lua-cli 3.38.0 → 3.39.1

package/dist/api-exports.js

@@ -18,6 +18,7 @@ var __export = (target, all) => {
 import { z } from "zod";
 import { z as z2 } from "zod";
 import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 function isChannelConversationChannel(channel) {
   return !!channel && CHANNEL_CONVERSATION_CHANNELS.includes(channel);
 }
@@ -114,9 +115,9 @@ function isMcpDraftCreateTool(tool) {
 function mcpSendSiblingForDraftTool(tool, availableToolIds) {
   const candidates = [
     ...availableToolIds
-  ].filter((id) => id.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id) => ({
-    id,
-    serverName: id.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
+  ].filter((id2) => id2.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id2) => ({
+    id: id2,
+    serverName: id2.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
   })).filter(({ serverName }) => tool.startsWith(`${serverName}_`)).sort((a, b) => b.serverName.length - a.serverName.length);
   return candidates[0]?.id;
 }
@@ -277,8 +278,8 @@ function transformChatHistoryContentParts(parts) {
   }
   return content;
 }
-function isSyntheticSideRow(id) {
-  return id.startsWith(SCREENSHOT_MESSAGE_ID_PREFIX) || id.startsWith(RICH_PARTS_MESSAGE_ID_PREFIX);
+function isSyntheticSideRow(id2) {
+  return id2.startsWith(SCREENSHOT_MESSAGE_ID_PREFIX) || id2.startsWith(RICH_PARTS_MESSAGE_ID_PREFIX);
 }
 function mergeRichPartMirrorMessages(messages, sameTurnGroup) {
   const merged = [];
@@ -359,6 +360,155 @@ function foldRichPartsIntoMessages(messages, records, makeMessage, sameTurnGroup
   while (next < synthetic.length) combined.push(synthetic[next++].message);
   return mergeRichPartMirrorMessages(combined, sameTurnGroup);
 }
+function utf8WidthAt(value3, index) {
+  const code = value3.charCodeAt(index);
+  if (code < 128) return {
+    bytes: 1,
+    units: 1
+  };
+  if (code < 2048) return {
+    bytes: 2,
+    units: 1
+  };
+  if (code >= 55296 && code <= 56319) {
+    const next = value3.charCodeAt(index + 1);
+    if (next >= 56320 && next <= 57343) return {
+      bytes: 4,
+      units: 2
+    };
+  }
+  return {
+    bytes: 3,
+    units: 1
+  };
+}
+function utf8ByteLength(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const width = utf8WidthAt(value3, i);
+    bytes += width.bytes;
+    i += width.units;
+  }
+  return bytes;
+}
+function clampUtf8(value3, maxBytes) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const width = utf8WidthAt(value3, i);
+    if (bytes + width.bytes > maxBytes) return value3.slice(0, i);
+    bytes += width.bytes;
+    i += width.units;
+  }
+  return value3;
+}
+function mapBytes(fields, withMark) {
+  return utf8ByteLength(JSON.stringify(withMark ? {
+    ...fields,
+    [LOG_FIELDS_CLAMPED_KEY]: true
+  } : fields));
+}
+function withValueCap(fields, capBytes) {
+  const out = {};
+  for (const [key, value3] of Object.entries(fields)) {
+    out[key] = typeof value3 === "string" ? clampUtf8(value3, capBytes) : value3;
+  }
+  return out;
+}
+function describeValue(value3) {
+  if (value3 === null) return "null";
+  if (value3 === void 0) return "undefined";
+  if (Array.isArray(value3)) return "an array";
+  return typeof value3 === "object" ? "an object" : `a ${typeof value3}`;
+}
+function assertValidLogFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is not allowed \u2014 a key must match ${LOG_FIELD_KEY_PATTERN.source} (lower-case, starts with a letter, then letters/digits/underscore, at most 64 characters)`);
+  }
+  if (LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key))) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is not allowed \u2014 it has the shape of a credential that the log-drain scrubber masks in values; a field KEY is never scrubbed, so it may never carry a secret shape`);
+  }
+  if (key === LOG_FIELDS_CLAMPED_KEY) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is reserved \u2014 the platform sets it to mark a field map it had to clamp`);
+  }
+}
+function normalizeLogFields(fields) {
+  if (fields === void 0 || fields === null) return void 0;
+  if (typeof fields !== "object" || Array.isArray(fields)) {
+    throw new LuaLogFieldsError(`log fields: expected a plain object of fields, received ${describeValue(fields)}`);
+  }
+  const entries = Object.entries(fields);
+  if (entries.length > LOG_FIELDS_MAX_KEYS) {
+    throw new LuaLogFieldsError(`log fields: ${entries.length} keys exceeds the cap of ${LOG_FIELDS_MAX_KEYS} keys per call`);
+  }
+  const out = {};
+  for (const [key, value3] of entries) {
+    assertValidLogFieldKey(key);
+    if (typeof value3 === "string" || typeof value3 === "boolean") {
+      out[key] = value3;
+      continue;
+    }
+    if (typeof value3 === "number") {
+      if (!Number.isFinite(value3)) {
+        throw new LuaLogFieldsError(`log fields: \`${key}\` must be a finite number \u2014 NaN and Infinity have no JSON form`);
+      }
+      out[key] = value3;
+      continue;
+    }
+    if (Array.isArray(value3)) {
+      const parts = [];
+      for (const element of value3) {
+        if (typeof element !== "string") {
+          throw new LuaLogFieldsError(`log fields: \`${key}\` is an array, so every element must be a string (found ${describeValue(element)})`);
+        }
+        if (element.includes(",")) {
+          throw new LuaLogFieldsError(`log fields: \`${key}\` \u2014 an array element may not contain a comma; elements are comma-joined into one value (with \`${key}${LOG_FIELD_ARRAY_COUNT_SUFFIX}\` beside it), so a comma inside one would be indistinguishable from the separator`);
+        }
+        parts.push(element);
+      }
+      out[key] = parts.join(",");
+      out[`${key}${LOG_FIELD_ARRAY_COUNT_SUFFIX}`] = parts.length;
+      continue;
+    }
+    throw new LuaLogFieldsError(`log fields: \`${key}\` must be a string, number, boolean or string[] \u2014 received ${describeValue(value3)}` + (value3 !== null && typeof value3 === "object" ? " (nested objects are not supported)" : ""));
+  }
+  const keys = Object.keys(out);
+  if (keys.length === 0) return void 0;
+  if (keys.length > LOG_FIELDS_MAX_KEYS) {
+    throw new LuaLogFieldsError(`log fields: ${keys.length} keys exceeds the cap of ${LOG_FIELDS_MAX_KEYS} keys per call \u2014 an array field also contributes its \`${LOG_FIELD_ARRAY_COUNT_SUFFIX.slice(1)}\` sibling`);
+  }
+  if (clampLogFields(out)) out[LOG_FIELDS_CLAMPED_KEY] = true;
+  return out;
+}
+function clampLogFields(out) {
+  let clamped = false;
+  for (const [key, value3] of Object.entries(out)) {
+    if (typeof value3 !== "string") continue;
+    const capped = clampUtf8(value3, LOG_FIELD_MAX_VALUE_BYTES);
+    if (capped !== value3) {
+      out[key] = capped;
+      clamped = true;
+    }
+  }
+  if (mapBytes(out, clamped) <= LOG_FIELDS_MAX_BYTES) return clamped;
+  const base = {
+    ...out
+  };
+  let low = 0;
+  let high = LOG_FIELD_MAX_VALUE_BYTES;
+  let best = 0;
+  while (low <= high) {
+    const mid = Math.floor((low + high) / 2);
+    if (mapBytes(withValueCap(base, mid), true) <= LOG_FIELDS_MAX_BYTES) {
+      best = mid;
+      low = mid + 1;
+    } else {
+      high = mid - 1;
+    }
+  }
+  const fitted = withValueCap(base, best);
+  for (const key of Object.keys(out)) out[key] = fitted[key];
+  return true;
+}
 function isDesktopFileCommandName(value3) {
   return typeof value3 === "string" && DESKTOP_FILE_COMMAND_SET.has(value3);
 }
@@ -449,12 +599,12 @@ function isWorkflowArmEntryType(type) {
 function workflowContainerRunsHitlArm(container) {
   return typeof container === "string" && WORKFLOW_HITL_ARM_CONTAINERS.includes(container);
 }
-function workflowHitlArmUnsupportedMessage(type, id, container) {
+function workflowHitlArmUnsupportedMessage(type, id2, container) {
   const legal = WORKFLOW_HITL_ARM_CONTAINERS.map((c) => `\`${c}\``).join(" / ");
-  return `the engine does not run \`${type}\` inside a \`${container}\` yet (node "${id}") \u2014 place it at the top level, as a ${legal} arm, or inside a child \`workflow\``;
+  return `the engine does not run \`${type}\` inside a \`${container}\` yet (node "${id2}") \u2014 place it at the top level, as a ${legal} arm, or inside a child \`workflow\``;
 }
-function workflowHitlArmShapeMessage(type, id, shape) {
-  return shape === "mapped-arm" ? `\`${type}\` arm "${id}" takes the previous output as its payload \u2014 it cannot head a [mapping, step] chain; map before the container instead` : `a chunked foreach hands each child a slice of items, not one \u2014 \`${type}\` body "${id}" takes one item; drop \`chunk\``;
+function workflowHitlArmShapeMessage(type, id2, shape) {
+  return shape === "mapped-arm" ? `\`${type}\` arm "${id2}" takes the previous output as its payload \u2014 it cannot head a [mapping, step] chain; map before the container instead` : `a chunked foreach hands each child a slice of items, not one \u2014 \`${type}\` body "${id2}" takes one item; drop \`chunk\``;
 }
 function isModelIdSentinel(input) {
   const lower = (input ?? "").trim().toLowerCase();
@@ -586,6 +736,81 @@ function buildDefaultPersona(agentName) {
 function buildPersonalSpaceStartingPersona(agentName) {
   return PERSONAL_SPACE_STARTING_PERSONA.replace(new RegExp(AGENT_NAME_TOKEN.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), () => agentName || "Your assistant");
 }
+function utf8Bytes(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const code = value3.charCodeAt(i);
+    if (code < 128) {
+      bytes += 1;
+      i += 1;
+    } else if (code < 2048) {
+      bytes += 2;
+      i += 1;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value3.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        i += 2;
+      } else {
+        bytes += 3;
+        i += 1;
+      }
+    } else {
+      bytes += 3;
+      i += 1;
+    }
+  }
+  return bytes;
+}
+function isPlainFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
+  return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+function describeAgentLogFieldsViolation(value3) {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) {
+    return "fields must be an object";
+  }
+  const entries = Object.entries(value3);
+  let userKeys = 0;
+  for (const [key, entry] of entries) {
+    if (key === LOG_FIELDS_CLAMPED_KEY) {
+      if (entry !== true) return `fields.${key} must be true`;
+      continue;
+    }
+    userKeys += 1;
+    if (key.endsWith(LOG_FIELD_ARRAY_COUNT_SUFFIX)) {
+      const base = key.slice(0, -LOG_FIELD_ARRAY_COUNT_SUFFIX.length);
+      if (!isPlainFieldKey(base)) return `fields key \`${key}\` is not a legal field key`;
+      if (typeof entry !== "number" || !Number.isFinite(entry)) {
+        return `fields.${key} must be a finite number`;
+      }
+      continue;
+    }
+    if (!isPlainFieldKey(key)) return `fields key \`${key}\` is not a legal field key`;
+    if (typeof entry === "string") {
+      if (utf8Bytes(entry) > LOG_FIELD_MAX_VALUE_BYTES) {
+        return `fields.${key} exceeds ${LOG_FIELD_MAX_VALUE_BYTES} bytes`;
+      }
+      continue;
+    }
+    if (typeof entry === "boolean") continue;
+    if (typeof entry === "number") {
+      if (!Number.isFinite(entry)) return `fields.${key} must be a finite number`;
+      continue;
+    }
+    return `fields.${key} must be a string, number or boolean`;
+  }
+  if (userKeys > LOG_FIELDS_MAX_KEYS) {
+    return `fields has ${userKeys} keys, over the cap of ${LOG_FIELDS_MAX_KEYS}`;
+  }
+  if (utf8Bytes(JSON.stringify(value3)) > LOG_FIELDS_MAX_BYTES) {
+    return `fields exceeds ${LOG_FIELDS_MAX_BYTES} bytes`;
+  }
+  return void 0;
+}
+function isAgentLogFields(value3) {
+  return describeAgentLogFieldsViolation(value3) === void 0;
+}
 function maxDrainsForTier(tier) {
   return tier === "enterprise" ? LOG_DRAIN_MAX_PER_ORG_ENTERPRISE : LOG_DRAIN_MAX_PER_ORG;
 }
@@ -594,6 +819,148 @@ function resolvePresetEndpoint(type, site) {
   if (!template3 || !site) return void 0;
   return template3.replace("{site}", site);
 }
+function isLogDrainBucketHostAllowed(provider, host) {
+  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (!normalized) return false;
+  return (LOG_DRAIN_BUCKET_HOST_PATTERNS[provider] ?? []).some((pattern) => pattern.test(normalized));
+}
+function resolveDrainBucketEndpoint(bucket) {
+  if (!LOG_DRAIN_BUCKET_NAME_PATTERN.test(bucket.bucket)) {
+    throw new Error("log drain bucket name is not a valid S3 bucket label");
+  }
+  if (bucket.provider === "aws") {
+    const region = bucket.region.trim().toLowerCase();
+    if (!/^[a-z0-9-]{1,32}$/.test(region)) throw new Error("log drain bucket region is not an AWS region");
+    return `https://${bucket.bucket}.s3.${region}.amazonaws.com`;
+  }
+  if (!bucket.endpoint) throw new Error(`log drain '${bucket.provider}' bucket requires an endpoint`);
+  let url;
+  try {
+    url = new URL(bucket.endpoint);
