lua-cli 3.39.0 → 3.39.1

package/dist/api-exports.js

@@ -18,6 +18,7 @@ var __export = (target, all) => {
 import { z } from "zod";
 import { z as z2 } from "zod";
 import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 function isChannelConversationChannel(channel) {
   return !!channel && CHANNEL_CONVERSATION_CHANNELS.includes(channel);
 }
@@ -114,9 +115,9 @@ function isMcpDraftCreateTool(tool) {
 function mcpSendSiblingForDraftTool(tool, availableToolIds) {
   const candidates = [
     ...availableToolIds
-  ].filter((id) => id.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id) => ({
-    id,
-    serverName: id.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
+  ].filter((id2) => id2.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id2) => ({
+    id: id2,
+    serverName: id2.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
   })).filter(({ serverName }) => tool.startsWith(`${serverName}_`)).sort((a, b) => b.serverName.length - a.serverName.length);
   return candidates[0]?.id;
 }
@@ -277,8 +278,8 @@ function transformChatHistoryContentParts(parts) {
   }
   return content;
 }
-function isSyntheticSideRow(id) {
-  return id.startsWith(SCREENSHOT_MESSAGE_ID_PREFIX) || id.startsWith(RICH_PARTS_MESSAGE_ID_PREFIX);
+function isSyntheticSideRow(id2) {
+  return id2.startsWith(SCREENSHOT_MESSAGE_ID_PREFIX) || id2.startsWith(RICH_PARTS_MESSAGE_ID_PREFIX);
 }
 function mergeRichPartMirrorMessages(messages, sameTurnGroup) {
   const merged = [];
@@ -598,12 +599,12 @@ function isWorkflowArmEntryType(type) {
 function workflowContainerRunsHitlArm(container) {
   return typeof container === "string" && WORKFLOW_HITL_ARM_CONTAINERS.includes(container);
 }
-function workflowHitlArmUnsupportedMessage(type, id, container) {
+function workflowHitlArmUnsupportedMessage(type, id2, container) {
   const legal = WORKFLOW_HITL_ARM_CONTAINERS.map((c) => `\`${c}\``).join(" / ");
-  return `the engine does not run \`${type}\` inside a \`${container}\` yet (node "${id}") \u2014 place it at the top level, as a ${legal} arm, or inside a child \`workflow\``;
+  return `the engine does not run \`${type}\` inside a \`${container}\` yet (node "${id2}") \u2014 place it at the top level, as a ${legal} arm, or inside a child \`workflow\``;
 }
-function workflowHitlArmShapeMessage(type, id, shape) {
-  return shape === "mapped-arm" ? `\`${type}\` arm "${id}" takes the previous output as its payload \u2014 it cannot head a [mapping, step] chain; map before the container instead` : `a chunked foreach hands each child a slice of items, not one \u2014 \`${type}\` body "${id}" takes one item; drop \`chunk\``;
+function workflowHitlArmShapeMessage(type, id2, shape) {
+  return shape === "mapped-arm" ? `\`${type}\` arm "${id2}" takes the previous output as its payload \u2014 it cannot head a [mapping, step] chain; map before the container instead` : `a chunked foreach hands each child a slice of items, not one \u2014 \`${type}\` body "${id2}" takes one item; drop \`chunk\``;
 }
 function isModelIdSentinel(input) {
   const lower = (input ?? "").trim().toLowerCase();
@@ -1281,12 +1282,12 @@ function decodeLogCursor(raw) {
     return null;
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  const { t, id } = parsed;
+  const { t, id: id2 } = parsed;
   if (typeof t !== "number" || !Number.isSafeInteger(t) || t < 0) return null;
-  if (typeof id !== "string" || !id || id.length > LOG_CURSOR_MAX_ID_LENGTH) return null;
+  if (typeof id2 !== "string" || !id2 || id2.length > LOG_CURSOR_MAX_ID_LENGTH) return null;
   return {
     t,
-    id
+    id: id2
   };
 }
 function parseLogTimeBound(raw, now = /* @__PURE__ */ new Date()) {
@@ -1524,62 +1525,62 @@ function isKnownProfile(profiles, profileId) {
 function hasCapability(profiles, profileId, required) {
   return capabilitiesFor(profiles, profileId).includes(required);
 }
-function workflowJobId(id) {
-  switch (id.kind) {
+function workflowJobId(id2) {
+  switch (id2.kind) {
     case "start":
-      return `wft_${id.runId}_0`;
+      return `wft_${id2.runId}_0`;
     case "start-redrive":
-      return `wft_${id.runId}_start_r${id.now}`;
+      return `wft_${id2.runId}_start_r${id2.now}`;
     case "tick":
-      return `wft_${id.runId}_${id.seq}`;
+      return `wft_${id2.runId}_${id2.seq}`;
     case "timer":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}`;
     case "timer-remainder":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "timer-deferral":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_d${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_d${id2.now}`;
     case "timer-sibling":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_w${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_w${id2.now}`;
     case "retry":
-      return `wft_${id.runId}_retry_${id.stepId}_${id.attempt}`;
+      return `wft_${id2.runId}_retry_${id2.stepId}_${id2.attempt}`;
     case "respawn":
-      return `wft_${id.runId}_respawn_${id.stepId}_${id.attempt}_s${id.segment}_r${id.now}`;
+      return `wft_${id2.runId}_respawn_${id2.stepId}_${id2.attempt}_s${id2.segment}_r${id2.now}`;
     case "redrive":
-      return `wft_${id.runId}_redrive_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_redrive_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "redispatch":
-      return `wft_${id.runId}_redispatch_${id.stepId}_${id.attempt}_x${id.executionId ?? "none"}_r${id.now}`;
+      return `wft_${id2.runId}_redispatch_${id2.stepId}_${id2.attempt}_x${id2.executionId ?? "none"}_r${id2.now}`;
     case "expiry":
-      return `wft_${id.runId}_expire_${id.stepId}_${id.attempt}_t${id.suspendedAt}${id.hop > 0 ? `_h${id.hop}` : ""}`;
+      return `wft_${id2.runId}_expire_${id2.stepId}_${id2.attempt}_t${id2.suspendedAt}${id2.hop > 0 ? `_h${id2.hop}` : ""}`;
     case "step-terminal":
-      return `wft_${id.runId}_term_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_term_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "handback":
-      return `wft_${id.runId}_handback_${id.stepId}_${id.attempt}_${id.now}`;
+      return `wft_${id2.runId}_handback_${id2.stepId}_${id2.attempt}_${id2.now}`;
     case "foreach-rate":
-      return `wft_${id.runId}_fe_${id.stepId}_${id.attempt}_${id.bucket}`;
+      return `wft_${id2.runId}_fe_${id2.stepId}_${id2.attempt}_${id2.bucket}`;
     case "budget-expiry":
-      return `wft_${id.runId}_expiry_budget_r${id.now}`;
+      return `wft_${id2.runId}_expiry_budget_r${id2.now}`;
     case "budget-resume":
-      return `wft_${id.runId}_resume_budget_${id.now}`;
+      return `wft_${id2.runId}_resume_budget_${id2.now}`;
     case "deadline":
-      return `wft_${id.runId}_deadline_${id.deadlineAt}`;
+      return `wft_${id2.runId}_deadline_${id2.deadlineAt}`;
     case "deadline-remainder":
-      return `wft_${id.runId}_deadline_${id.deadlineAt}_r${id.now}`;
+      return `wft_${id2.runId}_deadline_${id2.deadlineAt}_r${id2.now}`;
     case "readmit":
-      return `wft_${id.runId}_readmit_${id.now}`;
+      return `wft_${id2.runId}_readmit_${id2.now}`;
     case "cancel":
-      return `wft_${id.runId}_cancel`;
+      return `wft_${id2.runId}_cancel`;
     case "reconcile":
-      return `wft_${id.runId}_reconcile_${id.now}`;
+      return `wft_${id2.runId}_reconcile_${id2.now}`;
     case "replay":
-      return `wft_${id.runId}_replay_g${id.leaseGeneration}`;
+      return `wft_${id2.runId}_replay_g${id2.leaseGeneration}`;
     case "migration":
-      return `wfm_${id.migrationId}`;
+      return `wfm_${id2.migrationId}`;
     default:
-      return assertNever(id);
+      return assertNever(id2);
   }
 }
-function assertNever(id) {
-  throw new Error(`workflowJobId: unknown wake kind ${JSON.stringify(id)}`);
+function assertNever(id2) {
+  throw new Error(`workflowJobId: unknown wake kind ${JSON.stringify(id2)}`);
 }
 function agentStepJobId(msg) {
   return `${msg.runId}_${msg.stepId}_${msg.attempt}_x${msg.executionId}`;
@@ -1617,11 +1618,11 @@ function isArchiveWindowTooOld(run, retentionDays, now = Date.now(), marginDays
 function workflowOrgPurgingKey(orgId) {
   return `wf:org:${orgId}:purging`;
 }
-function isCloudTaskRunId(id) {
-  return id.startsWith(CLOUD_TASK_RUN_ID_PREFIX);
+function isCloudTaskRunId(id2) {
+  return id2.startsWith(CLOUD_TASK_RUN_ID_PREFIX);
 }
-function isScheduledWorkflowRunId(id) {
-  return id.startsWith(WORKFLOW_SCHEDULED_RUN_ID_PREFIX);
+function isScheduledWorkflowRunId(id2) {
+  return id2.startsWith(WORKFLOW_SCHEDULED_RUN_ID_PREFIX);
 }
 function scheduledWorkflowRunId(jobId, scheduledTime) {
   const key = typeof scheduledTime === "number" ? String(scheduledTime) : scheduledTimeKey(scheduledTime);
@@ -1982,7 +1983,13 @@ function effectiveAgentFeatures(base, override, rule) {
   if (rule === "wholesale") return override || base || void 0;
   return effectiveAgentFeatureRows(base, override).rows;
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES;
+function parseOnboardingFlow(value3) {
+  return onboardingFlowSchema.parse(value3);
+}
+function parsePublishedOnboardingResponse(value3) {
+  return getPublishedOnboardingResponseSchema.parse(value3);
