lua-cli 3.33.0 → 3.35.0

package/dist/workflow-builder.js

@@ -100,6 +100,14 @@ function isAllowedReviewableExecuteTool(tool) {
 }
 __name(isAllowedReviewableExecuteTool, "isAllowedReviewableExecuteTool");
 __name2(isAllowedReviewableExecuteTool, "isAllowedReviewableExecuteTool");
+var REVIEWABLE_STANDING_START_TOOLS = [
+  "scheduleWorkflow"
+];
+function isReviewableStandingStartTool(tool) {
+  return REVIEWABLE_STANDING_START_TOOLS.includes(tool);
+}
+__name(isReviewableStandingStartTool, "isReviewableStandingStartTool");
+__name2(isReviewableStandingStartTool, "isReviewableStandingStartTool");
 var REVIEWABLE_MCP_SEND_TOOL_SUFFIX = "_create_messaging_message";
 function isReviewableMcpSendTool(tool) {
   return tool.length > REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length && tool.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX);
@@ -152,7 +160,7 @@ function mcpSendSiblingForDraftTool(tool, availableToolIds) {
 __name(mcpSendSiblingForDraftTool, "mcpSendSiblingForDraftTool");
 __name2(mcpSendSiblingForDraftTool, "mcpSendSiblingForDraftTool");
 function isReviewableExecuteTool(tool) {
-  return isAllowedReviewableExecuteTool(tool) || isReviewableMcpSendTool(tool);
+  return isAllowedReviewableExecuteTool(tool) || isReviewableMcpSendTool(tool) || isReviewableStandingStartTool(tool);
 }
 __name(isReviewableExecuteTool, "isReviewableExecuteTool");
 __name2(isReviewableExecuteTool, "isReviewableExecuteTool");
@@ -312,7 +320,10 @@ function transformChatHistoryContentParts(parts) {
         content.push({
           type: "file",
           data: part.data,
-          mediaType
+          mediaType,
+          ...part.filename && {
+            filename: part.filename
+          }
         });
       }
     }
@@ -1206,6 +1217,70 @@ function normalizeLuaJobExecutionTimeoutSeconds(timeout) {
 }
 __name(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
 __name2(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
+var KEYS = /* @__PURE__ */ new Set([
+  "v",
+  "kind",
+  "agentId",
+  "jobId",
+  "scheduledTime",
+  "triggerId"
+]);
+var MAX_BODY_BYTES = 4096;
+var MAX_ID_LENGTH = 512;
+var UTC_ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+function isId(value3) {
+  return typeof value3 === "string" && value3.length > 0 && value3.length <= MAX_ID_LENGTH;
+}
+__name(isId, "isId");
+__name2(isId, "isId");
+function parseScheduledJobFire(raw) {
+  if (new TextEncoder().encode(raw).byteLength > MAX_BODY_BYTES) {
+    throw new Error("Invalid scheduled job fire: body is too large");
+  }
+  let value3;
+  try {
+    value3 = JSON.parse(raw);
+  } catch {
+    throw new Error("Invalid scheduled job fire: body is not JSON");
+  }
+  if (!value3 || typeof value3 !== "object" || Array.isArray(value3)) {
+    throw new Error("Invalid scheduled job fire: body must be an object");
+  }
+  const record = value3;
+  if (Object.keys(record).some((key) => !KEYS.has(key))) {
+    throw new Error("Invalid scheduled job fire: unknown field");
+  }
+  if (record.v !== 1 || record.kind !== "scheduled-job-fire") {
+    throw new Error("Invalid scheduled job fire: unsupported contract");
+  }
+  if (!isId(record.agentId)) {
+    throw new Error("Invalid scheduled job fire: agentId is required");
+  }
+  if (!isId(record.jobId)) {
+    throw new Error("Invalid scheduled job fire: jobId is required");
+  }
+  if (typeof record.scheduledTime !== "string" || !UTC_ISO.test(record.scheduledTime) || !Number.isFinite(Date.parse(record.scheduledTime)) || ![
+    new Date(record.scheduledTime).toISOString(),
+    new Date(record.scheduledTime).toISOString().replace(".000Z", "Z")
+  ].includes(record.scheduledTime)) {
+    throw new Error("Invalid scheduled job fire: scheduledTime must be ISO 8601");
+  }
+  if (record.triggerId !== void 0 && !isId(record.triggerId)) {