+  } catch {
+    throw new Error(`log drain '${bucket.provider}' bucket endpoint is not an absolute URL`);
+  }
+  if (url.protocol !== "https:") throw new Error(`log drain '${bucket.provider}' bucket endpoint must be https`);
+  return `https://${url.host}/${bucket.bucket}`;
+}
+function drainBucketUsesPathStyle(provider) {
+  return provider !== "aws";
+}
+function presetIntakeHosts(type) {
+  const template3 = LOG_DRAIN_ENDPOINT_TEMPLATES[type];
+  const sites = LOG_DRAIN_PRESET_SITES[type];
+  if (!template3 || !sites) return [];
+  const hosts = [];
+  for (const site of sites) {
+    try {
+      hosts.push(new URL(template3.replace("{site}", site)).hostname.toLowerCase());
+    } catch {
+    }
+  }
+  return hosts;
+}
+function presetHostAllowlist(type) {
+  return [
+    ...presetIntakeHosts(type),
+    ...LOG_DRAIN_PRESET_HOST_SUFFIXES[type] ?? []
+  ];
+}
+function drainHostAllowlistAllows(allowlist, host) {
+  const needle = host.toLowerCase();
+  return allowlist.some((raw) => {
+    const entry = raw.toLowerCase();
+    if (entry.startsWith(".")) return needle === entry.slice(1) || needle.endsWith(entry);
+    return entry === needle;
+  });
+}
+function drainDestinationIsVendorPinned(type) {
+  if (LOG_DRAIN_ENDPOINT_TEMPLATES[type]) return true;
+  return presetHostAllowlist(type).length > 0;
+}
+function drainVerificationOwnership(input) {
+  if (input.proved === true) return "verified";
+  if (input.mode === "test-post" && drainDestinationIsVendorPinned(input.type)) return "verified";
+  return "reachability-only";
+}
+function drainOwnershipOrDefault(ownership) {
+  return ownership === "verified" ? "verified" : "reachability-only";
+}
+function assertDrainContentAck(input) {
+  const turningOn = input.next === true && input.was !== true;
+  if (!turningOn) return void 0;
+  if (input.ack !== true) throw new DrainContentAckRequiredError();
+  return {
+    by: input.actor,
+    source: input.source,
+    at: input.at,
+    ...input.inheritedFrom ? {
+      inheritedFrom: input.inheritedFrom
+    } : {}
+  };
+}
+function composePresetEndpoint(type, endpoint) {
+  const rule = LOG_DRAIN_PRESET_PATHS[type];
+  if (!rule) return void 0;
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    return {
+      ok: false,
+      reason: "invalid_url"
+    };
+  }
+  if (url.protocol !== "https:" || !url.hostname) return {
+    ok: false,
+    reason: "invalid_url"
+  };
+  const origin = url.origin;
+  const path3 = url.pathname.replace(/\/+$/, "");
+  if (!rule.segment) {
+    const base2 = path3.endsWith(rule.path) ? path3.slice(0, path3.length - rule.path.length) : path3;
+    return {
+      ok: true,
+      endpoint: `${origin}${base2}${rule.path}`
+    };
+  }
+  const marker = `${rule.path}/`;
+  const at = path3.indexOf(marker);
+  if (at < 0) {
+    return {
+      ok: false,
+      reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
+    };
+  }
+  const base = path3.slice(0, at);
+  const afterMarker = path3.slice(at + marker.length);
+  const rest = rule.suffix && afterMarker.endsWith(rule.suffix) ? afterMarker.slice(0, afterMarker.length - rule.suffix.length) : afterMarker;
+  if (!rest || rest.includes("/")) {
+    return {
+      ok: false,
+      reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
+    };
+  }
+  if (!PRESET_SEGMENT_RE.test(rest)) return {
+    ok: false,
+    reason: "bad_segment"
+  };
+  if (rule.segment === "dataset") {
+    return {
+      ok: true,
+      endpoint: `${origin}${base}${rule.path}/${rest}${rule.suffix ?? ""}`,
+      dataset: rest
+    };
+  }
+  return {
+    ok: true,
+    endpoint: `${origin}${base}${rule.path}/`,
+    token: rest
+  };
+}
+function joinPresetEndpointToken(endpoint, token) {
+  if (typeof token !== "string" || !PRESET_SEGMENT_RE.test(token)) return endpoint;
+  return endpoint.endsWith("/") ? `${endpoint}${token}` : `${endpoint}/${token}`;
+}
 function nextLogDrainQuotaResetAt(now) {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1)).toISOString();
 }
@@ -640,6 +1007,264 @@ function logDrainQuotaDroppedSeverities(degradation) {
       return [];
   }
 }
+function isLogExportSource(source) {
+  return LOG_EXPORT_SOURCES.includes(source);
+}
+function clamp(value3, max) {
+  if (typeof value3 !== "string") return void 0;
+  const trimmed = value3.trim();
+  if (!trimmed) return void 0;
+  return trimmed.length <= max ? trimmed : `${trimmed.slice(0, max - 1)}\u2026`;
+}
+function numberOr(value3, fallback) {
+  return typeof value3 === "number" && Number.isFinite(value3) ? value3 : fallback;
+}
+function isoOr(value3) {
+  return typeof value3 === "string" && value3.length > 0 ? value3 : void 0;
+}
+function logDrainNoticeView(drain, now) {
+  const health = drain.health ?? {};
+  const quota = drain.quota;
+  const view = {
+    id: String(drain.id ?? ""),
+    name: String(drain.name ?? ""),
+    type: drain.type,
+    state: drain.state,
+    deliveredCount24h: numberOr(health.deliveredCount24h, 0),
+    droppedCount24h: numberOr(health.droppedCount24h, 0),
+    rejectedCount24h: numberOr(health.rejectedCount24h, 0),
+    backlog: numberOr(health.backlog, 0),
+    quotaRatio: quota ? logDrainQuotaRatio(quota, now) : 0
+  };
+  if (health.pauseReason) view.pauseReason = health.pauseReason;
+  const lastError = clamp(health.lastError, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS);
+  if (lastError) view.lastError = lastError;
+  if (typeof health.lastStatusCode === "number") view.lastStatusCode = health.lastStatusCode;
+  const lastSuccessAt = isoOr(health.lastSuccessAt);
+  if (lastSuccessAt) view.lastSuccessAt = lastSuccessAt;
+  const lastFailureAt = isoOr(health.lastFailureAt);
+  if (lastFailureAt) view.lastFailureAt = lastFailureAt;
+  const resetsAt = isoOr(quota?.resetsAt);
+  if (resetsAt) view.quotaResetsAt = resetsAt;
+  return view;
+}
+function logDrainHealthCardPath(orgId, drainId) {
+  return `/orgs/${encodeURIComponent(orgId)}/log-drains/${encodeURIComponent(drainId)}`;
+}
+function percent(ratio) {
+  if (!Number.isFinite(ratio) || ratio <= 0) return "0%";
+  return `${Math.round(ratio * 100)}%`;
+}
+function becauseClause(view) {
+  const bits = [];
+  if (view.lastStatusCode) bits.push(`HTTP ${view.lastStatusCode}`);
+  if (view.lastError) bits.push(view.lastError);
+  return bits.length ? ` Last error: ${bits.join(" \u2014 ")}.` : "";
+}
+function logDrainNoticeCopy(payload) {
+  const view = payload.drain;
+  const name = view.name || view.id;
+  const backlog = view.backlog > 0 ? ` ${view.backlog.toLocaleString("en-US")} records are buffered.` : "";
+  switch (payload.kind) {
+    case "failing":
+      return {
+        title: name,
+        subject: `Log drain "${name}" is failing`,
+        previewLine: "Failing \u2014 15 minutes without a successful delivery",
+        summary: `The log drain "${name}" (${view.type}) has gone 15 minutes without a successful delivery and is now failing.${becauseClause(view)}${backlog} Records keep buffering; the drain pauses itself after 24 hours without a success.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "paused_auto":
+      return {
+        title: name,
+        subject: `Log drain "${name}" was paused`,
+        previewLine: "Paused \u2014 24 hours without a successful delivery",
+        summary: `The log drain "${name}" (${view.type}) was paused automatically after 24 hours without a successful delivery.${becauseClause(view)}${backlog} Nothing is being sent while it is paused, and the buffer is delivered on resume. Fix the destination, then resume it from the drain's health card or with \`lua drains resume ${view.id}\`.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "paused_quota":
+      return {
+        title: name,
+        subject: `Log drain "${name}" was paused \u2014 daily quota exhausted`,
+        previewLine: `Paused \u2014 ${percent(view.quotaRatio)} of the daily allowance used`,
+        summary: `The log drain "${name}" (${view.type}) reached ${percent(view.quotaRatio)} of its daily allowance and was paused.${backlog} Records keep buffering. The allowance resets${view.quotaResetsAt ? ` at ${view.quotaResetsAt}` : " at 00:00 UTC"}; narrow the drain's sources or raise the plan's limit to stop it happening again, then resume it with \`lua drains resume ${view.id}\`.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "quota_warning":
+      return {
+        title: name,
+        subject: `Log drain "${name}" has used 80% of its daily allowance`,
+        previewLine: `${percent(view.quotaRatio)} of the daily allowance used`,
+        summary: `The log drain "${name}" (${view.type}) has used ${percent(view.quotaRatio)} of today's allowance. Past 100% debug records are dropped, past 125% info records as well, and at 150% the drain pauses. The allowance resets${view.quotaResetsAt ? ` at ${view.quotaResetsAt}` : " at 00:00 UTC"}.`,
+        status: "failed",
+        priority: "normal"
+      };
+    case "dropped": {
+      const dropped = payload.droppedCount ?? view.droppedCount24h;
+      return {
+        title: name,
+        subject: `Log drain "${name}" is dropping records`,
+        previewLine: `${dropped.toLocaleString("en-US")} records dropped`,
+        summary: `The log drain "${name}" (${view.type}) dropped ${dropped.toLocaleString("en-US")} records because its buffer filled up faster than the destination accepted them.${becauseClause(view)} The gap is reported in band on the next successful batch, so the range is recoverable from the destination itself.`,
+        status: "failed",
+        priority: "high"
+      };
+    }
+    case "verification_pending":
+      return {
+        title: name,
+        subject: `Log drain "${name}" is still unverified`,
+        previewLine: "Unverified after 24 hours \u2014 nothing is being delivered",
+        summary: `The log drain "${name}" (${view.type}) was created more than 24 hours ago and has never completed verification, so nothing is being delivered to it.${becauseClause(view)} Run \`lua drains verify ${view.id}\` once the destination echoes the verification token.`,
+        status: "failed",
+        priority: "normal"
+      };
+    default: {
+      const exhaustive = payload.kind;
+      throw new Error(`unhandled log-drain notice kind: ${String(exhaustive)}`);
+    }
+  }
+}
+function logDrainNoticeLabel(kind) {
+  switch (kind) {
+    case "failing":
+      return "failing";
+    case "paused_auto":
+      return "paused (no success for 24 h)";
+    case "paused_quota":
+      return "paused (daily allowance exhausted)";
+    case "quota_warning":
+      return "80% of the daily allowance used";
+    case "dropped":
+      return "dropping records";
+    case "verification_pending":
+      return "still unverified";
+    default: {
+      const exhaustive = kind;
+      throw new Error(`unhandled log-drain notice kind: ${String(exhaustive)}`);
+    }
+  }
+}
+function logDrainNoticeDigestCopy(payload) {
+  const entries = [
+    ...payload.entries ?? []
+  ].sort((a, b) => a.at < b.at ? -1 : a.at > b.at ? 1 : 0).slice(0, LOG_DRAIN_DIGEST_MAX_ENTRIES);
+  const drains = new Set(entries.map((entry) => entry.drainId));
+  const noun = `${entries.length} notice${entries.length === 1 ? "" : "s"}`;
+  const across = `${drains.size} drain${drains.size === 1 ? "" : "s"}`;
+  const lines = entries.map((entry) => `${entry.drainName || entry.drainId} \u2014 ${logDrainNoticeLabel(entry.kind)}`);
+  return {
+    title: "Log drains \u2014 daily summary",
+    subject: `Log drains \u2014 ${noun} in the last day`,
+    previewLine: `${noun} across ${across}`,
+    summary: `${noun} across ${across} in the last day: ${lines.join("; ")}.`,
+    status: "failed",
+    priority: "normal"
+  };
+}
+function finiteNonNegative(value3) {
+  return typeof value3 === "number" && Number.isFinite(value3) && value3 >= 0 ? value3 : void 0;
+}
+function mergeLimits(base, stored) {
+  const patch = stored ?? {};
+  return {
+    eventsPerDay: finiteNonNegative(patch.eventsPerDay) ?? base.eventsPerDay,
+    bytesPerDay: finiteNonNegative(patch.bytesPerDay) ?? base.bytesPerDay
+  };
+}
+function mergeCard(base, stored) {
+  const patch = stored ?? {};
+  return {
+    includedEventsPerMonth: finiteNonNegative(patch.includedEventsPerMonth) ?? base.includedEventsPerMonth,
+    includedBytesPerMonth: finiteNonNegative(patch.includedBytesPerMonth) ?? base.includedBytesPerMonth,
+    usdPerMillionEvents: finiteNonNegative(patch.usdPerMillionEvents) ?? base.usdPerMillionEvents,
+    usdPerGiB: finiteNonNegative(patch.usdPerGiB) ?? base.usdPerGiB
+  };
+}
+function resolveStoredLogDrainPlanConfig(stored) {
+  const values = stored;
+  if (!values || typeof values.version !== "number" || !Number.isFinite(values.version)) {
+    return DEFAULT_LOG_DRAIN_PLAN_CONFIG;
+  }
+  const tiers = {};
