lua-cli 3.38.0 → 3.39.1

package/dist/workflow-builder.js

@@ -8,6 +8,7 @@ import { zodToJsonSchema } from "zod-to-json-schema";
 import { z } from "zod";
 import { z as z2 } from "zod";
 import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var __defProp2 = Object.defineProperty;
 var __name2 = /* @__PURE__ */ __name((target, value3) => __defProp2(target, "name", { value: value3, configurable: true }), "__name");
 var PLUMBING_THREAD_CHANNELS = [
@@ -184,9 +185,9 @@ __name2(isMcpDraftCreateTool, "isMcpDraftCreateTool");
 function mcpSendSiblingForDraftTool(tool, availableToolIds) {
   const candidates = [
     ...availableToolIds
-  ].filter((id) => id.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id) => ({
-    id,
-    serverName: id.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
+  ].filter((id2) => id2.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id2) => ({
+    id: id2,
+    serverName: id2.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
   })).filter(({ serverName }) => tool.startsWith(`${serverName}_`)).sort((a, b) => b.serverName.length - a.serverName.length);
   return candidates[0]?.id;
 }
@@ -367,8 +368,8 @@ __name(transformChatHistoryContentParts, "transformChatHistoryContentParts");
 __name2(transformChatHistoryContentParts, "transformChatHistoryContentParts");
 var RICH_PARTS_MESSAGE_ID_PREFIX = "rich-parts:";
 var SCREENSHOT_MESSAGE_ID_PREFIX = "screenshot:";
-function isSyntheticSideRow(id) {
-  return id.startsWith(SCREENSHOT_MESSAGE_ID_PREFIX) || id.startsWith(RICH_PARTS_MESSAGE_ID_PREFIX);
+function isSyntheticSideRow(id2) {
+  return id2.startsWith(SCREENSHOT_MESSAGE_ID_PREFIX) || id2.startsWith(RICH_PARTS_MESSAGE_ID_PREFIX);
 }
 __name(isSyntheticSideRow, "isSyntheticSideRow");
 __name2(isSyntheticSideRow, "isSyntheticSideRow");
@@ -664,6 +665,199 @@ var BROWSER_COMMANDS = [
   }
 ];
 var BROWSER_COMMAND_NAMES = BROWSER_COMMANDS.map((c) => c.name);
+var LOG_FIELDS_MAX_KEYS = 32;
+var LOG_FIELD_MAX_VALUE_BYTES = 1024;
+var LOG_FIELDS_MAX_BYTES = 8192;
+var LOG_FIELD_KEY_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+var LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS = Object.freeze([
+  /^api_[0-9a-f]{24,}$/,
+  /^gh[pousr]_[a-z0-9]{36}$/,
+  /^(?:sk|rk|pk)_(?:live|test)_[a-z0-9]{16,}$/,
+  /^lua_hc_[a-z0-9]{20,}/,
+  /^lua_sk_[a-z0-9]{20,}/
+]);
+var LOG_FIELDS_CLAMPED_KEY = "lua_fields_clamped";
+var LOG_FIELD_ARRAY_COUNT_SUFFIX = ".count";
+var LuaLogFieldsError = class _LuaLogFieldsError extends Error {
+  static {
+    __name(this, "_LuaLogFieldsError");
+  }
+  static {
+    __name2(this, "LuaLogFieldsError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "LuaLogFieldsError";
+    Object.setPrototypeOf(this, _LuaLogFieldsError.prototype);
+  }
+};
+function utf8WidthAt(value3, index) {
+  const code = value3.charCodeAt(index);
+  if (code < 128) return {
+    bytes: 1,
+    units: 1
+  };
+  if (code < 2048) return {
+    bytes: 2,
+    units: 1
+  };
+  if (code >= 55296 && code <= 56319) {
+    const next = value3.charCodeAt(index + 1);
+    if (next >= 56320 && next <= 57343) return {
+      bytes: 4,
+      units: 2
+    };
+  }
+  return {
+    bytes: 3,
+    units: 1
+  };
+}
+__name(utf8WidthAt, "utf8WidthAt");
+__name2(utf8WidthAt, "utf8WidthAt");
+function utf8ByteLength(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const width = utf8WidthAt(value3, i);
+    bytes += width.bytes;
+    i += width.units;
+  }
+  return bytes;
+}
+__name(utf8ByteLength, "utf8ByteLength");
+__name2(utf8ByteLength, "utf8ByteLength");
+function clampUtf8(value3, maxBytes) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const width = utf8WidthAt(value3, i);
+    if (bytes + width.bytes > maxBytes) return value3.slice(0, i);
+    bytes += width.bytes;
+    i += width.units;
+  }
+  return value3;
+}
+__name(clampUtf8, "clampUtf8");
+__name2(clampUtf8, "clampUtf8");
+function mapBytes(fields, withMark) {
+  return utf8ByteLength(JSON.stringify(withMark ? {
+    ...fields,
+    [LOG_FIELDS_CLAMPED_KEY]: true
+  } : fields));
+}
+__name(mapBytes, "mapBytes");
+__name2(mapBytes, "mapBytes");
+function withValueCap(fields, capBytes) {
+  const out = {};
+  for (const [key, value3] of Object.entries(fields)) {
+    out[key] = typeof value3 === "string" ? clampUtf8(value3, capBytes) : value3;
+  }
+  return out;
+}
+__name(withValueCap, "withValueCap");
+__name2(withValueCap, "withValueCap");
+function describeValue(value3) {
+  if (value3 === null) return "null";
+  if (value3 === void 0) return "undefined";
+  if (Array.isArray(value3)) return "an array";
+  return typeof value3 === "object" ? "an object" : `a ${typeof value3}`;
+}
+__name(describeValue, "describeValue");
+__name2(describeValue, "describeValue");
+function assertValidLogFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is not allowed \u2014 a key must match ${LOG_FIELD_KEY_PATTERN.source} (lower-case, starts with a letter, then letters/digits/underscore, at most 64 characters)`);
+  }
+  if (LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key))) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is not allowed \u2014 it has the shape of a credential that the log-drain scrubber masks in values; a field KEY is never scrubbed, so it may never carry a secret shape`);
+  }
+  if (key === LOG_FIELDS_CLAMPED_KEY) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is reserved \u2014 the platform sets it to mark a field map it had to clamp`);
+  }
+}
+__name(assertValidLogFieldKey, "assertValidLogFieldKey");
+__name2(assertValidLogFieldKey, "assertValidLogFieldKey");
+function normalizeLogFields(fields) {
+  if (fields === void 0 || fields === null) return void 0;
+  if (typeof fields !== "object" || Array.isArray(fields)) {
+    throw new LuaLogFieldsError(`log fields: expected a plain object of fields, received ${describeValue(fields)}`);
+  }
+  const entries = Object.entries(fields);
+  if (entries.length > LOG_FIELDS_MAX_KEYS) {
+    throw new LuaLogFieldsError(`log fields: ${entries.length} keys exceeds the cap of ${LOG_FIELDS_MAX_KEYS} keys per call`);
+  }
+  const out = {};
+  for (const [key, value3] of entries) {
+    assertValidLogFieldKey(key);
+    if (typeof value3 === "string" || typeof value3 === "boolean") {
+      out[key] = value3;
+      continue;
+    }
+    if (typeof value3 === "number") {
+      if (!Number.isFinite(value3)) {
+        throw new LuaLogFieldsError(`log fields: \`${key}\` must be a finite number \u2014 NaN and Infinity have no JSON form`);
+      }
+      out[key] = value3;
+      continue;
+    }
+    if (Array.isArray(value3)) {
+      const parts = [];
+      for (const element of value3) {
+        if (typeof element !== "string") {
+          throw new LuaLogFieldsError(`log fields: \`${key}\` is an array, so every element must be a string (found ${describeValue(element)})`);
+        }
+        if (element.includes(",")) {
+          throw new LuaLogFieldsError(`log fields: \`${key}\` \u2014 an array element may not contain a comma; elements are comma-joined into one value (with \`${key}${LOG_FIELD_ARRAY_COUNT_SUFFIX}\` beside it), so a comma inside one would be indistinguishable from the separator`);
+        }
+        parts.push(element);
+      }
+      out[key] = parts.join(",");
+      out[`${key}${LOG_FIELD_ARRAY_COUNT_SUFFIX}`] = parts.length;
+      continue;
+    }
+    throw new LuaLogFieldsError(`log fields: \`${key}\` must be a string, number, boolean or string[] \u2014 received ${describeValue(value3)}` + (value3 !== null && typeof value3 === "object" ? " (nested objects are not supported)" : ""));
+  }
+  const keys = Object.keys(out);
+  if (keys.length === 0) return void 0;
+  if (keys.length > LOG_FIELDS_MAX_KEYS) {
+    throw new LuaLogFieldsError(`log fields: ${keys.length} keys exceeds the cap of ${LOG_FIELDS_MAX_KEYS} keys per call \u2014 an array field also contributes its \`${LOG_FIELD_ARRAY_COUNT_SUFFIX.slice(1)}\` sibling`);
+  }
+  if (clampLogFields(out)) out[LOG_FIELDS_CLAMPED_KEY] = true;
+  return out;
+}
+__name(normalizeLogFields, "normalizeLogFields");
+__name2(normalizeLogFields, "normalizeLogFields");
+function clampLogFields(out) {
+  let clamped = false;
+  for (const [key, value3] of Object.entries(out)) {
+    if (typeof value3 !== "string") continue;
+    const capped = clampUtf8(value3, LOG_FIELD_MAX_VALUE_BYTES);
+    if (capped !== value3) {
+      out[key] = capped;
+      clamped = true;
+    }
+  }
+  if (mapBytes(out, clamped) <= LOG_FIELDS_MAX_BYTES) return clamped;
+  const base = {
+    ...out
+  };
+  let low = 0;
+  let high = LOG_FIELD_MAX_VALUE_BYTES;
+  let best = 0;
+  while (low <= high) {
+    const mid = Math.floor((low + high) / 2);
+    if (mapBytes(withValueCap(base, mid), true) <= LOG_FIELDS_MAX_BYTES) {
+      best = mid;
+      low = mid + 1;
+    } else {
+      high = mid - 1;
+    }
+  }
+  const fitted = withValueCap(base, best);
+  for (const key of Object.keys(out)) out[key] = fitted[key];
+  return true;
+}
+__name(clampLogFields, "clampLogFields");
+__name2(clampLogFields, "clampLogFields");
 var DESKTOP_FILE_COMMANDS = [
   "files_roots",
   "files_stat",
@@ -925,14 +1119,14 @@ function workflowContainerRunsHitlArm(container) {
 }
 __name(workflowContainerRunsHitlArm, "workflowContainerRunsHitlArm");
 __name2(workflowContainerRunsHitlArm, "workflowContainerRunsHitlArm");
-function workflowHitlArmUnsupportedMessage(type, id, container) {
+function workflowHitlArmUnsupportedMessage(type, id2, container) {
   const legal = WORKFLOW_HITL_ARM_CONTAINERS.map((c) => `\`${c}\``).join(" / ");
-  return `the engine does not run \`${type}\` inside a \`${container}\` yet (node "${id}") \u2014 place it at the top level, as a ${legal} arm, or inside a child \`workflow\``;
+  return `the engine does not run \`${type}\` inside a \`${container}\` yet (node "${id2}") \u2014 place it at the top level, as a ${legal} arm, or inside a child \`workflow\``;
 }
 __name(workflowHitlArmUnsupportedMessage, "workflowHitlArmUnsupportedMessage");
 __name2(workflowHitlArmUnsupportedMessage, "workflowHitlArmUnsupportedMessage");
-function workflowHitlArmShapeMessage(type, id, shape) {
-  return shape === "mapped-arm" ? `\`${type}\` arm "${id}" takes the previous output as its payload \u2014 it cannot head a [mapping, step] chain; map before the container instead` : `a chunked foreach hands each child a slice of items, not one \u2014 \`${type}\` body "${id}" takes one item; drop \`chunk\``;
+function workflowHitlArmShapeMessage(type, id2, shape) {
+  return shape === "mapped-arm" ? `\`${type}\` arm "${id2}" takes the previous output as its payload \u2014 it cannot head a [mapping, step] chain; map before the container instead` : `a chunked foreach hands each child a slice of items, not one \u2014 \`${type}\` body "${id2}" takes one item; drop \`chunk\``;
 }
 __name(workflowHitlArmShapeMessage, "workflowHitlArmShapeMessage");
 __name2(workflowHitlArmShapeMessage, "workflowHitlArmShapeMessage");
@@ -1227,6 +1421,112 @@ var AGENT_LOG_SOURCES = [
   "workflow-script",
   "workflow"
 ];
+var AGENT_LOG_FIELDS_MAX_WIRE_KEYS = LOG_FIELDS_MAX_KEYS + 1;
+function utf8Bytes(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const code = value3.charCodeAt(i);
+    if (code < 128) {
+      bytes += 1;
+      i += 1;
+    } else if (code < 2048) {
+      bytes += 2;
+      i += 1;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value3.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        i += 2;
+      } else {
+        bytes += 3;
+        i += 1;
+      }
+    } else {
+      bytes += 3;
+      i += 1;
+    }
+  }
+  return bytes;
+}
+__name(utf8Bytes, "utf8Bytes");
+__name2(utf8Bytes, "utf8Bytes");
+function isPlainFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
+  return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+__name(isPlainFieldKey, "isPlainFieldKey");
+__name2(isPlainFieldKey, "isPlainFieldKey");
+function describeAgentLogFieldsViolation(value3) {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) {
+    return "fields must be an object";
+  }
+  const entries = Object.entries(value3);
+  let userKeys = 0;
+  for (const [key, entry] of entries) {
+    if (key === LOG_FIELDS_CLAMPED_KEY) {
+      if (entry !== true) return `fields.${key} must be true`;
+      continue;
+    }
+    userKeys += 1;
+    if (key.endsWith(LOG_FIELD_ARRAY_COUNT_SUFFIX)) {
+      const base = key.slice(0, -LOG_FIELD_ARRAY_COUNT_SUFFIX.length);
+      if (!isPlainFieldKey(base)) return `fields key \`${key}\` is not a legal field key`;
+      if (typeof entry !== "number" || !Number.isFinite(entry)) {
+        return `fields.${key} must be a finite number`;
+      }
+      continue;
+    }
+    if (!isPlainFieldKey(key)) return `fields key \`${key}\` is not a legal field key`;
+    if (typeof entry === "string") {
+      if (utf8Bytes(entry) > LOG_FIELD_MAX_VALUE_BYTES) {
+        return `fields.${key} exceeds ${LOG_FIELD_MAX_VALUE_BYTES} bytes`;
+      }
+      continue;
+    }
+    if (typeof entry === "boolean") continue;
+    if (typeof entry === "number") {
+      if (!Number.isFinite(entry)) return `fields.${key} must be a finite number`;
+      continue;
+    }
+    return `fields.${key} must be a string, number or boolean`;
+  }
+  if (userKeys > LOG_FIELDS_MAX_KEYS) {
+    return `fields has ${userKeys} keys, over the cap of ${LOG_FIELDS_MAX_KEYS}`;
+  }
+  if (utf8Bytes(JSON.stringify(value3)) > LOG_FIELDS_MAX_BYTES) {
+    return `fields exceeds ${LOG_FIELDS_MAX_BYTES} bytes`;
+  }
+  return void 0;
+}
+__name(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+__name2(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+function isAgentLogFields(value3) {
+  return describeAgentLogFieldsViolation(value3) === void 0;
+}
+__name(isAgentLogFields, "isAgentLogFields");
+__name2(isAgentLogFields, "isAgentLogFields");
+var LOG_DRAIN_TYPES_PHASE1 = [
+  "http",
+  "otlp",
+  "datadog",
+  "betterstack"
+];
+var LOG_DRAIN_TYPES_PHASE2 = [
+  "splunk",
+  "loki",
+  "axiom",
+  "newrelic",
+  "sumologic"
+];
+var LOG_DRAIN_TYPES_IMPLEMENTED = [
+  ...LOG_DRAIN_TYPES_PHASE1,
+  ...LOG_DRAIN_TYPES_PHASE2,
+  // RECONCILE-4 (W4-4). `s3` is implemented (H4 / PRO-1887) but is NOT in
+  // `LOG_DRAIN_TYPES_PHASE2`, because its own flag opens it and `*` must not. It
+  // belongs here all the same: this list is what a CLIENT may offer, and the server
+  // remains the authority that answers 422 with the live list.
