseItemPointer, "rebaseItemPointer");
-__name3(rebaseItemPointer, "rebaseItemPointer");
+__name4(rebaseItemPointer, "rebaseItemPointer");
+var WORKFLOW_SCHEDULE_TYPES = [
+  "cron",
+  "interval",
+  "once"
+];
+var WORKFLOW_SCHEDULE_SHAPE_ISSUE = "schedule-shape-invalid";
+var WORKFLOW_SCHEDULE_SHAPES_HINT = "`schedule` must be one of { type: 'cron', expression: '<5-field cron>', timezone?: '<IANA tz>' } | { type: 'interval', seconds: <n> } | { type: 'once', executeAt: '<ISO-8601>' }";
+var WORKFLOW_SCHEDULE_RUN_AS = [
+  "installer",
+  "system"
+];
+var isObject = /* @__PURE__ */ __name4((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObject");
+function validateWorkflowSchedule(schedule, path = "/schedule") {
+  if (schedule === void 0 || schedule === null) return [];
+  const issue = /* @__PURE__ */ __name4((at, detail) => [
+    {
+      code: WORKFLOW_SCHEDULE_SHAPE_ISSUE,
+      severity: "error",
+      path: at,
+      message: `${detail} \u2014 ${WORKFLOW_SCHEDULE_SHAPES_HINT}`
+    }
+  ], "issue");
+  if (!isObject(schedule)) {
+    return issue(path, `\`schedule\` is ${Array.isArray(schedule) ? "an array" : `a ${typeof schedule}`}, not a typed schedule object`);
+  }
+  const type = schedule.type;
+  if (type === void 0) {
+    const keys = Object.keys(schedule);
+    const seen = keys.length ? ` (got { ${keys.join(", ")} })` : " (got {})";
+    return issue(path, `\`schedule\` carries no \`type\` discriminator${seen}`);
+  }
+  if (typeof type !== "string" || !WORKFLOW_SCHEDULE_TYPES.includes(type)) {
+    return issue(path, `\`schedule.type\` ${JSON.stringify(type)} is not one of ${WORKFLOW_SCHEDULE_TYPES.map((t) => `'${t}'`).join(" | ")}`);
+  }
+  if (schedule.runAs !== void 0 && !WORKFLOW_SCHEDULE_RUN_AS.includes(schedule.runAs)) {
+    return issue(`${path}/runAs`, `\`schedule.runAs\` ${JSON.stringify(schedule.runAs)} is not one of ${WORKFLOW_SCHEDULE_RUN_AS.map((v) => `'${v}'`).join(" | ")}`);
+  }
+  switch (type) {
+    case "cron": {
+      if (typeof schedule.expression !== "string" || schedule.expression.trim().length === 0) {
+        return issue(`${path}/expression`, "a { type: 'cron' } schedule needs a non-empty string `expression`");
+      }
+      if (schedule.timezone !== void 0 && (typeof schedule.timezone !== "string" || schedule.timezone.length === 0)) {
+        return issue(`${path}/timezone`, "a { type: 'cron' } schedule's `timezone`, when given, is a non-empty IANA string");
+      }
+      return [];
+    }
+    case "interval": {
+      const s = schedule.seconds;
+      if (typeof s !== "number" || !Number.isFinite(s) || s <= 0) {
+        return issue(`${path}/seconds`, "a { type: 'interval' } schedule needs a positive number `seconds`");
+      }
+      return [];
+    }
+    case "once": {
+      if (typeof schedule.executeAt !== "string" || Number.isNaN(Date.parse(schedule.executeAt))) {
+        return issue(`${path}/executeAt`, "a { type: 'once' } schedule needs an ISO-8601 string `executeAt`");
+      }
+      return [];
+    }
+  }
+}
+__name(validateWorkflowSchedule, "validateWorkflowSchedule");
+__name4(validateWorkflowSchedule, "validateWorkflowSchedule");
 var WORKFLOW_ENV_OVERLAY_MAX_KEYS = 64;
 var WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES = 4096;
 var WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE = /(SECRET|TOKEN|KEY|PASSWORD)$/;
-var isEnvRef = /* @__PURE__ */ __name3((v) => typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.__envRef === "string" && Object.keys(v).length === 1, "isEnvRef");
-var looksLikeEmbeddedJson = /* @__PURE__ */ __name3((s) => s.length > 1 && s[0] === "{" && s.includes("__envRef"), "looksLikeEmbeddedJson");