+  const pricing = {};
+  for (const tier of TIERS) {
+    tiers[tier] = mergeLimits(DEFAULT_LOG_DRAIN_PLAN_CONFIG.tiers[tier], values.tiers?.[tier]);
+    pricing[tier] = mergeCard(DEFAULT_LOG_DRAIN_PLAN_CONFIG.pricing[tier], values.pricing?.[tier]);
+  }
+  const orgs = {};
+  for (const [orgId, override] of Object.entries(values.orgs ?? {})) {
+    if (!orgId || !override || typeof override !== "object") continue;
+    const row = {};
+    if (override.tier && TIERS.includes(override.tier)) row.tier = override.tier;
+    const events = finiteNonNegative(override.eventsPerDay);
+    const bytes = finiteNonNegative(override.bytesPerDay);
+    if (events !== void 0) row.eventsPerDay = events;
+    if (bytes !== void 0) row.bytesPerDay = bytes;
+    if (override.pricing && typeof override.pricing === "object") row.pricing = {
+      ...override.pricing
+    };
+    if (Object.keys(row).length) orgs[orgId] = row;
+  }
+  return {
+    version: values.version,
+    tiers,
+    pricing,
+    ...Object.keys(orgs).length ? {
+      orgs
+    } : {}
+  };
+}
+function logDrainPlanTierOverride(config, orgId) {
+  return orgId ? config.orgs?.[orgId]?.tier : void 0;
+}
+function logDrainQuotaLimitsFor(config, orgId, tier) {
+  const base = config.tiers[tier] ?? config.tiers.team ?? LOG_DRAIN_QUOTAS.team;
+  const override = orgId ? config.orgs?.[orgId] : void 0;
+  if (!override) return {
+    ...base
+  };
+  return {
+    eventsPerDay: override.eventsPerDay ?? base.eventsPerDay,
+    bytesPerDay: override.bytesPerDay ?? base.bytesPerDay
+  };
+}
+function logDrainPriceCardFor(config, orgId, tier) {
+  const base = config.pricing[tier] ?? config.pricing.team ?? DEFAULT_LOG_DRAIN_PLAN_CONFIG.pricing.team;
+  const override = orgId ? config.orgs?.[orgId]?.pricing : void 0;
+  return override ? mergeCard(base, override) : {
+    ...base
+  };
+}
+function priceDrainUsage(totals, card, tier) {
+  const billableRecords = Math.max(0, Math.floor(finiteNonNegative(totals?.billableRecords) ?? 0));
+  const billableBytes = Math.max(0, Math.floor(finiteNonNegative(totals?.billableBytes) ?? 0));
+  const includedEvents = card.includedEventsPerMonth;
+  const includedBytes = card.includedBytesPerMonth;
+  const overageEvents = Math.max(0, billableRecords - includedEvents);
+  const overageBytes = Math.max(0, billableBytes - includedBytes);
+  const eventsUsd = overageEvents / 1e6 * card.usdPerMillionEvents;
+  const bytesUsd = overageBytes / LOG_DRAIN_BYTES_PER_GIB * card.usdPerGiB;
+  const unpriced = card.usdPerMillionEvents === 0 && card.usdPerGiB === 0;
+  const round = /* @__PURE__ */ __name2((usd) => Math.round(usd * 100) / 100, "round");
+  return {
+    lineItem: LOG_DRAIN_USAGE_LINE_ITEM,
+    tier,
+    billableRecords,
+    billableBytes,
+    includedEvents,
+    includedBytes,
+    overageEvents,
+    overageBytes,
+    eventsUsd: round(eventsUsd),
+    bytesUsd: round(bytesUsd),
+    usd: round(Math.max(eventsUsd, bytesUsd)),
+    unpriced
+  };
+}
 function encodeLogCursor(c) {
   return Buffer.from(JSON.stringify({
     t: c.t,
@@ -657,12 +1282,12 @@ function decodeLogCursor(raw) {
     return null;
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  const { t, id } = parsed;
+  const { t, id: id2 } = parsed;
   if (typeof t !== "number" || !Number.isSafeInteger(t) || t < 0) return null;
-  if (typeof id !== "string" || !id || id.length > LOG_CURSOR_MAX_ID_LENGTH) return null;
+  if (typeof id2 !== "string" || !id2 || id2.length > LOG_CURSOR_MAX_ID_LENGTH) return null;
   return {
     t,
-    id
+    id: id2
   };
 }
 function parseLogTimeBound(raw, now = /* @__PURE__ */ new Date()) {
@@ -900,62 +1525,62 @@ function isKnownProfile(profiles, profileId) {
 function hasCapability(profiles, profileId, required) {
   return capabilitiesFor(profiles, profileId).includes(required);
 }
-function workflowJobId(id) {
-  switch (id.kind) {
+function workflowJobId(id2) {
+  switch (id2.kind) {
     case "start":
-      return `wft_${id.runId}_0`;
+      return `wft_${id2.runId}_0`;
     case "start-redrive":
-      return `wft_${id.runId}_start_r${id.now}`;
+      return `wft_${id2.runId}_start_r${id2.now}`;
     case "tick":
-      return `wft_${id.runId}_${id.seq}`;
+      return `wft_${id2.runId}_${id2.seq}`;
     case "timer":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}`;
     case "timer-remainder":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "timer-deferral":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_d${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_d${id2.now}`;
     case "timer-sibling":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_w${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_w${id2.now}`;
     case "retry":
-      return `wft_${id.runId}_retry_${id.stepId}_${id.attempt}`;
+      return `wft_${id2.runId}_retry_${id2.stepId}_${id2.attempt}`;
     case "respawn":
-      return `wft_${id.runId}_respawn_${id.stepId}_${id.attempt}_s${id.segment}_r${id.now}`;
+      return `wft_${id2.runId}_respawn_${id2.stepId}_${id2.attempt}_s${id2.segment}_r${id2.now}`;
     case "redrive":
-      return `wft_${id.runId}_redrive_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_redrive_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "redispatch":
-      return `wft_${id.runId}_redispatch_${id.stepId}_${id.attempt}_x${id.executionId ?? "none"}_r${id.now}`;
+      return `wft_${id2.runId}_redispatch_${id2.stepId}_${id2.attempt}_x${id2.executionId ?? "none"}_r${id2.now}`;
     case "expiry":
-      return `wft_${id.runId}_expire_${id.stepId}_${id.attempt}_t${id.suspendedAt}${id.hop > 0 ? `_h${id.hop}` : ""}`;
+      return `wft_${id2.runId}_expire_${id2.stepId}_${id2.attempt}_t${id2.suspendedAt}${id2.hop > 0 ? `_h${id2.hop}` : ""}`;
     case "step-terminal":
-      return `wft_${id.runId}_term_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_term_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "handback":
-      return `wft_${id.runId}_handback_${id.stepId}_${id.attempt}_${id.now}`;
+      return `wft_${id2.runId}_handback_${id2.stepId}_${id2.attempt}_${id2.now}`;
     case "foreach-rate":
-      return `wft_${id.runId}_fe_${id.stepId}_${id.attempt}_${id.bucket}`;
+      return `wft_${id2.runId}_fe_${id2.stepId}_${id2.attempt}_${id2.bucket}`;
     case "budget-expiry":
-      return `wft_${id.runId}_expiry_budget_r${id.now}`;
+      return `wft_${id2.runId}_expiry_budget_r${id2.now}`;
     case "budget-resume":
-      return `wft_${id.runId}_resume_budget_${id.now}`;
+      return `wft_${id2.runId}_resume_budget_${id2.now}`;
     case "deadline":
-      return `wft_${id.runId}_deadline_${id.deadlineAt}`;
+      return `wft_${id2.runId}_deadline_${id2.deadlineAt}`;
     case "deadline-remainder":
-      return `wft_${id.runId}_deadline_${id.deadlineAt}_r${id.now}`;
+      return `wft_${id2.runId}_deadline_${id2.deadlineAt}_r${id2.now}`;
     case "readmit":
-      return `wft_${id.runId}_readmit_${id.now}`;
+      return `wft_${id2.runId}_readmit_${id2.now}`;
     case "cancel":
-      return `wft_${id.runId}_cancel`;
+      return `wft_${id2.runId}_cancel`;
     case "reconcile":
-      return `wft_${id.runId}_reconcile_${id.now}`;
+      return `wft_${id2.runId}_reconcile_${id2.now}`;
     case "replay":
-      return `wft_${id.runId}_replay_g${id.leaseGeneration}`;
+      return `wft_${id2.runId}_replay_g${id2.leaseGeneration}`;
     case "migration":
-      return `wfm_${id.migrationId}`;
+      return `wfm_${id2.migrationId}`;
     default:
-      return assertNever(id);
+      return assertNever(id2);
   }
 }
-function assertNever(id) {
-  throw new Error(`workflowJobId: unknown wake kind ${JSON.stringify(id)}`);
+function assertNever(id2) {
+  throw new Error(`workflowJobId: unknown wake kind ${JSON.stringify(id2)}`);
 }
 function agentStepJobId(msg) {
   return `${msg.runId}_${msg.stepId}_${msg.attempt}_x${msg.executionId}`;
@@ -993,11 +1618,11 @@ function isArchiveWindowTooOld(run, retentionDays, now = Date.now(), marginDays
 function workflowOrgPurgingKey(orgId) {
   return `wf:org:${orgId}:purging`;
 }
-function isCloudTaskRunId(id) {
-  return id.startsWith(CLOUD_TASK_RUN_ID_PREFIX);
+function isCloudTaskRunId(id2) {
+  return id2.startsWith(CLOUD_TASK_RUN_ID_PREFIX);
 }
-function isScheduledWorkflowRunId(id) {
-  return id.startsWith(WORKFLOW_SCHEDULED_RUN_ID_PREFIX);
+function isScheduledWorkflowRunId(id2) {
+  return id2.startsWith(WORKFLOW_SCHEDULED_RUN_ID_PREFIX);
 }
 function scheduledWorkflowRunId(jobId, scheduledTime) {
   const key = typeof scheduledTime === "number" ? String(scheduledTime) : scheduledTimeKey(scheduledTime);
@@ -1358,7 +1983,13 @@ function effectiveAgentFeatures(base, override, rule) {
   if (rule === "wholesale") return override || base || void 0;
   return effectiveAgentFeatureRows(base, override).rows;
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES;
+function parseOnboardingFlow(value3) {
+  return onboardingFlowSchema.parse(value3);
+}
+function parsePublishedOnboardingResponse(value3) {
+  return getPublishedOnboardingResponseSchema.parse(value3);
+}
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1686,6 +2317,50 @@ var init_dist = __esm({
       }
     ];
     BROWSER_COMMAND_NAMES = BROWSER_COMMANDS.map((c) => c.name);
+    LOG_FIELDS_MAX_KEYS = 32;
+    LOG_FIELD_MAX_VALUE_BYTES = 1024;
+    LOG_FIELDS_MAX_BYTES = 8192;
+    LOG_FIELD_KEY_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+    LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS = Object.freeze([
+      /^api_[0-9a-f]{24,}$/,
+      /^gh[pousr]_[a-z0-9]{36}$/,
+      /^(?:sk|rk|pk)_(?:live|test)_[a-z0-9]{16,}$/,
+      /^lua_hc_[a-z0-9]{20,}/,
+      /^lua_sk_[a-z0-9]{20,}/
+    ]);
+    LOG_FIELDS_CLAMPED_KEY = "lua_fields_clamped";
+    LOG_FIELD_ARRAY_COUNT_SUFFIX = ".count";
+    LuaLogFieldsError = class _LuaLogFieldsError extends Error {
+      static {
+        __name(this, "_LuaLogFieldsError");
+      }
+      static {
+        __name2(this, "LuaLogFieldsError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "LuaLogFieldsError";
+        Object.setPrototypeOf(this, _LuaLogFieldsError.prototype);
+      }
+    };
+    __name(utf8WidthAt, "utf8WidthAt");
+    __name2(utf8WidthAt, "utf8WidthAt");
+    __name(utf8ByteLength, "utf8ByteLength");
+    __name2(utf8ByteLength, "utf8ByteLength");
+    __name(clampUtf8, "clampUtf8");
+    __name2(clampUtf8, "clampUtf8");
+    __name(mapBytes, "mapBytes");
+    __name2(mapBytes, "mapBytes");
+    __name(withValueCap, "withValueCap");
+    __name2(withValueCap, "withValueCap");
+    __name(describeValue, "describeValue");
+    __name2(describeValue, "describeValue");
+    __name(assertValidLogFieldKey, "assertValidLogFieldKey");
+    __name2(assertValidLogFieldKey, "assertValidLogFieldKey");
+    __name(normalizeLogFields, "normalizeLogFields");
+    __name2(normalizeLogFields, "normalizeLogFields");
+    __name(clampLogFields, "clampLogFields");
+    __name2(clampLogFields, "clampLogFields");
     DESKTOP_FILE_COMMANDS = [
       "files_roots",
       "files_stat",
@@ -2030,6 +2705,37 @@ This text is who you are for this person. As you learn them, their name, their w
       "workflow-script",
       "workflow"
     ];
+    AGENT_LOG_FIELDS_MAX_WIRE_KEYS = LOG_FIELDS_MAX_KEYS + 1;
+    __name(utf8Bytes, "utf8Bytes");
+    __name2(utf8Bytes, "utf8Bytes");
+    __name(isPlainFieldKey, "isPlainFieldKey");
+    __name2(isPlainFieldKey, "isPlainFieldKey");
+    __name(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+    __name2(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+    __name(isAgentLogFields, "isAgentLogFields");
+    __name2(isAgentLogFields, "isAgentLogFields");
+    LOG_DRAIN_TYPES_PHASE1 = [
+      "http",
+      "otlp",
+      "datadog",
+      "betterstack"
+    ];
+    LOG_DRAIN_TYPES_PHASE2 = [
+      "splunk",
+      "loki",
+      "axiom",
+      "newrelic",
+      "sumologic"
+    ];
+    LOG_DRAIN_TYPES_IMPLEMENTED = [
+      ...LOG_DRAIN_TYPES_PHASE1,
+      ...LOG_DRAIN_TYPES_PHASE2,
+      // RECONCILE-4 (W4-4). `s3` is implemented (H4 / PRO-1887) but is NOT in
+      // `LOG_DRAIN_TYPES_PHASE2`, because its own flag opens it and `*` must not. It
+      // belongs here all the same: this list is what a CLIENT may offer, and the server
+      // remains the authority that answers 422 with the live list.
+      "s3"
+    ];
     LOG_DRAIN_SOURCES = [
       ...AGENT_LOG_SOURCES,
       "execution",
@@ -2038,17 +2744,123 @@ This text is who you are for this person. As you learn them, their name, their w
       "trigger-execution",
       "job-execution",
       "workflow-run",
-      "workflow-audit"
+      "workflow-audit",
+      // PRO-1884 (H2). Appended AFTER 'workflow-audit' so the enum stays additive and
+      // no existing member changes position.
