lua-cli 3.39.0 → 3.39.1

package/dist/index.js

@@ -840,6 +840,7 @@ var init_package_root = __esm({
 import { z } from "zod";
 import { z as z2 } from "zod";
 import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 function isChannelConversationChannel(channel) {
   return !!channel && CHANNEL_CONVERSATION_CHANNELS.includes(channel);
 }
@@ -936,9 +937,9 @@ function isMcpDraftCreateTool(tool) {
 function mcpSendSiblingForDraftTool(tool, availableToolIds) {
   const candidates = [
     ...availableToolIds
-  ].filter((id) => id.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id) => ({
-    id,
-    serverName: id.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
+  ].filter((id2) => id2.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id2) => ({
+    id: id2,
+    serverName: id2.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
   })).filter(({ serverName }) => tool.startsWith(`${serverName}_`)).sort((a, b) => b.serverName.length - a.serverName.length);
   return candidates[0]?.id;
 }
@@ -1099,8 +1100,8 @@ function transformChatHistoryContentParts(parts) {
   }
   return content;
 }
-function isSyntheticSideRow(id) {
-  return id.startsWith(SCREENSHOT_MESSAGE_ID_PREFIX) || id.startsWith(RICH_PARTS_MESSAGE_ID_PREFIX);
+function isSyntheticSideRow(id2) {
+  return id2.startsWith(SCREENSHOT_MESSAGE_ID_PREFIX) || id2.startsWith(RICH_PARTS_MESSAGE_ID_PREFIX);
 }
 function mergeRichPartMirrorMessages(messages, sameTurnGroup) {
   const merged = [];
@@ -1420,12 +1421,12 @@ function isWorkflowArmEntryType(type) {
 function workflowContainerRunsHitlArm(container) {
   return typeof container === "string" && WORKFLOW_HITL_ARM_CONTAINERS.includes(container);
 }
-function workflowHitlArmUnsupportedMessage(type, id, container) {
+function workflowHitlArmUnsupportedMessage(type, id2, container) {
   const legal = WORKFLOW_HITL_ARM_CONTAINERS.map((c) => `\`${c}\``).join(" / ");
-  return `the engine does not run \`${type}\` inside a \`${container}\` yet (node "${id}") \u2014 place it at the top level, as a ${legal} arm, or inside a child \`workflow\``;
+  return `the engine does not run \`${type}\` inside a \`${container}\` yet (node "${id2}") \u2014 place it at the top level, as a ${legal} arm, or inside a child \`workflow\``;
 }
-function workflowHitlArmShapeMessage(type, id, shape) {
-  return shape === "mapped-arm" ? `\`${type}\` arm "${id}" takes the previous output as its payload \u2014 it cannot head a [mapping, step] chain; map before the container instead` : `a chunked foreach hands each child a slice of items, not one \u2014 \`${type}\` body "${id}" takes one item; drop \`chunk\``;
+function workflowHitlArmShapeMessage(type, id2, shape) {
+  return shape === "mapped-arm" ? `\`${type}\` arm "${id2}" takes the previous output as its payload \u2014 it cannot head a [mapping, step] chain; map before the container instead` : `a chunked foreach hands each child a slice of items, not one \u2014 \`${type}\` body "${id2}" takes one item; drop \`chunk\``;
 }
 function isModelIdSentinel(input) {
   const lower = (input ?? "").trim().toLowerCase();
@@ -2103,12 +2104,12 @@ function decodeLogCursor(raw) {
     return null;
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  const { t, id } = parsed;
+  const { t, id: id2 } = parsed;
   if (typeof t !== "number" || !Number.isSafeInteger(t) || t < 0) return null;
-  if (typeof id !== "string" || !id || id.length > LOG_CURSOR_MAX_ID_LENGTH) return null;
+  if (typeof id2 !== "string" || !id2 || id2.length > LOG_CURSOR_MAX_ID_LENGTH) return null;
   return {
     t,
-    id
+    id: id2
   };
 }
 function parseLogTimeBound(raw, now = /* @__PURE__ */ new Date()) {