+  "s3"
+];
 var LOG_DRAIN_SOURCES = [
   ...AGENT_LOG_SOURCES,
   "execution",
@@ -1235,7 +1535,10 @@ var LOG_DRAIN_SOURCES = [
   "trigger-execution",
   "job-execution",
   "workflow-run",
-  "workflow-audit"
+  "workflow-audit",
+  // PRO-1884 (H2). Appended AFTER 'workflow-audit' so the enum stays additive and
+  // no existing member changes position.
+  "voice-call"
 ];
 var LOG_DRAIN_MAX_PER_ORG = 5;
 var LOG_DRAIN_MAX_PER_ORG_ENTERPRISE = 10;
@@ -1244,8 +1547,26 @@ function maxDrainsForTier(tier) {
 }
 __name(maxDrainsForTier, "maxDrainsForTier");
 __name2(maxDrainsForTier, "maxDrainsForTier");
+var LOG_DRAIN_DATADOG_SITES = [
+  "datadoghq.com",
+  "datadoghq.eu",
+  "us3.datadoghq.com",
+  "us5.datadoghq.com",
+  "ap1.datadoghq.com",
+  "ddog-gov.com"
+];
+var LOG_DRAIN_NEWRELIC_SITES = [
+  "log-api.newrelic.com",
+  "log-api.eu.newrelic.com",
+  "log-api.jp.newrelic.com"
+];
 var LOG_DRAIN_ENDPOINT_TEMPLATES = {
-  datadog: "https://http-intake.logs.{site}/api/v2/logs"
+  datadog: "https://http-intake.logs.{site}/api/v2/logs",
+  newrelic: "https://{site}/log/v1"
+};
+var LOG_DRAIN_PRESET_SITES = {
+  datadog: LOG_DRAIN_DATADOG_SITES,
+  newrelic: LOG_DRAIN_NEWRELIC_SITES
 };
 function resolvePresetEndpoint(type, site) {
   const template3 = LOG_DRAIN_ENDPOINT_TEMPLATES[type];
@@ -1254,6 +1575,233 @@ function resolvePresetEndpoint(type, site) {
 }
 __name(resolvePresetEndpoint, "resolvePresetEndpoint");
 __name2(resolvePresetEndpoint, "resolvePresetEndpoint");
+var LOG_DRAIN_BUCKET_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+var LOG_DRAIN_BUCKET_HOST_PATTERNS = Object.freeze({
+  aws: [
+    // virtual-host style, regional and legacy global
+    /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.s3(\.dualstack)?(\.[a-z0-9-]+)?\.amazonaws\.com$/,
+    // path style
+    /^s3(\.dualstack)?(\.[a-z0-9-]+)?\.amazonaws\.com$/
+  ],
+  r2: [
+    /^[a-f0-9]{32}\.r2\.cloudflarestorage\.com$/
+  ],
+  gcs: [
+    /^storage\.googleapis\.com$/
+  ]
+});
+function isLogDrainBucketHostAllowed(provider, host) {
+  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (!normalized) return false;
+  return (LOG_DRAIN_BUCKET_HOST_PATTERNS[provider] ?? []).some((pattern) => pattern.test(normalized));
+}
+__name(isLogDrainBucketHostAllowed, "isLogDrainBucketHostAllowed");
+__name2(isLogDrainBucketHostAllowed, "isLogDrainBucketHostAllowed");
+function resolveDrainBucketEndpoint(bucket) {
+  if (!LOG_DRAIN_BUCKET_NAME_PATTERN.test(bucket.bucket)) {
+    throw new Error("log drain bucket name is not a valid S3 bucket label");
+  }
+  if (bucket.provider === "aws") {
+    const region = bucket.region.trim().toLowerCase();
+    if (!/^[a-z0-9-]{1,32}$/.test(region)) throw new Error("log drain bucket region is not an AWS region");
+    return `https://${bucket.bucket}.s3.${region}.amazonaws.com`;
+  }
+  if (!bucket.endpoint) throw new Error(`log drain '${bucket.provider}' bucket requires an endpoint`);
+  let url;
+  try {
+    url = new URL(bucket.endpoint);
+  } catch {
+    throw new Error(`log drain '${bucket.provider}' bucket endpoint is not an absolute URL`);
+  }
+  if (url.protocol !== "https:") throw new Error(`log drain '${bucket.provider}' bucket endpoint must be https`);
+  return `https://${url.host}/${bucket.bucket}`;
+}
+__name(resolveDrainBucketEndpoint, "resolveDrainBucketEndpoint");
+__name2(resolveDrainBucketEndpoint, "resolveDrainBucketEndpoint");
+function drainBucketUsesPathStyle(provider) {
+  return provider !== "aws";
+}
+__name(drainBucketUsesPathStyle, "drainBucketUsesPathStyle");
+__name2(drainBucketUsesPathStyle, "drainBucketUsesPathStyle");
+function presetIntakeHosts(type) {
+  const template3 = LOG_DRAIN_ENDPOINT_TEMPLATES[type];
+  const sites = LOG_DRAIN_PRESET_SITES[type];
+  if (!template3 || !sites) return [];
+  const hosts = [];
+  for (const site of sites) {
+    try {
+      hosts.push(new URL(template3.replace("{site}", site)).hostname.toLowerCase());
+    } catch {
+    }
+  }
+  return hosts;
+}
+__name(presetIntakeHosts, "presetIntakeHosts");
+__name2(presetIntakeHosts, "presetIntakeHosts");
+var LOG_DRAIN_PRESET_HOST_SUFFIXES = {
+  axiom: [
+    ".axiom.co"
+  ],
+  sumologic: [
+    ".sumologic.com"
+  ]
+};
+function presetHostAllowlist(type) {
+  return [
+    ...presetIntakeHosts(type),
+    ...LOG_DRAIN_PRESET_HOST_SUFFIXES[type] ?? []
+  ];
+}
+__name(presetHostAllowlist, "presetHostAllowlist");
+__name2(presetHostAllowlist, "presetHostAllowlist");
+function drainHostAllowlistAllows(allowlist, host) {
+  const needle = host.toLowerCase();
+  return allowlist.some((raw) => {
+    const entry = raw.toLowerCase();
+    if (entry.startsWith(".")) return needle === entry.slice(1) || needle.endsWith(entry);
+    return entry === needle;
+  });
+}
+__name(drainHostAllowlistAllows, "drainHostAllowlistAllows");
+__name2(drainHostAllowlistAllows, "drainHostAllowlistAllows");
+function drainDestinationIsVendorPinned(type) {
+  if (LOG_DRAIN_ENDPOINT_TEMPLATES[type]) return true;
+  return presetHostAllowlist(type).length > 0;
+}
+__name(drainDestinationIsVendorPinned, "drainDestinationIsVendorPinned");
+__name2(drainDestinationIsVendorPinned, "drainDestinationIsVendorPinned");
+function drainVerificationOwnership(input) {
+  if (input.proved === true) return "verified";
+  if (input.mode === "test-post" && drainDestinationIsVendorPinned(input.type)) return "verified";
+  return "reachability-only";
+}
+__name(drainVerificationOwnership, "drainVerificationOwnership");
+__name2(drainVerificationOwnership, "drainVerificationOwnership");
+function drainOwnershipOrDefault(ownership) {
+  return ownership === "verified" ? "verified" : "reachability-only";
+}
+__name(drainOwnershipOrDefault, "drainOwnershipOrDefault");
+__name2(drainOwnershipOrDefault, "drainOwnershipOrDefault");
+var DRAIN_CONTENT_ACK_ERROR_CODE = "DRAIN_CONTENT_ACK_REQUIRED";
+var DRAIN_CONTENT_ACK_FIELD = "includeContentAck";
+var DrainContentAckRequiredError = class extends Error {
+  static {
+    __name(this, "DrainContentAckRequiredError");
+  }
+  static {
+    __name2(this, "DrainContentAckRequiredError");
+  }
+  code = DRAIN_CONTENT_ACK_ERROR_CODE;
+  field = DRAIN_CONTENT_ACK_FIELD;
+  constructor() {
+    super("includeContent ships end-user message content to a third party; set includeContentAck: true to confirm.");
+    this.name = "DrainContentAckRequiredError";
+  }
+};
+function assertDrainContentAck(input) {
+  const turningOn = input.next === true && input.was !== true;
+  if (!turningOn) return void 0;
+  if (input.ack !== true) throw new DrainContentAckRequiredError();
+  return {
+    by: input.actor,
+    source: input.source,
+    at: input.at,
+    ...input.inheritedFrom ? {
+      inheritedFrom: input.inheritedFrom
+    } : {}
+  };
+}
+__name(assertDrainContentAck, "assertDrainContentAck");
+__name2(assertDrainContentAck, "assertDrainContentAck");
+var LOG_DRAIN_PRESET_PATHS = {
+  // https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples
+  splunk: {
+    path: "/services/collector/event"
+  },
+  // https://grafana.com/docs/loki/latest/reference/loki-http-api/#ingest-logs
+  loki: {
+    path: "/loki/api/v1/push"
+  },
+  // https://axiom.co/docs/restapi/endpoints/ingestIntoDataset
+  axiom: {
+    path: "/v1/datasets",
+    segment: "dataset",
+    suffix: "/ingest"
+  },
+  // https://help.sumologic.com/docs/send-data/hosted-collectors/http-source/logs-metrics/upload-logs/
+  sumologic: {
+    path: "/receiver/v1/http",
+    segment: "token"
+  }
+};
+var PRESET_SEGMENT_RE = /^[A-Za-z0-9._~%=+-]{1,512}$/;
+function composePresetEndpoint(type, endpoint) {
+  const rule = LOG_DRAIN_PRESET_PATHS[type];
+  if (!rule) return void 0;
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    return {
+      ok: false,
+      reason: "invalid_url"
+    };
+  }
+  if (url.protocol !== "https:" || !url.hostname) return {
+    ok: false,
+    reason: "invalid_url"
+  };
+  const origin = url.origin;
+  const path = url.pathname.replace(/\/+$/, "");
+  if (!rule.segment) {
+    const base2 = path.endsWith(rule.path) ? path.slice(0, path.length - rule.path.length) : path;
+    return {
+      ok: true,
+      endpoint: `${origin}${base2}${rule.path}`
+    };
+  }
+  const marker = `${rule.path}/`;
+  const at = path.indexOf(marker);
+  if (at < 0) {
+    return {
+      ok: false,
+      reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
+    };
+  }
+  const base = path.slice(0, at);
+  const afterMarker = path.slice(at + marker.length);
+  const rest = rule.suffix && afterMarker.endsWith(rule.suffix) ? afterMarker.slice(0, afterMarker.length - rule.suffix.length) : afterMarker;
+  if (!rest || rest.includes("/")) {
+    return {
+      ok: false,
+      reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
+    };
+  }
+  if (!PRESET_SEGMENT_RE.test(rest)) return {
+    ok: false,
+    reason: "bad_segment"
+  };
+  if (rule.segment === "dataset") {
+    return {
+      ok: true,
+      endpoint: `${origin}${base}${rule.path}/${rest}${rule.suffix ?? ""}`,
+      dataset: rest
+    };
+  }
+  return {
+    ok: true,
+    endpoint: `${origin}${base}${rule.path}/`,
+    token: rest
+  };
+}
+__name(composePresetEndpoint, "composePresetEndpoint");
+__name2(composePresetEndpoint, "composePresetEndpoint");
+function joinPresetEndpointToken(endpoint, token) {
+  if (typeof token !== "string" || !PRESET_SEGMENT_RE.test(token)) return endpoint;
+  return endpoint.endsWith("/") ? `${endpoint}${token}` : `${endpoint}/${token}`;
+}
+__name(joinPresetEndpointToken, "joinPresetEndpointToken");
+__name2(joinPresetEndpointToken, "joinPresetEndpointToken");
 var LOG_DRAIN_QUOTAS = {
   team: {
     eventsPerDay: 1e6,
@@ -1332,6 +1880,358 @@ function logDrainQuotaDroppedSeverities(degradation) {
 }
 __name(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
 __name2(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
+var LOG_EXPORT_SOURCES = [
+  ...AGENT_LOG_SOURCES,
+  "execution"
+];
+var LOG_EXPORT_MAX_WINDOW_DAYS = 31;
+var LOG_EXPORT_MAX_WINDOW_MS = LOG_EXPORT_MAX_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
+var LOG_EXPORT_URL_TTL_SECONDS = 24 * 60 * 60;
+var LOG_EXPORT_FILE_RETENTION_DAYS = 7;
+var LOG_EXPORT_FILE_RETENTION_MS = LOG_EXPORT_FILE_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+var LOG_EXPORT_PART_MAX_BYTES = 256 * 1024 * 1024;
+function isLogExportSource(source) {
+  return LOG_EXPORT_SOURCES.includes(source);
+}
+__name(isLogExportSource, "isLogExportSource");
+__name2(isLogExportSource, "isLogExportSource");
+var LOG_DRAIN_NOTICE_RATE_LIMIT_MS = 60 * 6e4;
+var LOG_DRAIN_VERIFICATION_STALE_MS = 24 * 60 * 6e4;
+var LOG_DRAIN_DIGEST_INTERVAL_MS = 24 * 60 * 6e4;
+var LOG_DRAIN_DIGEST_MAX_ENTRIES = 50;
+var LOG_DRAIN_NOTICE_ERROR_MAX_CHARS = 200;
+function clamp(value3, max) {
+  if (typeof value3 !== "string") return void 0;
+  const trimmed = value3.trim();
+  if (!trimmed) return void 0;
+  return trimmed.length <= max ? trimmed : `${trimmed.slice(0, max - 1)}\u2026`;
+}
+__name(clamp, "clamp");
+__name2(clamp, "clamp");
+function numberOr(value3, fallback) {
+  return typeof value3 === "number" && Number.isFinite(value3) ? value3 : fallback;
+}
+__name(numberOr, "numberOr");
+__name2(numberOr, "numberOr");
+function isoOr(value3) {
+  return typeof value3 === "string" && value3.length > 0 ? value3 : void 0;
+}
+__name(isoOr, "isoOr");
+__name2(isoOr, "isoOr");
+function logDrainNoticeView(drain, now) {
+  const health = drain.health ?? {};
+  const quota = drain.quota;
+  const view = {
+    id: String(drain.id ?? ""),
+    name: String(drain.name ?? ""),
+    type: drain.type,
+    state: drain.state,
+    deliveredCount24h: numberOr(health.deliveredCount24h, 0),
+    droppedCount24h: numberOr(health.droppedCount24h, 0),
+    rejectedCount24h: numberOr(health.rejectedCount24h, 0),
+    backlog: numberOr(health.backlog, 0),
+    quotaRatio: quota ? logDrainQuotaRatio(quota, now) : 0
+  };
+  if (health.pauseReason) view.pauseReason = health.pauseReason;