+    throw new Error("Invalid scheduled job fire: triggerId must be a non-empty string");
+  }
+  return {
+    v: 1,
+    kind: "scheduled-job-fire",
+    agentId: record.agentId,
+    jobId: record.jobId,
+    scheduledTime: record.scheduledTime,
+    ...typeof record.triggerId === "string" ? {
+      triggerId: record.triggerId
+    } : {}
+  };
+}
+__name(parseScheduledJobFire, "parseScheduledJobFire");
+__name2(parseScheduledJobFire, "parseScheduledJobFire");
 var TEMPLATE_TRIGGER_URL_ENV_PREFIX = "LUA_TRIGGER_URL__";
 function triggerUrlEnvKey(triggerKey) {
   const upper = triggerKey.trim().replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
@@ -1550,7 +1625,20 @@ var ProjectedResourceSchema = z3.object({
     "platform-allowlist"
   ]),
   /** Product data only. A roster row confers nothing. */
-  rostered: z3.boolean()
+  rostered: z3.boolean(),
+  /**
+   * Ownership, product data only (PRO-1754). `createdBy` is the creating
+   * user's id straight off the sub-agent document; `owner` is that id
+   * resolved to a display identity after the list is decided. Both are
+   * absent when the document records no creator or the lookup fails —
+   * they never influence which resources are listed.
+   */
+  createdBy: z3.string().min(1).max(256).optional(),
+  owner: z3.object({
+    id: z3.string().min(1).max(256),
+    name: z3.string().optional(),
+    email: z3.string().optional()
+  }).optional()
 }).passthrough();
 var CapabilityProfilesSchema = z3.record(z3.string().min(1).max(64), z3.array(ProjectedScopeSchema));
 var RoleCatalogSchema = z3.record(z3.string().min(1).max(128), z3.object({
@@ -3078,6 +3166,169 @@ var fromKnowledge = /* @__PURE__ */ __name4((k) => ({
 }), "fromKnowledge");
 var SideEffectsSchema = z4.enum(WORKFLOW_SIDE_EFFECTS);
 var JobResourcesSchema = z4.enum(WORKFLOW_JOB_RESOURCES);
+var WORKFLOW_MODEL_TEMPLATE_ROOT = "initData";
+var WORKFLOW_MODEL_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*(?:\|([^}]*))?\}$/;
+var PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
+function looksLikeModelTemplate(model) {
+  return typeof model === "string" && model.includes("${");
+}
+__name(looksLikeModelTemplate, "looksLikeModelTemplate");
+__name4(looksLikeModelTemplate, "looksLikeModelTemplate");
+function parseModelTemplate(model) {
+  if (!looksLikeModelTemplate(model)) return {
+    kind: "static"
+  };
+  const trimmed = model.trim();
+  const m = WORKFLOW_MODEL_TEMPLATE_RE.exec(trimmed);
+  if (!m) {
+    const inner = /^\$\{([^}]*)\}$/.exec(trimmed)?.[1];
+    const root = inner?.split(/[.|]/, 1)[0];
+    const why = inner !== void 0 && root !== void 0 && root !== WORKFLOW_MODEL_TEMPLATE_ROOT ? `only the \`${WORKFLOW_MODEL_TEMPLATE_ROOT}\` root is allowed (got \`${root || "(empty)"}\`)` : inner !== void 0 && (inner === WORKFLOW_MODEL_TEMPLATE_ROOT || inner.startsWith(`${WORKFLOW_MODEL_TEMPLATE_ROOT}.`)) ? "the path after `initData.` is empty" : "the whole value must be exactly one placeholder \u2014 no prefix, suffix or second placeholder";
+    return {
+      kind: "invalid",
+      message: modelTemplateInvalidMessage(model, why)
+    };
+  }
+  const path = m[1];
+  if (!path.split(".").every((seg) => PATH_SEGMENT_RE.test(seg))) {
+    return {
+      kind: "invalid",
+      message: modelTemplateInvalidMessage(model, `the path \`${path}\` is not a dotted path of names and canonical [n] indexes`)
+    };
+  }
+  if (m[2] !== void 0) {
+    const dflt = m[2].trim();
+    if (!dflt) return {
+      kind: "invalid",
+      message: modelTemplateInvalidMessage(model, "the default after `|` is empty")
+    };
+    if (dflt.includes("|")) {
+      return {
+        kind: "invalid",
+        message: modelTemplateInvalidMessage(model, "a placeholder names ONE default \u2014 a second `|` is not a fallback chain")