+      "voice-call"
     ];
     LOG_DRAIN_MAX_PER_ORG = 5;
     LOG_DRAIN_MAX_PER_ORG_ENTERPRISE = 10;
     __name(maxDrainsForTier, "maxDrainsForTier");
     __name2(maxDrainsForTier, "maxDrainsForTier");
+    LOG_DRAIN_DATADOG_SITES = [
+      "datadoghq.com",
+      "datadoghq.eu",
+      "us3.datadoghq.com",
+      "us5.datadoghq.com",
+      "ap1.datadoghq.com",
+      "ddog-gov.com"
+    ];
+    LOG_DRAIN_NEWRELIC_SITES = [
+      "log-api.newrelic.com",
+      "log-api.eu.newrelic.com",
+      "log-api.jp.newrelic.com"
+    ];
     LOG_DRAIN_ENDPOINT_TEMPLATES = {
-      datadog: "https://http-intake.logs.{site}/api/v2/logs"
+      datadog: "https://http-intake.logs.{site}/api/v2/logs",
+      newrelic: "https://{site}/log/v1"
+    };
+    LOG_DRAIN_PRESET_SITES = {
+      datadog: LOG_DRAIN_DATADOG_SITES,
+      newrelic: LOG_DRAIN_NEWRELIC_SITES
     };
     __name(resolvePresetEndpoint, "resolvePresetEndpoint");
     __name2(resolvePresetEndpoint, "resolvePresetEndpoint");
+    LOG_DRAIN_BUCKET_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+    LOG_DRAIN_BUCKET_HOST_PATTERNS = Object.freeze({
+      aws: [
+        // virtual-host style, regional and legacy global
+        /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.s3(\.dualstack)?(\.[a-z0-9-]+)?\.amazonaws\.com$/,
+        // path style
+        /^s3(\.dualstack)?(\.[a-z0-9-]+)?\.amazonaws\.com$/
+      ],
+      r2: [
+        /^[a-f0-9]{32}\.r2\.cloudflarestorage\.com$/
+      ],
+      gcs: [
+        /^storage\.googleapis\.com$/
+      ]
+    });
+    __name(isLogDrainBucketHostAllowed, "isLogDrainBucketHostAllowed");
+    __name2(isLogDrainBucketHostAllowed, "isLogDrainBucketHostAllowed");
+    __name(resolveDrainBucketEndpoint, "resolveDrainBucketEndpoint");
+    __name2(resolveDrainBucketEndpoint, "resolveDrainBucketEndpoint");
+    __name(drainBucketUsesPathStyle, "drainBucketUsesPathStyle");
+    __name2(drainBucketUsesPathStyle, "drainBucketUsesPathStyle");
+    __name(presetIntakeHosts, "presetIntakeHosts");
+    __name2(presetIntakeHosts, "presetIntakeHosts");
+    LOG_DRAIN_PRESET_HOST_SUFFIXES = {
+      axiom: [
+        ".axiom.co"
+      ],
+      sumologic: [
+        ".sumologic.com"
+      ]
+    };
+    __name(presetHostAllowlist, "presetHostAllowlist");
+    __name2(presetHostAllowlist, "presetHostAllowlist");
+    __name(drainHostAllowlistAllows, "drainHostAllowlistAllows");
+    __name2(drainHostAllowlistAllows, "drainHostAllowlistAllows");
+    __name(drainDestinationIsVendorPinned, "drainDestinationIsVendorPinned");
+    __name2(drainDestinationIsVendorPinned, "drainDestinationIsVendorPinned");
+    __name(drainVerificationOwnership, "drainVerificationOwnership");
+    __name2(drainVerificationOwnership, "drainVerificationOwnership");
+    __name(drainOwnershipOrDefault, "drainOwnershipOrDefault");
+    __name2(drainOwnershipOrDefault, "drainOwnershipOrDefault");
+    DRAIN_CONTENT_ACK_ERROR_CODE = "DRAIN_CONTENT_ACK_REQUIRED";
+    DRAIN_CONTENT_ACK_FIELD = "includeContentAck";
+    DrainContentAckRequiredError = class extends Error {
+      static {
+        __name(this, "DrainContentAckRequiredError");
+      }
+      static {
+        __name2(this, "DrainContentAckRequiredError");
+      }
+      code = DRAIN_CONTENT_ACK_ERROR_CODE;
+      field = DRAIN_CONTENT_ACK_FIELD;
+      constructor() {
+        super("includeContent ships end-user message content to a third party; set includeContentAck: true to confirm.");
+        this.name = "DrainContentAckRequiredError";
+      }
+    };
+    __name(assertDrainContentAck, "assertDrainContentAck");
+    __name2(assertDrainContentAck, "assertDrainContentAck");
+    LOG_DRAIN_PRESET_PATHS = {
+      // https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples
+      splunk: {
+        path: "/services/collector/event"
+      },
+      // https://grafana.com/docs/loki/latest/reference/loki-http-api/#ingest-logs
+      loki: {
+        path: "/loki/api/v1/push"
+      },
+      // https://axiom.co/docs/restapi/endpoints/ingestIntoDataset
+      axiom: {
+        path: "/v1/datasets",
+        segment: "dataset",
+        suffix: "/ingest"
+      },
+      // https://help.sumologic.com/docs/send-data/hosted-collectors/http-source/logs-metrics/upload-logs/
+      sumologic: {
+        path: "/receiver/v1/http",
+        segment: "token"
+      }
+    };
+    PRESET_SEGMENT_RE = /^[A-Za-z0-9._~%=+-]{1,512}$/;
+    __name(composePresetEndpoint, "composePresetEndpoint");
+    __name2(composePresetEndpoint, "composePresetEndpoint");
+    __name(joinPresetEndpointToken, "joinPresetEndpointToken");
+    __name2(joinPresetEndpointToken, "joinPresetEndpointToken");
     LOG_DRAIN_QUOTAS = {
       team: {
         eventsPerDay: 1e6,
@@ -2081,6 +2893,100 @@ This text is who you are for this person. As you learn them, their name, their w
     __name2(logDrainQuotaWarned, "logDrainQuotaWarned");
     __name(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
     __name2(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
+    LOG_EXPORT_SOURCES = [
+      ...AGENT_LOG_SOURCES,
+      "execution"
+    ];
+    LOG_EXPORT_MAX_WINDOW_DAYS = 31;
+    LOG_EXPORT_MAX_WINDOW_MS = LOG_EXPORT_MAX_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
+    LOG_EXPORT_URL_TTL_SECONDS = 24 * 60 * 60;
+    LOG_EXPORT_FILE_RETENTION_DAYS = 7;
+    LOG_EXPORT_FILE_RETENTION_MS = LOG_EXPORT_FILE_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+    LOG_EXPORT_PART_MAX_BYTES = 256 * 1024 * 1024;
+    __name(isLogExportSource, "isLogExportSource");
+    __name2(isLogExportSource, "isLogExportSource");
+    LOG_DRAIN_NOTICE_RATE_LIMIT_MS = 60 * 6e4;
+    LOG_DRAIN_VERIFICATION_STALE_MS = 24 * 60 * 6e4;
+    LOG_DRAIN_DIGEST_INTERVAL_MS = 24 * 60 * 6e4;
+    LOG_DRAIN_DIGEST_MAX_ENTRIES = 50;
+    LOG_DRAIN_NOTICE_ERROR_MAX_CHARS = 200;
+    __name(clamp, "clamp");
+    __name2(clamp, "clamp");
+    __name(numberOr, "numberOr");
+    __name2(numberOr, "numberOr");
+    __name(isoOr, "isoOr");
+    __name2(isoOr, "isoOr");
+    __name(logDrainNoticeView, "logDrainNoticeView");
+    __name2(logDrainNoticeView, "logDrainNoticeView");
+    __name(logDrainHealthCardPath, "logDrainHealthCardPath");
+    __name2(logDrainHealthCardPath, "logDrainHealthCardPath");
+    __name(percent, "percent");
+    __name2(percent, "percent");
+    __name(becauseClause, "becauseClause");
+    __name2(becauseClause, "becauseClause");
+    __name(logDrainNoticeCopy, "logDrainNoticeCopy");
+    __name2(logDrainNoticeCopy, "logDrainNoticeCopy");
+    __name(logDrainNoticeLabel, "logDrainNoticeLabel");
+    __name2(logDrainNoticeLabel, "logDrainNoticeLabel");
+    __name(logDrainNoticeDigestCopy, "logDrainNoticeDigestCopy");
+    __name2(logDrainNoticeDigestCopy, "logDrainNoticeDigestCopy");
+    LOG_DRAIN_USAGE_LINE_ITEM = "log_drain_events";
+    LOG_DRAIN_BYTES_PER_GIB = 1024 ** 3;
+    DEFAULT_LOG_DRAIN_PLAN_CONFIG = {
+      version: 1,
+      tiers: {
+        team: {
+          ...LOG_DRAIN_QUOTAS.team
+        },
+        business: {
+          ...LOG_DRAIN_QUOTAS.business
+        },
+        enterprise: {
+          ...LOG_DRAIN_QUOTAS.enterprise
+        }
+      },
+      pricing: {
+        team: {
+          includedEventsPerMonth: 0,
+          includedBytesPerMonth: 0,
+          usdPerMillionEvents: 0,
+          usdPerGiB: 0
+        },
+        business: {
+          includedEventsPerMonth: 0,
+          includedBytesPerMonth: 0,
+          usdPerMillionEvents: 0,
+          usdPerGiB: 0
+        },
+        enterprise: {
+          includedEventsPerMonth: 0,
+          includedBytesPerMonth: 0,
+          usdPerMillionEvents: 0,
+          usdPerGiB: 0
+        }
+      }
+    };
+    TIERS = [
+      "team",
+      "business",
+      "enterprise"
+    ];
+    __name(finiteNonNegative, "finiteNonNegative");
+    __name2(finiteNonNegative, "finiteNonNegative");
+    __name(mergeLimits, "mergeLimits");
+    __name2(mergeLimits, "mergeLimits");
+    __name(mergeCard, "mergeCard");
+    __name2(mergeCard, "mergeCard");
+    __name(resolveStoredLogDrainPlanConfig, "resolveStoredLogDrainPlanConfig");
+    __name2(resolveStoredLogDrainPlanConfig, "resolveStoredLogDrainPlanConfig");
+    __name(logDrainPlanTierOverride, "logDrainPlanTierOverride");
+    __name2(logDrainPlanTierOverride, "logDrainPlanTierOverride");
+    __name(logDrainQuotaLimitsFor, "logDrainQuotaLimitsFor");
+    __name2(logDrainQuotaLimitsFor, "logDrainQuotaLimitsFor");
+    __name(logDrainPriceCardFor, "logDrainPriceCardFor");
+    __name2(logDrainPriceCardFor, "logDrainPriceCardFor");
+    __name(priceDrainUsage, "priceDrainUsage");
+    __name2(priceDrainUsage, "priceDrainUsage");
     LOG_CURSOR_MAX_LENGTH = 512;
     LOG_CURSOR_MAX_ID_LENGTH = 128;
     LOG_RELATIVE_TIME_PATTERN = /^(\d{1,9})([smhd])$/;
@@ -3244,6 +4150,236 @@ listed here; never invent a target.`;
     __name2(agentFeatureMergeRuleFromEnv, "agentFeatureMergeRuleFromEnv");
     __name(effectiveAgentFeatures, "effectiveAgentFeatures");
     __name2(effectiveAgentFeatures, "effectiveAgentFeatures");
+    ONBOARDING_FLOW_KEY = "alpha-choose-meet";
+    ONBOARDING_SCHEMA_VERSION = 1;
+    id = z4.string().min(1).max(80).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/);
+    copy = /* @__PURE__ */ __name2((max) => z4.string().max(max), "copy");
+    onboardingHeadingSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("plain"),
+        text: copy(240)
+      }).strict(),
+      z4.object({
+        kind: z4.literal("highlighted"),
+        before: copy(240),
+        highlight: copy(240),
+        after: copy(240)
+      }).strict()
+    ]);
+    onboardingRichTextInlineSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("text"),
+        text: copy(2e3),
+        marks: z4.array(z4.enum([
+          "bold",
+          "italic"
+        ])).max(2).refine((marks) => new Set(marks).size === marks.length, "Text marks must be unique").optional()
+      }).strict(),
+      z4.object({
+        kind: z4.literal("lineBreak")
+      }).strict()
+    ]);
+    onboardingRichTextSchema = z4.object({
+      blocks: z4.array(z4.object({
+        kind: z4.literal("paragraph"),
+        content: z4.array(onboardingRichTextInlineSchema).max(100)
+      }).strict()).max(40)
+    }).strict();
+    onboardingDestinationSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("question"),
+        questionId: id
+      }).strict(),
+      z4.object({
+        kind: z4.literal("template"),
+        templateContentId: id
+      }).strict(),
+      z4.object({
+        kind: z4.literal("unavailable"),
+        unavailableId: id
+      }).strict()
+    ]);
+    onboardingArtworkSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("builtinRing")
+      }).strict(),
+      z4.object({
+        kind: z4.literal("uploaded"),
+        assetId: id,
+        accessibility: z4.discriminatedUnion("kind", [
+          z4.object({
+            kind: z4.literal("decorative")
+          }).strict(),
+          z4.object({
+            kind: z4.literal("described"),
+            altText: copy(500)
+          }).strict()
+        ])
+      }).strict()
+    ]);
+    onboardingAnswerSchema = z4.object({
+      id,
+      label: copy(160),
+      supportingText: copy(500).optional(),
+      destination: onboardingDestinationSchema.nullable()
+    }).strict();
+    onboardingQuestionSchema = z4.object({
+      id,
+      heading: onboardingHeadingSchema,
+      helperText: onboardingRichTextSchema.optional(),
+      continueButtonLabel: copy(80),
+      answers: z4.array(onboardingAnswerSchema).max(30)
+    }).strict();
+    onboardingTemplateSectionSchema = z4.object({
+      id,
+      label: copy(100),
+      body: onboardingRichTextSchema
+    }).strict();
+    onboardingTemplateContentSchema = z4.object({
+      id,
+      templateId: copy(160),
+      displayName: copy(100),
+      eyebrow: copy(100).optional(),
+      heading: onboardingHeadingSchema,
+      description: onboardingRichTextSchema,
+      badges: z4.array(copy(80)).max(12),
+      sections: z4.array(onboardingTemplateSectionSchema).max(20),
+      artwork: onboardingArtworkSchema,
+      hireButtonLabel: copy(80),
+      changeRoleButtonLabel: copy(80),
+      nextStepText: onboardingRichTextSchema
+    }).strict();
+    onboardingUnavailableOutcomeSchema = z4.object({
+      id,
+      heading: onboardingHeadingSchema,
+      explanation: onboardingRichTextSchema,
+      backButtonLabel: copy(80),
+      alternative: z4.object({
+        templateContentId: id,
+        introduction: onboardingRichTextSchema,
+        buttonLabel: copy(80)
+      }).strict().optional()
+    }).strict();
+    onboardingFlowSchema = z4.object({
+      key: z4.literal(ONBOARDING_FLOW_KEY),
+      schemaVersion: z4.literal(ONBOARDING_SCHEMA_VERSION),
+      entryQuestionId: id.nullable(),
+      questions: z4.array(onboardingQuestionSchema).max(100),
+      templateContents: z4.array(onboardingTemplateContentSchema).max(100),
+      unavailableOutcomes: z4.array(onboardingUnavailableOutcomeSchema).max(100)
+    }).strict();
+    onboardingActorSchema = z4.object({
+      subjectId: z4.string(),
+      email: z4.string().email()
+    }).strict();
+    onboardingEditorSchema = onboardingActorSchema.extend({
+      editedAt: z4.string().datetime({
+        offset: true
+      })
+    }).strict();
+    onboardingPublicationSummarySchema = z4.object({
+      publicationId: id,
+      revision: z4.number().int().positive(),
+      sourceDraftVersion: z4.number().int().nonnegative(),
+      contentHash: z4.string().regex(/^[a-f0-9]{64}$/),
+      publishedAt: z4.string().datetime({
+        offset: true
+      }),
+      publishedBy: onboardingActorSchema,
+      questionCount: z4.number().int().nonnegative(),
+      templateCount: z4.number().int().nonnegative(),
+      unavailableCount: z4.number().int().nonnegative()
+    }).strict();
+    onboardingValidationIssueSchema = z4.object({
+      code: z4.string(),
+      path: z4.string(),
+      message: z4.string()
+    }).strict();
+    onboardingValidationResponseSchema = z4.discriminatedUnion("valid", [
+      z4.object({
+        valid: z4.literal(true),
+        summary: z4.object({
+          questionCount: z4.number().int().nonnegative(),
+          templateCount: z4.number().int().nonnegative(),
+          unavailableCount: z4.number().int().nonnegative()
+        }).strict()
+      }).strict(),
+      z4.object({
+        valid: z4.literal(false),
+        issues: z4.array(onboardingValidationIssueSchema)
+      }).strict()
+    ]);
+    onboardingAssetSchema = z4.object({
+      assetId: id,
+      url: z4.string().url(),
+      width: z4.number().int().positive(),
+      height: z4.number().int().positive(),