+  const lastError = clamp(health.lastError, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS);
+  if (lastError) view.lastError = lastError;
+  if (typeof health.lastStatusCode === "number") view.lastStatusCode = health.lastStatusCode;
+  const lastSuccessAt = isoOr(health.lastSuccessAt);
+  if (lastSuccessAt) view.lastSuccessAt = lastSuccessAt;
+  const lastFailureAt = isoOr(health.lastFailureAt);
+  if (lastFailureAt) view.lastFailureAt = lastFailureAt;
+  const resetsAt = isoOr(quota?.resetsAt);
+  if (resetsAt) view.quotaResetsAt = resetsAt;
+  return view;
+}
+__name(logDrainNoticeView, "logDrainNoticeView");
+__name2(logDrainNoticeView, "logDrainNoticeView");
+function logDrainHealthCardPath(orgId, drainId) {
+  return `/orgs/${encodeURIComponent(orgId)}/log-drains/${encodeURIComponent(drainId)}`;
+}
+__name(logDrainHealthCardPath, "logDrainHealthCardPath");
+__name2(logDrainHealthCardPath, "logDrainHealthCardPath");
+function percent(ratio) {
+  if (!Number.isFinite(ratio) || ratio <= 0) return "0%";
+  return `${Math.round(ratio * 100)}%`;
+}
+__name(percent, "percent");
+__name2(percent, "percent");
+function becauseClause(view) {
+  const bits = [];
+  if (view.lastStatusCode) bits.push(`HTTP ${view.lastStatusCode}`);
+  if (view.lastError) bits.push(view.lastError);
+  return bits.length ? ` Last error: ${bits.join(" \u2014 ")}.` : "";
+}
+__name(becauseClause, "becauseClause");
+__name2(becauseClause, "becauseClause");
+function logDrainNoticeCopy(payload) {
+  const view = payload.drain;
+  const name = view.name || view.id;
+  const backlog = view.backlog > 0 ? ` ${view.backlog.toLocaleString("en-US")} records are buffered.` : "";
+  switch (payload.kind) {
+    case "failing":
+      return {
+        title: name,
+        subject: `Log drain "${name}" is failing`,
+        previewLine: "Failing \u2014 15 minutes without a successful delivery",
+        summary: `The log drain "${name}" (${view.type}) has gone 15 minutes without a successful delivery and is now failing.${becauseClause(view)}${backlog} Records keep buffering; the drain pauses itself after 24 hours without a success.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "paused_auto":
+      return {
+        title: name,
+        subject: `Log drain "${name}" was paused`,
+        previewLine: "Paused \u2014 24 hours without a successful delivery",
+        summary: `The log drain "${name}" (${view.type}) was paused automatically after 24 hours without a successful delivery.${becauseClause(view)}${backlog} Nothing is being sent while it is paused, and the buffer is delivered on resume. Fix the destination, then resume it from the drain's health card or with \`lua drains resume ${view.id}\`.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "paused_quota":
+      return {
+        title: name,
+        subject: `Log drain "${name}" was paused \u2014 daily quota exhausted`,
+        previewLine: `Paused \u2014 ${percent(view.quotaRatio)} of the daily allowance used`,
+        summary: `The log drain "${name}" (${view.type}) reached ${percent(view.quotaRatio)} of its daily allowance and was paused.${backlog} Records keep buffering. The allowance resets${view.quotaResetsAt ? ` at ${view.quotaResetsAt}` : " at 00:00 UTC"}; narrow the drain's sources or raise the plan's limit to stop it happening again, then resume it with \`lua drains resume ${view.id}\`.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "quota_warning":
+      return {
+        title: name,
+        subject: `Log drain "${name}" has used 80% of its daily allowance`,
+        previewLine: `${percent(view.quotaRatio)} of the daily allowance used`,
+        summary: `The log drain "${name}" (${view.type}) has used ${percent(view.quotaRatio)} of today's allowance. Past 100% debug records are dropped, past 125% info records as well, and at 150% the drain pauses. The allowance resets${view.quotaResetsAt ? ` at ${view.quotaResetsAt}` : " at 00:00 UTC"}.`,
+        status: "failed",
+        priority: "normal"
+      };
+    case "dropped": {
+      const dropped = payload.droppedCount ?? view.droppedCount24h;
+      return {
+        title: name,
+        subject: `Log drain "${name}" is dropping records`,
+        previewLine: `${dropped.toLocaleString("en-US")} records dropped`,
+        summary: `The log drain "${name}" (${view.type}) dropped ${dropped.toLocaleString("en-US")} records because its buffer filled up faster than the destination accepted them.${becauseClause(view)} The gap is reported in band on the next successful batch, so the range is recoverable from the destination itself.`,
+        status: "failed",
+        priority: "high"
+      };
+    }
+    case "verification_pending":
+      return {
+        title: name,
+        subject: `Log drain "${name}" is still unverified`,
+        previewLine: "Unverified after 24 hours \u2014 nothing is being delivered",
+        summary: `The log drain "${name}" (${view.type}) was created more than 24 hours ago and has never completed verification, so nothing is being delivered to it.${becauseClause(view)} Run \`lua drains verify ${view.id}\` once the destination echoes the verification token.`,
+        status: "failed",
+        priority: "normal"
+      };
+    default: {
+      const exhaustive = payload.kind;
+      throw new Error(`unhandled log-drain notice kind: ${String(exhaustive)}`);
+    }
+  }
+}
+__name(logDrainNoticeCopy, "logDrainNoticeCopy");
+__name2(logDrainNoticeCopy, "logDrainNoticeCopy");
+function logDrainNoticeLabel(kind) {
+  switch (kind) {
+    case "failing":
+      return "failing";
+    case "paused_auto":
+      return "paused (no success for 24 h)";
+    case "paused_quota":
+      return "paused (daily allowance exhausted)";
+    case "quota_warning":
+      return "80% of the daily allowance used";
+    case "dropped":
+      return "dropping records";
+    case "verification_pending":
+      return "still unverified";
+    default: {
+      const exhaustive = kind;
+      throw new Error(`unhandled log-drain notice kind: ${String(exhaustive)}`);
+    }
+  }
+}
+__name(logDrainNoticeLabel, "logDrainNoticeLabel");
+__name2(logDrainNoticeLabel, "logDrainNoticeLabel");
+function logDrainNoticeDigestCopy(payload) {
+  const entries = [
+    ...payload.entries ?? []
+  ].sort((a, b) => a.at < b.at ? -1 : a.at > b.at ? 1 : 0).slice(0, LOG_DRAIN_DIGEST_MAX_ENTRIES);
+  const drains = new Set(entries.map((entry) => entry.drainId));
+  const noun = `${entries.length} notice${entries.length === 1 ? "" : "s"}`;
+  const across = `${drains.size} drain${drains.size === 1 ? "" : "s"}`;
+  const lines = entries.map((entry) => `${entry.drainName || entry.drainId} \u2014 ${logDrainNoticeLabel(entry.kind)}`);
+  return {
+    title: "Log drains \u2014 daily summary",
+    subject: `Log drains \u2014 ${noun} in the last day`,
+    previewLine: `${noun} across ${across}`,
+    summary: `${noun} across ${across} in the last day: ${lines.join("; ")}.`,
+    status: "failed",
+    priority: "normal"
+  };
+}
+__name(logDrainNoticeDigestCopy, "logDrainNoticeDigestCopy");
+__name2(logDrainNoticeDigestCopy, "logDrainNoticeDigestCopy");
+var LOG_DRAIN_USAGE_LINE_ITEM = "log_drain_events";
+var LOG_DRAIN_BYTES_PER_GIB = 1024 ** 3;
+var DEFAULT_LOG_DRAIN_PLAN_CONFIG = {
+  version: 1,
+  tiers: {
+    team: {
+      ...LOG_DRAIN_QUOTAS.team
+    },
+    business: {
+      ...LOG_DRAIN_QUOTAS.business
+    },
+    enterprise: {
+      ...LOG_DRAIN_QUOTAS.enterprise
+    }
+  },
+  pricing: {
+    team: {
+      includedEventsPerMonth: 0,
+      includedBytesPerMonth: 0,
+      usdPerMillionEvents: 0,
+      usdPerGiB: 0
+    },
+    business: {
+      includedEventsPerMonth: 0,
+      includedBytesPerMonth: 0,
+      usdPerMillionEvents: 0,
+      usdPerGiB: 0
+    },
+    enterprise: {
+      includedEventsPerMonth: 0,
+      includedBytesPerMonth: 0,
+      usdPerMillionEvents: 0,
+      usdPerGiB: 0
+    }
+  }
+};
+var TIERS = [
+  "team",
+  "business",
+  "enterprise"
+];
+function finiteNonNegative(value3) {
+  return typeof value3 === "number" && Number.isFinite(value3) && value3 >= 0 ? value3 : void 0;
+}
+__name(finiteNonNegative, "finiteNonNegative");
+__name2(finiteNonNegative, "finiteNonNegative");
+function mergeLimits(base, stored) {
+  const patch = stored ?? {};
+  return {
+    eventsPerDay: finiteNonNegative(patch.eventsPerDay) ?? base.eventsPerDay,
+    bytesPerDay: finiteNonNegative(patch.bytesPerDay) ?? base.bytesPerDay
+  };
+}
+__name(mergeLimits, "mergeLimits");
+__name2(mergeLimits, "mergeLimits");
+function mergeCard(base, stored) {
+  const patch = stored ?? {};
+  return {
+    includedEventsPerMonth: finiteNonNegative(patch.includedEventsPerMonth) ?? base.includedEventsPerMonth,
+    includedBytesPerMonth: finiteNonNegative(patch.includedBytesPerMonth) ?? base.includedBytesPerMonth,
+    usdPerMillionEvents: finiteNonNegative(patch.usdPerMillionEvents) ?? base.usdPerMillionEvents,
+    usdPerGiB: finiteNonNegative(patch.usdPerGiB) ?? base.usdPerGiB
+  };
+}
+__name(mergeCard, "mergeCard");
+__name2(mergeCard, "mergeCard");
+function resolveStoredLogDrainPlanConfig(stored) {
+  const values = stored;
+  if (!values || typeof values.version !== "number" || !Number.isFinite(values.version)) {
+    return DEFAULT_LOG_DRAIN_PLAN_CONFIG;
+  }
+  const tiers = {};
+  const pricing = {};
+  for (const tier of TIERS) {
+    tiers[tier] = mergeLimits(DEFAULT_LOG_DRAIN_PLAN_CONFIG.tiers[tier], values.tiers?.[tier]);
+    pricing[tier] = mergeCard(DEFAULT_LOG_DRAIN_PLAN_CONFIG.pricing[tier], values.pricing?.[tier]);
+  }
+  const orgs = {};
+  for (const [orgId, override] of Object.entries(values.orgs ?? {})) {
+    if (!orgId || !override || typeof override !== "object") continue;
+    const row = {};
+    if (override.tier && TIERS.includes(override.tier)) row.tier = override.tier;
+    const events = finiteNonNegative(override.eventsPerDay);
+    const bytes = finiteNonNegative(override.bytesPerDay);
+    if (events !== void 0) row.eventsPerDay = events;
+    if (bytes !== void 0) row.bytesPerDay = bytes;
+    if (override.pricing && typeof override.pricing === "object") row.pricing = {
+      ...override.pricing
+    };
+    if (Object.keys(row).length) orgs[orgId] = row;
+  }
+  return {
+    version: values.version,
+    tiers,
+    pricing,
+    ...Object.keys(orgs).length ? {
+      orgs
+    } : {}
+  };
+}
+__name(resolveStoredLogDrainPlanConfig, "resolveStoredLogDrainPlanConfig");
+__name2(resolveStoredLogDrainPlanConfig, "resolveStoredLogDrainPlanConfig");
+function logDrainPlanTierOverride(config, orgId) {
+  return orgId ? config.orgs?.[orgId]?.tier : void 0;
+}
+__name(logDrainPlanTierOverride, "logDrainPlanTierOverride");
+__name2(logDrainPlanTierOverride, "logDrainPlanTierOverride");
+function logDrainQuotaLimitsFor(config, orgId, tier) {
+  const base = config.tiers[tier] ?? config.tiers.team ?? LOG_DRAIN_QUOTAS.team;
+  const override = orgId ? config.orgs?.[orgId] : void 0;
+  if (!override) return {
+    ...base
+  };
+  return {
+    eventsPerDay: override.eventsPerDay ?? base.eventsPerDay,
+    bytesPerDay: override.bytesPerDay ?? base.bytesPerDay
+  };
+}
+__name(logDrainQuotaLimitsFor, "logDrainQuotaLimitsFor");
+__name2(logDrainQuotaLimitsFor, "logDrainQuotaLimitsFor");
+function logDrainPriceCardFor(config, orgId, tier) {
+  const base = config.pricing[tier] ?? config.pricing.team ?? DEFAULT_LOG_DRAIN_PLAN_CONFIG.pricing.team;
+  const override = orgId ? config.orgs?.[orgId]?.pricing : void 0;
+  return override ? mergeCard(base, override) : {
+    ...base
+  };
+}
+__name(logDrainPriceCardFor, "logDrainPriceCardFor");
+__name2(logDrainPriceCardFor, "logDrainPriceCardFor");
+function priceDrainUsage(totals, card, tier) {
+  const billableRecords = Math.max(0, Math.floor(finiteNonNegative(totals?.billableRecords) ?? 0));
+  const billableBytes = Math.max(0, Math.floor(finiteNonNegative(totals?.billableBytes) ?? 0));