+}
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -4143,6 +4150,236 @@ listed here; never invent a target.`;
     __name2(agentFeatureMergeRuleFromEnv, "agentFeatureMergeRuleFromEnv");
     __name(effectiveAgentFeatures, "effectiveAgentFeatures");
     __name2(effectiveAgentFeatures, "effectiveAgentFeatures");
+    ONBOARDING_FLOW_KEY = "alpha-choose-meet";
+    ONBOARDING_SCHEMA_VERSION = 1;
+    id = z4.string().min(1).max(80).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/);
+    copy = /* @__PURE__ */ __name2((max) => z4.string().max(max), "copy");
+    onboardingHeadingSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("plain"),
+        text: copy(240)
+      }).strict(),
+      z4.object({
+        kind: z4.literal("highlighted"),
+        before: copy(240),
+        highlight: copy(240),
+        after: copy(240)
+      }).strict()
+    ]);
+    onboardingRichTextInlineSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("text"),
+        text: copy(2e3),
+        marks: z4.array(z4.enum([
+          "bold",
+          "italic"
+        ])).max(2).refine((marks) => new Set(marks).size === marks.length, "Text marks must be unique").optional()
+      }).strict(),
+      z4.object({
+        kind: z4.literal("lineBreak")
+      }).strict()
+    ]);
+    onboardingRichTextSchema = z4.object({
+      blocks: z4.array(z4.object({
+        kind: z4.literal("paragraph"),
+        content: z4.array(onboardingRichTextInlineSchema).max(100)
+      }).strict()).max(40)
+    }).strict();
+    onboardingDestinationSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("question"),
+        questionId: id
+      }).strict(),
+      z4.object({
+        kind: z4.literal("template"),
+        templateContentId: id
+      }).strict(),
+      z4.object({
+        kind: z4.literal("unavailable"),
+        unavailableId: id
+      }).strict()
+    ]);
+    onboardingArtworkSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("builtinRing")
+      }).strict(),
+      z4.object({
+        kind: z4.literal("uploaded"),
+        assetId: id,
+        accessibility: z4.discriminatedUnion("kind", [
+          z4.object({
+            kind: z4.literal("decorative")
+          }).strict(),
+          z4.object({
+            kind: z4.literal("described"),
+            altText: copy(500)
+          }).strict()
+        ])
+      }).strict()
+    ]);
+    onboardingAnswerSchema = z4.object({
+      id,
+      label: copy(160),
+      supportingText: copy(500).optional(),
+      destination: onboardingDestinationSchema.nullable()
+    }).strict();
+    onboardingQuestionSchema = z4.object({
+      id,
+      heading: onboardingHeadingSchema,
+      helperText: onboardingRichTextSchema.optional(),
+      continueButtonLabel: copy(80),
+      answers: z4.array(onboardingAnswerSchema).max(30)
+    }).strict();
+    onboardingTemplateSectionSchema = z4.object({
+      id,
+      label: copy(100),
+      body: onboardingRichTextSchema
+    }).strict();
+    onboardingTemplateContentSchema = z4.object({
+      id,
+      templateId: copy(160),
+      displayName: copy(100),
+      eyebrow: copy(100).optional(),
+      heading: onboardingHeadingSchema,
+      description: onboardingRichTextSchema,
+      badges: z4.array(copy(80)).max(12),
+      sections: z4.array(onboardingTemplateSectionSchema).max(20),
+      artwork: onboardingArtworkSchema,
+      hireButtonLabel: copy(80),
+      changeRoleButtonLabel: copy(80),
+      nextStepText: onboardingRichTextSchema
+    }).strict();
+    onboardingUnavailableOutcomeSchema = z4.object({
+      id,
+      heading: onboardingHeadingSchema,
+      explanation: onboardingRichTextSchema,
+      backButtonLabel: copy(80),
+      alternative: z4.object({
+        templateContentId: id,
+        introduction: onboardingRichTextSchema,
+        buttonLabel: copy(80)
+      }).strict().optional()
+    }).strict();
+    onboardingFlowSchema = z4.object({
+      key: z4.literal(ONBOARDING_FLOW_KEY),
+      schemaVersion: z4.literal(ONBOARDING_SCHEMA_VERSION),
+      entryQuestionId: id.nullable(),
+      questions: z4.array(onboardingQuestionSchema).max(100),
+      templateContents: z4.array(onboardingTemplateContentSchema).max(100),
+      unavailableOutcomes: z4.array(onboardingUnavailableOutcomeSchema).max(100)
+    }).strict();
+    onboardingActorSchema = z4.object({
+      subjectId: z4.string(),
+      email: z4.string().email()
+    }).strict();
+    onboardingEditorSchema = onboardingActorSchema.extend({
+      editedAt: z4.string().datetime({
+        offset: true
+      })
+    }).strict();
+    onboardingPublicationSummarySchema = z4.object({
+      publicationId: id,
+      revision: z4.number().int().positive(),
+      sourceDraftVersion: z4.number().int().nonnegative(),
+      contentHash: z4.string().regex(/^[a-f0-9]{64}$/),
+      publishedAt: z4.string().datetime({
+        offset: true
+      }),
+      publishedBy: onboardingActorSchema,
+      questionCount: z4.number().int().nonnegative(),
+      templateCount: z4.number().int().nonnegative(),
+      unavailableCount: z4.number().int().nonnegative()
+    }).strict();
+    onboardingValidationIssueSchema = z4.object({
+      code: z4.string(),
+      path: z4.string(),
+      message: z4.string()
+    }).strict();
+    onboardingValidationResponseSchema = z4.discriminatedUnion("valid", [
+      z4.object({
+        valid: z4.literal(true),
+        summary: z4.object({
+          questionCount: z4.number().int().nonnegative(),
+          templateCount: z4.number().int().nonnegative(),
+          unavailableCount: z4.number().int().nonnegative()
+        }).strict()
+      }).strict(),
+      z4.object({
+        valid: z4.literal(false),
+        issues: z4.array(onboardingValidationIssueSchema)
+      }).strict()
+    ]);
+    onboardingAssetSchema = z4.object({
+      assetId: id,
+      url: z4.string().url(),
+      width: z4.number().int().positive(),
+      height: z4.number().int().positive(),
+      contentType: z4.enum([
+        "image/png",
+        "image/jpeg",
+        "image/webp"
+      ]),
+      bytes: z4.number().int().positive(),
+      sha256: z4.string().regex(/^[a-f0-9]{64}$/),
+      createdAt: z4.string().datetime({
+        offset: true
+      }),
+      uploadedBy: onboardingActorSchema
+    }).strict();
+    onboardingPublicAssetSchema = onboardingAssetSchema.pick({
+      assetId: true,
+      url: true,
+      width: true,
+      height: true,
+      contentType: true
+    }).strict();
+    getOnboardingConfigResponseSchema = z4.object({
+      flowKey: z4.literal(ONBOARDING_FLOW_KEY),
+      draftVersion: z4.number().int().nonnegative(),
+      draft: onboardingFlowSchema,
+      assets: z4.array(onboardingAssetSchema),
+      lastEditor: onboardingEditorSchema.nullable(),
+      activePublication: onboardingPublicationSummarySchema.nullable()
+    }).strict();
+    saveOnboardingDraftRequestSchema = z4.object({
+      expectedDraftVersion: z4.number().int().nonnegative(),
+      draft: onboardingFlowSchema
+    }).strict();
+    validateOnboardingRequestSchema = z4.object({
+      draft: onboardingFlowSchema
+    }).strict();
+    publishOnboardingRequestSchema = z4.object({
+      expectedDraftVersion: z4.number().int().nonnegative(),
+      expectedActivePublicationId: id.nullable()
+    }).strict();
+    rollbackOnboardingRequestSchema = z4.object({
+      publicationId: id,
+      expectedActivePublicationId: id.nullable()
+    }).strict();
+    onboardingTemplateCatalogItemSchema = z4.object({
+      templateId: z4.string(),
+      name: z4.string(),
+      description: z4.string().optional()
+    }).strict();
+    getPublishedOnboardingResponseSchema = z4.discriminatedUnion("status", [
+      z4.object({
+        status: z4.literal("available"),
+        publicationId: id,
+        revision: z4.number().int().positive(),
+        contentHash: z4.string().regex(/^[a-f0-9]{64}$/),
+        flow: onboardingFlowSchema,
+        assets: z4.array(onboardingPublicAssetSchema)
+      }).strict(),
+      z4.object({
+        status: z4.literal("unavailable"),
+        reason: z4.literal("not_published"),
+        message: z4.string()
+      }).strict()
+    ]);
+    __name(parseOnboardingFlow, "parseOnboardingFlow");
+    __name2(parseOnboardingFlow, "parseOnboardingFlow");
+    __name(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
+    __name2(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
   }
 });
 
@@ -4150,9 +4387,9 @@ listed here; never invent a target.`;
 function effectiveJobTools(jobTools, readOnly) {
   const base = jobTools?.length ? jobTools : WORKFLOW_JOB_DEFAULT_TOOLS;
   const out = [];
-  for (const id of base) {
-    if (readOnly && WORKFLOW_JOB_READ_ONLY_DROPPED.includes(id)) continue;
-    if (!out.includes(id)) out.push(id);
+  for (const id2 of base) {
+    if (readOnly && WORKFLOW_JOB_READ_ONLY_DROPPED.includes(id2)) continue;
+    if (!out.includes(id2)) out.push(id2);
   }
   return out;
 }
@@ -4196,7 +4433,7 @@ var init_workflow_job_tools = __esm({
 
 // ../workflow-graph/dist/index.mjs