+      contentType: z4.enum([
+        "image/png",
+        "image/jpeg",
+        "image/webp"
+      ]),
+      bytes: z4.number().int().positive(),
+      sha256: z4.string().regex(/^[a-f0-9]{64}$/),
+      createdAt: z4.string().datetime({
+        offset: true
+      }),
+      uploadedBy: onboardingActorSchema
+    }).strict();
+    onboardingPublicAssetSchema = onboardingAssetSchema.pick({
+      assetId: true,
+      url: true,
+      width: true,
+      height: true,
+      contentType: true
+    }).strict();
+    getOnboardingConfigResponseSchema = z4.object({
+      flowKey: z4.literal(ONBOARDING_FLOW_KEY),
+      draftVersion: z4.number().int().nonnegative(),
+      draft: onboardingFlowSchema,
+      assets: z4.array(onboardingAssetSchema),
+      lastEditor: onboardingEditorSchema.nullable(),
+      activePublication: onboardingPublicationSummarySchema.nullable()
+    }).strict();
+    saveOnboardingDraftRequestSchema = z4.object({
+      expectedDraftVersion: z4.number().int().nonnegative(),
+      draft: onboardingFlowSchema
+    }).strict();
+    validateOnboardingRequestSchema = z4.object({
+      draft: onboardingFlowSchema
+    }).strict();
+    publishOnboardingRequestSchema = z4.object({
+      expectedDraftVersion: z4.number().int().nonnegative(),
+      expectedActivePublicationId: id.nullable()
+    }).strict();
+    rollbackOnboardingRequestSchema = z4.object({
+      publicationId: id,
+      expectedActivePublicationId: id.nullable()
+    }).strict();
+    onboardingTemplateCatalogItemSchema = z4.object({
+      templateId: z4.string(),
+      name: z4.string(),
+      description: z4.string().optional()
+    }).strict();
+    getPublishedOnboardingResponseSchema = z4.discriminatedUnion("status", [
+      z4.object({
+        status: z4.literal("available"),
+        publicationId: id,
+        revision: z4.number().int().positive(),
+        contentHash: z4.string().regex(/^[a-f0-9]{64}$/),
+        flow: onboardingFlowSchema,
+        assets: z4.array(onboardingPublicAssetSchema)
+      }).strict(),
+      z4.object({
+        status: z4.literal("unavailable"),
+        reason: z4.literal("not_published"),
+        message: z4.string()
+      }).strict()
+    ]);
+    __name(parseOnboardingFlow, "parseOnboardingFlow");
+    __name2(parseOnboardingFlow, "parseOnboardingFlow");
+    __name(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
+    __name2(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
   }
 });
 
@@ -3251,9 +4387,9 @@ listed here; never invent a target.`;
 function effectiveJobTools(jobTools, readOnly) {
   const base = jobTools?.length ? jobTools : WORKFLOW_JOB_DEFAULT_TOOLS;
   const out = [];
-  for (const id of base) {
-    if (readOnly && WORKFLOW_JOB_READ_ONLY_DROPPED.includes(id)) continue;
-    if (!out.includes(id)) out.push(id);
+  for (const id2 of base) {
+    if (readOnly && WORKFLOW_JOB_READ_ONLY_DROPPED.includes(id2)) continue;
+    if (!out.includes(id2)) out.push(id2);
   }
   return out;
 }
@@ -3297,7 +4433,7 @@ var init_workflow_job_tools = __esm({
 
 // ../workflow-graph/dist/index.mjs
 import { createHash } from "crypto";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 import { z as z22 } from "zod";
 import { createHash as createHash2 } from "crypto";
 function isMapConfigObject(v) {
@@ -3424,9 +4560,9 @@ function malformedMapMembers(cfg) {
   }
   return out;
 }
-function mapMemberMalformedMessage(id, m) {
+function mapMemberMalformedMessage(id2, m) {
   const keys = m.keys.map((k) => `\`${k}\``).join(", ");
-  return `"${id}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
+  return `"${id2}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
 }
 function resolveDescriptor(key, m, ctx) {
   if (!isMapDescriptor(m)) return {
@@ -3780,11 +4916,11 @@ function retryBackoffs() {
   }
   return WORKFLOW_RETRY_BACKOFFS;
 }
-function sleepUntilUnsupportedMessage(id) {
-  return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
+function sleepUntilUnsupportedMessage(id2) {
+  return `the engine does not execute \`sleepUntil\` yet (node "${id2}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id2}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
 }
-function armSubrunUnsupportedMessage(id, workflowId) {
-  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
+function armSubrunUnsupportedMessage(id2, workflowId) {
+  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id2}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
 }
 function fillPolicy(node, defaultTimeout) {
   if (node.tier === void 0 && node.workspace !== void 0 && node.workspace !== "inherit") node.tier = "job";
@@ -4044,20 +5180,20 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
-  const checkId = /* @__PURE__ */ __name4((id, path3) => {
+  const checkId = /* @__PURE__ */ __name4((id2, path3) => {
     nodeCount += 1;
-    if (seen.has(id)) {
-      err("duplicate-step-id", `step id "${id}" is declared twice (first at ${seen.get(id)})`, path3, id);
+    if (seen.has(id2)) {
+      err("duplicate-step-id", `step id "${id2}" is declared twice (first at ${seen.get(id2)})`, path3, id2);
     } else {
-      seen.set(id, path3);
+      seen.set(id2, path3);
     }
   }, "checkId");
   const checkPolicyEnums = /* @__PURE__ */ __name4((node, path3) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     const check = /* @__PURE__ */ __name4((member, allowed) => {
       const value22 = node[member];
       if (value22 === void 0 || typeof value22 === "string" && allowed.includes(value22)) return;
-      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path3}.${member}`, id);
+      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path3}.${member}`, id2);
     }, "check");
     check("sideEffects", WORKFLOW_SIDE_EFFECTS);
     check("jobResources", WORKFLOW_JOB_RESOURCES);
@@ -4065,46 +5201,46 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const checkRetry = /* @__PURE__ */ __name4((node, path3) => {
     const r = node.retry;
     if (!r) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     const unknown = unknownWorkflowRetryMembers(r);
-    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path3}.retry`, id);
+    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path3}.retry`, id2);
     if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
       const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path3}.retry.maxAttempts`, id);
+      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path3}.retry.maxAttempts`, id2);
     }
     const backoffs = retryBackoffs();
     if (r.backoff !== void 0 && !backoffs.includes(r.backoff)) {
       const list = backoffs.map((b) => `'${b}'`).join(" | ");
-      err("backoff-invalid", `retry.backoff must be ${list}`, `${path3}.retry.backoff`, id);
+      err("backoff-invalid", `retry.backoff must be ${list}`, `${path3}.retry.backoff`, id2);
     }
     if (r.backoffSeconds !== void 0 && r.backoffSeconds < 0) {
-      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path3}.retry.backoffSeconds`, id);
+      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path3}.retry.backoffSeconds`, id2);
     }
     if (r.maxBackoffSeconds !== void 0) {
       if (r.backoff !== "exponential") {
-        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path3}.retry`, id);
+        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path3}.retry`, id2);
       } else if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) {
-        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path3}.retry.maxBackoffSeconds`, id);
+        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path3}.retry.maxBackoffSeconds`, id2);
       }
     }
   }, "checkRetry");
   const checkTimeout = /* @__PURE__ */ __name4((node, path3) => {
     const t = node.timeoutSeconds;
     if (t === void 0) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (!Number.isInteger(t) || t < 1) {
-      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path3}.timeoutSeconds`, id);
+      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path3}.timeoutSeconds`, id2);
       return;
     }
     if (node.tier === "job") {
       const cap = node.type === "agent" ? caps.maxJobTimeoutSeconds : caps.maxJobSegmentSeconds;
       if (t > cap) {
-        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path3}.timeoutSeconds`, id);
+        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path3}.timeoutSeconds`, id2);
       } else if (node.type === "agent" && t > caps.maxJobSegmentSeconds && !node.workspace) {
-        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path3}.timeoutSeconds`, id);
+        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path3}.timeoutSeconds`, id2);
       }
     } else if (t > caps.maxWorkerTimeoutSeconds) {
-      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path3}.timeoutSeconds`, id);
+      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path3}.timeoutSeconds`, id2);
     }
   }, "checkTimeout");
   const checkSpecialistRole = /* @__PURE__ */ __name4((node, path3) => {
@@ -4168,32 +5304,32 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     return void 0;
   }, "jobClassifiablePin");
   const checkTier = /* @__PURE__ */ __name4((node, path3) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (node.workspace && node.workspace !== "inherit" && node.tier !== void 0 && node.tier !== "job") {
-      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path3}.workspace`, id);
+      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path3}.workspace`, id2);
     }
     if (node.harness !== void 0 && node.tier !== "job") {
-      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path3}.harness`, id);
+      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path3}.harness`, id2);
     }
     const provider = node.type === "agent" ? classifyModelProvider(jobClassifiablePin(node.model)) : null;
     if (node.harness === "claude-code" && provider !== null && provider !== "anthropic") {
-      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path3}.harness`, id);
+      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path3}.harness`, id2);
     }
     if (isJobTier(node) && provider !== null && opts.policy?.jobProviders && !opts.policy.jobProviders.includes(provider)) {
-      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path3}.model`, id);
+      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path3}.model`, id2);
     }
   }, "checkTier");
   const checkModel = /* @__PURE__ */ __name4((node, path3) => {
     if (node.type !== "agent" || typeof node.model !== "string") return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     const parsed = parseModelTemplate(node.model);
     if (parsed.kind === "invalid") {
-      err("model-template-invalid", parsed.message, `${path3}.model`, id);
+      err("model-template-invalid", parsed.message, `${path3}.model`, id2);
       return;
     }
     if (parsed.kind === "template" && parsed.template.default === void 0) {
       if (isJobTier(node)) {
-        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path3}.model`, id);
+        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path3}.model`, id2);
       }
       return;
     }
@@ -4206,12 +5342,12 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (registry === "unavailable") {
       const trimmed = pin.trim();
       if (trimmed && !normalizeModelId(trimmed, []).ok) {
-        warn("model-unresolved", inContext(`model "${trimmed}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path3}.model`, id);
+        warn("model-unresolved", inContext(`model "${trimmed}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path3}.model`, id2);
       }
       return;
     }
     const resolved = normalizeModelId(pin, registry);
-    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path3}.model`, id);
+    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path3}.model`, id2);
   }, "checkModel");
   const checkTaskClass = /* @__PURE__ */ __name4((node, path3) => {
     if (node.type !== "agent" || node.taskClass === void 0) return;
@@ -4220,46 +5356,46 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     err("task-class-without-model", `taskClass '${String(node.taskClass)}' needs a \`model\` on a pushed definition \u2014 write a class (model: 'class/fast' | 'class/balanced' | 'class/strong') or an approved provider/model code; nothing maps a task class to a model at dispatch, so a step with neither would run on the agent\u2019s own model`, `${path3}.taskClass`, singleId(node));
   }, "checkTaskClass");
   const checkWorkspace = /* @__PURE__ */ __name4((node, path3) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     const ws = workspaceOf(node);
     if (isJobTier(node) && opts.policy && opts.policy.jobTier !== true) {
-      err("job-tier-disabled", `"${id}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path3}.tier`, id);
+      err("job-tier-disabled", `"${id2}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path3}.tier`, id2);
     }
     const tools = jobToolsOf(node);
     if (tools !== void 0) {
       if (!isJobTier(node)) {
-        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path3}.jobTools`, id);
+        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path3}.jobTools`, id2);
       }
       const unknown = (Array.isArray(tools) ? tools : [
         tools
       ]).filter((t) => !WORKFLOW_JOB_TOOLS.includes(t));
       if (unknown.length > 0) {
-        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path3}.jobTools`, id);
+        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path3}.jobTools`, id2);
       }
       if (node.type === "agent" && (Array.isArray(tools) ? tools : [
         tools
       ]).includes("gh")) {
-        warn("gh-on-coding-turn", `"${id}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path3}.jobTools`, id);
+        warn("gh-on-coding-turn", `"${id2}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path3}.jobTools`, id2);
       }
     }
     if (node.type === "agent" && ws && ws !== "inherit" && ws.mount === "ro" && Array.isArray(tools) && effectiveJobTools(tools, true).length === 0) {
-      warn("ro-step-has-no-tools", `"${id}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path3}.jobTools`, id);
+      warn("ro-step-has-no-tools", `"${id2}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path3}.jobTools`, id2);
     }
     if (ws && ws !== "inherit") {
       if (!envelopeWorkspace && !opts.mayInherit) {
-        err("workspace-not-declared", `"${id}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path3}.workspace`, id);
+        err("workspace-not-declared", `"${id2}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path3}.workspace`, id2);