+var isEnvRef = /* @__PURE__ */ __name4((v) => typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.__envRef === "string" && Object.keys(v).length === 1, "isEnvRef");
+var looksLikeEmbeddedJson = /* @__PURE__ */ __name4((s) => s.length > 1 && s[0] === "{" && s.includes("__envRef"), "looksLikeEmbeddedJson");
 function collectEnvTemplateKeys(value22) {
   const keys = /* @__PURE__ */ new Set();
-  const walk2 = /* @__PURE__ */ __name3((v) => {
+  const walk2 = /* @__PURE__ */ __name4((v) => {
     if (isEnvRef(v)) {
       keys.add(v.__envRef);
       return;
@@ -6254,10 +6467,10 @@ function collectEnvTemplateKeys(value22) {
   ].sort();
 }
 __name(collectEnvTemplateKeys, "collectEnvTemplateKeys");
-__name3(collectEnvTemplateKeys, "collectEnvTemplateKeys");
+__name4(collectEnvTemplateKeys, "collectEnvTemplateKeys");
 function substituteEnvRefs(value22, overlay) {
   const missing = /* @__PURE__ */ new Set();
-  const walk2 = /* @__PURE__ */ __name3((v, slot = false) => {
+  const walk2 = /* @__PURE__ */ __name4((v, slot = false) => {
     if (isEnvRef(v)) {
       if (Object.prototype.hasOwnProperty.call(overlay, v.__envRef)) {
         const s = overlay[v.__envRef];
@@ -6296,13 +6509,13 @@ function substituteEnvRefs(value22, overlay) {
   };
 }
 __name(substituteEnvRefs, "substituteEnvRefs");
-__name3(substituteEnvRefs, "substituteEnvRefs");
+__name4(substituteEnvRefs, "substituteEnvRefs");
 function hashEnvOverlay(overlay) {
   if (overlay === void 0 || overlay === null) return void 0;
   return GRAPH_HASH_PREFIX + createHash2("sha256").update(canonicalJson(overlay)).digest("hex");
 }
 __name(hashEnvOverlay, "hashEnvOverlay");
-__name3(hashEnvOverlay, "hashEnvOverlay");
+__name4(hashEnvOverlay, "hashEnvOverlay");
 function validateEnvOverlay(keys, overlay, limits = {}) {
   const maxKeys = limits.maxKeys ?? WORKFLOW_ENV_OVERLAY_MAX_KEYS;
   const maxValueBytes = limits.maxValueBytes ?? WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES;
@@ -6341,7 +6554,7 @@ function validateEnvOverlay(keys, overlay, limits = {}) {
   return issues;
 }
 __name(validateEnvOverlay, "validateEnvOverlay");
-__name3(validateEnvOverlay, "validateEnvOverlay");
+__name4(validateEnvOverlay, "validateEnvOverlay");
 var ZERO = {
   steps: {
     min: 0,
@@ -6367,7 +6580,7 @@ function add(a, b) {
   };
 }
 __name(add, "add");
-__name3(add, "add");
+__name4(add, "add");
 function scale(r, lo, hi) {
   return {
     steps: {
@@ -6382,12 +6595,12 @@ function scale(r, lo, hi) {
   };
 }
 __name(scale, "scale");
-__name3(scale, "scale");
+__name4(scale, "scale");
 function armEntry(arm) {
   return Array.isArray(arm) ? arm[arm.length - 1] : arm;
 }
 __name(armEntry, "armEntry");
-__name3(armEntry, "armEntry");
+__name4(armEntry, "armEntry");
 function ofEntry(e) {
   if (!e || typeof e !== "object") return ZERO;
   const n2 = e;
@@ -6476,7 +6689,7 @@ function ofEntry(e) {
   }
 }
 __name(ofEntry, "ofEntry");
-__name3(ofEntry, "ofEntry");
+__name4(ofEntry, "ofEntry");
 function estimateGraph(envelopeOrGraph) {
   const graph = Array.isArray(envelopeOrGraph) ? envelopeOrGraph : envelopeOrGraph?.definition?.graph ?? [];
   const r = graph.map(ofEntry).reduce(add, ZERO);
@@ -6492,8 +6705,8 @@ function estimateGraph(envelopeOrGraph) {
   };
 }
 __name(estimateGraph, "estimateGraph");
-__name3(estimateGraph, "estimateGraph");
-var isRecord2 = /* @__PURE__ */ __name3((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
+__name4(estimateGraph, "estimateGraph");
+var isRecord2 = /* @__PURE__ */ __name4((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
 function* singleStepsOf(entry) {
   if (!isRecord2(entry)) return;
   switch (entry.type) {
@@ -6519,14 +6732,14 @@ function* singleStepsOf(entry) {
   }
 }
 __name(singleStepsOf, "singleStepsOf");
-__name3(singleStepsOf, "singleStepsOf");