 import { createHash } from "crypto";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 import { z as z22 } from "zod";
 import { createHash as createHash2 } from "crypto";
 function isMapConfigObject(v) {
@@ -4323,9 +4560,9 @@ function malformedMapMembers(cfg) {
   }
   return out;
 }
-function mapMemberMalformedMessage(id, m) {
+function mapMemberMalformedMessage(id2, m) {
   const keys = m.keys.map((k) => `\`${k}\``).join(", ");
-  return `"${id}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
+  return `"${id2}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
 }
 function resolveDescriptor(key, m, ctx) {
   if (!isMapDescriptor(m)) return {
@@ -4679,11 +4916,11 @@ function retryBackoffs() {
   }
   return WORKFLOW_RETRY_BACKOFFS;
 }
-function sleepUntilUnsupportedMessage(id) {
-  return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
+function sleepUntilUnsupportedMessage(id2) {
+  return `the engine does not execute \`sleepUntil\` yet (node "${id2}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id2}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
 }
-function armSubrunUnsupportedMessage(id, workflowId) {
-  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
+function armSubrunUnsupportedMessage(id2, workflowId) {
+  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id2}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
 }
 function fillPolicy(node, defaultTimeout) {
   if (node.tier === void 0 && node.workspace !== void 0 && node.workspace !== "inherit") node.tier = "job";
@@ -4943,20 +5180,20 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
-  const checkId = /* @__PURE__ */ __name4((id, path3) => {
+  const checkId = /* @__PURE__ */ __name4((id2, path3) => {
     nodeCount += 1;
-    if (seen.has(id)) {
-      err("duplicate-step-id", `step id "${id}" is declared twice (first at ${seen.get(id)})`, path3, id);
+    if (seen.has(id2)) {
+      err("duplicate-step-id", `step id "${id2}" is declared twice (first at ${seen.get(id2)})`, path3, id2);
     } else {
-      seen.set(id, path3);
+      seen.set(id2, path3);
     }
   }, "checkId");
   const checkPolicyEnums = /* @__PURE__ */ __name4((node, path3) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     const check = /* @__PURE__ */ __name4((member, allowed) => {
       const value22 = node[member];
       if (value22 === void 0 || typeof value22 === "string" && allowed.includes(value22)) return;
-      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path3}.${member}`, id);
+      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path3}.${member}`, id2);
     }, "check");
     check("sideEffects", WORKFLOW_SIDE_EFFECTS);
     check("jobResources", WORKFLOW_JOB_RESOURCES);
@@ -4964,46 +5201,46 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const checkRetry = /* @__PURE__ */ __name4((node, path3) => {
     const r = node.retry;
     if (!r) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     const unknown = unknownWorkflowRetryMembers(r);
-    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path3}.retry`, id);
+    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path3}.retry`, id2);
     if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
       const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path3}.retry.maxAttempts`, id);
+      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path3}.retry.maxAttempts`, id2);
     }
     const backoffs = retryBackoffs();
     if (r.backoff !== void 0 && !backoffs.includes(r.backoff)) {
       const list = backoffs.map((b) => `'${b}'`).join(" | ");
-      err("backoff-invalid", `retry.backoff must be ${list}`, `${path3}.retry.backoff`, id);
+      err("backoff-invalid", `retry.backoff must be ${list}`, `${path3}.retry.backoff`, id2);
     }
     if (r.backoffSeconds !== void 0 && r.backoffSeconds < 0) {
-      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path3}.retry.backoffSeconds`, id);
+      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path3}.retry.backoffSeconds`, id2);
     }
     if (r.maxBackoffSeconds !== void 0) {
       if (r.backoff !== "exponential") {
-        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path3}.retry`, id);
+        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path3}.retry`, id2);
       } else if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) {
-        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path3}.retry.maxBackoffSeconds`, id);
+        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path3}.retry.maxBackoffSeconds`, id2);
       }
     }
   }, "checkRetry");
   const checkTimeout = /* @__PURE__ */ __name4((node, path3) => {
     const t = node.timeoutSeconds;
     if (t === void 0) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (!Number.isInteger(t) || t < 1) {
-      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path3}.timeoutSeconds`, id);
+      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path3}.timeoutSeconds`, id2);
       return;
     }
     if (node.tier === "job") {
       const cap = node.type === "agent" ? caps.maxJobTimeoutSeconds : caps.maxJobSegmentSeconds;
       if (t > cap) {
-        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path3}.timeoutSeconds`, id);
+        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path3}.timeoutSeconds`, id2);
       } else if (node.type === "agent" && t > caps.maxJobSegmentSeconds && !node.workspace) {
-        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path3}.timeoutSeconds`, id);
+        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path3}.timeoutSeconds`, id2);
       }
     } else if (t > caps.maxWorkerTimeoutSeconds) {
-      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path3}.timeoutSeconds`, id);
+      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path3}.timeoutSeconds`, id2);
     }
   }, "checkTimeout");
   const checkSpecialistRole = /* @__PURE__ */ __name4((node, path3) => {
@@ -5067,32 +5304,32 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     return void 0;
   }, "jobClassifiablePin");
   const checkTier = /* @__PURE__ */ __name4((node, path3) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (node.workspace && node.workspace !== "inherit" && node.tier !== void 0 && node.tier !== "job") {
-      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path3}.workspace`, id);
+      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path3}.workspace`, id2);
     }
     if (node.harness !== void 0 && node.tier !== "job") {
-      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path3}.harness`, id);
+      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path3}.harness`, id2);
     }
     const provider = node.type === "agent" ? classifyModelProvider(jobClassifiablePin(node.model)) : null;
     if (node.harness === "claude-code" && provider !== null && provider !== "anthropic") {
-      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path3}.harness`, id);
+      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path3}.harness`, id2);
     }
     if (isJobTier(node) && provider !== null && opts.policy?.jobProviders && !opts.policy.jobProviders.includes(provider)) {
-      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path3}.model`, id);
+      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path3}.model`, id2);
     }
   }, "checkTier");
   const checkModel = /* @__PURE__ */ __name4((node, path3) => {
     if (node.type !== "agent" || typeof node.model !== "string") return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     const parsed = parseModelTemplate(node.model);
     if (parsed.kind === "invalid") {
-      err("model-template-invalid", parsed.message, `${path3}.model`, id);
+      err("model-template-invalid", parsed.message, `${path3}.model`, id2);
       return;
     }
     if (parsed.kind === "template" && parsed.template.default === void 0) {
       if (isJobTier(node)) {
-        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path3}.model`, id);
+        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path3}.model`, id2);
       }
       return;
     }
@@ -5105,12 +5342,12 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (registry === "unavailable") {
       const trimmed = pin.trim();
       if (trimmed && !normalizeModelId(trimmed, []).ok) {
-        warn("model-unresolved", inContext(`model "${trimmed}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path3}.model`, id);
+        warn("model-unresolved", inContext(`model "${trimmed}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path3}.model`, id2);
       }
       return;
     }
     const resolved = normalizeModelId(pin, registry);
-    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path3}.model`, id);
+    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path3}.model`, id2);
   }, "checkModel");
   const checkTaskClass = /* @__PURE__ */ __name4((node, path3) => {
     if (node.type !== "agent" || node.taskClass === void 0) return;