       }
       if (ws.isolation === "worktree" && envelopeWorkspace?.kind === "empty") {
-        err("worktree-requires-git-workspace", `"${id}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path3}.workspace.isolation`, id);
+        err("worktree-requires-git-workspace", `"${id2}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path3}.workspace.isolation`, id2);
       }
     }
     if (node.type === "workflow" && ws === "inherit") {
       if (!envelopeWorkspace) {
-        err("workspace-inherit-without-parent-workspace", `"${id}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path3}.workspace`, id);
+        err("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path3}.workspace`, id2);
       }
       const child = opts.resolveWorkflow?.(node.workflowId);
       if (child?.workspace) {
-        err("workspace-inherit-conflict", `"${id}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path3}.workspace`, id);
+        err("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path3}.workspace`, id2);
       }
     }
   }, "checkWorkspace");
@@ -4268,20 +5404,20 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const schema = node.type === "step" ? node.step.outputSchema : node.type === "agent" ? node.outputSchema : void 0;
     if (schema !== void 0) outputSchemas.set(singleId(node), schema);
   }, "recordOutputSchema");
-  const checkMapMembers = /* @__PURE__ */ __name4((cfg, basePath, id) => {
+  const checkMapMembers = /* @__PURE__ */ __name4((cfg, basePath, id2) => {
     for (const m of malformedMapMembers(cfg)) {
-      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id, m), `${basePath}.${m.member}`, id);
+      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id2, m), `${basePath}.${m.member}`, id2);
     }
   }, "checkMapMembers");
   const checkInputShape = /* @__PURE__ */ __name4((node, path3) => {
     const input = node.input;
     if (input === void 0) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (input !== null && typeof input === "object" && !Array.isArray(input)) {
-      checkMapMembers(input, `${path3}.input`, id);
+      checkMapMembers(input, `${path3}.input`, id2);
       return;
     }
-    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path3}.input`, id);
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path3}.input`, id2);
   }, "checkInputShape");
   const checkBodyInput = /* @__PURE__ */ __name4((body, path3, container) => {
     if (body.type === "workflow" || body.input === void 0) return;
@@ -4572,7 +5708,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       default:
         err("invalid-envelope", `unknown entry type "${entry.type}"`, path3);
     }
-    for (const id of declared) upstream.add(id);
+    for (const id2 of declared) upstream.add(id2);
   });
   if (nodeCount > caps.maxNodes) {
     err("cap-exceeded", `${nodeCount} nodes exceeds the static cap of ${caps.maxNodes}`, "definition.graph");
@@ -4647,19 +5783,19 @@ function hashGraph(g) {
 function compilePlan(g) {
   const steps = {};
   const order = [];
-  const addNode = /* @__PURE__ */ __name4((id, node) => {
-    if (id in steps) {
-      throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id}" in definition.graph`);
+  const addNode = /* @__PURE__ */ __name4((id2, node) => {
+    if (id2 in steps) {
+      throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id2}" in definition.graph`);
     }
-    steps[id] = node;
-    order.push(id);
+    steps[id2] = node;
+    order.push(id2);
   }, "addNode");
   let prevTails = [];
   const foreachJoinToEntry = /* @__PURE__ */ new Map();
   g.definition.graph.forEach((entry, entryIndex) => {
     if (isArmStep(entry)) {
-      const id = armStepId(entry);
-      addNode(id, {
+      const id2 = armStepId(entry);
+      addNode(id2, {
         kind: armStepKind(entry),
         dependsOn: prevTails,
         downstream: [],
@@ -4667,7 +5803,7 @@ function compilePlan(g) {
         entry
       });
       prevTails = [
-        id
+        id2
       ];
       return;
     }
@@ -4806,10 +5942,10 @@ function compilePlan(g) {
         throw new WorkflowPlanError("unknown-entry-type", `Unknown graph entry type "${entry.type}" at definition.graph[${entryIndex}]`);
     }
   });
-  for (const id of order) {
-    for (const dep of steps[id].dependsOn) {
+  for (const id2 of order) {
+    for (const dep of steps[id2].dependsOn) {
       const target = steps[dep] ?? (foreachJoinToEntry.has(dep) ? steps[foreachJoinToEntry.get(dep)] : void 0);
-      target?.downstream.push(id);
+      target?.downstream.push(id2);
     }
   }
   return {
@@ -4975,15 +6111,15 @@ function renderRef(ref) {
   return ref.path;
 }
 function step(s) {
-  const id = stepIdOf(s);
+  const id2 = stepIdOf(s);
   return {
     path: /* @__PURE__ */ __name4((p) => ({
-      path: p === "" ? `stepResults.${id}` : `stepResults.${id}.${p}`
+      path: p === "" ? `stepResults.${id2}` : `stepResults.${id2}.${p}`
     }), "path")
   };
 }
-function stepOf(id) {
-  return step(id);
+function stepOf(id2) {
+  return step(id2);
 }
 function init(path3) {
   return {
@@ -5065,18 +6201,18 @@ function resolvePlacements(calls) {
   const declared = /* @__PURE__ */ new Map();
   const placedBy = /* @__PURE__ */ new Map();
   const allIds = /* @__PURE__ */ new Map();
-  const claimId = /* @__PURE__ */ __name4((id, callIndex) => {
-    const first = allIds.get(id);
+  const claimId = /* @__PURE__ */ __name4((id2, callIndex) => {
+    const first = allIds.get(id2);
     if (first !== void 0 && first !== callIndex) {
       issues.push({
         code: "duplicate-step-id",
-        message: `step id "${id}" is declared more than once (calls #${first} and #${callIndex})`,
+        message: `step id "${id2}" is declared more than once (calls #${first} and #${callIndex})`,
         callIndex,
-        stepId: id
+        stepId: id2
       });
       return;
     }
-    allIds.set(id, callIndex);
+    allIds.set(id2, callIndex);
   }, "claimId");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -5088,7 +6224,7 @@ function resolvePlacements(calls) {
         });
         break;
       case "entry":
-        for (const id of entryIds(call.entry)) claimId(id, i);
+        for (const id2 of entryIds(call.entry)) claimId(id2, i);
         break;
       case "parallel":
         for (const arm of call.arms) if ("node" in arm) claimId(nodeIdOf(arm.node), i);
@@ -5107,42 +6243,42 @@ function resolvePlacements(calls) {
   });
   const armMapPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!ref.armMap || node.type === "mapping" || isHitlNode2(node)) return void 0;
-    const id = nodeIdOf(node);
+    const id2 = nodeIdOf(node);
     if ((container === "foreach" || container === "loop") && node.type !== "workflow") {
       return {
         code: "mapping-placement",
-        message: container === "foreach" ? `foreach body "${id}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
+        message: container === "foreach" ? `foreach body "${id2}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id2}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     if (node.input !== void 0) {
       return {
         code: "mapping-placement",
-        message: `"${id}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
+        message: `"${id2}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     return void 0;
   }, "armMapPlacementIssue");
   const hitlPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!isHitlNode2(node)) return void 0;
-    const id = node.id;
+    const id2 = node.id;
     if (ref.armMap) {
       return {
         code: "node-type-unsupported-in-container",
-        message: workflowHitlArmShapeMessage(node.type, id, "mapped-arm"),
+        message: workflowHitlArmShapeMessage(node.type, id2, "mapped-arm"),
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     if (container !== "place" && !workflowContainerRunsHitlArm(container)) {
       return {
         code: "node-type-unsupported-in-container",
-        message: workflowHitlArmUnsupportedMessage(node.type, id, container),
+        message: workflowHitlArmUnsupportedMessage(node.type, id2, container),
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     return void 0;
@@ -5248,8 +6384,8 @@ function resolvePlacements(calls) {
         graph.push(call.entry);
         return;
       case "declare": {
-        const id = nodeIdOf(call.node);
-        if (placedBy.has(id)) return;
+        const id2 = nodeIdOf(call.node);
+        if (placedBy.has(id2)) return;
         graph.push(call.node);
         return;
       }
@@ -5380,14 +6516,14 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
   const seeded = [];
   const unseeded = [];
   const known = new Set(Object.keys(targetPlan.steps));
-  const parentOf = /* @__PURE__ */ __name4((id) => {
-    const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id);
+  const parentOf = /* @__PURE__ */ __name4((id2) => {
+    const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id2);
     return m ? m[1] : void 0;
   }, "parentOf");
-  const dependsOf = /* @__PURE__ */ __name4((id) => {
-    const node = targetPlan.steps[id];
+  const dependsOf = /* @__PURE__ */ __name4((id2) => {
+    const node = targetPlan.steps[id2];
     if (node) return node.dependsOn;
-    const parent = parentOf(id);
+    const parent = parentOf(id2);
     return parent && targetPlan.steps[parent] ? [
       parent
     ] : [];
@@ -5400,23 +6536,23 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
       walk22.push(s.stepId);
     }
   }
-  for (const id of walk22) {
-    const row = byId.get(id);
+  for (const id2 of walk22) {
+    const row = byId.get(id2);
     if (!row || row.status !== "completed") continue;
-    if (!dependsOf(id).every((d) => seededIds.has(d))) {
-      unseeded.push(id);
+    if (!dependsOf(id2).every((d) => seededIds.has(d))) {
+      unseeded.push(id2);
       continue;
     }
-    seededIds.add(id);
+    seededIds.add(id2);
     seeded.push({
-      stepId: id,
+      stepId: id2,
       output: row.output,
       attempt: row.attempt ?? 1,
       effects: row.effects ?? {}
     });
   }
   const dropped = steps.filter((s) => s.status === "completed" && !known.has(s.stepId) && !(parentOf(s.stepId) && known.has(parentOf(s.stepId)))).map((s) => s.stepId);
-  const firstPending = targetPlan.order.find((id) => !seededIds.has(id));
+  const firstPending = targetPlan.order.find((id2) => !seededIds.has(id2));
   const graphChanged = !!(opts.targetGraphHash && run.graphHash && opts.targetGraphHash !== run.graphHash);
   return {
     sourceRunId: run.id,
@@ -5471,37 +6607,37 @@ function replayLedger(g, ledger) {
     startedAt: 0,
     ...ledger.requestContext
   };
-  const ctxFor = /* @__PURE__ */ __name4((id) => ({
+  const ctxFor = /* @__PURE__ */ __name4((id2) => ({
     initData: ledger.initData,
-    stepResults: ancestorResults(plan, id, rows22),
+    stepResults: ancestorResults(plan, id2, rows22),
     state: ledger.state ?? {},
     requestContext
   }), "ctxFor");
   const verdicts = [];
-  for (const id of plan.order) {
-    const node = plan.steps[id];
-    const recorded = rows22.get(id);
+  for (const id2 of plan.order) {
+    const node = plan.steps[id2];
+    const recorded = rows22.get(id2);
     if (!recorded || recorded.status === "pending" || recorded.status === "skipped") continue;
     if (node.kind === "branch") {
       const entry = node.entry;
-      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id));
+      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id2));
       const recordedTaken = recorded.taken ?? inferTaken(entry, rows22);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "branch",
         recorded: recordedTaken,
         local: taken,
         diverged: canonical(recordedTaken) !== canonical(taken)
       });
-    } else if (node.kind === "map" && !id.endsWith(".join") && recorded.status === "completed") {
+    } else if (node.kind === "map" && !id2.endsWith(".join") && recorded.status === "completed") {
       const entry = node.entry;
-      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id), ctxFor(id));
+      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id2), ctxFor(id2));
       const local = "error" in resolved ? {
         error: resolved.error,
         key: resolved.key
       } : resolved.value;
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "map",
         recorded: recorded.output,
         local,
@@ -5510,11 +6646,11 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "foreach") {
       const entry = node.entry;
       const source = node.dependsOn[0];
-      const items = source ? ctxFor(id).stepResults[source] : void 0;
+      const items = source ? ctxFor(id2).stepResults[source] : void 0;
       const local = Array.isArray(items) ? items.length : void 0;
       const recordedCount = recorded.itemCount ?? countChildren(entry, rows22);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "foreach",
         recorded: recordedCount,
         local,
@@ -5523,7 +6659,7 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "subrun" && recorded.status === "completed" && recorded.child) {
       const local = subrunSettledOutput(recorded.child);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "subrun",
         recorded: recorded.output,
         local,
@@ -5549,7 +6685,7 @@ function replayResultOf(row, node) {
   }
   return void 0;
 }
-function ancestorResults(plan, id, rows22) {
+function ancestorResults(plan, id2, rows22) {
   const out = {};
   const joinAliased = /* @__PURE__ */ new Set();
   const seen = /* @__PURE__ */ new Set();
@@ -5598,7 +6734,7 @@ function ancestorResults(plan, id, rows22) {
       walk22(node.dependsOn);
     }
   }, "walk");
-  walk22(plan.steps[id]?.dependsOn ?? []);
+  walk22(plan.steps[id2]?.dependsOn ?? []);
   return out;
 }
 function inferTaken(entry, rows22) {
@@ -5608,15 +6744,15 @@ function inferTaken(entry, rows22) {
       entry.otherwise
     ] : []
   ];
-  return arms.map(branchArmId).filter((id) => {
-    const r = rows22.get(id);
+  return arms.map(branchArmId).filter((id2) => {
+    const r = rows22.get(id2);
     return r !== void 0 && r.status !== "skipped" && r.status !== "pending";
   });
 }
 function countChildren(entry, rows22) {
   const body = branchArmId(entry.step);
   let n2 = 0;
-  for (const id of rows22.keys()) if (id.startsWith(`${body}[`)) n2 += 1;
+  for (const id2 of rows22.keys()) if (id2.startsWith(`${body}[`)) n2 += 1;
   return n2;
 }
 function isTerminalRunStatus(status) {
@@ -6884,8 +8020,8 @@ var init_dist2 = __esm({
     fromKnowledge = /* @__PURE__ */ __name4((k) => ({
       knowledge: k
     }), "fromKnowledge");
-    SideEffectsSchema = z4.enum(WORKFLOW_SIDE_EFFECTS);