+  const includedEvents = card.includedEventsPerMonth;
+  const includedBytes = card.includedBytesPerMonth;
+  const overageEvents = Math.max(0, billableRecords - includedEvents);
+  const overageBytes = Math.max(0, billableBytes - includedBytes);
+  const eventsUsd = overageEvents / 1e6 * card.usdPerMillionEvents;
+  const bytesUsd = overageBytes / LOG_DRAIN_BYTES_PER_GIB * card.usdPerGiB;
+  const unpriced = card.usdPerMillionEvents === 0 && card.usdPerGiB === 0;
+  const round = /* @__PURE__ */ __name2((usd) => Math.round(usd * 100) / 100, "round");
+  return {
+    lineItem: LOG_DRAIN_USAGE_LINE_ITEM,
+    tier,
+    billableRecords,
+    billableBytes,
+    includedEvents,
+    includedBytes,
+    overageEvents,
+    overageBytes,
+    eventsUsd: round(eventsUsd),
+    bytesUsd: round(bytesUsd),
+    usd: round(Math.max(eventsUsd, bytesUsd)),
+    unpriced
+  };
+}
+__name(priceDrainUsage, "priceDrainUsage");
+__name2(priceDrainUsage, "priceDrainUsage");
 var LOG_CURSOR_MAX_LENGTH = 512;
 var LOG_CURSOR_MAX_ID_LENGTH = 128;
 var LOG_RELATIVE_TIME_PATTERN = /^(\d{1,9})([smhd])$/;
@@ -1361,12 +2261,12 @@ function decodeLogCursor(raw) {
     return null;
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  const { t, id } = parsed;
+  const { t, id: id2 } = parsed;
   if (typeof t !== "number" || !Number.isSafeInteger(t) || t < 0) return null;
-  if (typeof id !== "string" || !id || id.length > LOG_CURSOR_MAX_ID_LENGTH) return null;
+  if (typeof id2 !== "string" || !id2 || id2.length > LOG_CURSOR_MAX_ID_LENGTH) return null;
   return {
     t,
-    id
+    id: id2
   };
 }
 __name(decodeLogCursor, "decodeLogCursor");
@@ -2232,64 +3132,64 @@ function hasCapability(profiles, profileId, required) {
 }
 __name(hasCapability, "hasCapability");
 __name2(hasCapability, "hasCapability");
-function workflowJobId(id) {
-  switch (id.kind) {
+function workflowJobId(id2) {
+  switch (id2.kind) {
     case "start":
-      return `wft_${id.runId}_0`;
+      return `wft_${id2.runId}_0`;
     case "start-redrive":
-      return `wft_${id.runId}_start_r${id.now}`;
+      return `wft_${id2.runId}_start_r${id2.now}`;
     case "tick":
-      return `wft_${id.runId}_${id.seq}`;
+      return `wft_${id2.runId}_${id2.seq}`;
     case "timer":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}`;
     case "timer-remainder":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "timer-deferral":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_d${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_d${id2.now}`;
     case "timer-sibling":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_w${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_w${id2.now}`;
     case "retry":
-      return `wft_${id.runId}_retry_${id.stepId}_${id.attempt}`;
+      return `wft_${id2.runId}_retry_${id2.stepId}_${id2.attempt}`;
     case "respawn":
-      return `wft_${id.runId}_respawn_${id.stepId}_${id.attempt}_s${id.segment}_r${id.now}`;
+      return `wft_${id2.runId}_respawn_${id2.stepId}_${id2.attempt}_s${id2.segment}_r${id2.now}`;
     case "redrive":
-      return `wft_${id.runId}_redrive_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_redrive_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "redispatch":
-      return `wft_${id.runId}_redispatch_${id.stepId}_${id.attempt}_x${id.executionId ?? "none"}_r${id.now}`;
+      return `wft_${id2.runId}_redispatch_${id2.stepId}_${id2.attempt}_x${id2.executionId ?? "none"}_r${id2.now}`;
     case "expiry":
-      return `wft_${id.runId}_expire_${id.stepId}_${id.attempt}_t${id.suspendedAt}${id.hop > 0 ? `_h${id.hop}` : ""}`;
+      return `wft_${id2.runId}_expire_${id2.stepId}_${id2.attempt}_t${id2.suspendedAt}${id2.hop > 0 ? `_h${id2.hop}` : ""}`;
     case "step-terminal":
-      return `wft_${id.runId}_term_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_term_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "handback":
-      return `wft_${id.runId}_handback_${id.stepId}_${id.attempt}_${id.now}`;
+      return `wft_${id2.runId}_handback_${id2.stepId}_${id2.attempt}_${id2.now}`;
     case "foreach-rate":
-      return `wft_${id.runId}_fe_${id.stepId}_${id.attempt}_${id.bucket}`;
+      return `wft_${id2.runId}_fe_${id2.stepId}_${id2.attempt}_${id2.bucket}`;
     case "budget-expiry":
-      return `wft_${id.runId}_expiry_budget_r${id.now}`;
+      return `wft_${id2.runId}_expiry_budget_r${id2.now}`;
     case "budget-resume":
-      return `wft_${id.runId}_resume_budget_${id.now}`;
+      return `wft_${id2.runId}_resume_budget_${id2.now}`;
     case "deadline":
-      return `wft_${id.runId}_deadline_${id.deadlineAt}`;
+      return `wft_${id2.runId}_deadline_${id2.deadlineAt}`;
     case "deadline-remainder":
-      return `wft_${id.runId}_deadline_${id.deadlineAt}_r${id.now}`;
+      return `wft_${id2.runId}_deadline_${id2.deadlineAt}_r${id2.now}`;
     case "readmit":
-      return `wft_${id.runId}_readmit_${id.now}`;
+      return `wft_${id2.runId}_readmit_${id2.now}`;
     case "cancel":
-      return `wft_${id.runId}_cancel`;
+      return `wft_${id2.runId}_cancel`;
     case "reconcile":
-      return `wft_${id.runId}_reconcile_${id.now}`;
+      return `wft_${id2.runId}_reconcile_${id2.now}`;
     case "replay":
-      return `wft_${id.runId}_replay_g${id.leaseGeneration}`;
+      return `wft_${id2.runId}_replay_g${id2.leaseGeneration}`;
     case "migration":
-      return `wfm_${id.migrationId}`;
+      return `wfm_${id2.migrationId}`;
     default:
-      return assertNever(id);
+      return assertNever(id2);
   }
 }
 __name(workflowJobId, "workflowJobId");
 __name2(workflowJobId, "workflowJobId");
-function assertNever(id) {
-  throw new Error(`workflowJobId: unknown wake kind ${JSON.stringify(id)}`);
+function assertNever(id2) {
+  throw new Error(`workflowJobId: unknown wake kind ${JSON.stringify(id2)}`);
 }
 __name(assertNever, "assertNever");
 __name2(assertNever, "assertNever");
@@ -2420,13 +3320,13 @@ var IDEMPOTENCY_HOLDING_STATUSES = [
 ];
 var WORKFLOW_SCHEDULED_RUN_ID_PREFIX = "wfr_sched_";
 var CLOUD_TASK_RUN_ID_PREFIX = "ct_";
-function isCloudTaskRunId(id) {
-  return id.startsWith(CLOUD_TASK_RUN_ID_PREFIX);
+function isCloudTaskRunId(id2) {
+  return id2.startsWith(CLOUD_TASK_RUN_ID_PREFIX);
 }
 __name(isCloudTaskRunId, "isCloudTaskRunId");
 __name2(isCloudTaskRunId, "isCloudTaskRunId");
-function isScheduledWorkflowRunId(id) {
-  return id.startsWith(WORKFLOW_SCHEDULED_RUN_ID_PREFIX);
+function isScheduledWorkflowRunId(id2) {
+  return id2.startsWith(WORKFLOW_SCHEDULED_RUN_ID_PREFIX);
 }
 __name(isScheduledWorkflowRunId, "isScheduledWorkflowRunId");
 __name2(isScheduledWorkflowRunId, "isScheduledWorkflowRunId");
@@ -3210,10 +4110,246 @@ function effectiveAgentFeatures(base, override, rule) {
 }
 __name(effectiveAgentFeatures, "effectiveAgentFeatures");
 __name2(effectiveAgentFeatures, "effectiveAgentFeatures");
+var ONBOARDING_FLOW_KEY = "alpha-choose-meet";
+var ONBOARDING_SCHEMA_VERSION = 1;
+var id = z4.string().min(1).max(80).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/);
+var copy = /* @__PURE__ */ __name2((max) => z4.string().max(max), "copy");
+var onboardingHeadingSchema = z4.discriminatedUnion("kind", [
+  z4.object({
+    kind: z4.literal("plain"),
+    text: copy(240)
+  }).strict(),
+  z4.object({
+    kind: z4.literal("highlighted"),
+    before: copy(240),
+    highlight: copy(240),
+    after: copy(240)
+  }).strict()
+]);
+var onboardingRichTextInlineSchema = z4.discriminatedUnion("kind", [
+  z4.object({
+    kind: z4.literal("text"),
+    text: copy(2e3),
+    marks: z4.array(z4.enum([
+      "bold",
+      "italic"
+    ])).max(2).refine((marks) => new Set(marks).size === marks.length, "Text marks must be unique").optional()
+  }).strict(),
+  z4.object({
+    kind: z4.literal("lineBreak")
+  }).strict()
+]);
+var onboardingRichTextSchema = z4.object({
+  blocks: z4.array(z4.object({
+    kind: z4.literal("paragraph"),
+    content: z4.array(onboardingRichTextInlineSchema).max(100)
+  }).strict()).max(40)
+}).strict();
+var onboardingDestinationSchema = z4.discriminatedUnion("kind", [
+  z4.object({
+    kind: z4.literal("question"),
+    questionId: id
+  }).strict(),
+  z4.object({
+    kind: z4.literal("template"),
+    templateContentId: id
+  }).strict(),
+  z4.object({
+    kind: z4.literal("unavailable"),
+    unavailableId: id
+  }).strict()
+]);
+var onboardingArtworkSchema = z4.discriminatedUnion("kind", [
+  z4.object({
+    kind: z4.literal("builtinRing")
+  }).strict(),
+  z4.object({
+    kind: z4.literal("uploaded"),
+    assetId: id,
+    accessibility: z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("decorative")
+      }).strict(),
+      z4.object({
+        kind: z4.literal("described"),
+        altText: copy(500)
+      }).strict()
+    ])
+  }).strict()
+]);
+var onboardingAnswerSchema = z4.object({
+  id,
+  label: copy(160),
+  supportingText: copy(500).optional(),
+  destination: onboardingDestinationSchema.nullable()
+}).strict();
+var onboardingQuestionSchema = z4.object({
+  id,
+  heading: onboardingHeadingSchema,
+  helperText: onboardingRichTextSchema.optional(),
+  continueButtonLabel: copy(80),
+  answers: z4.array(onboardingAnswerSchema).max(30)
+}).strict();
+var onboardingTemplateSectionSchema = z4.object({
+  id,
+  label: copy(100),
+  body: onboardingRichTextSchema
+}).strict();
+var onboardingTemplateContentSchema = z4.object({
+  id,
+  templateId: copy(160),
+  displayName: copy(100),
+  eyebrow: copy(100).optional(),
+  heading: onboardingHeadingSchema,
+  description: onboardingRichTextSchema,
+  badges: z4.array(copy(80)).max(12),
+  sections: z4.array(onboardingTemplateSectionSchema).max(20),
+  artwork: onboardingArtworkSchema,
+  hireButtonLabel: copy(80),
+  changeRoleButtonLabel: copy(80),
+  nextStepText: onboardingRichTextSchema
+}).strict();
+var onboardingUnavailableOutcomeSchema = z4.object({
+  id,
+  heading: onboardingHeadingSchema,
+  explanation: onboardingRichTextSchema,
+  backButtonLabel: copy(80),
+  alternative: z4.object({
+    templateContentId: id,
+    introduction: onboardingRichTextSchema,
+    buttonLabel: copy(80)
+  }).strict().optional()
+}).strict();
+var onboardingFlowSchema = z4.object({
+  key: z4.literal(ONBOARDING_FLOW_KEY),
+  schemaVersion: z4.literal(ONBOARDING_SCHEMA_VERSION),
+  entryQuestionId: id.nullable(),
+  questions: z4.array(onboardingQuestionSchema).max(100),
+  templateContents: z4.array(onboardingTemplateContentSchema).max(100),
+  unavailableOutcomes: z4.array(onboardingUnavailableOutcomeSchema).max(100)
+}).strict();
+var onboardingActorSchema = z4.object({
+  subjectId: z4.string(),
+  email: z4.string().email()
+}).strict();
+var onboardingEditorSchema = onboardingActorSchema.extend({
+  editedAt: z4.string().datetime({
+    offset: true
+  })
+}).strict();
+var onboardingPublicationSummarySchema = z4.object({
+  publicationId: id,
+  revision: z4.number().int().positive(),
+  sourceDraftVersion: z4.number().int().nonnegative(),
+  contentHash: z4.string().regex(/^[a-f0-9]{64}$/),
+  publishedAt: z4.string().datetime({
+    offset: true
+  }),
+  publishedBy: onboardingActorSchema,
+  questionCount: z4.number().int().nonnegative(),
+  templateCount: z4.number().int().nonnegative(),
+  unavailableCount: z4.number().int().nonnegative()
+}).strict();
+var onboardingValidationIssueSchema = z4.object({
+  code: z4.string(),
+  path: z4.string(),
+  message: z4.string()
+}).strict();
+var onboardingValidationResponseSchema = z4.discriminatedUnion("valid", [
+  z4.object({
+    valid: z4.literal(true),
+    summary: z4.object({
+      questionCount: z4.number().int().nonnegative(),
+      templateCount: z4.number().int().nonnegative(),
+      unavailableCount: z4.number().int().nonnegative()
+    }).strict()
+  }).strict(),
+  z4.object({
+    valid: z4.literal(false),
+    issues: z4.array(onboardingValidationIssueSchema)
+  }).strict()
+]);
+var onboardingAssetSchema = z4.object({
+  assetId: id,