@@ -5119,46 +5356,46 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     err("task-class-without-model", `taskClass '${String(node.taskClass)}' needs a \`model\` on a pushed definition \u2014 write a class (model: 'class/fast' | 'class/balanced' | 'class/strong') or an approved provider/model code; nothing maps a task class to a model at dispatch, so a step with neither would run on the agent\u2019s own model`, `${path3}.taskClass`, singleId(node));
   }, "checkTaskClass");
   const checkWorkspace = /* @__PURE__ */ __name4((node, path3) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     const ws = workspaceOf(node);
     if (isJobTier(node) && opts.policy && opts.policy.jobTier !== true) {
-      err("job-tier-disabled", `"${id}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path3}.tier`, id);
+      err("job-tier-disabled", `"${id2}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path3}.tier`, id2);
     }
     const tools = jobToolsOf(node);
     if (tools !== void 0) {
       if (!isJobTier(node)) {
-        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path3}.jobTools`, id);
+        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path3}.jobTools`, id2);
       }
       const unknown = (Array.isArray(tools) ? tools : [
         tools
       ]).filter((t) => !WORKFLOW_JOB_TOOLS.includes(t));
       if (unknown.length > 0) {
-        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path3}.jobTools`, id);
+        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path3}.jobTools`, id2);
       }
       if (node.type === "agent" && (Array.isArray(tools) ? tools : [
         tools
       ]).includes("gh")) {
-        warn("gh-on-coding-turn", `"${id}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path3}.jobTools`, id);
+        warn("gh-on-coding-turn", `"${id2}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path3}.jobTools`, id2);
       }
     }
     if (node.type === "agent" && ws && ws !== "inherit" && ws.mount === "ro" && Array.isArray(tools) && effectiveJobTools(tools, true).length === 0) {
-      warn("ro-step-has-no-tools", `"${id}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path3}.jobTools`, id);
+      warn("ro-step-has-no-tools", `"${id2}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path3}.jobTools`, id2);
     }
     if (ws && ws !== "inherit") {
       if (!envelopeWorkspace && !opts.mayInherit) {
-        err("workspace-not-declared", `"${id}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path3}.workspace`, id);
+        err("workspace-not-declared", `"${id2}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path3}.workspace`, id2);
       }
       if (ws.isolation === "worktree" && envelopeWorkspace?.kind === "empty") {
-        err("worktree-requires-git-workspace", `"${id}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path3}.workspace.isolation`, id);
+        err("worktree-requires-git-workspace", `"${id2}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path3}.workspace.isolation`, id2);
       }
     }
     if (node.type === "workflow" && ws === "inherit") {
       if (!envelopeWorkspace) {
-        err("workspace-inherit-without-parent-workspace", `"${id}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path3}.workspace`, id);
+        err("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path3}.workspace`, id2);
       }
       const child = opts.resolveWorkflow?.(node.workflowId);
       if (child?.workspace) {
-        err("workspace-inherit-conflict", `"${id}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path3}.workspace`, id);
+        err("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path3}.workspace`, id2);
       }
     }
   }, "checkWorkspace");
@@ -5167,20 +5404,20 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const schema = node.type === "step" ? node.step.outputSchema : node.type === "agent" ? node.outputSchema : void 0;
     if (schema !== void 0) outputSchemas.set(singleId(node), schema);
   }, "recordOutputSchema");
-  const checkMapMembers = /* @__PURE__ */ __name4((cfg, basePath, id) => {
+  const checkMapMembers = /* @__PURE__ */ __name4((cfg, basePath, id2) => {
     for (const m of malformedMapMembers(cfg)) {
-      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id, m), `${basePath}.${m.member}`, id);
+      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id2, m), `${basePath}.${m.member}`, id2);
     }
   }, "checkMapMembers");
   const checkInputShape = /* @__PURE__ */ __name4((node, path3) => {
     const input = node.input;
     if (input === void 0) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (input !== null && typeof input === "object" && !Array.isArray(input)) {
-      checkMapMembers(input, `${path3}.input`, id);
+      checkMapMembers(input, `${path3}.input`, id2);
       return;
     }
-    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path3}.input`, id);
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path3}.input`, id2);
   }, "checkInputShape");
   const checkBodyInput = /* @__PURE__ */ __name4((body, path3, container) => {
     if (body.type === "workflow" || body.input === void 0) return;
@@ -5471,7 +5708,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       default:
         err("invalid-envelope", `unknown entry type "${entry.type}"`, path3);
     }
-    for (const id of declared) upstream.add(id);
+    for (const id2 of declared) upstream.add(id2);
   });
   if (nodeCount > caps.maxNodes) {
     err("cap-exceeded", `${nodeCount} nodes exceeds the static cap of ${caps.maxNodes}`, "definition.graph");
@@ -5546,19 +5783,19 @@ function hashGraph(g) {
 function compilePlan(g) {
   const steps = {};
   const order = [];
-  const addNode = /* @__PURE__ */ __name4((id, node) => {
-    if (id in steps) {
-      throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id}" in definition.graph`);
+  const addNode = /* @__PURE__ */ __name4((id2, node) => {
+    if (id2 in steps) {
+      throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id2}" in definition.graph`);
     }
-    steps[id] = node;
-    order.push(id);
+    steps[id2] = node;
+    order.push(id2);
   }, "addNode");
   let prevTails = [];
   const foreachJoinToEntry = /* @__PURE__ */ new Map();
   g.definition.graph.forEach((entry, entryIndex) => {
     if (isArmStep(entry)) {
-      const id = armStepId(entry);
-      addNode(id, {
+      const id2 = armStepId(entry);
+      addNode(id2, {
         kind: armStepKind(entry),
         dependsOn: prevTails,
         downstream: [],
@@ -5566,7 +5803,7 @@ function compilePlan(g) {
         entry
       });
       prevTails = [
-        id
+        id2
       ];
       return;
     }
@@ -5705,10 +5942,10 @@ function compilePlan(g) {
         throw new WorkflowPlanError("unknown-entry-type", `Unknown graph entry type "${entry.type}" at definition.graph[${entryIndex}]`);
     }
   });
-  for (const id of order) {
-    for (const dep of steps[id].dependsOn) {
+  for (const id2 of order) {
+    for (const dep of steps[id2].dependsOn) {
       const target = steps[dep] ?? (foreachJoinToEntry.has(dep) ? steps[foreachJoinToEntry.get(dep)] : void 0);
-      target?.downstream.push(id);
+      target?.downstream.push(id2);
     }
   }
   return {
@@ -5874,15 +6111,15 @@ function renderRef(ref) {
   return ref.path;
 }
 function step(s) {
-  const id = stepIdOf(s);
+  const id2 = stepIdOf(s);
   return {
     path: /* @__PURE__ */ __name4((p) => ({
-      path: p === "" ? `stepResults.${id}` : `stepResults.${id}.${p}`
+      path: p === "" ? `stepResults.${id2}` : `stepResults.${id2}.${p}`
     }), "path")
   };
 }
-function stepOf(id) {
-  return step(id);
+function stepOf(id2) {
+  return step(id2);
 }
 function init(path3) {
   return {
@@ -5964,18 +6201,18 @@ function resolvePlacements(calls) {
   const declared = /* @__PURE__ */ new Map();
   const placedBy = /* @__PURE__ */ new Map();
   const allIds = /* @__PURE__ */ new Map();
-  const claimId = /* @__PURE__ */ __name4((id, callIndex) => {
-    const first = allIds.get(id);
+  const claimId = /* @__PURE__ */ __name4((id2, callIndex) => {
+    const first = allIds.get(id2);
     if (first !== void 0 && first !== callIndex) {
       issues.push({
         code: "duplicate-step-id",
-        message: `step id "${id}" is declared more than once (calls #${first} and #${callIndex})`,
+        message: `step id "${id2}" is declared more than once (calls #${first} and #${callIndex})`,
         callIndex,
-        stepId: id
+        stepId: id2
       });
       return;
     }
-    allIds.set(id, callIndex);
+    allIds.set(id2, callIndex);
   }, "claimId");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -5987,7 +6224,7 @@ function resolvePlacements(calls) {
         });
         break;
       case "entry":
-        for (const id of entryIds(call.entry)) claimId(id, i);
+        for (const id2 of entryIds(call.entry)) claimId(id2, i);
         break;
       case "parallel":
         for (const arm of call.arms) if ("node" in arm) claimId(nodeIdOf(arm.node), i);
@@ -6006,42 +6243,42 @@ function resolvePlacements(calls) {
   });
   const armMapPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!ref.armMap || node.type === "mapping" || isHitlNode2(node)) return void 0;