+      };
+    }
+    return {
+      kind: "template",
+      template: {
+        placeholder: trimmed,
+        path,
+        default: dflt
+      }
+    };
+  }
+  return {
+    kind: "template",
+    template: {
+      placeholder: trimmed,
+      path
+    }
+  };
+}
+__name(parseModelTemplate, "parseModelTemplate");
+__name4(parseModelTemplate, "parseModelTemplate");
+function modelTemplateInvalidMessage(model, why) {
+  return `model "${model.trim()}" is not a valid run-input-bound model placeholder \u2014 ${why}; the forms are \${initData.<path>} and \${initData.<path>|<provider/model default>}`;
+}
+__name(modelTemplateInvalidMessage, "modelTemplateInvalidMessage");
+__name4(modelTemplateInvalidMessage, "modelTemplateInvalidMessage");
+function modelTemplateDefaultRequiredMessage(model) {
+  return `model "${model}" runs on the Job tier, so its placeholder needs a default \u2014 the harness / provider gates (harness:'claude-code' needs an Anthropic model) classify it at push; write ${model.replace(/\}$/, "|<provider/model>}")}`;
+}
+__name(modelTemplateDefaultRequiredMessage, "modelTemplateDefaultRequiredMessage");
+__name4(modelTemplateDefaultRequiredMessage, "modelTemplateDefaultRequiredMessage");
+function staticModelPin(model) {
+  if (typeof model !== "string") return void 0;
+  const parsed = parseModelTemplate(model);
+  if (parsed.kind === "static") return model;
+  if (parsed.kind === "template") return parsed.template.default;
+  return void 0;
+}
+__name(staticModelPin, "staticModelPin");
+__name4(staticModelPin, "staticModelPin");
+function readPath(root, path) {
+  let cur = root;
+  for (const seg of path.split(".")) {
+    const name = seg.replace(/\[(?:0|[1-9]\d*)\]/g, "");
+    const indexes = [
+      ...seg.matchAll(/\[(0|[1-9]\d*)\]/g)
+    ].map((x) => Number(x[1]));
+    if (cur === null || typeof cur !== "object") return void 0;
+    cur = cur[name];
+    for (const i of indexes) {
+      if (!Array.isArray(cur)) return void 0;
+      cur = cur[i];
+    }
+  }
+  return cur;
+}
+__name(readPath, "readPath");
+__name4(readPath, "readPath");
+function renderModelTemplate(model, initData) {
+  if (model === void 0 || !looksLikeModelTemplate(model)) return {
+    ok: true,
+    model,
+    source: "static"
+  };
+  const parsed = parseModelTemplate(model);
+  if (parsed.kind === "invalid") {
+    return {
+      ok: false,
+      placeholder: model.trim(),
+      path: "",
+      reason: "invalid",
+      message: parsed.message
+    };
+  }
+  if (parsed.kind === "static") return {
+    ok: true,
+    model,
+    source: "static"
+  };
+  const { placeholder, path } = parsed.template;
+  if (initData !== void 0 && initData !== null && (typeof initData !== "object" || Array.isArray(initData))) {
+    return {
+      ok: false,
+      placeholder,
+      path,
+      reason: "input-not-object",
+      message: modelTemplateInputNotObjectMessage(placeholder, initData)
+    };
+  }
+  const value22 = readPath(initData, path);
+  const reason = value22 === void 0 || value22 === null ? "unbound" : typeof value22 !== "string" ? "not-a-string" : value22.trim() ? null : "empty";
+  if (reason === null) return {
+    ok: true,
+    model: value22.trim(),
+    source: "initData"
+  };
+  if (parsed.template.default !== void 0) return {
+    ok: true,
+    model: parsed.template.default,
+    source: "default"
+  };
+  return {
+    ok: false,
+    placeholder,
+    path,
+    reason,
+    message: modelTemplateUnboundMessage(placeholder, path, reason)
+  };
+}
+__name(renderModelTemplate, "renderModelTemplate");
+__name4(renderModelTemplate, "renderModelTemplate");
+function modelTemplateUnboundMessage(placeholder, path, reason) {