+__name4(singleStepsOf, "singleStepsOf");
 function entriesOf(graph) {
   const definition = isRecord2(graph) ? graph.definition : void 0;
   const entries = isRecord2(definition) ? definition.graph : void 0;
   return Array.isArray(entries) ? entries : [];
 }
 __name(entriesOf, "entriesOf");
-__name3(entriesOf, "entriesOf");
+__name4(entriesOf, "entriesOf");
 function inheritTargets(graphs) {
   const targets = /* @__PURE__ */ new Set();
   for (const graph of graphs) {
@@ -6541,7 +6754,7 @@ function inheritTargets(graphs) {
   return targets;
 }
 __name(inheritTargets, "inheritTargets");
-__name3(inheritTargets, "inheritTargets");
+__name4(inheritTargets, "inheritTargets");
 function needsInheritedWorkspace(graph) {
   if (!isRecord2(graph) || graph.workspace !== void 0) return false;
   for (const entry of entriesOf(graph)) {
@@ -6552,7 +6765,7 @@ function needsInheritedWorkspace(graph) {
   return false;
 }
 __name(needsInheritedWorkspace, "needsInheritedWorkspace");
-__name3(needsInheritedWorkspace, "needsInheritedWorkspace");
+__name4(needsInheritedWorkspace, "needsInheritedWorkspace");
 
 // src/types/workflow.ts
 function createStep(s) {
@@ -6694,6 +6907,7 @@ var envRefKeys = /* @__PURE__ */ __name((v, into) => {
   }
   for (const inner of Object.values(v)) envRefKeys(inner, into);
 }, "envRefKeys");
+var foreachItemsNotLowered = /* @__PURE__ */ __name((what) => new LuaWorkflowBuildError("invalid-envelope", `foreach.items takes fromInit(path) / fromStep(step, path) or an initData.* / stepResults.* ref \u2014 ${what} is not a foreach source; .map({ '': \u2026 }, { id }) before the foreach instead`), "foreachItemsNotLowered");
 var refToDescriptor = /* @__PURE__ */ __name((items) => {
   if (!items) throw new LuaWorkflowBuildError("invalid-envelope", "foreach.items needs a ref");
   if ("initData" in items && items.initData === true) {
@@ -6703,11 +6917,14 @@ var refToDescriptor = /* @__PURE__ */ __name((items) => {
     };
   }
   if ("step" in items && typeof items.step === "string" && !("path" in items && items.path.startsWith("stepResults"))) {
+    if ("rows" in items) throw foreachItemsNotLowered("rows(\u2026) (a paged dataset)");
     return {
       step: items.step,
       path: items.path
     };
   }
+  if ("step" in items && Array.isArray(items.step)) throw foreachItemsNotLowered("a fan-in fromStep([\u2026])");
+  if (typeof items.path !== "string") throw foreachItemsNotLowered("value(\u2026) / template(\u2026) / fromRequest(\u2026) / fromKnowledge(\u2026)");
   const path = items.path;
   if (path.startsWith("initData")) return {
     initData: true,
@@ -7257,9 +7474,12 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
     if (opts.approver === "creator" && opts.excludeInitiator === true) {
       throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
     }
-    if (opts.fourEyes !== void 0 && opts.editable !== true) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": fourEyes requires editable:true`);
-    if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && opts.editable !== true) {
-      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths / editedPayloadSchema require editable:true`);
+    const editable = approvalEditable(opts);
+    if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": \`fourEyes\` requires editable:true`);
+    if (opts.editable === false && Array.isArray(opts.editablePaths) && opts.editablePaths.length > 0) {
+      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
+    } else if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && !editable) {
+      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
     }
     for (const p of opts.editablePaths ?? []) {
       if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);