-    const id = nodeIdOf(node);
+    const id2 = nodeIdOf(node);
     if ((container === "foreach" || container === "loop") && node.type !== "workflow") {
       return {
         code: "mapping-placement",
-        message: container === "foreach" ? `foreach body "${id}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
+        message: container === "foreach" ? `foreach body "${id2}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id2}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     if (node.input !== void 0) {
       return {
         code: "mapping-placement",
-        message: `"${id}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
+        message: `"${id2}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     return void 0;
   }, "armMapPlacementIssue");
   const hitlPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!isHitlNode2(node)) return void 0;
-    const id = node.id;
+    const id2 = node.id;
     if (ref.armMap) {
       return {
         code: "node-type-unsupported-in-container",
-        message: workflowHitlArmShapeMessage(node.type, id, "mapped-arm"),
+        message: workflowHitlArmShapeMessage(node.type, id2, "mapped-arm"),
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     if (container !== "place" && !workflowContainerRunsHitlArm(container)) {
       return {
         code: "node-type-unsupported-in-container",
-        message: workflowHitlArmUnsupportedMessage(node.type, id, container),
+        message: workflowHitlArmUnsupportedMessage(node.type, id2, container),
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     return void 0;
@@ -6147,8 +6384,8 @@ function resolvePlacements(calls) {
         graph.push(call.entry);
         return;
       case "declare": {
-        const id = nodeIdOf(call.node);
-        if (placedBy.has(id)) return;
+        const id2 = nodeIdOf(call.node);
+        if (placedBy.has(id2)) return;
         graph.push(call.node);
         return;
       }
@@ -6279,14 +6516,14 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
   const seeded = [];
   const unseeded = [];
   const known = new Set(Object.keys(targetPlan.steps));
-  const parentOf = /* @__PURE__ */ __name4((id) => {
-    const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id);
+  const parentOf = /* @__PURE__ */ __name4((id2) => {
+    const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id2);
     return m ? m[1] : void 0;
   }, "parentOf");
-  const dependsOf = /* @__PURE__ */ __name4((id) => {
-    const node = targetPlan.steps[id];
+  const dependsOf = /* @__PURE__ */ __name4((id2) => {
+    const node = targetPlan.steps[id2];
     if (node) return node.dependsOn;
-    const parent = parentOf(id);
+    const parent = parentOf(id2);
     return parent && targetPlan.steps[parent] ? [
       parent
     ] : [];
@@ -6299,23 +6536,23 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
       walk22.push(s.stepId);
     }
   }
-  for (const id of walk22) {
-    const row = byId.get(id);
+  for (const id2 of walk22) {
+    const row = byId.get(id2);
     if (!row || row.status !== "completed") continue;
-    if (!dependsOf(id).every((d) => seededIds.has(d))) {
-      unseeded.push(id);
+    if (!dependsOf(id2).every((d) => seededIds.has(d))) {
+      unseeded.push(id2);
       continue;
     }
-    seededIds.add(id);
+    seededIds.add(id2);
     seeded.push({
-      stepId: id,
+      stepId: id2,
       output: row.output,
       attempt: row.attempt ?? 1,
       effects: row.effects ?? {}
     });
   }
   const dropped = steps.filter((s) => s.status === "completed" && !known.has(s.stepId) && !(parentOf(s.stepId) && known.has(parentOf(s.stepId)))).map((s) => s.stepId);
-  const firstPending = targetPlan.order.find((id) => !seededIds.has(id));
+  const firstPending = targetPlan.order.find((id2) => !seededIds.has(id2));
   const graphChanged = !!(opts.targetGraphHash && run.graphHash && opts.targetGraphHash !== run.graphHash);
   return {
     sourceRunId: run.id,
@@ -6370,37 +6607,37 @@ function replayLedger(g, ledger) {
     startedAt: 0,
     ...ledger.requestContext
   };
-  const ctxFor = /* @__PURE__ */ __name4((id) => ({
+  const ctxFor = /* @__PURE__ */ __name4((id2) => ({
     initData: ledger.initData,
-    stepResults: ancestorResults(plan, id, rows22),
+    stepResults: ancestorResults(plan, id2, rows22),
     state: ledger.state ?? {},
     requestContext
   }), "ctxFor");
   const verdicts = [];
-  for (const id of plan.order) {
-    const node = plan.steps[id];
-    const recorded = rows22.get(id);
+  for (const id2 of plan.order) {
+    const node = plan.steps[id2];
+    const recorded = rows22.get(id2);
     if (!recorded || recorded.status === "pending" || recorded.status === "skipped") continue;
     if (node.kind === "branch") {
       const entry = node.entry;
-      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id));
+      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id2));
       const recordedTaken = recorded.taken ?? inferTaken(entry, rows22);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "branch",
         recorded: recordedTaken,
         local: taken,
         diverged: canonical(recordedTaken) !== canonical(taken)
       });
-    } else if (node.kind === "map" && !id.endsWith(".join") && recorded.status === "completed") {
+    } else if (node.kind === "map" && !id2.endsWith(".join") && recorded.status === "completed") {
       const entry = node.entry;
-      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id), ctxFor(id));
+      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id2), ctxFor(id2));
       const local = "error" in resolved ? {
         error: resolved.error,
         key: resolved.key
       } : resolved.value;
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "map",
         recorded: recorded.output,
         local,
@@ -6409,11 +6646,11 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "foreach") {
       const entry = node.entry;
       const source = node.dependsOn[0];
-      const items = source ? ctxFor(id).stepResults[source] : void 0;
+      const items = source ? ctxFor(id2).stepResults[source] : void 0;
       const local = Array.isArray(items) ? items.length : void 0;
       const recordedCount = recorded.itemCount ?? countChildren(entry, rows22);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "foreach",
         recorded: recordedCount,
         local,
@@ -6422,7 +6659,7 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "subrun" && recorded.status === "completed" && recorded.child) {
       const local = subrunSettledOutput(recorded.child);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "subrun",
         recorded: recorded.output,
         local,
@@ -6448,7 +6685,7 @@ function replayResultOf(row, node) {
   }
   return void 0;
 }
-function ancestorResults(plan, id, rows22) {
+function ancestorResults(plan, id2, rows22) {
   const out = {};
   const joinAliased = /* @__PURE__ */ new Set();
   const seen = /* @__PURE__ */ new Set();
@@ -6497,7 +6734,7 @@ function ancestorResults(plan, id, rows22) {
       walk22(node.dependsOn);
     }
   }, "walk");
-  walk22(plan.steps[id]?.dependsOn ?? []);
+  walk22(plan.steps[id2]?.dependsOn ?? []);
   return out;
 }
 function inferTaken(entry, rows22) {
@@ -6507,15 +6744,15 @@ function inferTaken(entry, rows22) {
       entry.otherwise
     ] : []
   ];
-  return arms.map(branchArmId).filter((id) => {
-    const r = rows22.get(id);
+  return arms.map(branchArmId).filter((id2) => {
+    const r = rows22.get(id2);
     return r !== void 0 && r.status !== "skipped" && r.status !== "pending";
   });
 }
 function countChildren(entry, rows22) {
   const body = branchArmId(entry.step);
   let n2 = 0;
-  for (const id of rows22.keys()) if (id.startsWith(`${body}[`)) n2 += 1;
+  for (const id2 of rows22.keys()) if (id2.startsWith(`${body}[`)) n2 += 1;
   return n2;
 }
 function isTerminalRunStatus(status) {
@@ -7783,8 +8020,8 @@ var init_dist2 = __esm({
     fromKnowledge = /* @__PURE__ */ __name4((k) => ({
       knowledge: k
     }), "fromKnowledge");
-    SideEffectsSchema = z4.enum(WORKFLOW_SIDE_EFFECTS);
-    JobResourcesSchema = z4.enum(WORKFLOW_JOB_RESOURCES);
+    SideEffectsSchema = z5.enum(WORKFLOW_SIDE_EFFECTS);
+    JobResourcesSchema = z5.enum(WORKFLOW_JOB_RESOURCES);
     WORKFLOW_MODEL_TEMPLATE_ROOT = "initData";
     WORKFLOW_MODEL_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*(?:\|([^}]*))?\}$/;
     PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
@@ -8217,7 +8454,7 @@ var init_dist2 = __esm({
     __name(replayLedger, "replayLedger");
     __name4(replayLedger, "replayLedger");
     JOIN = ".join";
-    entryOfJoin = /* @__PURE__ */ __name4((id) => id.endsWith(JOIN) ? id.slice(0, -JOIN.length) : void 0, "entryOfJoin");
+    entryOfJoin = /* @__PURE__ */ __name4((id2) => id2.endsWith(JOIN) ? id2.slice(0, -JOIN.length) : void 0, "entryOfJoin");
     __name(replayResultOf, "replayResultOf");
     __name4(replayResultOf, "replayResultOf");
     __name(ancestorResults, "ancestorResults");