-    JobResourcesSchema = z4.enum(WORKFLOW_JOB_RESOURCES);
+    SideEffectsSchema = z5.enum(WORKFLOW_SIDE_EFFECTS);
+    JobResourcesSchema = z5.enum(WORKFLOW_JOB_RESOURCES);
     WORKFLOW_MODEL_TEMPLATE_ROOT = "initData";
     WORKFLOW_MODEL_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*(?:\|([^}]*))?\}$/;
     PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
@@ -7318,7 +8454,7 @@ var init_dist2 = __esm({
     __name(replayLedger, "replayLedger");
     __name4(replayLedger, "replayLedger");
     JOIN = ".join";
-    entryOfJoin = /* @__PURE__ */ __name4((id) => id.endsWith(JOIN) ? id.slice(0, -JOIN.length) : void 0, "entryOfJoin");
+    entryOfJoin = /* @__PURE__ */ __name4((id2) => id2.endsWith(JOIN) ? id2.slice(0, -JOIN.length) : void 0, "entryOfJoin");
     __name(replayResultOf, "replayResultOf");
     __name4(replayResultOf, "replayResultOf");
     __name(ancestorResults, "ancestorResults");
@@ -7607,8 +8743,8 @@ function createStep(s) {
 function step2(s) {
   return step(typeof s === "string" ? s : s.id);
 }
-function stepOf2(id) {
-  return stepOf(id);
+function stepOf2(id2) {
+  return stepOf(id2);
 }
 function schemaToJson(schema) {
   if (schema === void 0 || schema === null) return void 0;
@@ -7812,16 +8948,16 @@ var init_workflow = __esm({
       if (!isPredicate(p)) throw new LuaWorkflowBuildError("closure-predicate", `${where}: not a LuaPredicate`, "build predicates with eq/gt/inSet/exists/and/or/not");
       return p;
     }, "assertPredicate");
-    assertRetry = /* @__PURE__ */ __name((r, id) => {
+    assertRetry = /* @__PURE__ */ __name((r, id2) => {
       if (!r) return;
       if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
         const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-        throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
+        throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id2}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
       }
-      if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
+      if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
       if (r.maxBackoffSeconds !== void 0) {
-        if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
-        if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds`);
+        if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
+        if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds`);
       }
     }, "assertRetry");
     assertTimeout = /* @__PURE__ */ __name((node) => {
@@ -8019,8 +9155,8 @@ var init_workflow = __esm({
           ref: arm
         };
         if (arm && typeof arm === "object" && isHitlEntry(arm)) {
-          const id = arm.id;
-          throw new LuaWorkflowBuildError("invalid-step", `${where}: an approval / waitForSignal arm is placed by id \u2014 declare it with .approval(${JSON.stringify(id ?? "id")}, \u2026) / .waitForSignal(\u2026) and pass the id string`);
+          const id2 = arm.id;
+          throw new LuaWorkflowBuildError("invalid-step", `${where}: an approval / waitForSignal arm is placed by id \u2014 declare it with .approval(${JSON.stringify(id2 ?? "id")}, \u2026) / .waitForSignal(\u2026) and pass the id string`);
         }
         return {
           node: this.registerStep(arm, where)
@@ -8140,14 +9276,14 @@ var init_workflow = __esm({
         assertNoClosure(mapping, "map()");
         this.recordEnvRefs(mapping);
         this.mapCount += 1;
-        let id = opts?.id;
-        if (id === void 0) {
+        let id2 = opts?.id;
+        if (id2 === void 0) {
           this.unnamedMaps += 1;
-          id = `map_${this.mapCount}`;
+          id2 = `map_${this.mapCount}`;
         }
         const node = {
           type: "mapping",
-          id,
+          id: id2,
           mapConfig: canonicalJson(mapping)
         };
         return this.push({
@@ -8158,12 +9294,12 @@ var init_workflow = __esm({
       sleep(ms, opts) {
         if (typeof ms !== "number" || !Number.isFinite(ms) || ms < 0) throw new LuaWorkflowBuildError("invalid-envelope", "sleep(ms) takes a literal non-negative number");
         this.sleepCount += 1;
-        const id = opts?.id ?? `sleep_${this.sleepCount}`;
+        const id2 = opts?.id ?? `sleep_${this.sleepCount}`;
         return this.push({
           kind: "entry",
           entry: defined({
             type: "sleep",
-            id,
+            id: id2,
             duration: ms,
             businessHours: opts?.businessHours
           })
@@ -8171,13 +9307,13 @@ var init_workflow = __esm({
       }
       sleepUntil(iso, opts) {
         this.sleepCount += 1;
-        const id = opts?.id ?? `sleep_${this.sleepCount}`;
+        const id2 = opts?.id ?? `sleep_${this.sleepCount}`;
         if (typeof iso === "string") {
           return this.push({
             kind: "entry",
             entry: defined({
               type: "sleepUntil",
-              id,
+              id: id2,
               date: iso,
               businessHours: opts?.businessHours,
               round: opts?.round
@@ -8190,7 +9326,7 @@ var init_workflow = __esm({
           kind: "entry",
           entry: {
             type: "mapping",
-            id: `${id}_at`,
+            id: `${id2}_at`,
             mapConfig: canonicalJson({
               date: {
                 template: iso.template
@@ -8202,9 +9338,9 @@ var init_workflow = __esm({
           kind: "entry",
           entry: defined({
             type: "sleepUntil",
-            id,
+            id: id2,
             dateFrom: {
-              step: `${id}_at`,
+              step: `${id2}_at`,
               path: "date"
             },
             businessHours: opts?.businessHours,
@@ -8212,35 +9348,35 @@ var init_workflow = __esm({
           })
         });
       }
-      agentStep(id, opts) {
-        this.assertId(id, "agentStep()");
+      agentStep(id2, opts) {
+        this.assertId(id2, "agentStep()");
         if (!opts || typeof opts.agentId !== "string" && !(opts.agentId && typeof opts.agentId === "object" && "__envRef" in opts.agentId)) {
-          throw new LuaWorkflowBuildError("invalid-envelope", `agentStep("${id}") needs an agentId`);
+          throw new LuaWorkflowBuildError("invalid-envelope", `agentStep("${id2}") needs an agentId`);
         }
         const tier = opts.tier ?? (opts.workspace ? "job" : void 0);
-        if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id}": a step mounting a workspace must be tier:'job'`);
-        if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id}": harness is only legal on a tier:'job' agent step`);
-        if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
+        if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id2}": a step mounting a workspace must be tier:'job'`);
+        if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id2}": harness is only legal on a tier:'job' agent step`);
+        if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id2}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
         for (const m of WORKFLOW_JOB_RANGE_MEMBERS) {
           if (opts[m] === void 0) continue;
-          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": ${m} is only legal on a tier:'job' agent step`);
+          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id2}": ${m} is only legal on a tier:'job' agent step`);
           if (!isWithinWorkflowJobRange(m, opts[m])) {
             const { min, max } = WORKFLOW_JOB_RANGES[m];
-            throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": ${m} must be an integer ${min}..${max}`);
+            throw new LuaWorkflowBuildError("max-turns-invalid", `"${id2}": ${m} must be an integer ${min}..${max}`);
           }
         }
         assertTimeout({
-          id,
+          id: id2,
           timeoutSeconds: opts.timeoutSeconds,
           tier,
           workspace: opts.workspace,
           kind: "agent"
         });
-        assertRetry(opts.retry, id);
+        assertRetry(opts.retry, id2);
         this.recordEnvRefs(opts.agentId, opts.prompt);
         const node = defined({
           type: "agent",
-          id,
+          id: id2,
           agentId: opts.agentId,
           promptTemplate: templateText(opts.prompt),
           outputSchema: schemaToJson(opts.outputSchema),
@@ -8268,30 +9404,30 @@ var init_workflow = __esm({
           node
         });
       }
-      specialistStep(id, opts) {
-        this.assertId(id, "specialistStep()");
+      specialistStep(id2, opts) {
+        this.assertId(id2, "specialistStep()");
         const role = opts?.role;
-        if (!role || typeof role !== "object") throw new LuaWorkflowBuildError("invalid-envelope", `specialistStep("${id}") needs a role`);
+        if (!role || typeof role !== "object") throw new LuaWorkflowBuildError("invalid-envelope", `specialistStep("${id2}") needs a role`);
         if (role.ref !== void 0 && (role.name !== void 0 || role.instructions !== void 0 || role.tools !== void 0)) {
-          throw new LuaWorkflowBuildError("role-ref-and-inline", `"${id}": role is EITHER { ref } OR the inline { name, instructions, tools } shape`);
+          throw new LuaWorkflowBuildError("role-ref-and-inline", `"${id2}": role is EITHER { ref } OR the inline { name, instructions, tools } shape`);
         }
         if (role.ref === void 0) {
           if (typeof role.instructions !== "string" || role.instructions.length > WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS) {
-            throw new LuaWorkflowBuildError("ephemeral-role-too-long", `"${id}": role.instructions must be \u2264 ${WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS} chars`);
+            throw new LuaWorkflowBuildError("ephemeral-role-too-long", `"${id2}": role.instructions must be \u2264 ${WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS} chars`);
           }
-          if (!Array.isArray(role.tools)) throw new LuaWorkflowBuildError("invalid-envelope", `"${id}": role.tools must be an array ([] = no tools)`);
-          if (role.tools.length > 64) throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": role.tools exceeds 64 entries`);
+          if (!Array.isArray(role.tools)) throw new LuaWorkflowBuildError("invalid-envelope", `"${id2}": role.tools must be an array ([] = no tools)`);
+          if (role.tools.length > 64) throw new LuaWorkflowBuildError("cap-exceeded", `"${id2}": role.tools exceeds 64 entries`);
         }
         assertTimeout({
-          id,
+          id: id2,
           timeoutSeconds: opts.timeoutSeconds,
           kind: "agent"
         });
-        assertRetry(opts.retry, id);
+        assertRetry(opts.retry, id2);
         this.recordEnvRefs(opts.prompt);
         const node = defined({
           type: "agent",
-          id,
+          id: id2,
           agentId: "$self",
           role: role.ref !== void 0 ? {
             ref: role.ref
@@ -8314,20 +9450,20 @@ var init_workflow = __esm({
           node
         });
       }
-      toolStep(id, tool, opts = {}) {
-        this.assertId(id, "toolStep()");
-        if (!tool || typeof tool !== "object" || typeof tool.name !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `toolStep("${id}") needs a LuaTool`);
-        assertNoClosure(opts.input, `toolStep("${id}").input`);
+      toolStep(id2, tool, opts = {}) {
+        this.assertId(id2, "toolStep()");
+        if (!tool || typeof tool !== "object" || typeof tool.name !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `toolStep("${id2}") needs a LuaTool`);
+        assertNoClosure(opts.input, `toolStep("${id2}").input`);
         this.recordEnvRefs(opts.input);
         assertTimeout({
-          id,
+          id: id2,
           timeoutSeconds: opts.timeoutSeconds,
           kind: "tool"
         });
-        assertRetry(opts.retry, id);
+        assertRetry(opts.retry, id2);
         const node = defined({
           type: "tool",
-          id,
+          id: id2,
           toolId: tool.name,
           input: opts.input,
           timeoutSeconds: opts.timeoutSeconds,
@@ -8341,34 +9477,34 @@ var init_workflow = __esm({
           node
         });
       }
-      approval(id, opts) {
-        this.assertId(id, "approval()");
-        if (!opts || typeof opts.title !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `approval("${id}") needs a title`);
+      approval(id2, opts) {
+        this.assertId(id2, "approval()");
+        if (!opts || typeof opts.title !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `approval("${id2}") needs a title`);
         if (opts.approver === "creator" && opts.excludeInitiator === true) {
-          throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
+          throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id2}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
         }
         const editable = approvalEditable(opts);
-        if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": \`fourEyes\` requires editable:true`);
+        if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id2}": \`fourEyes\` requires editable:true`);
         if (opts.editable === false && Array.isArray(opts.editablePaths) && opts.editablePaths.length > 0) {
-          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
         } else if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && !editable) {
-          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
         }
         for (const p of opts.editablePaths ?? []) {
-          if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
+          if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
         }
         if (Array.isArray(opts.onTimeout)) {
           const chain = opts.onTimeout;
           const hops = chain.filter((h) => typeof h === "object");
-          if (hops.length > 3) throw new LuaWorkflowBuildError("escalation-chain-too-long", `"${id}": an onTimeout chain carries at most 3 escalation hops`);
+          if (hops.length > 3) throw new LuaWorkflowBuildError("escalation-chain-too-long", `"${id2}": an onTimeout chain carries at most 3 escalation hops`);
           const last = chain[chain.length - 1];
-          if (last === void 0 || typeof last === "object") throw new LuaWorkflowBuildError("escalation-chain-not-terminal", `"${id}": an onTimeout chain must end in a terminal member`);
+          if (last === void 0 || typeof last === "object") throw new LuaWorkflowBuildError("escalation-chain-not-terminal", `"${id2}": an onTimeout chain must end in a terminal member`);
         }
-        if (typeof opts.details === "function") throw new LuaWorkflowBuildError("closure-binding", `approval("${id}").details must be template(...)`);
+        if (typeof opts.details === "function") throw new LuaWorkflowBuildError("closure-binding", `approval("${id2}").details must be template(...)`);