@@ -2346,62 +2347,62 @@ function isKnownProfile(profiles, profileId) {
 function hasCapability(profiles, profileId, required) {
   return capabilitiesFor(profiles, profileId).includes(required);
 }
-function workflowJobId(id) {
-  switch (id.kind) {
+function workflowJobId(id2) {
+  switch (id2.kind) {
     case "start":
-      return `wft_${id.runId}_0`;
+      return `wft_${id2.runId}_0`;
     case "start-redrive":
-      return `wft_${id.runId}_start_r${id.now}`;
+      return `wft_${id2.runId}_start_r${id2.now}`;
     case "tick":
-      return `wft_${id.runId}_${id.seq}`;
+      return `wft_${id2.runId}_${id2.seq}`;
     case "timer":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}`;
     case "timer-remainder":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "timer-deferral":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_d${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_d${id2.now}`;
     case "timer-sibling":
-      return `wft_${id.runId}_timer_${id.stepId}_${id.attempt}_w${id.now}`;
+      return `wft_${id2.runId}_timer_${id2.stepId}_${id2.attempt}_w${id2.now}`;
     case "retry":
-      return `wft_${id.runId}_retry_${id.stepId}_${id.attempt}`;
+      return `wft_${id2.runId}_retry_${id2.stepId}_${id2.attempt}`;
     case "respawn":
-      return `wft_${id.runId}_respawn_${id.stepId}_${id.attempt}_s${id.segment}_r${id.now}`;
+      return `wft_${id2.runId}_respawn_${id2.stepId}_${id2.attempt}_s${id2.segment}_r${id2.now}`;
     case "redrive":
-      return `wft_${id.runId}_redrive_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_redrive_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "redispatch":
-      return `wft_${id.runId}_redispatch_${id.stepId}_${id.attempt}_x${id.executionId ?? "none"}_r${id.now}`;
+      return `wft_${id2.runId}_redispatch_${id2.stepId}_${id2.attempt}_x${id2.executionId ?? "none"}_r${id2.now}`;
     case "expiry":
-      return `wft_${id.runId}_expire_${id.stepId}_${id.attempt}_t${id.suspendedAt}${id.hop > 0 ? `_h${id.hop}` : ""}`;
+      return `wft_${id2.runId}_expire_${id2.stepId}_${id2.attempt}_t${id2.suspendedAt}${id2.hop > 0 ? `_h${id2.hop}` : ""}`;
     case "step-terminal":
-      return `wft_${id.runId}_term_${id.stepId}_${id.attempt}_r${id.now}`;
+      return `wft_${id2.runId}_term_${id2.stepId}_${id2.attempt}_r${id2.now}`;
     case "handback":
-      return `wft_${id.runId}_handback_${id.stepId}_${id.attempt}_${id.now}`;
+      return `wft_${id2.runId}_handback_${id2.stepId}_${id2.attempt}_${id2.now}`;
     case "foreach-rate":
-      return `wft_${id.runId}_fe_${id.stepId}_${id.attempt}_${id.bucket}`;
+      return `wft_${id2.runId}_fe_${id2.stepId}_${id2.attempt}_${id2.bucket}`;
     case "budget-expiry":
-      return `wft_${id.runId}_expiry_budget_r${id.now}`;
+      return `wft_${id2.runId}_expiry_budget_r${id2.now}`;
     case "budget-resume":
-      return `wft_${id.runId}_resume_budget_${id.now}`;
+      return `wft_${id2.runId}_resume_budget_${id2.now}`;
     case "deadline":
-      return `wft_${id.runId}_deadline_${id.deadlineAt}`;
+      return `wft_${id2.runId}_deadline_${id2.deadlineAt}`;
     case "deadline-remainder":
-      return `wft_${id.runId}_deadline_${id.deadlineAt}_r${id.now}`;
+      return `wft_${id2.runId}_deadline_${id2.deadlineAt}_r${id2.now}`;
     case "readmit":
-      return `wft_${id.runId}_readmit_${id.now}`;
+      return `wft_${id2.runId}_readmit_${id2.now}`;
     case "cancel":
-      return `wft_${id.runId}_cancel`;
+      return `wft_${id2.runId}_cancel`;
     case "reconcile":
-      return `wft_${id.runId}_reconcile_${id.now}`;
+      return `wft_${id2.runId}_reconcile_${id2.now}`;