@@ -8506,8 +8743,8 @@ function createStep(s) {
 function step2(s) {
   return step(typeof s === "string" ? s : s.id);
 }
-function stepOf2(id) {
-  return stepOf(id);
+function stepOf2(id2) {
+  return stepOf(id2);
 }
 function schemaToJson(schema) {
   if (schema === void 0 || schema === null) return void 0;
@@ -8711,16 +8948,16 @@ var init_workflow = __esm({
       if (!isPredicate(p)) throw new LuaWorkflowBuildError("closure-predicate", `${where}: not a LuaPredicate`, "build predicates with eq/gt/inSet/exists/and/or/not");
       return p;
     }, "assertPredicate");
-    assertRetry = /* @__PURE__ */ __name((r, id) => {
+    assertRetry = /* @__PURE__ */ __name((r, id2) => {
       if (!r) return;
       if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
         const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-        throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
+        throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id2}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
       }
-      if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
+      if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
       if (r.maxBackoffSeconds !== void 0) {
-        if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
-        if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds`);
+        if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
+        if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds`);
       }
     }, "assertRetry");
     assertTimeout = /* @__PURE__ */ __name((node) => {
@@ -8918,8 +9155,8 @@ var init_workflow = __esm({
           ref: arm
         };
         if (arm && typeof arm === "object" && isHitlEntry(arm)) {
-          const id = arm.id;
-          throw new LuaWorkflowBuildError("invalid-step", `${where}: an approval / waitForSignal arm is placed by id \u2014 declare it with .approval(${JSON.stringify(id ?? "id")}, \u2026) / .waitForSignal(\u2026) and pass the id string`);
+          const id2 = arm.id;
+          throw new LuaWorkflowBuildError("invalid-step", `${where}: an approval / waitForSignal arm is placed by id \u2014 declare it with .approval(${JSON.stringify(id2 ?? "id")}, \u2026) / .waitForSignal(\u2026) and pass the id string`);
         }
         return {
           node: this.registerStep(arm, where)
@@ -9039,14 +9276,14 @@ var init_workflow = __esm({
         assertNoClosure(mapping, "map()");
         this.recordEnvRefs(mapping);
         this.mapCount += 1;
-        let id = opts?.id;
-        if (id === void 0) {
+        let id2 = opts?.id;
+        if (id2 === void 0) {
           this.unnamedMaps += 1;
-          id = `map_${this.mapCount}`;
+          id2 = `map_${this.mapCount}`;
         }
         const node = {
           type: "mapping",
-          id,
+          id: id2,
           mapConfig: canonicalJson(mapping)
         };
         return this.push({
@@ -9057,12 +9294,12 @@ var init_workflow = __esm({
       sleep(ms, opts) {
         if (typeof ms !== "number" || !Number.isFinite(ms) || ms < 0) throw new LuaWorkflowBuildError("invalid-envelope", "sleep(ms) takes a literal non-negative number");
         this.sleepCount += 1;
-        const id = opts?.id ?? `sleep_${this.sleepCount}`;
+        const id2 = opts?.id ?? `sleep_${this.sleepCount}`;
         return this.push({
           kind: "entry",
           entry: defined({
             type: "sleep",
-            id,
+            id: id2,
             duration: ms,
             businessHours: opts?.businessHours
           })
@@ -9070,13 +9307,13 @@ var init_workflow = __esm({
       }
       sleepUntil(iso, opts) {
         this.sleepCount += 1;
-        const id = opts?.id ?? `sleep_${this.sleepCount}`;
+        const id2 = opts?.id ?? `sleep_${this.sleepCount}`;
         if (typeof iso === "string") {
           return this.push({
             kind: "entry",
             entry: defined({
               type: "sleepUntil",
-              id,
+              id: id2,
               date: iso,
               businessHours: opts?.businessHours,
               round: opts?.round
@@ -9089,7 +9326,7 @@ var init_workflow = __esm({
           kind: "entry",
           entry: {
             type: "mapping",
-            id: `${id}_at`,
+            id: `${id2}_at`,
             mapConfig: canonicalJson({
               date: {
                 template: iso.template
@@ -9101,9 +9338,9 @@ var init_workflow = __esm({
           kind: "entry",
           entry: defined({
             type: "sleepUntil",
-            id,
+            id: id2,
             dateFrom: {
-              step: `${id}_at`,
+              step: `${id2}_at`,
               path: "date"
             },
             businessHours: opts?.businessHours,
@@ -9111,35 +9348,35 @@ var init_workflow = __esm({
           })
         });
       }
-      agentStep(id, opts) {
-        this.assertId(id, "agentStep()");
+      agentStep(id2, opts) {
+        this.assertId(id2, "agentStep()");
         if (!opts || typeof opts.agentId !== "string" && !(opts.agentId && typeof opts.agentId === "object" && "__envRef" in opts.agentId)) {
-          throw new LuaWorkflowBuildError("invalid-envelope", `agentStep("${id}") needs an agentId`);
+          throw new LuaWorkflowBuildError("invalid-envelope", `agentStep("${id2}") needs an agentId`);
         }
         const tier = opts.tier ?? (opts.workspace ? "job" : void 0);
-        if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id}": a step mounting a workspace must be tier:'job'`);
-        if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id}": harness is only legal on a tier:'job' agent step`);
-        if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
+        if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id2}": a step mounting a workspace must be tier:'job'`);
+        if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id2}": harness is only legal on a tier:'job' agent step`);
+        if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id2}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
         for (const m of WORKFLOW_JOB_RANGE_MEMBERS) {
           if (opts[m] === void 0) continue;
-          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": ${m} is only legal on a tier:'job' agent step`);
+          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id2}": ${m} is only legal on a tier:'job' agent step`);
           if (!isWithinWorkflowJobRange(m, opts[m])) {
             const { min, max } = WORKFLOW_JOB_RANGES[m];
-            throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": ${m} must be an integer ${min}..${max}`);
+            throw new LuaWorkflowBuildError("max-turns-invalid", `"${id2}": ${m} must be an integer ${min}..${max}`);
           }
         }
         assertTimeout({
-          id,
+          id: id2,
           timeoutSeconds: opts.timeoutSeconds,
           tier,
           workspace: opts.workspace,
           kind: "agent"
         });
-        assertRetry(opts.retry, id);
+        assertRetry(opts.retry, id2);
         this.recordEnvRefs(opts.agentId, opts.prompt);
         const node = defined({
           type: "agent",
-          id,
+          id: id2,
           agentId: opts.agentId,
           promptTemplate: templateText(opts.prompt),
           outputSchema: schemaToJson(opts.outputSchema),
@@ -9167,30 +9404,30 @@ var init_workflow = __esm({
           node
         });
       }
-      specialistStep(id, opts) {
-        this.assertId(id, "specialistStep()");
+      specialistStep(id2, opts) {
+        this.assertId(id2, "specialistStep()");
         const role = opts?.role;
-        if (!role || typeof role !== "object") throw new LuaWorkflowBuildError("invalid-envelope", `specialistStep("${id}") needs a role`);
+        if (!role || typeof role !== "object") throw new LuaWorkflowBuildError("invalid-envelope", `specialistStep("${id2}") needs a role`);
         if (role.ref !== void 0 && (role.name !== void 0 || role.instructions !== void 0 || role.tools !== void 0)) {
-          throw new LuaWorkflowBuildError("role-ref-and-inline", `"${id}": role is EITHER { ref } OR the inline { name, instructions, tools } shape`);
+          throw new LuaWorkflowBuildError("role-ref-and-inline", `"${id2}": role is EITHER { ref } OR the inline { name, instructions, tools } shape`);
         }
         if (role.ref === void 0) {
           if (typeof role.instructions !== "string" || role.instructions.length > WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS) {
-            throw new LuaWorkflowBuildError("ephemeral-role-too-long", `"${id}": role.instructions must be \u2264 ${WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS} chars`);
+            throw new LuaWorkflowBuildError("ephemeral-role-too-long", `"${id2}": role.instructions must be \u2264 ${WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS} chars`);
           }
-          if (!Array.isArray(role.tools)) throw new LuaWorkflowBuildError("invalid-envelope", `"${id}": role.tools must be an array ([] = no tools)`);