+  url: z4.string().url(),
+  width: z4.number().int().positive(),
+  height: z4.number().int().positive(),
+  contentType: z4.enum([
+    "image/png",
+    "image/jpeg",
+    "image/webp"
+  ]),
+  bytes: z4.number().int().positive(),
+  sha256: z4.string().regex(/^[a-f0-9]{64}$/),
+  createdAt: z4.string().datetime({
+    offset: true
+  }),
+  uploadedBy: onboardingActorSchema
+}).strict();
+var onboardingPublicAssetSchema = onboardingAssetSchema.pick({
+  assetId: true,
+  url: true,
+  width: true,
+  height: true,
+  contentType: true
+}).strict();
+var getOnboardingConfigResponseSchema = z4.object({
+  flowKey: z4.literal(ONBOARDING_FLOW_KEY),
+  draftVersion: z4.number().int().nonnegative(),
+  draft: onboardingFlowSchema,
+  assets: z4.array(onboardingAssetSchema),
+  lastEditor: onboardingEditorSchema.nullable(),
+  activePublication: onboardingPublicationSummarySchema.nullable()
+}).strict();
+var saveOnboardingDraftRequestSchema = z4.object({
+  expectedDraftVersion: z4.number().int().nonnegative(),
+  draft: onboardingFlowSchema
+}).strict();
+var validateOnboardingRequestSchema = z4.object({
+  draft: onboardingFlowSchema
+}).strict();
+var publishOnboardingRequestSchema = z4.object({
+  expectedDraftVersion: z4.number().int().nonnegative(),
+  expectedActivePublicationId: id.nullable()
+}).strict();
+var rollbackOnboardingRequestSchema = z4.object({
+  publicationId: id,
+  expectedActivePublicationId: id.nullable()
+}).strict();
+var onboardingTemplateCatalogItemSchema = z4.object({
+  templateId: z4.string(),
+  name: z4.string(),
+  description: z4.string().optional()
+}).strict();
+var getPublishedOnboardingResponseSchema = z4.discriminatedUnion("status", [
+  z4.object({
+    status: z4.literal("available"),
+    publicationId: id,
+    revision: z4.number().int().positive(),
+    contentHash: z4.string().regex(/^[a-f0-9]{64}$/),
+    flow: onboardingFlowSchema,
+    assets: z4.array(onboardingPublicAssetSchema)
+  }).strict(),
+  z4.object({
+    status: z4.literal("unavailable"),
+    reason: z4.literal("not_published"),
+    message: z4.string()
+  }).strict()
+]);
+function parseOnboardingFlow(value3) {
+  return onboardingFlowSchema.parse(value3);
+}
+__name(parseOnboardingFlow, "parseOnboardingFlow");
+__name2(parseOnboardingFlow, "parseOnboardingFlow");
+function parsePublishedOnboardingResponse(value3) {
+  return getPublishedOnboardingResponseSchema.parse(value3);
+}
+__name(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
+__name2(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
 
 // ../workflow-graph/dist/index.mjs
 import { createHash } from "crypto";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 import { z as z22 } from "zod";
 
 // ../shared-types/dist/workflow-job-tools.mjs
@@ -3249,9 +4385,9 @@ var WORKFLOW_JOB_DEFAULT_TOOLS = [
 function effectiveJobTools(jobTools, readOnly) {
   const base = jobTools?.length ? jobTools : WORKFLOW_JOB_DEFAULT_TOOLS;
   const out = [];
-  for (const id of base) {
-    if (readOnly && WORKFLOW_JOB_READ_ONLY_DROPPED.includes(id)) continue;
-    if (!out.includes(id)) out.push(id);
+  for (const id2 of base) {
+    if (readOnly && WORKFLOW_JOB_READ_ONLY_DROPPED.includes(id2)) continue;
+    if (!out.includes(id2)) out.push(id2);
   }
   return out;
 }
@@ -3440,9 +4576,9 @@ function malformedMapMembers(cfg) {
 }
 __name(malformedMapMembers, "malformedMapMembers");
 __name4(malformedMapMembers, "malformedMapMembers");
-function mapMemberMalformedMessage(id, m) {
+function mapMemberMalformedMessage(id2, m) {
   const keys = m.keys.map((k) => `\`${k}\``).join(", ");
-  return `"${id}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
+  return `"${id2}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
 }
 __name(mapMemberMalformedMessage, "mapMemberMalformedMessage");
 __name4(mapMemberMalformedMessage, "mapMemberMalformedMessage");
@@ -3552,8 +4688,8 @@ var rows = /* @__PURE__ */ __name4((s, path, page) => ({
 var fromKnowledge = /* @__PURE__ */ __name4((k) => ({
   knowledge: k
 }), "fromKnowledge");
-var SideEffectsSchema = z4.enum(WORKFLOW_SIDE_EFFECTS);
-var JobResourcesSchema = z4.enum(WORKFLOW_JOB_RESOURCES);
+var SideEffectsSchema = z5.enum(WORKFLOW_SIDE_EFFECTS);
+var JobResourcesSchema = z5.enum(WORKFLOW_JOB_RESOURCES);
 var WORKFLOW_MODEL_TEMPLATE_ROOT = "initData";
 var WORKFLOW_MODEL_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*(?:\|([^}]*))?\}$/;
 var PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
@@ -3944,13 +5080,13 @@ var SLEEP_UNTIL_REPLACEMENT = Object.freeze({
   type: "sleep",
   duration: 6e4
 });
-function sleepUntilUnsupportedMessage(id) {
-  return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
+function sleepUntilUnsupportedMessage(id2) {
+  return `the engine does not execute \`sleepUntil\` yet (node "${id2}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id2}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
 }
 __name(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
 __name4(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
-function armSubrunUnsupportedMessage(id, workflowId) {
-  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
+function armSubrunUnsupportedMessage(id2, workflowId) {
+  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id2}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
 }
 __name(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
 __name4(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
@@ -4288,20 +5424,20 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
-  const checkId = /* @__PURE__ */ __name4((id, path) => {
+  const checkId = /* @__PURE__ */ __name4((id2, path) => {
     nodeCount += 1;
-    if (seen.has(id)) {
-      err("duplicate-step-id", `step id "${id}" is declared twice (first at ${seen.get(id)})`, path, id);
+    if (seen.has(id2)) {
+      err("duplicate-step-id", `step id "${id2}" is declared twice (first at ${seen.get(id2)})`, path, id2);
     } else {
-      seen.set(id, path);
+      seen.set(id2, path);
     }
   }, "checkId");
   const checkPolicyEnums = /* @__PURE__ */ __name4((node, path) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     const check = /* @__PURE__ */ __name4((member, allowed) => {
       const value22 = node[member];
       if (value22 === void 0 || typeof value22 === "string" && allowed.includes(value22)) return;
-      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path}.${member}`, id);
+      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path}.${member}`, id2);
     }, "check");
     check("sideEffects", WORKFLOW_SIDE_EFFECTS);
     check("jobResources", WORKFLOW_JOB_RESOURCES);
@@ -4309,46 +5445,46 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const checkRetry = /* @__PURE__ */ __name4((node, path) => {
     const r = node.retry;
     if (!r) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     const unknown = unknownWorkflowRetryMembers(r);
-    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path}.retry`, id);
+    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path}.retry`, id2);
     if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
       const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path}.retry.maxAttempts`, id);
+      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path}.retry.maxAttempts`, id2);
     }
     const backoffs = retryBackoffs();
     if (r.backoff !== void 0 && !backoffs.includes(r.backoff)) {
       const list = backoffs.map((b) => `'${b}'`).join(" | ");
-      err("backoff-invalid", `retry.backoff must be ${list}`, `${path}.retry.backoff`, id);
+      err("backoff-invalid", `retry.backoff must be ${list}`, `${path}.retry.backoff`, id2);
     }
     if (r.backoffSeconds !== void 0 && r.backoffSeconds < 0) {
-      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path}.retry.backoffSeconds`, id);
+      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path}.retry.backoffSeconds`, id2);
     }
     if (r.maxBackoffSeconds !== void 0) {
       if (r.backoff !== "exponential") {
-        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path}.retry`, id);
+        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path}.retry`, id2);
       } else if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) {
-        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path}.retry.maxBackoffSeconds`, id);
+        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path}.retry.maxBackoffSeconds`, id2);
       }
     }
   }, "checkRetry");
   const checkTimeout = /* @__PURE__ */ __name4((node, path) => {
     const t = node.timeoutSeconds;
     if (t === void 0) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (!Number.isInteger(t) || t < 1) {
-      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path}.timeoutSeconds`, id);
+      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path}.timeoutSeconds`, id2);
       return;
     }
     if (node.tier === "job") {
       const cap = node.type === "agent" ? caps.maxJobTimeoutSeconds : caps.maxJobSegmentSeconds;
       if (t > cap) {
-        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path}.timeoutSeconds`, id);
+        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path}.timeoutSeconds`, id2);
       } else if (node.type === "agent" && t > caps.maxJobSegmentSeconds && !node.workspace) {
-        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path}.timeoutSeconds`, id);
+        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path}.timeoutSeconds`, id2);
       }
     } else if (t > caps.maxWorkerTimeoutSeconds) {
-      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path}.timeoutSeconds`, id);
+      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path}.timeoutSeconds`, id2);
     }
   }, "checkTimeout");
   const checkSpecialistRole = /* @__PURE__ */ __name4((node, path) => {
@@ -4412,32 +5548,32 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     return void 0;
   }, "jobClassifiablePin");
   const checkTier = /* @__PURE__ */ __name4((node, path) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (node.workspace && node.workspace !== "inherit" && node.tier !== void 0 && node.tier !== "job") {
-      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path}.workspace`, id);
+      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path}.workspace`, id2);
     }
     if (node.harness !== void 0 && node.tier !== "job") {
-      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path}.harness`, id);
+      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path}.harness`, id2);
     }
     const provider = node.type === "agent" ? classifyModelProvider(jobClassifiablePin(node.model)) : null;
     if (node.harness === "claude-code" && provider !== null && provider !== "anthropic") {
-      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path}.harness`, id);
+      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path}.harness`, id2);
     }
     if (isJobTier(node) && provider !== null && opts.policy?.jobProviders && !opts.policy.jobProviders.includes(provider)) {
-      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path}.model`, id);
+      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path}.model`, id2);
     }
   }, "checkTier");
   const checkModel = /* @__PURE__ */ __name4((node, path) => {
     if (node.type !== "agent" || typeof node.model !== "string") return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     const parsed = parseModelTemplate(node.model);
     if (parsed.kind === "invalid") {
-      err("model-template-invalid", parsed.message, `${path}.model`, id);
+      err("model-template-invalid", parsed.message, `${path}.model`, id2);
       return;
     }
     if (parsed.kind === "template" && parsed.template.default === void 0) {
       if (isJobTier(node)) {
-        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path}.model`, id);
+        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path}.model`, id2);