     case "replay":
-      return `wft_${id.runId}_replay_g${id.leaseGeneration}`;
+      return `wft_${id2.runId}_replay_g${id2.leaseGeneration}`;
     case "migration":
-      return `wfm_${id.migrationId}`;
+      return `wfm_${id2.migrationId}`;
     default:
-      return assertNever(id);
+      return assertNever(id2);
   }
 }
-function assertNever(id) {
-  throw new Error(`workflowJobId: unknown wake kind ${JSON.stringify(id)}`);
+function assertNever(id2) {
+  throw new Error(`workflowJobId: unknown wake kind ${JSON.stringify(id2)}`);
 }
 function agentStepJobId(msg) {
   return `${msg.runId}_${msg.stepId}_${msg.attempt}_x${msg.executionId}`;
@@ -2439,11 +2440,11 @@ function isArchiveWindowTooOld(run, retentionDays, now = Date.now(), marginDays
 function workflowOrgPurgingKey(orgId) {
   return `wf:org:${orgId}:purging`;
 }
-function isCloudTaskRunId(id) {
-  return id.startsWith(CLOUD_TASK_RUN_ID_PREFIX);
+function isCloudTaskRunId(id2) {
+  return id2.startsWith(CLOUD_TASK_RUN_ID_PREFIX);
 }
-function isScheduledWorkflowRunId(id) {
-  return id.startsWith(WORKFLOW_SCHEDULED_RUN_ID_PREFIX);
+function isScheduledWorkflowRunId(id2) {
+  return id2.startsWith(WORKFLOW_SCHEDULED_RUN_ID_PREFIX);
 }
 function scheduledWorkflowRunId(jobId, scheduledTime) {
   const key = typeof scheduledTime === "number" ? String(scheduledTime) : scheduledTimeKey(scheduledTime);
@@ -2804,7 +2805,13 @@ function effectiveAgentFeatures(base, override, rule) {
   if (rule === "wholesale") return override || base || void 0;
   return effectiveAgentFeatureRows(base, override).rows;
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES;
+function parseOnboardingFlow(value3) {
+  return onboardingFlowSchema.parse(value3);
+}
+function parsePublishedOnboardingResponse(value3) {
+  return getPublishedOnboardingResponseSchema.parse(value3);
+}
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -5071,6 +5078,236 @@ listed here; never invent a target.`;
     __name2(agentFeatureMergeRuleFromEnv, "agentFeatureMergeRuleFromEnv");
     __name(effectiveAgentFeatures, "effectiveAgentFeatures");
     __name2(effectiveAgentFeatures, "effectiveAgentFeatures");
+    ONBOARDING_FLOW_KEY = "alpha-choose-meet";
+    ONBOARDING_SCHEMA_VERSION = 1;
+    id = z4.string().min(1).max(80).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/);
+    copy = /* @__PURE__ */ __name2((max) => z4.string().max(max), "copy");
+    onboardingHeadingSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("plain"),
+        text: copy(240)
+      }).strict(),
+      z4.object({
+        kind: z4.literal("highlighted"),
+        before: copy(240),
+        highlight: copy(240),
+        after: copy(240)
+      }).strict()
+    ]);
+    onboardingRichTextInlineSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("text"),
+        text: copy(2e3),
+        marks: z4.array(z4.enum([
+          "bold",
+          "italic"
+        ])).max(2).refine((marks) => new Set(marks).size === marks.length, "Text marks must be unique").optional()
+      }).strict(),
+      z4.object({
+        kind: z4.literal("lineBreak")
+      }).strict()
+    ]);
+    onboardingRichTextSchema = z4.object({
+      blocks: z4.array(z4.object({
+        kind: z4.literal("paragraph"),
+        content: z4.array(onboardingRichTextInlineSchema).max(100)
+      }).strict()).max(40)
+    }).strict();
+    onboardingDestinationSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("question"),
+        questionId: id
+      }).strict(),
+      z4.object({
+        kind: z4.literal("template"),
+        templateContentId: id
+      }).strict(),
+      z4.object({
+        kind: z4.literal("unavailable"),