-          if (role.tools.length > 64) throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": role.tools exceeds 64 entries`);
+          if (!Array.isArray(role.tools)) throw new LuaWorkflowBuildError("invalid-envelope", `"${id2}": role.tools must be an array ([] = no tools)`);
+          if (role.tools.length > 64) throw new LuaWorkflowBuildError("cap-exceeded", `"${id2}": role.tools exceeds 64 entries`);
         }
         assertTimeout({
-          id,
+          id: id2,
           timeoutSeconds: opts.timeoutSeconds,
           kind: "agent"
         });
-        assertRetry(opts.retry, id);
+        assertRetry(opts.retry, id2);
         this.recordEnvRefs(opts.prompt);
         const node = defined({
           type: "agent",
-          id,
+          id: id2,
           agentId: "$self",
           role: role.ref !== void 0 ? {
             ref: role.ref
@@ -9213,20 +9450,20 @@ var init_workflow = __esm({
           node
         });
       }
-      toolStep(id, tool, opts = {}) {
-        this.assertId(id, "toolStep()");
-        if (!tool || typeof tool !== "object" || typeof tool.name !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `toolStep("${id}") needs a LuaTool`);
-        assertNoClosure(opts.input, `toolStep("${id}").input`);
+      toolStep(id2, tool, opts = {}) {
+        this.assertId(id2, "toolStep()");
+        if (!tool || typeof tool !== "object" || typeof tool.name !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `toolStep("${id2}") needs a LuaTool`);
+        assertNoClosure(opts.input, `toolStep("${id2}").input`);
         this.recordEnvRefs(opts.input);
         assertTimeout({
-          id,
+          id: id2,
           timeoutSeconds: opts.timeoutSeconds,
           kind: "tool"
         });
-        assertRetry(opts.retry, id);
+        assertRetry(opts.retry, id2);
         const node = defined({
           type: "tool",
-          id,
+          id: id2,
           toolId: tool.name,
           input: opts.input,
           timeoutSeconds: opts.timeoutSeconds,
@@ -9240,34 +9477,34 @@ var init_workflow = __esm({
           node
         });
       }
-      approval(id, opts) {
-        this.assertId(id, "approval()");
-        if (!opts || typeof opts.title !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `approval("${id}") needs a title`);
+      approval(id2, opts) {
+        this.assertId(id2, "approval()");
+        if (!opts || typeof opts.title !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `approval("${id2}") needs a title`);
         if (opts.approver === "creator" && opts.excludeInitiator === true) {
-          throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
+          throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id2}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
         }
         const editable = approvalEditable(opts);
-        if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": \`fourEyes\` requires editable:true`);
+        if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id2}": \`fourEyes\` requires editable:true`);
         if (opts.editable === false && Array.isArray(opts.editablePaths) && opts.editablePaths.length > 0) {
-          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
         } else if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && !editable) {
-          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
         }
         for (const p of opts.editablePaths ?? []) {
-          if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
+          if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
         }
         if (Array.isArray(opts.onTimeout)) {
           const chain = opts.onTimeout;
           const hops = chain.filter((h) => typeof h === "object");
-          if (hops.length > 3) throw new LuaWorkflowBuildError("escalation-chain-too-long", `"${id}": an onTimeout chain carries at most 3 escalation hops`);
+          if (hops.length > 3) throw new LuaWorkflowBuildError("escalation-chain-too-long", `"${id2}": an onTimeout chain carries at most 3 escalation hops`);
           const last = chain[chain.length - 1];
-          if (last === void 0 || typeof last === "object") throw new LuaWorkflowBuildError("escalation-chain-not-terminal", `"${id}": an onTimeout chain must end in a terminal member`);
+          if (last === void 0 || typeof last === "object") throw new LuaWorkflowBuildError("escalation-chain-not-terminal", `"${id2}": an onTimeout chain must end in a terminal member`);
         }
-        if (typeof opts.details === "function") throw new LuaWorkflowBuildError("closure-binding", `approval("${id}").details must be template(...)`);
+        if (typeof opts.details === "function") throw new LuaWorkflowBuildError("closure-binding", `approval("${id2}").details must be template(...)`);
         this.recordEnvRefs(opts.details, opts.timeoutHours, opts.approver);
         const node = defined({
           type: "approval",
-          id,
+          id: id2,
           title: opts.title,
           details: opts.details ? templateText(opts.details) : void 0,
           approver: opts.approver,
@@ -9289,13 +9526,13 @@ var init_workflow = __esm({
           node
         });
       }
-      waitForSignal(id, opts) {
-        this.assertId(id, "waitForSignal()");
-        if (!opts || typeof opts.signal !== "string" || opts.signal.length === 0) throw new LuaWorkflowBuildError("invalid-envelope", `waitForSignal("${id}") needs a signal name`);
+      waitForSignal(id2, opts) {
+        this.assertId(id2, "waitForSignal()");
+        if (!opts || typeof opts.signal !== "string" || opts.signal.length === 0) throw new LuaWorkflowBuildError("invalid-envelope", `waitForSignal("${id2}") needs a signal name`);
         this.recordEnvRefs(opts.timeoutHours);
         const node = defined({
           type: "waitForSignal",
-          id,
+          id: id2,
           signal: opts.signal,
           schema: schemaToJson(opts.schema),
           timeoutHours: opts.timeoutHours,
@@ -9308,28 +9545,28 @@ var init_workflow = __esm({
           node
         });
       }
-      workflow(id, ref, input, opts) {
-        this.assertId(id, "workflow()");
-        assertRetry(opts?.retry, id);
+      workflow(id2, ref, input, opts) {
+        this.assertId(id2, "workflow()");
+        assertRetry(opts?.retry, id2);
         const name = typeof ref === "string" ? ref : ref instanceof LuaWorkflow ? ref.getName() : void 0;
-        if (!name) throw new LuaWorkflowBuildError("invalid-envelope", `workflow("${id}") needs a LuaWorkflow or a workflow name`);
+        if (!name) throw new LuaWorkflowBuildError("invalid-envelope", `workflow("${id2}") needs a LuaWorkflow or a workflow name`);
         if (opts?.workspace === "inherit") {
-          if (!this.config.workspace) throw new LuaWorkflowBuildError("workspace-inherit-without-parent-workspace", `"${id}": workspace:'inherit' but the parent createWorkflow declares no workspace`);
-          if (ref instanceof LuaWorkflow && ref.getConfig().workspace) throw new LuaWorkflowBuildError("workspace-inherit-conflict", `"${id}": workspace:'inherit' on a workflow that declares its own workspace`);
+          if (!this.config.workspace) throw new LuaWorkflowBuildError("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent createWorkflow declares no workspace`);
+          if (ref instanceof LuaWorkflow && ref.getConfig().workspace) throw new LuaWorkflowBuildError("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on a workflow that declares its own workspace`);
         }
-        assertNoClosure(input, `workflow("${id}").input`);
+        assertNoClosure(input, `workflow("${id2}").input`);
         this.recordEnvRefs(input);
         this.nestedRefs.push(opts?.workspace === "inherit" ? {
-          id,
+          id: id2,
           name,
           workspace: "inherit"
         } : {
-          id,
+          id: id2,
           name
         });
         const node = defined({
           type: "workflow",
-          id,
+          id: id2,
           workflowId: name,
           input,
           workspace: opts?.workspace,
@@ -9408,8 +9645,8 @@ var init_workflow = __esm({
           });
         }
       }
-      assertId(id, where) {
-        if (typeof id !== "string" || !STEP_ID_RE.test(id)) throw new LuaWorkflowBuildError("invalid-step-id", `${where}: id "${String(id)}" must match ${STEP_ID_RE}`);
+      assertId(id2, where) {
+        if (typeof id2 !== "string" || !STEP_ID_RE.test(id2)) throw new LuaWorkflowBuildError("invalid-step-id", `${where}: id "${String(id2)}" must match ${STEP_ID_RE}`);
       }
     };
     EDITABLE_PATH_RE2 = /^[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?(\.[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?)*$/;
@@ -9587,7 +9824,7 @@ var init_lua_fetch = __esm({
 });
 
 // src/services/firebase-session.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function rejectedRefreshReason(message) {
   const normalised = message.toUpperCase();
   return REJECTED_REFRESH_REASONS.find((reason) => normalised.includes(reason));
@@ -9733,20 +9970,20 @@ var init_firebase_session = __esm({