       }
       return;
     }
@@ -4450,12 +5586,12 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (registry === "unavailable") {
       const trimmed = pin.trim();
       if (trimmed && !normalizeModelId(trimmed, []).ok) {
-        warn("model-unresolved", inContext(`model "${trimmed}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path}.model`, id);
+        warn("model-unresolved", inContext(`model "${trimmed}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path}.model`, id2);
       }
       return;
     }
     const resolved = normalizeModelId(pin, registry);
-    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path}.model`, id);
+    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path}.model`, id2);
   }, "checkModel");
   const checkTaskClass = /* @__PURE__ */ __name4((node, path) => {
     if (node.type !== "agent" || node.taskClass === void 0) return;
@@ -4464,46 +5600,46 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     err("task-class-without-model", `taskClass '${String(node.taskClass)}' needs a \`model\` on a pushed definition \u2014 write a class (model: 'class/fast' | 'class/balanced' | 'class/strong') or an approved provider/model code; nothing maps a task class to a model at dispatch, so a step with neither would run on the agent\u2019s own model`, `${path}.taskClass`, singleId(node));
   }, "checkTaskClass");
   const checkWorkspace = /* @__PURE__ */ __name4((node, path) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     const ws = workspaceOf(node);
     if (isJobTier(node) && opts.policy && opts.policy.jobTier !== true) {
-      err("job-tier-disabled", `"${id}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path}.tier`, id);
+      err("job-tier-disabled", `"${id2}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path}.tier`, id2);
     }
     const tools = jobToolsOf(node);
     if (tools !== void 0) {
       if (!isJobTier(node)) {
-        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path}.jobTools`, id);
+        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path}.jobTools`, id2);
       }
       const unknown = (Array.isArray(tools) ? tools : [
         tools
       ]).filter((t) => !WORKFLOW_JOB_TOOLS.includes(t));
       if (unknown.length > 0) {
-        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path}.jobTools`, id);
+        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path}.jobTools`, id2);
       }
       if (node.type === "agent" && (Array.isArray(tools) ? tools : [
         tools
       ]).includes("gh")) {
-        warn("gh-on-coding-turn", `"${id}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path}.jobTools`, id);
+        warn("gh-on-coding-turn", `"${id2}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path}.jobTools`, id2);
       }
     }
     if (node.type === "agent" && ws && ws !== "inherit" && ws.mount === "ro" && Array.isArray(tools) && effectiveJobTools(tools, true).length === 0) {
-      warn("ro-step-has-no-tools", `"${id}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path}.jobTools`, id);
+      warn("ro-step-has-no-tools", `"${id2}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path}.jobTools`, id2);
     }
     if (ws && ws !== "inherit") {
       if (!envelopeWorkspace && !opts.mayInherit) {
-        err("workspace-not-declared", `"${id}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path}.workspace`, id);
+        err("workspace-not-declared", `"${id2}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path}.workspace`, id2);
       }
       if (ws.isolation === "worktree" && envelopeWorkspace?.kind === "empty") {
-        err("worktree-requires-git-workspace", `"${id}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path}.workspace.isolation`, id);
+        err("worktree-requires-git-workspace", `"${id2}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path}.workspace.isolation`, id2);
       }
     }
     if (node.type === "workflow" && ws === "inherit") {
       if (!envelopeWorkspace) {
-        err("workspace-inherit-without-parent-workspace", `"${id}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path}.workspace`, id);
+        err("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path}.workspace`, id2);
       }
       const child = opts.resolveWorkflow?.(node.workflowId);
       if (child?.workspace) {
-        err("workspace-inherit-conflict", `"${id}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path}.workspace`, id);
+        err("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path}.workspace`, id2);
       }
     }
   }, "checkWorkspace");
@@ -4512,20 +5648,20 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const schema = node.type === "step" ? node.step.outputSchema : node.type === "agent" ? node.outputSchema : void 0;
     if (schema !== void 0) outputSchemas.set(singleId(node), schema);
   }, "recordOutputSchema");
-  const checkMapMembers = /* @__PURE__ */ __name4((cfg, basePath, id) => {
+  const checkMapMembers = /* @__PURE__ */ __name4((cfg, basePath, id2) => {
     for (const m of malformedMapMembers(cfg)) {
-      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id, m), `${basePath}.${m.member}`, id);
+      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id2, m), `${basePath}.${m.member}`, id2);
     }
   }, "checkMapMembers");
   const checkInputShape = /* @__PURE__ */ __name4((node, path) => {
     const input = node.input;
     if (input === void 0) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (input !== null && typeof input === "object" && !Array.isArray(input)) {
-      checkMapMembers(input, `${path}.input`, id);
+      checkMapMembers(input, `${path}.input`, id2);
       return;
     }
-    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path}.input`, id);
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path}.input`, id2);
   }, "checkInputShape");
   const checkBodyInput = /* @__PURE__ */ __name4((body, path, container) => {
     if (body.type === "workflow" || body.input === void 0) return;
@@ -4816,7 +5952,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       default:
         err("invalid-envelope", `unknown entry type "${entry.type}"`, path);
     }
-    for (const id of declared) upstream.add(id);
+    for (const id2 of declared) upstream.add(id2);
   });
   if (nodeCount > caps.maxNodes) {
     err("cap-exceeded", `${nodeCount} nodes exceeds the static cap of ${caps.maxNodes}`, "definition.graph");
@@ -4941,19 +6077,19 @@ var containerIdOf = /* @__PURE__ */ __name4((type, entryIndex) => `${type}@${ent
 function compilePlan(g) {
   const steps = {};
   const order = [];
-  const addNode = /* @__PURE__ */ __name4((id, node) => {
-    if (id in steps) {
-      throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id}" in definition.graph`);
+  const addNode = /* @__PURE__ */ __name4((id2, node) => {
+    if (id2 in steps) {
+      throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id2}" in definition.graph`);
     }
-    steps[id] = node;
-    order.push(id);
+    steps[id2] = node;
+    order.push(id2);
   }, "addNode");
   let prevTails = [];
   const foreachJoinToEntry = /* @__PURE__ */ new Map();
   g.definition.graph.forEach((entry, entryIndex) => {
     if (isArmStep(entry)) {
-      const id = armStepId(entry);
-      addNode(id, {
+      const id2 = armStepId(entry);
+      addNode(id2, {
         kind: armStepKind(entry),
         dependsOn: prevTails,
         downstream: [],
@@ -4961,7 +6097,7 @@ function compilePlan(g) {
         entry
       });
       prevTails = [
-        id
+        id2
       ];
       return;
     }
@@ -5100,10 +6236,10 @@ function compilePlan(g) {
         throw new WorkflowPlanError("unknown-entry-type", `Unknown graph entry type "${entry.type}" at definition.graph[${entryIndex}]`);
     }
   });
-  for (const id of order) {
-    for (const dep of steps[id].dependsOn) {
+  for (const id2 of order) {
+    for (const dep of steps[id2].dependsOn) {
       const target = steps[dep] ?? (foreachJoinToEntry.has(dep) ? steps[foreachJoinToEntry.get(dep)] : void 0);
-      target?.downstream.push(id);
+      target?.downstream.push(id2);
     }
   }
   return {
@@ -5292,17 +6428,17 @@ __name(renderRef, "renderRef");
 __name4(renderRef, "renderRef");
 var stepIdOf = /* @__PURE__ */ __name4((s) => typeof s === "string" ? s : s.id, "stepIdOf");
 function step(s) {
-  const id = stepIdOf(s);
+  const id2 = stepIdOf(s);
   return {
     path: /* @__PURE__ */ __name4((p) => ({
-      path: p === "" ? `stepResults.${id}` : `stepResults.${id}.${p}`
+      path: p === "" ? `stepResults.${id2}` : `stepResults.${id2}.${p}`
     }), "path")
   };
 }
 __name(step, "step");
 __name4(step, "step");
-function stepOf(id) {
-  return step(id);
+function stepOf(id2) {
+  return step(id2);
 }
 __name(stepOf, "stepOf");
 __name4(stepOf, "stepOf");
@@ -5508,18 +6644,18 @@ function resolvePlacements(calls) {
   const declared = /* @__PURE__ */ new Map();
   const placedBy = /* @__PURE__ */ new Map();
   const allIds = /* @__PURE__ */ new Map();
-  const claimId = /* @__PURE__ */ __name4((id, callIndex) => {
-    const first = allIds.get(id);
+  const claimId = /* @__PURE__ */ __name4((id2, callIndex) => {
+    const first = allIds.get(id2);
     if (first !== void 0 && first !== callIndex) {
       issues.push({
         code: "duplicate-step-id",
-        message: `step id "${id}" is declared more than once (calls #${first} and #${callIndex})`,
+        message: `step id "${id2}" is declared more than once (calls #${first} and #${callIndex})`,
         callIndex,
-        stepId: id
+        stepId: id2
       });
       return;
     }
-    allIds.set(id, callIndex);
+    allIds.set(id2, callIndex);
   }, "claimId");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -5531,7 +6667,7 @@ function resolvePlacements(calls) {
         });
         break;
       case "entry":
-        for (const id of entryIds(call.entry)) claimId(id, i);
+        for (const id2 of entryIds(call.entry)) claimId(id2, i);
         break;
       case "parallel":
         for (const arm of call.arms) if ("node" in arm) claimId(nodeIdOf(arm.node), i);
@@ -5550,42 +6686,42 @@ function resolvePlacements(calls) {
   });
   const armMapPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!ref.armMap || node.type === "mapping" || isHitlNode2(node)) return void 0;
-    const id = nodeIdOf(node);
+    const id2 = nodeIdOf(node);
     if ((container === "foreach" || container === "loop") && node.type !== "workflow") {
       return {
         code: "mapping-placement",
-        message: container === "foreach" ? `foreach body "${id}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
+        message: container === "foreach" ? `foreach body "${id2}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id2}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     if (node.input !== void 0) {
       return {
         code: "mapping-placement",
-        message: `"${id}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
+        message: `"${id2}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     return void 0;
   }, "armMapPlacementIssue");
   const hitlPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!isHitlNode2(node)) return void 0;
-    const id = node.id;
+    const id2 = node.id;
     if (ref.armMap) {
       return {
         code: "node-type-unsupported-in-container",
-        message: workflowHitlArmShapeMessage(node.type, id, "mapped-arm"),
+        message: workflowHitlArmShapeMessage(node.type, id2, "mapped-arm"),
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     if (container !== "place" && !workflowContainerRunsHitlArm(container)) {
       return {
         code: "node-type-unsupported-in-container",
-        message: workflowHitlArmUnsupportedMessage(node.type, id, container),
+        message: workflowHitlArmUnsupportedMessage(node.type, id2, container),
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     return void 0;