+        unavailableId: id
+      }).strict()
+    ]);
+    onboardingArtworkSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("builtinRing")
+      }).strict(),
+      z4.object({
+        kind: z4.literal("uploaded"),
+        assetId: id,
+        accessibility: z4.discriminatedUnion("kind", [
+          z4.object({
+            kind: z4.literal("decorative")
+          }).strict(),
+          z4.object({
+            kind: z4.literal("described"),
+            altText: copy(500)
+          }).strict()
+        ])
+      }).strict()
+    ]);
+    onboardingAnswerSchema = z4.object({
+      id,
+      label: copy(160),
+      supportingText: copy(500).optional(),
+      destination: onboardingDestinationSchema.nullable()
+    }).strict();
+    onboardingQuestionSchema = z4.object({
+      id,
+      heading: onboardingHeadingSchema,
+      helperText: onboardingRichTextSchema.optional(),
+      continueButtonLabel: copy(80),
+      answers: z4.array(onboardingAnswerSchema).max(30)
+    }).strict();
+    onboardingTemplateSectionSchema = z4.object({
+      id,
+      label: copy(100),
+      body: onboardingRichTextSchema
+    }).strict();
+    onboardingTemplateContentSchema = z4.object({
+      id,
+      templateId: copy(160),
+      displayName: copy(100),
+      eyebrow: copy(100).optional(),
+      heading: onboardingHeadingSchema,
+      description: onboardingRichTextSchema,
+      badges: z4.array(copy(80)).max(12),
+      sections: z4.array(onboardingTemplateSectionSchema).max(20),
+      artwork: onboardingArtworkSchema,
+      hireButtonLabel: copy(80),
+      changeRoleButtonLabel: copy(80),
+      nextStepText: onboardingRichTextSchema
+    }).strict();
+    onboardingUnavailableOutcomeSchema = z4.object({
+      id,
+      heading: onboardingHeadingSchema,
+      explanation: onboardingRichTextSchema,
+      backButtonLabel: copy(80),
+      alternative: z4.object({
+        templateContentId: id,
+        introduction: onboardingRichTextSchema,
+        buttonLabel: copy(80)
+      }).strict().optional()
+    }).strict();
+    onboardingFlowSchema = z4.object({
+      key: z4.literal(ONBOARDING_FLOW_KEY),
+      schemaVersion: z4.literal(ONBOARDING_SCHEMA_VERSION),
+      entryQuestionId: id.nullable(),
+      questions: z4.array(onboardingQuestionSchema).max(100),
+      templateContents: z4.array(onboardingTemplateContentSchema).max(100),
+      unavailableOutcomes: z4.array(onboardingUnavailableOutcomeSchema).max(100)
+    }).strict();
+    onboardingActorSchema = z4.object({
+      subjectId: z4.string(),
+      email: z4.string().email()
+    }).strict();
+    onboardingEditorSchema = onboardingActorSchema.extend({
+      editedAt: z4.string().datetime({
+        offset: true
+      })
+    }).strict();
+    onboardingPublicationSummarySchema = z4.object({
+      publicationId: id,
+      revision: z4.number().int().positive(),
+      sourceDraftVersion: z4.number().int().nonnegative(),
+      contentHash: z4.string().regex(/^[a-f0-9]{64}$/),
+      publishedAt: z4.string().datetime({
+        offset: true
+      }),
+      publishedBy: onboardingActorSchema,
+      questionCount: z4.number().int().nonnegative(),
+      templateCount: z4.number().int().nonnegative(),
+      unavailableCount: z4.number().int().nonnegative()
+    }).strict();
+    onboardingValidationIssueSchema = z4.object({
+      code: z4.string(),
+      path: z4.string(),
+      message: z4.string()
+    }).strict();
+    onboardingValidationResponseSchema = z4.discriminatedUnion("valid", [
+      z4.object({
+        valid: z4.literal(true),
+        summary: z4.object({