         this.name = "FirebaseSessionRejectedError";
       }
     };
-    customTokenResponseSchema = z5.object({
-      idToken: z5.string().min(1),
-      refreshToken: z5.string().min(1),
-      expiresIn: z5.coerce.number().positive().finite(),
-      localId: z5.string().min(1).optional()
+    customTokenResponseSchema = z6.object({
+      idToken: z6.string().min(1),
+      refreshToken: z6.string().min(1),
+      expiresIn: z6.coerce.number().positive().finite(),
+      localId: z6.string().min(1).optional()
     });
-    refreshResponseSchema = z5.object({
-      id_token: z5.string().min(1),
-      refresh_token: z5.string().min(1),
-      expires_in: z5.coerce.number().positive().finite(),
-      user_id: z5.string().min(1)
+    refreshResponseSchema = z6.object({
+      id_token: z6.string().min(1),
+      refresh_token: z6.string().min(1),
+      expires_in: z6.coerce.number().positive().finite(),
+      user_id: z6.string().min(1)
     });
-    firebaseIdTokenPayloadSchema = z5.object({
-      sub: z5.string().min(1)
+    firebaseIdTokenPayloadSchema = z6.object({
+      sub: z6.string().min(1)
     });
     __name(requireFirebaseWebApiKey, "requireFirebaseWebApiKey");
     __name(claimsOfFirebaseIdToken, "claimsOfFirebaseIdToken");
@@ -9763,7 +10000,7 @@ var init_firebase_session = __esm({
 import { createHash as createHash3, randomUUID } from "crypto";
 import { mkdir, open, readFile, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { join as join3 } from "path";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function environmentKey(environment) {
   return createHash3("sha256").update(`${environment.apiUrl}
 ${environment.authUrl}
@@ -9780,15 +10017,15 @@ var init_firebase_session_store = __esm({
   "src/services/firebase-session-store.ts"() {
     "use strict";
     init_constants();
-    storedFirebaseSessionSchema = z6.object({
-      version: z6.literal(1),
-      kind: z6.literal("firebase-session"),
-      generation: z6.string().min(1),
-      refreshToken: z6.string().min(1),
-      firebaseUid: z6.string().min(1),
-      apiUrl: z6.string().url(),
-      authUrl: z6.string().url(),
-      firebaseWebApiKey: z6.string().min(1)
+    storedFirebaseSessionSchema = z7.object({
+      version: z7.literal(1),
+      kind: z7.literal("firebase-session"),
+      generation: z7.string().min(1),
+      refreshToken: z7.string().min(1),
+      firebaseUid: z7.string().min(1),
+      apiUrl: z7.string().url(),
+      authUrl: z7.string().url(),
+      firebaseWebApiKey: z7.string().min(1)
     });
     currentFirebaseSessionEnvironment = /* @__PURE__ */ __name(() => ({
       apiUrl: BASE_URLS.API,
@@ -10459,7 +10696,7 @@ async function* parseSseStream(body, signal) {
   const decoder = new TextDecoder();
   let buffer = "";
   const flush = /* @__PURE__ */ __name((block) => {
-    let id;
+    let id2;
     let event = "message";
     const data = [];
     for (const rawLine of block.split("\n")) {
@@ -10469,11 +10706,11 @@ async function* parseSseStream(body, signal) {
       const field = colon === -1 ? line : line.slice(0, colon);
       let value3 = colon === -1 ? "" : line.slice(colon + 1);
       if (value3.startsWith(" ")) value3 = value3.slice(1);
-      if (field === "id") id = value3;
+      if (field === "id") id2 = value3;
       else if (field === "event") event = value3;
       else if (field === "data") data.push(value3);
     }
-    if (data.length === 0 && id === void 0 && event === "message") return void 0;
+    if (data.length === 0 && id2 === void 0 && event === "message") return void 0;
     const joined = data.join("\n");
     let parsed = joined;
     try {
@@ -10482,7 +10719,7 @@ async function* parseSseStream(body, signal) {
       parsed = joined;
     }
     return {
-      id,
+      id: id2,
       event,
       data: parsed
     };
@@ -11874,11 +12111,17 @@ var init_base_handler = __esm({
       /**
       * Phase 2 of parallel sync: apply fetched data to YAML.
       * Optionally creates missing primitives on server if apiKey+agentId provided.
+      *
+      * PRO-2150 — `apiCredentials.registerOnly` drops the two writes that overwrite what the developer
+      * pinned (the server-only orphan stubs in Part 1, and the version reconciliation half of Part 2)
+      * while keeping id linking and create-on-server. `lua chat` uses it: it needs the skills'/processors'
+      * server ids to exist before the sandbox push, and nothing else.
       */
       async applySyncToYaml(serverData, config, manifest, apiCredentials) {
         const messages = [];
         let yamlUpdated = false;
         let orphanedCount = 0;
+        const registerOnly = apiCredentials?.registerOnly === true;
         try {
           if (!serverData.serverItems) {
             if (serverData.fetchError) {
@@ -11906,10 +12149,10 @@ var init_base_handler = __esm({
             messages.push(msg);
             console.log(msg);
           }
-          const orphans = serverData.serverItems.filter((item) => {
-            const id = item.id;
+          const orphans = registerOnly ? [] : serverData.serverItems.filter((item) => {
+            const id2 = item.id;
             const name = item.name;
-            return !yamlById.has(id) && !yamlByName.has(name) && this.isActive(item) && this.shouldConsiderForOrphan(item);
+            return !yamlById.has(id2) && !yamlByName.has(name) && this.isActive(item) && this.shouldConsiderForOrphan(item);
           });
           if (orphans.length > 0) {
             const stubs = orphans.map((item) => this.cleanItem({
@@ -11933,7 +12176,9 @@ var init_base_handler = __esm({
 `);
             orphanedCount = orphans.length;
           }
-          const { items: updatedItems, changed, msgs } = this.syncFromServer(yamlItems, serverByName);
+          const { items: updatedItems, changed, msgs } = this.syncFromServer(yamlItems, serverByName, {
+            syncVersions: !registerOnly
+          });
           messages.push(...msgs);
           if (changed) {
             yamlUpdated = true;
@@ -12125,7 +12370,7 @@ var init_base_handler = __esm({
         const result = /* @__PURE__ */ new Map();
         const { serverItems } = await this.fetchServerState(apiKey, agentId);
         if (!serverItems) {
-          entityIds.forEach((id) => result.set(id, null));
+          entityIds.forEach((id2) => result.set(id2, null));
           return result;
         }
         for (const entityId of entityIds) {
@@ -12159,8 +12404,8 @@ var init_base_handler = __esm({
         const yamlById = /* @__PURE__ */ new Map();
         const yamlByName = /* @__PURE__ */ new Map();
         for (const item of yamlItems) {
-          const id = this.getItemId(item);
-          if (id) yamlById.set(id, item);
+          const id2 = this.getItemId(item);
+          if (id2) yamlById.set(id2, item);
           yamlByName.set(item.name, item);
         }
         const serverByName = /* @__PURE__ */ new Map();
@@ -12176,7 +12421,8 @@ var init_base_handler = __esm({
       /**
       * For each YAML item, match to server by name, populate missing IDs, update versions.
       */
-      syncFromServer(yamlItems, serverByName) {
+      syncFromServer(yamlItems, serverByName, options) {
+        const syncVersions = options?.syncVersions !== false;
         const msgs = [];
         let changed = false;
         const idField = this.yamlConfig.idField;
@@ -12197,7 +12443,7 @@ var init_base_handler = __esm({
             };
           }
           const versions = serverItem.versions;
-          if (Array.isArray(versions) && versions.length > 0) {
+          if (syncVersions && Array.isArray(versions) && versions.length > 0) {
             const activeVersion = this.getActiveVersion(serverItem);
             const currentVersion = item.version;
             if (activeVersion && activeVersion !== currentVersion) {
@@ -16022,7 +16268,7 @@ var init_workflow_api_service = __esm({
         throw new WorkflowApiError("FORBIDDEN", `Workflows.${member}: goals are scoped to the bound agent ${api.agentId}`, 403);
       }
     }, "assertBoundAgent");
-    pathId = /* @__PURE__ */ __name((id) => encodeURIComponent(id), "pathId");
+    pathId = /* @__PURE__ */ __name((id2) => encodeURIComponent(id2), "pathId");
     unavailable = /* @__PURE__ */ __name((member, route) => async () => {
       throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route} lands with a later wave)`, 501);
     }, "unavailable");
@@ -17732,9 +17978,9 @@ var Products = {
   * @param id - Product ID
   * @returns Promise resolving when deletion is complete
   */
-  async delete(id) {
+  async delete(id2) {
     const instance = await getProductsInstance();
-    return instance.delete(id);
+    return instance.delete(id2);
   },
   /**
   * Searches products by query string.
@@ -17752,9 +17998,9 @@ var Products = {
   * @param id - Product ID
   * @returns Promise resolving to product data
   */
-  async getById(id) {
+  async getById(id2) {
     const instance = await getProductsInstance();
-    return instance.getById(id);
+    return instance.getById(id2);
   }
 };
 var Baskets = {