@@ -5691,8 +6827,8 @@ function resolvePlacements(calls) {
         graph.push(call.entry);
         return;
       case "declare": {
-        const id = nodeIdOf(call.node);
-        if (placedBy.has(id)) return;
+        const id2 = nodeIdOf(call.node);
+        if (placedBy.has(id2)) return;
         graph.push(call.node);
         return;
       }
@@ -5843,14 +6979,14 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
   const seeded = [];
   const unseeded = [];
   const known = new Set(Object.keys(targetPlan.steps));
-  const parentOf = /* @__PURE__ */ __name4((id) => {
-    const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id);
+  const parentOf = /* @__PURE__ */ __name4((id2) => {
+    const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id2);
     return m ? m[1] : void 0;
   }, "parentOf");
-  const dependsOf = /* @__PURE__ */ __name4((id) => {
-    const node = targetPlan.steps[id];
+  const dependsOf = /* @__PURE__ */ __name4((id2) => {
+    const node = targetPlan.steps[id2];
     if (node) return node.dependsOn;
-    const parent = parentOf(id);
+    const parent = parentOf(id2);
     return parent && targetPlan.steps[parent] ? [
       parent
     ] : [];
@@ -5863,23 +6999,23 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
       walk2.push(s.stepId);
     }
   }
-  for (const id of walk2) {
-    const row = byId.get(id);
+  for (const id2 of walk2) {
+    const row = byId.get(id2);
     if (!row || row.status !== "completed") continue;
-    if (!dependsOf(id).every((d) => seededIds.has(d))) {
-      unseeded.push(id);
+    if (!dependsOf(id2).every((d) => seededIds.has(d))) {
+      unseeded.push(id2);
       continue;
     }
-    seededIds.add(id);
+    seededIds.add(id2);
     seeded.push({
-      stepId: id,
+      stepId: id2,
       output: row.output,
       attempt: row.attempt ?? 1,
       effects: row.effects ?? {}
     });
   }
   const dropped = steps.filter((s) => s.status === "completed" && !known.has(s.stepId) && !(parentOf(s.stepId) && known.has(parentOf(s.stepId)))).map((s) => s.stepId);
-  const firstPending = targetPlan.order.find((id) => !seededIds.has(id));
+  const firstPending = targetPlan.order.find((id2) => !seededIds.has(id2));
   const graphChanged = !!(opts.targetGraphHash && run.graphHash && opts.targetGraphHash !== run.graphHash);
   return {
     sourceRunId: run.id,
@@ -5952,37 +7088,37 @@ function replayLedger(g, ledger) {
     startedAt: 0,
     ...ledger.requestContext
   };
-  const ctxFor = /* @__PURE__ */ __name4((id) => ({
+  const ctxFor = /* @__PURE__ */ __name4((id2) => ({
     initData: ledger.initData,
-    stepResults: ancestorResults(plan, id, rows22),
+    stepResults: ancestorResults(plan, id2, rows22),
     state: ledger.state ?? {},
     requestContext
   }), "ctxFor");
   const verdicts = [];
-  for (const id of plan.order) {
-    const node = plan.steps[id];
-    const recorded = rows22.get(id);
+  for (const id2 of plan.order) {
+    const node = plan.steps[id2];
+    const recorded = rows22.get(id2);
     if (!recorded || recorded.status === "pending" || recorded.status === "skipped") continue;
     if (node.kind === "branch") {
       const entry = node.entry;
-      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id));
+      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id2));
       const recordedTaken = recorded.taken ?? inferTaken(entry, rows22);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "branch",
         recorded: recordedTaken,
         local: taken,
         diverged: canonical(recordedTaken) !== canonical(taken)
       });
-    } else if (node.kind === "map" && !id.endsWith(".join") && recorded.status === "completed") {
+    } else if (node.kind === "map" && !id2.endsWith(".join") && recorded.status === "completed") {
       const entry = node.entry;
-      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id), ctxFor(id));
+      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id2), ctxFor(id2));
       const local = "error" in resolved ? {
         error: resolved.error,
         key: resolved.key
       } : resolved.value;
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "map",
         recorded: recorded.output,
         local,
@@ -5991,11 +7127,11 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "foreach") {
       const entry = node.entry;
       const source = node.dependsOn[0];
-      const items = source ? ctxFor(id).stepResults[source] : void 0;
+      const items = source ? ctxFor(id2).stepResults[source] : void 0;
       const local = Array.isArray(items) ? items.length : void 0;
       const recordedCount = recorded.itemCount ?? countChildren(entry, rows22);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "foreach",
         recorded: recordedCount,
         local,
@@ -6004,7 +7140,7 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "subrun" && recorded.status === "completed" && recorded.child) {
       const local = subrunSettledOutput(recorded.child);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "subrun",
         recorded: recorded.output,
         local,
@@ -6020,7 +7156,7 @@ function replayLedger(g, ledger) {
 __name(replayLedger, "replayLedger");
 __name4(replayLedger, "replayLedger");
 var JOIN = ".join";
-var entryOfJoin = /* @__PURE__ */ __name4((id) => id.endsWith(JOIN) ? id.slice(0, -JOIN.length) : void 0, "entryOfJoin");
+var entryOfJoin = /* @__PURE__ */ __name4((id2) => id2.endsWith(JOIN) ? id2.slice(0, -JOIN.length) : void 0, "entryOfJoin");
 function replayResultOf(row, node) {
   if (!row) return void 0;
   if (row.status === "completed") return {
@@ -6036,7 +7172,7 @@ function replayResultOf(row, node) {
 }
 __name(replayResultOf, "replayResultOf");
 __name4(replayResultOf, "replayResultOf");
-function ancestorResults(plan, id, rows22) {
+function ancestorResults(plan, id2, rows22) {
   const out = {};
   const joinAliased = /* @__PURE__ */ new Set();
   const seen = /* @__PURE__ */ new Set();
@@ -6085,7 +7221,7 @@ function ancestorResults(plan, id, rows22) {
       walk2(node.dependsOn);
     }
   }, "walk");
-  walk2(plan.steps[id]?.dependsOn ?? []);
+  walk2(plan.steps[id2]?.dependsOn ?? []);
   return out;
 }
 __name(ancestorResults, "ancestorResults");
@@ -6097,8 +7233,8 @@ function inferTaken(entry, rows22) {
       entry.otherwise
     ] : []
   ];
-  return arms.map(branchArmId).filter((id) => {
-    const r = rows22.get(id);
+  return arms.map(branchArmId).filter((id2) => {
+    const r = rows22.get(id2);
     return r !== void 0 && r.status !== "skipped" && r.status !== "pending";
   });
 }
@@ -6107,7 +7243,7 @@ __name4(inferTaken, "inferTaken");
 function countChildren(entry, rows22) {
   const body = branchArmId(entry.step);
   let n2 = 0;
-  for (const id of rows22.keys()) if (id.startsWith(`${body}[`)) n2 += 1;
+  for (const id2 of rows22.keys()) if (id2.startsWith(`${body}[`)) n2 += 1;
   return n2;
 }
 __name(countChildren, "countChildren");
@@ -7553,8 +8689,8 @@ function step2(s) {
   return step(typeof s === "string" ? s : s.id);
 }
 __name(step2, "step");
-function stepOf2(id) {
-  return stepOf(id);
+function stepOf2(id2) {
+  return stepOf(id2);
 }
 __name(stepOf2, "stepOf");
 var init2 = init;
@@ -7645,16 +8781,16 @@ var assertPredicate = /* @__PURE__ */ __name((p, where) => {
   if (!isPredicate(p)) throw new LuaWorkflowBuildError("closure-predicate", `${where}: not a LuaPredicate`, "build predicates with eq/gt/inSet/exists/and/or/not");
   return p;
 }, "assertPredicate");
-var assertRetry = /* @__PURE__ */ __name((r, id) => {
+var assertRetry = /* @__PURE__ */ __name((r, id2) => {
   if (!r) return;
   if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
     const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-    throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
+    throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id2}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
   }
-  if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
+  if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
   if (r.maxBackoffSeconds !== void 0) {
-    if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
-    if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds`);
+    if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
+    if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds`);
   }
 }, "assertRetry");
 var assertTimeout = /* @__PURE__ */ __name((node) => {
@@ -7926,8 +9062,8 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       ref: arm
     };
     if (arm && typeof arm === "object" && isHitlEntry(arm)) {
-      const id = arm.id;
-      throw new LuaWorkflowBuildError("invalid-step", `${where}: an approval / waitForSignal arm is placed by id \u2014 declare it with .approval(${JSON.stringify(id ?? "id")}, \u2026) / .waitForSignal(\u2026) and pass the id string`);
+      const id2 = arm.id;
+      throw new LuaWorkflowBuildError("invalid-step", `${where}: an approval / waitForSignal arm is placed by id \u2014 declare it with .approval(${JSON.stringify(id2 ?? "id")}, \u2026) / .waitForSignal(\u2026) and pass the id string`);
     }
     return {
       node: this.registerStep(arm, where)
@@ -8047,14 +9183,14 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
     assertNoClosure(mapping, "map()");
     this.recordEnvRefs(mapping);
     this.mapCount += 1;
-    let id = opts?.id;
-    if (id === void 0) {
+    let id2 = opts?.id;
+    if (id2 === void 0) {
       this.unnamedMaps += 1;
-      id = `map_${this.mapCount}`;
+      id2 = `map_${this.mapCount}`;
     }
     const node = {
       type: "mapping",
-      id,
+      id: id2,
       mapConfig: canonicalJson(mapping)
     };
     return this.push({
@@ -8065,12 +9201,12 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
   sleep(ms, opts) {
     if (typeof ms !== "number" || !Number.isFinite(ms) || ms < 0) throw new LuaWorkflowBuildError("invalid-envelope", "sleep(ms) takes a literal non-negative number");
     this.sleepCount += 1;
-    const id = opts?.id ?? `sleep_${this.sleepCount}`;
+    const id2 = opts?.id ?? `sleep_${this.sleepCount}`;
     return this.push({
       kind: "entry",
       entry: defined({
         type: "sleep",
-        id,
+        id: id2,
         duration: ms,
         businessHours: opts?.businessHours
       })
@@ -8078,13 +9214,13 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
   }
   sleepUntil(iso, opts) {
     this.sleepCount += 1;
-    const id = opts?.id ?? `sleep_${this.sleepCount}`;
+    const id2 = opts?.id ?? `sleep_${this.sleepCount}`;
     if (typeof iso === "string") {
       return this.push({
         kind: "entry",
         entry: defined({
           type: "sleepUntil",
-          id,
+          id: id2,
           date: iso,
           businessHours: opts?.businessHours,
           round: opts?.round
@@ -8097,7 +9233,7 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       kind: "entry",
       entry: {
         type: "mapping",
-        id: `${id}_at`,
+        id: `${id2}_at`,
         mapConfig: canonicalJson({
           date: {
             template: iso.template
@@ -8109,9 +9245,9 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       kind: "entry",
       entry: defined({
         type: "sleepUntil",
-        id,
+        id: id2,
         dateFrom: {
-          step: `${id}_at`,
+          step: `${id2}_at`,
           path: "date"
         },
         businessHours: opts?.businessHours,
@@ -8119,35 +9255,35 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       })
     });
   }
-  agentStep(id, opts) {
-    this.assertId(id, "agentStep()");
+  agentStep(id2, opts) {
+    this.assertId(id2, "agentStep()");
     if (!opts || typeof opts.agentId !== "string" && !(opts.agentId && typeof opts.agentId === "object" && "__envRef" in opts.agentId)) {
-      throw new LuaWorkflowBuildError("invalid-envelope", `agentStep("${id}") needs an agentId`);
+      throw new LuaWorkflowBuildError("invalid-envelope", `agentStep("${id2}") needs an agentId`);