+          questionCount: z4.number().int().nonnegative(),
+          templateCount: z4.number().int().nonnegative(),
+          unavailableCount: z4.number().int().nonnegative()
+        }).strict()
+      }).strict(),
+      z4.object({
+        valid: z4.literal(false),
+        issues: z4.array(onboardingValidationIssueSchema)
+      }).strict()
+    ]);
+    onboardingAssetSchema = z4.object({
+      assetId: id,
+      url: z4.string().url(),
+      width: z4.number().int().positive(),
+      height: z4.number().int().positive(),
+      contentType: z4.enum([
+        "image/png",
+        "image/jpeg",
+        "image/webp"
+      ]),
+      bytes: z4.number().int().positive(),
+      sha256: z4.string().regex(/^[a-f0-9]{64}$/),
+      createdAt: z4.string().datetime({
+        offset: true
+      }),
+      uploadedBy: onboardingActorSchema
+    }).strict();
+    onboardingPublicAssetSchema = onboardingAssetSchema.pick({
+      assetId: true,
+      url: true,
+      width: true,
+      height: true,
+      contentType: true
+    }).strict();
+    getOnboardingConfigResponseSchema = z4.object({
+      flowKey: z4.literal(ONBOARDING_FLOW_KEY),
+      draftVersion: z4.number().int().nonnegative(),
+      draft: onboardingFlowSchema,
+      assets: z4.array(onboardingAssetSchema),
+      lastEditor: onboardingEditorSchema.nullable(),
+      activePublication: onboardingPublicationSummarySchema.nullable()
+    }).strict();
+    saveOnboardingDraftRequestSchema = z4.object({
+      expectedDraftVersion: z4.number().int().nonnegative(),
+      draft: onboardingFlowSchema
+    }).strict();
+    validateOnboardingRequestSchema = z4.object({
+      draft: onboardingFlowSchema
+    }).strict();
+    publishOnboardingRequestSchema = z4.object({
+      expectedDraftVersion: z4.number().int().nonnegative(),
+      expectedActivePublicationId: id.nullable()
+    }).strict();
+    rollbackOnboardingRequestSchema = z4.object({
+      publicationId: id,
+      expectedActivePublicationId: id.nullable()
+    }).strict();
+    onboardingTemplateCatalogItemSchema = z4.object({
+      templateId: z4.string(),
+      name: z4.string(),
+      description: z4.string().optional()
+    }).strict();
+    getPublishedOnboardingResponseSchema = z4.discriminatedUnion("status", [
+      z4.object({
+        status: z4.literal("available"),
+        publicationId: id,
+        revision: z4.number().int().positive(),
+        contentHash: z4.string().regex(/^[a-f0-9]{64}$/),
+        flow: onboardingFlowSchema,
+        assets: z4.array(onboardingPublicAssetSchema)
+      }).strict(),
+      z4.object({
+        status: z4.literal("unavailable"),
+        reason: z4.literal("not_published"),
+        message: z4.string()
+      }).strict()
+    ]);
+    __name(parseOnboardingFlow, "parseOnboardingFlow");
+    __name2(parseOnboardingFlow, "parseOnboardingFlow");
+    __name(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
+    __name2(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
   }
 });
 
@@ -5111,7 +5348,7 @@ var init_lua_fetch = __esm({
 });
 
 // src/services/firebase-session.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 function rejectedRefreshReason(message) {
   const normalised = message.toUpperCase();
   return REJECTED_REFRESH_REASONS.find((reason) => normalised.includes(reason));
@@ -5257,20 +5494,20 @@ var init_firebase_session = __esm({
         this.name = "FirebaseSessionRejectedError";
       }
     };
-    customTokenResponseSchema = z4.object({
-      idToken: z4.string().min(1),
-      refreshToken: z4.string().min(1),
-      expiresIn: z4.coerce.number().positive().finite(),
-      localId: z4.string().min(1).optional()