+  const what = reason === "unbound" ? `the run input has no ${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path}` : reason === "empty" ? `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path} is empty on the run input` : `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path} on the run input is not a string`;
+  return `model placeholder "${placeholder}" is unbound \u2014 ${what} and the placeholder declares no default; pass one in the run input or write \${${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path}|<provider/model>}`;
+}
+__name(modelTemplateUnboundMessage, "modelTemplateUnboundMessage");
+__name4(modelTemplateUnboundMessage, "modelTemplateUnboundMessage");
+function modelTemplateInputNotObjectMessage(placeholder, initData) {
+  const type = Array.isArray(initData) ? "an array" : `a ${typeof initData}`;
+  return `model placeholder "${placeholder}" cannot be rendered \u2014 the run input is ${type}, not an object; start the run with an object input (a JSON string must be parsed before it is passed)`;
+}
+__name(modelTemplateInputNotObjectMessage, "modelTemplateInputNotObjectMessage");
+__name4(modelTemplateInputNotObjectMessage, "modelTemplateInputNotObjectMessage");
 var APPROVER_SPEC_MAX_USERS = 20;
 var ESCALATION_MAX_HOPS = 3;
 var TemplateBindingSchema = z22.object({
@@ -3618,6 +3869,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
   }
   const declaredKeys = new Set(opts.connectionKeys ?? []);
+  const ownKeys = /* @__PURE__ */ new Set();
   if (g.connections !== void 0 && !Array.isArray(g.connections)) {
     err("connection-declaration-invalid", "`connections` must be an array of { key, integrationType }", "connections");
   }
@@ -3629,7 +3881,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("connection-declaration-invalid", `connections[${i}].key must match ${WORKFLOW_CONNECTION_KEY_RE}`, `${path}.key`);
       return;
     }
-    if (declaredKeys.has(key)) {
+    if (ownKeys.has(key)) {
       err("connection-declaration-invalid", `connections[${i}].key "${key}" is declared twice`, `${path}.key`);
       return;
     }
@@ -3637,6 +3889,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("connection-declaration-invalid", `connections[${i}] ("${key}") needs an integrationType (the catalog slug, e.g. 'github')`, `${path}.integrationType`);
       return;
     }
+    ownKeys.add(key);
     declaredKeys.add(key);
   });
   const undeclaredKey = /* @__PURE__ */ __name4((ref) => typeof ref === "string" && !declaredKeys.has(ref) && isConnectionKeyShaped(ref) && opts.connectionIds?.has(ref) !== true, "undeclaredKey");
@@ -3763,7 +4016,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (node.harness !== void 0 && node.tier !== "job") {
       err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path}.harness`, id);
     }
-    const provider = node.type === "agent" ? classifyModelProvider(node.model) : null;
+    const provider = node.type === "agent" ? classifyModelProvider(staticModelPin(node.model)) : null;
     if (node.harness === "claude-code" && provider !== null && provider !== "anthropic") {
       err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path}.harness`, id);
     }
@@ -3773,18 +4026,32 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   }, "checkTier");
   const checkModel = /* @__PURE__ */ __name4((node, path) => {
     if (node.type !== "agent" || typeof node.model !== "string") return;
+    const id = singleId(node);
+    const parsed = parseModelTemplate(node.model);
+    if (parsed.kind === "invalid") {
+      err("model-template-invalid", parsed.message, `${path}.model`, id);
+      return;
+    }
+    if (parsed.kind === "template" && parsed.template.default === void 0) {
+      if (isJobTier(node)) {
+        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path}.model`, id);