     }
     const tier = opts.tier ?? (opts.workspace ? "job" : void 0);
-    if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id}": a step mounting a workspace must be tier:'job'`);
-    if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id}": harness is only legal on a tier:'job' agent step`);
-    if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
+    if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id2}": a step mounting a workspace must be tier:'job'`);
+    if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id2}": harness is only legal on a tier:'job' agent step`);
+    if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id2}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
     for (const m of WORKFLOW_JOB_RANGE_MEMBERS) {
       if (opts[m] === void 0) continue;
-      if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": ${m} is only legal on a tier:'job' agent step`);
+      if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id2}": ${m} is only legal on a tier:'job' agent step`);
       if (!isWithinWorkflowJobRange(m, opts[m])) {
         const { min, max } = WORKFLOW_JOB_RANGES[m];
-        throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": ${m} must be an integer ${min}..${max}`);
+        throw new LuaWorkflowBuildError("max-turns-invalid", `"${id2}": ${m} must be an integer ${min}..${max}`);
       }
     }
     assertTimeout({
-      id,
+      id: id2,
       timeoutSeconds: opts.timeoutSeconds,
       tier,
       workspace: opts.workspace,
       kind: "agent"
     });
-    assertRetry(opts.retry, id);
+    assertRetry(opts.retry, id2);
     this.recordEnvRefs(opts.agentId, opts.prompt);
     const node = defined({
       type: "agent",
-      id,
+      id: id2,
       agentId: opts.agentId,
       promptTemplate: templateText(opts.prompt),
       outputSchema: schemaToJson(opts.outputSchema),
@@ -8175,30 +9311,30 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       node
     });
   }
-  specialistStep(id, opts) {
-    this.assertId(id, "specialistStep()");
+  specialistStep(id2, opts) {
+    this.assertId(id2, "specialistStep()");
     const role = opts?.role;
-    if (!role || typeof role !== "object") throw new LuaWorkflowBuildError("invalid-envelope", `specialistStep("${id}") needs a role`);
+    if (!role || typeof role !== "object") throw new LuaWorkflowBuildError("invalid-envelope", `specialistStep("${id2}") needs a role`);
     if (role.ref !== void 0 && (role.name !== void 0 || role.instructions !== void 0 || role.tools !== void 0)) {
-      throw new LuaWorkflowBuildError("role-ref-and-inline", `"${id}": role is EITHER { ref } OR the inline { name, instructions, tools } shape`);
+      throw new LuaWorkflowBuildError("role-ref-and-inline", `"${id2}": role is EITHER { ref } OR the inline { name, instructions, tools } shape`);
     }
     if (role.ref === void 0) {
       if (typeof role.instructions !== "string" || role.instructions.length > WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS) {
-        throw new LuaWorkflowBuildError("ephemeral-role-too-long", `"${id}": role.instructions must be \u2264 ${WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS} chars`);
+        throw new LuaWorkflowBuildError("ephemeral-role-too-long", `"${id2}": role.instructions must be \u2264 ${WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS} chars`);
       }
-      if (!Array.isArray(role.tools)) throw new LuaWorkflowBuildError("invalid-envelope", `"${id}": role.tools must be an array ([] = no tools)`);
-      if (role.tools.length > 64) throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": role.tools exceeds 64 entries`);
+      if (!Array.isArray(role.tools)) throw new LuaWorkflowBuildError("invalid-envelope", `"${id2}": role.tools must be an array ([] = no tools)`);
+      if (role.tools.length > 64) throw new LuaWorkflowBuildError("cap-exceeded", `"${id2}": role.tools exceeds 64 entries`);
     }
     assertTimeout({
-      id,
+      id: id2,
       timeoutSeconds: opts.timeoutSeconds,
       kind: "agent"
     });
-    assertRetry(opts.retry, id);
+    assertRetry(opts.retry, id2);
     this.recordEnvRefs(opts.prompt);
     const node = defined({
       type: "agent",
-      id,
+      id: id2,
       agentId: "$self",
       role: role.ref !== void 0 ? {
         ref: role.ref
@@ -8221,20 +9357,20 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       node
     });
   }
-  toolStep(id, tool, opts = {}) {
-    this.assertId(id, "toolStep()");
-    if (!tool || typeof tool !== "object" || typeof tool.name !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `toolStep("${id}") needs a LuaTool`);
-    assertNoClosure(opts.input, `toolStep("${id}").input`);
+  toolStep(id2, tool, opts = {}) {
+    this.assertId(id2, "toolStep()");
+    if (!tool || typeof tool !== "object" || typeof tool.name !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `toolStep("${id2}") needs a LuaTool`);
+    assertNoClosure(opts.input, `toolStep("${id2}").input`);
     this.recordEnvRefs(opts.input);
     assertTimeout({
-      id,
+      id: id2,
       timeoutSeconds: opts.timeoutSeconds,
       kind: "tool"
     });
-    assertRetry(opts.retry, id);
+    assertRetry(opts.retry, id2);
     const node = defined({
       type: "tool",
-      id,
+      id: id2,
       toolId: tool.name,
       input: opts.input,
       timeoutSeconds: opts.timeoutSeconds,
@@ -8248,34 +9384,34 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       node
     });
   }
-  approval(id, opts) {
-    this.assertId(id, "approval()");
-    if (!opts || typeof opts.title !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `approval("${id}") needs a title`);
+  approval(id2, opts) {
+    this.assertId(id2, "approval()");
+    if (!opts || typeof opts.title !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `approval("${id2}") needs a title`);
     if (opts.approver === "creator" && opts.excludeInitiator === true) {
-      throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
+      throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id2}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
     }
     const editable = approvalEditable(opts);
-    if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": \`fourEyes\` requires editable:true`);
+    if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id2}": \`fourEyes\` requires editable:true`);
     if (opts.editable === false && Array.isArray(opts.editablePaths) && opts.editablePaths.length > 0) {
-      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
+      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
     } else if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && !editable) {
-      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
+      throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
     }
     for (const p of opts.editablePaths ?? []) {
-      if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
+      if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
     }
     if (Array.isArray(opts.onTimeout)) {
       const chain = opts.onTimeout;
       const hops = chain.filter((h) => typeof h === "object");
-      if (hops.length > 3) throw new LuaWorkflowBuildError("escalation-chain-too-long", `"${id}": an onTimeout chain carries at most 3 escalation hops`);
+      if (hops.length > 3) throw new LuaWorkflowBuildError("escalation-chain-too-long", `"${id2}": an onTimeout chain carries at most 3 escalation hops`);
       const last = chain[chain.length - 1];
-      if (last === void 0 || typeof last === "object") throw new LuaWorkflowBuildError("escalation-chain-not-terminal", `"${id}": an onTimeout chain must end in a terminal member`);
+      if (last === void 0 || typeof last === "object") throw new LuaWorkflowBuildError("escalation-chain-not-terminal", `"${id2}": an onTimeout chain must end in a terminal member`);
     }
-    if (typeof opts.details === "function") throw new LuaWorkflowBuildError("closure-binding", `approval("${id}").details must be template(...)`);
+    if (typeof opts.details === "function") throw new LuaWorkflowBuildError("closure-binding", `approval("${id2}").details must be template(...)`);
     this.recordEnvRefs(opts.details, opts.timeoutHours, opts.approver);
     const node = defined({
       type: "approval",
-      id,
+      id: id2,
       title: opts.title,
       details: opts.details ? templateText(opts.details) : void 0,
       approver: opts.approver,
@@ -8297,13 +9433,13 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       node
     });
   }
-  waitForSignal(id, opts) {
-    this.assertId(id, "waitForSignal()");
-    if (!opts || typeof opts.signal !== "string" || opts.signal.length === 0) throw new LuaWorkflowBuildError("invalid-envelope", `waitForSignal("${id}") needs a signal name`);
+  waitForSignal(id2, opts) {
+    this.assertId(id2, "waitForSignal()");
+    if (!opts || typeof opts.signal !== "string" || opts.signal.length === 0) throw new LuaWorkflowBuildError("invalid-envelope", `waitForSignal("${id2}") needs a signal name`);
     this.recordEnvRefs(opts.timeoutHours);
     const node = defined({
       type: "waitForSignal",
-      id,
+      id: id2,
       signal: opts.signal,
       schema: schemaToJson(opts.schema),
       timeoutHours: opts.timeoutHours,
@@ -8316,28 +9452,28 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       node
     });
   }
-  workflow(id, ref, input, opts) {
-    this.assertId(id, "workflow()");
-    assertRetry(opts?.retry, id);
+  workflow(id2, ref, input, opts) {
+    this.assertId(id2, "workflow()");
+    assertRetry(opts?.retry, id2);
     const name = typeof ref === "string" ? ref : ref instanceof LuaWorkflow ? ref.getName() : void 0;
-    if (!name) throw new LuaWorkflowBuildError("invalid-envelope", `workflow("${id}") needs a LuaWorkflow or a workflow name`);
+    if (!name) throw new LuaWorkflowBuildError("invalid-envelope", `workflow("${id2}") needs a LuaWorkflow or a workflow name`);
     if (opts?.workspace === "inherit") {
-      if (!this.config.workspace) throw new LuaWorkflowBuildError("workspace-inherit-without-parent-workspace", `"${id}": workspace:'inherit' but the parent createWorkflow declares no workspace`);
-      if (ref instanceof LuaWorkflow && ref.getConfig().workspace) throw new LuaWorkflowBuildError("workspace-inherit-conflict", `"${id}": workspace:'inherit' on a workflow that declares its own workspace`);
+      if (!this.config.workspace) throw new LuaWorkflowBuildError("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent createWorkflow declares no workspace`);
+      if (ref instanceof LuaWorkflow && ref.getConfig().workspace) throw new LuaWorkflowBuildError("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on a workflow that declares its own workspace`);
     }
-    assertNoClosure(input, `workflow("${id}").input`);
+    assertNoClosure(input, `workflow("${id2}").input`);
     this.recordEnvRefs(input);
     this.nestedRefs.push(opts?.workspace === "inherit" ? {
-      id,
+      id: id2,
       name,
       workspace: "inherit"
     } : {
-      id,
+      id: id2,
       name
     });
     const node = defined({
       type: "workflow",
-      id,
+      id: id2,
       workflowId: name,
       input,
       workspace: opts?.workspace,
@@ -8416,8 +9552,8 @@ var WorkflowBuilderImpl = class WorkflowBuilderImpl2 {
       });
     }
   }
-  assertId(id, where) {
-    if (typeof id !== "string" || !STEP_ID_RE.test(id)) throw new LuaWorkflowBuildError("invalid-step-id", `${where}: id "${String(id)}" must match ${STEP_ID_RE}`);
+  assertId(id2, where) {
+    if (typeof id2 !== "string" || !STEP_ID_RE.test(id2)) throw new LuaWorkflowBuildError("invalid-step-id", `${where}: id "${String(id2)}" must match ${STEP_ID_RE}`);
   }
 };
 var EDITABLE_PATH_RE2 = /^[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?(\.[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?)*$/;