         this.recordEnvRefs(opts.details, opts.timeoutHours, opts.approver);
         const node = defined({
           type: "approval",
-          id,
+          id: id2,
           title: opts.title,
           details: opts.details ? templateText(opts.details) : void 0,
           approver: opts.approver,
@@ -8390,13 +9526,13 @@ var init_workflow = __esm({
           node
         });
       }
-      waitForSignal(id, opts) {
-        this.assertId(id, "waitForSignal()");
-        if (!opts || typeof opts.signal !== "string" || opts.signal.length === 0) throw new LuaWorkflowBuildError("invalid-envelope", `waitForSignal("${id}") needs a signal name`);
+      waitForSignal(id2, opts) {
+        this.assertId(id2, "waitForSignal()");
+        if (!opts || typeof opts.signal !== "string" || opts.signal.length === 0) throw new LuaWorkflowBuildError("invalid-envelope", `waitForSignal("${id2}") needs a signal name`);
         this.recordEnvRefs(opts.timeoutHours);
         const node = defined({
           type: "waitForSignal",
-          id,
+          id: id2,
           signal: opts.signal,
           schema: schemaToJson(opts.schema),
           timeoutHours: opts.timeoutHours,
@@ -8409,28 +9545,28 @@ var init_workflow = __esm({
           node
         });
       }
-      workflow(id, ref, input, opts) {
-        this.assertId(id, "workflow()");
-        assertRetry(opts?.retry, id);
+      workflow(id2, ref, input, opts) {
+        this.assertId(id2, "workflow()");
+        assertRetry(opts?.retry, id2);
         const name = typeof ref === "string" ? ref : ref instanceof LuaWorkflow ? ref.getName() : void 0;
-        if (!name) throw new LuaWorkflowBuildError("invalid-envelope", `workflow("${id}") needs a LuaWorkflow or a workflow name`);
+        if (!name) throw new LuaWorkflowBuildError("invalid-envelope", `workflow("${id2}") needs a LuaWorkflow or a workflow name`);
         if (opts?.workspace === "inherit") {
-          if (!this.config.workspace) throw new LuaWorkflowBuildError("workspace-inherit-without-parent-workspace", `"${id}": workspace:'inherit' but the parent createWorkflow declares no workspace`);
-          if (ref instanceof LuaWorkflow && ref.getConfig().workspace) throw new LuaWorkflowBuildError("workspace-inherit-conflict", `"${id}": workspace:'inherit' on a workflow that declares its own workspace`);
+          if (!this.config.workspace) throw new LuaWorkflowBuildError("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent createWorkflow declares no workspace`);
+          if (ref instanceof LuaWorkflow && ref.getConfig().workspace) throw new LuaWorkflowBuildError("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on a workflow that declares its own workspace`);
         }
-        assertNoClosure(input, `workflow("${id}").input`);
+        assertNoClosure(input, `workflow("${id2}").input`);
         this.recordEnvRefs(input);
         this.nestedRefs.push(opts?.workspace === "inherit" ? {
-          id,
+          id: id2,
           name,
           workspace: "inherit"
         } : {
-          id,
+          id: id2,
           name
         });
         const node = defined({
           type: "workflow",
-          id,
+          id: id2,
           workflowId: name,
           input,
           workspace: opts?.workspace,
@@ -8509,8 +9645,8 @@ var init_workflow = __esm({
           });
         }
       }
-      assertId(id, where) {
-        if (typeof id !== "string" || !STEP_ID_RE.test(id)) throw new LuaWorkflowBuildError("invalid-step-id", `${where}: id "${String(id)}" must match ${STEP_ID_RE}`);
+      assertId(id2, where) {
+        if (typeof id2 !== "string" || !STEP_ID_RE.test(id2)) throw new LuaWorkflowBuildError("invalid-step-id", `${where}: id "${String(id2)}" must match ${STEP_ID_RE}`);
       }
     };
     EDITABLE_PATH_RE2 = /^[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?(\.[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?)*$/;
@@ -8688,7 +9824,7 @@ var init_lua_fetch = __esm({
 });
 
 // src/services/firebase-session.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function rejectedRefreshReason(message) {
   const normalised = message.toUpperCase();
   return REJECTED_REFRESH_REASONS.find((reason) => normalised.includes(reason));
@@ -8834,20 +9970,20 @@ var init_firebase_session = __esm({
         this.name = "FirebaseSessionRejectedError";
       }
     };
-    customTokenResponseSchema = z5.object({
-      idToken: z5.string().min(1),
-      refreshToken: z5.string().min(1),
-      expiresIn: z5.coerce.number().positive().finite(),
-      localId: z5.string().min(1).optional()
+    customTokenResponseSchema = z6.object({
+      idToken: z6.string().min(1),
+      refreshToken: z6.string().min(1),
+      expiresIn: z6.coerce.number().positive().finite(),
+      localId: z6.string().min(1).optional()
     });
-    refreshResponseSchema = z5.object({
-      id_token: z5.string().min(1),
-      refresh_token: z5.string().min(1),
-      expires_in: z5.coerce.number().positive().finite(),
-      user_id: z5.string().min(1)
+    refreshResponseSchema = z6.object({
+      id_token: z6.string().min(1),
+      refresh_token: z6.string().min(1),
+      expires_in: z6.coerce.number().positive().finite(),
+      user_id: z6.string().min(1)
     });
-    firebaseIdTokenPayloadSchema = z5.object({
-      sub: z5.string().min(1)
+    firebaseIdTokenPayloadSchema = z6.object({
+      sub: z6.string().min(1)
     });
     __name(requireFirebaseWebApiKey, "requireFirebaseWebApiKey");
     __name(claimsOfFirebaseIdToken, "claimsOfFirebaseIdToken");
@@ -8864,7 +10000,7 @@ var init_firebase_session = __esm({
 import { createHash as createHash3, randomUUID } from "crypto";
 import { mkdir, open, readFile, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { join as join3 } from "path";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function environmentKey(environment) {
   return createHash3("sha256").update(`${environment.apiUrl}
 ${environment.authUrl}
@@ -8881,15 +10017,15 @@ var init_firebase_session_store = __esm({
   "src/services/firebase-session-store.ts"() {
     "use strict";
     init_constants();
-    storedFirebaseSessionSchema = z6.object({
-      version: z6.literal(1),
-      kind: z6.literal("firebase-session"),
-      generation: z6.string().min(1),
-      refreshToken: z6.string().min(1),
-      firebaseUid: z6.string().min(1),
-      apiUrl: z6.string().url(),
-      authUrl: z6.string().url(),
-      firebaseWebApiKey: z6.string().min(1)
+    storedFirebaseSessionSchema = z7.object({
+      version: z7.literal(1),
+      kind: z7.literal("firebase-session"),
+      generation: z7.string().min(1),
+      refreshToken: z7.string().min(1),
+      firebaseUid: z7.string().min(1),
+      apiUrl: z7.string().url(),
+      authUrl: z7.string().url(),
+      firebaseWebApiKey: z7.string().min(1)
     });
     currentFirebaseSessionEnvironment = /* @__PURE__ */ __name(() => ({
       apiUrl: BASE_URLS.API,
@@ -9560,7 +10696,7 @@ async function* parseSseStream(body, signal) {
   const decoder = new TextDecoder();
   let buffer = "";
   const flush = /* @__PURE__ */ __name((block) => {
-    let id;
+    let id2;
     let event = "message";
     const data = [];
     for (const rawLine of block.split("\n")) {
@@ -9570,11 +10706,11 @@ async function* parseSseStream(body, signal) {
       const field = colon === -1 ? line : line.slice(0, colon);
       let value3 = colon === -1 ? "" : line.slice(colon + 1);
       if (value3.startsWith(" ")) value3 = value3.slice(1);
-      if (field === "id") id = value3;
+      if (field === "id") id2 = value3;
       else if (field === "event") event = value3;
       else if (field === "data") data.push(value3);
     }
-    if (data.length === 0 && id === void 0 && event === "message") return void 0;
+    if (data.length === 0 && id2 === void 0 && event === "message") return void 0;
     const joined = data.join("\n");
     let parsed = joined;
     try {
@@ -9583,7 +10719,7 @@ async function* parseSseStream(body, signal) {
       parsed = joined;
     }
     return {
-      id,
+      id: id2,
       event,
       data: parsed
     };
@@ -10975,11 +12111,17 @@ var init_base_handler = __esm({
       /**
       * Phase 2 of parallel sync: apply fetched data to YAML.
       * Optionally creates missing primitives on server if apiKey+agentId provided.
+      *
+      * PRO-2150 — `apiCredentials.registerOnly` drops the two writes that overwrite what the developer
+      * pinned (the server-only orphan stubs in Part 1, and the version reconciliation half of Part 2)
+      * while keeping id linking and create-on-server. `lua chat` uses it: it needs the skills'/processors'
+      * server ids to exist before the sandbox push, and nothing else.
       */
       async applySyncToYaml(serverData, config, manifest, apiCredentials) {
         const messages = [];
         let yamlUpdated = false;
         let orphanedCount = 0;
+        const registerOnly = apiCredentials?.registerOnly === true;
         try {
           if (!serverData.serverItems) {
             if (serverData.fetchError) {
@@ -11007,10 +12149,10 @@ var init_base_handler = __esm({
             messages.push(msg);
             console.log(msg);
           }
-          const orphans = serverData.serverItems.filter((item) => {
-            const id = item.id;
+          const orphans = registerOnly ? [] : serverData.serverItems.filter((item) => {
+            const id2 = item.id;
             const name = item.name;
-            return !yamlById.has(id) && !yamlByName.has(name) && this.isActive(item) && this.shouldConsiderForOrphan(item);
+            return !yamlById.has(id2) && !yamlByName.has(name) && this.isActive(item) && this.shouldConsiderForOrphan(item);
           });
           if (orphans.length > 0) {
             const stubs = orphans.map((item) => this.cleanItem({
@@ -11034,7 +12176,9 @@ var init_base_handler = __esm({
 `);
             orphanedCount = orphans.length;
           }
-          const { items: updatedItems, changed, msgs } = this.syncFromServer(yamlItems, serverByName);
+          const { items: updatedItems, changed, msgs } = this.syncFromServer(yamlItems, serverByName, {
+            syncVersions: !registerOnly
+          });
           messages.push(...msgs);
           if (changed) {
             yamlUpdated = true;
@@ -11226,7 +12370,7 @@ var init_base_handler = __esm({
         const result = /* @__PURE__ */ new Map();
         const { serverItems } = await this.fetchServerState(apiKey, agentId);
         if (!serverItems) {
-          entityIds.forEach((id) => result.set(id, null));
+          entityIds.forEach((id2) => result.set(id2, null));
           return result;
         }
         for (const entityId of entityIds) {
@@ -11260,8 +12404,8 @@ var init_base_handler = __esm({
         const yamlById = /* @__PURE__ */ new Map();
         const yamlByName = /* @__PURE__ */ new Map();
         for (const item of yamlItems) {
-          const id = this.getItemId(item);
-          if (id) yamlById.set(id, item);
+          const id2 = this.getItemId(item);
+          if (id2) yamlById.set(id2, item);
           yamlByName.set(item.name, item);
         }
         const serverByName = /* @__PURE__ */ new Map();
@@ -11277,7 +12421,8 @@ var init_base_handler = __esm({
       /**
       * For each YAML item, match to server by name, populate missing IDs, update versions.
       */
-      syncFromServer(yamlItems, serverByName) {
+      syncFromServer(yamlItems, serverByName, options) {
+        const syncVersions = options?.syncVersions !== false;
         const msgs = [];
         let changed = false;
         const idField = this.yamlConfig.idField;
@@ -11298,7 +12443,7 @@ var init_base_handler = __esm({
             };
           }
           const versions = serverItem.versions;
-          if (Array.isArray(versions) && versions.length > 0) {
+          if (syncVersions && Array.isArray(versions) && versions.length > 0) {
             const activeVersion = this.getActiveVersion(serverItem);
             const currentVersion = item.version;
             if (activeVersion && activeVersion !== currentVersion) {
@@ -15123,7 +16268,7 @@ var init_workflow_api_service = __esm({
         throw new WorkflowApiError("FORBIDDEN", `Workflows.${member}: goals are scoped to the bound agent ${api.agentId}`, 403);
       }
     }, "assertBoundAgent");
-    pathId = /* @__PURE__ */ __name((id) => encodeURIComponent(id), "pathId");
+    pathId = /* @__PURE__ */ __name((id2) => encodeURIComponent(id2), "pathId");
     unavailable = /* @__PURE__ */ __name((member, route) => async () => {
       throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route} lands with a later wave)`, 501);
     }, "unavailable");
@@ -15859,6 +17004,20 @@ var env = Object.assign((key, _opts) => readEnv(key), {
     };
   }, "template")
 });
+var log = Object.freeze({
+  debug: /* @__PURE__ */ __name((message, fields) => emitLocalLog("debug", message, fields), "debug"),
+  info: /* @__PURE__ */ __name((message, fields) => emitLocalLog("info", message, fields), "info"),
+  warn: /* @__PURE__ */ __name((message, fields) => emitLocalLog("warn", message, fields), "warn"),
+  error: /* @__PURE__ */ __name((message, fields) => emitLocalLog("error", message, fields), "error")
+});
+function emitLocalLog(level, message, fields) {
+  const normalized = normalizeLogFields(fields);
+  const text = typeof message === "object" && message !== null ? JSON.stringify(message) : String(message);
+  const write = level === "error" ? console.error : level === "warn" ? console.warn : level === "info" ? console.info : console.debug;
+  if (normalized) write(text, JSON.stringify(normalized));
+  else write(text);
+}
+__name(emitLocalLog, "emitLocalLog");
 var ToolFlag = /* @__PURE__ */ (function(ToolFlag2) {
   ToolFlag2["NONE"] = "none";
   ToolFlag2["IGNORE_ON_ENTER"] = "ignore_on_enter";
@@ -16819,9 +17978,9 @@ var Products = {
   * @param id - Product ID
   * @returns Promise resolving when deletion is complete
   */
-  async delete(id) {
+  async delete(id2) {
     const instance = await getProductsInstance();
-    return instance.delete(id);
+    return instance.delete(id2);
   },
   /**
   * Searches products by query string.
@@ -16839,9 +17998,9 @@ var Products = {
   * @param id - Product ID
   * @returns Promise resolving to product data
   */
-  async getById(id) {
+  async getById(id2) {
     const instance = await getProductsInstance();
-    return instance.getById(id);
+    return instance.getById(id2);
   }
 };
 var Baskets = {
@@ -17378,6 +18537,7 @@ export {
   inSet2 as inSet,
   init2 as init,
   lit2 as lit,
+  log,
   lt2 as lt,
   lte2 as lte,
   ne2 as ne,