+      }
+      return;
+    }
+    const pin = parsed.kind === "template" ? parsed.template.default : node.model;
+    if (pin === void 0) return;
+    const inContext = /* @__PURE__ */ __name4((message) => parsed.kind === "template" ? `${message} (the default of ${parsed.template.placeholder})` : message, "inContext");
     const registry = opts.approvedModels;
     if (registry === void 0) return;
-    const id = singleId(node);
     if (registry === "unavailable") {
-      const pin = node.model.trim();
-      if (pin && !normalizeModelId(pin, []).ok) {
-        warn("model-unresolved", `model "${pin}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`, `${path}.model`, id);
+      const trimmed = pin.trim();
+      if (trimmed && !normalizeModelId(trimmed, []).ok) {
+        warn("model-unresolved", inContext(`model "${trimmed}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path}.model`, id);
       }
       return;
     }
-    const resolved = normalizeModelId(node.model, registry);
-    if (!resolved.ok) err("model-unresolved", modelUnresolvedMessage(resolved), `${path}.model`, id);
+    const resolved = normalizeModelId(pin, registry);
+    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path}.model`, id);
   }, "checkModel");
   const checkWorkspace = /* @__PURE__ */ __name4((node, path) => {
     const id = singleId(node);
@@ -5764,7 +6031,16 @@ var STEP_ERROR_DETAIL_KEYS = [
   "secretName",
   "executionId",
   "credentialsExecutionId",
-  "expired"
+  "expired",
+  // Run-input-bound model pins (the Principal Engineer stage models): the Job tier's `MODEL_ERROR` refusals name the
+  // pin they judged (`requested`), the declared harness, the provider the classifier read and the precedence leg the
+  // pin came from (`source`: initData / default / node / env / org / stamp), and `provider_unsupported`'s fleet
+  // (`allowed`, the LUA_WF_JOB_PROVIDERS list) — the members the PR body promises.
+  "requested",
+  "harness",
+  "provider",
+  "source",
+  "allowed"
 ];
 var STEP_ERROR_DETAIL_MAX_BYTES = 8 * 1024;
 var DETAIL_MAX_DEPTH = 4;
@@ -6766,6 +7042,42 @@ function needsInheritedWorkspace(graph) {
 }
 __name(needsInheritedWorkspace, "needsInheritedWorkspace");
 __name4(needsInheritedWorkspace, "needsInheritedWorkspace");
+function armEntry2(arm) {
+  return Array.isArray(arm) ? arm[arm.length - 1] : arm;
+}
+__name(armEntry2, "armEntry2");
+__name4(armEntry2, "armEntry");
+function entryHasJobTier(entry) {
+  const n2 = armEntry2(entry);
+  if (!n2 || typeof n2 !== "object") return false;
+  const node = n2;
+  if (node.tier === "job") return true;
+  const ws = node.workspace;
+  if (ws !== void 0 && ws !== "inherit") return true;
+  switch (node.type) {
+    case "parallel":
+      return Array.isArray(node.steps) && node.steps.some(entryHasJobTier);
+    case "conditional":
+      return Array.isArray(node.steps) && node.steps.some(entryHasJobTier) || node.otherwise !== void 0 && entryHasJobTier(node.otherwise);
+    case "foreach":
+    case "loop":
+      return entryHasJobTier(node.step);
+    default:
+      return false;
+  }
+}
+__name(entryHasJobTier, "entryHasJobTier");
+__name4(entryHasJobTier, "entryHasJobTier");
+function graphHasJobTierStep(envelopeOrGraph) {
+  if (!envelopeOrGraph || typeof envelopeOrGraph !== "object") return false;
+  const env = envelopeOrGraph;
+  const envWorkspace = env.workspace;
+  if (envWorkspace !== void 0 && envWorkspace !== "inherit") return true;
+  const graph = Array.isArray(envelopeOrGraph) ? envelopeOrGraph : env.definition?.graph ?? [];
+  return Array.isArray(graph) && graph.some(entryHasJobTier);
+}
+__name(graphHasJobTierStep, "graphHasJobTierStep");
+__name4(graphHasJobTierStep, "graphHasJobTierStep");
 
 // src/types/workflow.ts
 function createStep(s) {