+    customTokenResponseSchema = z5.object({
+      idToken: z5.string().min(1),
+      refreshToken: z5.string().min(1),
+      expiresIn: z5.coerce.number().positive().finite(),
+      localId: z5.string().min(1).optional()
     });
-    refreshResponseSchema = z4.object({
-      id_token: z4.string().min(1),
-      refresh_token: z4.string().min(1),
-      expires_in: z4.coerce.number().positive().finite(),
-      user_id: z4.string().min(1)
+    refreshResponseSchema = z5.object({
+      id_token: z5.string().min(1),
+      refresh_token: z5.string().min(1),
+      expires_in: z5.coerce.number().positive().finite(),
+      user_id: z5.string().min(1)
     });
-    firebaseIdTokenPayloadSchema = z4.object({
-      sub: z4.string().min(1)
+    firebaseIdTokenPayloadSchema = z5.object({
+      sub: z5.string().min(1)
     });
     __name(requireFirebaseWebApiKey, "requireFirebaseWebApiKey");
     __name(claimsOfFirebaseIdToken, "claimsOfFirebaseIdToken");
@@ -5287,7 +5524,7 @@ var init_firebase_session = __esm({
 import { createHash, randomUUID } from "crypto";
 import { mkdir, open, readFile, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { join as join3 } from "path";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function environmentKey(environment) {
   return createHash("sha256").update(`${environment.apiUrl}
 ${environment.authUrl}
@@ -5304,15 +5541,15 @@ var init_firebase_session_store = __esm({
   "src/services/firebase-session-store.ts"() {
     "use strict";
     init_constants();
-    storedFirebaseSessionSchema = z5.object({
-      version: z5.literal(1),
-      kind: z5.literal("firebase-session"),
-      generation: z5.string().min(1),
-      refreshToken: z5.string().min(1),
-      firebaseUid: z5.string().min(1),
-      apiUrl: z5.string().url(),
-      authUrl: z5.string().url(),
-      firebaseWebApiKey: z5.string().min(1)
+    storedFirebaseSessionSchema = z6.object({
+      version: z6.literal(1),
+      kind: z6.literal("firebase-session"),
+      generation: z6.string().min(1),
+      refreshToken: z6.string().min(1),
+      firebaseUid: z6.string().min(1),
+      apiUrl: z6.string().url(),
+      authUrl: z6.string().url(),
+      firebaseWebApiKey: z6.string().min(1)
     });
     currentFirebaseSessionEnvironment = /* @__PURE__ */ __name(() => ({
       apiUrl: BASE_URLS.API,
@@ -5679,9 +5916,9 @@ var init_request_credential = __esm({
 function effectiveJobTools(jobTools, readOnly) {
   const base = jobTools?.length ? jobTools : WORKFLOW_JOB_DEFAULT_TOOLS;
   const out = [];
-  for (const id of base) {
-    if (readOnly && WORKFLOW_JOB_READ_ONLY_DROPPED.includes(id)) continue;
-    if (!out.includes(id)) out.push(id);
+  for (const id2 of base) {
+    if (readOnly && WORKFLOW_JOB_READ_ONLY_DROPPED.includes(id2)) continue;
+    if (!out.includes(id2)) out.push(id2);
   }
   return out;
 }
@@ -5725,7 +5962,7 @@ var init_workflow_job_tools = __esm({
 
 // ../workflow-graph/dist/index.mjs
 import { createHash as createHash2 } from "crypto";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 import { z as z22 } from "zod";
 import { createHash as createHash22 } from "crypto";
 function isMapConfigObject(v) {
@@ -5852,9 +6089,9 @@ function malformedMapMembers(cfg) {
   }
   return out;
 }
-function mapMemberMalformedMessage(id, m) {
+function mapMemberMalformedMessage(id2, m) {
   const keys = m.keys.map((k) => `\`${k}\``).join(", ");
-  return `"${id}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
+  return `"${id2}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
 }
 function resolveDescriptor(key, m, ctx) {
   if (!isMapDescriptor(m)) return {
@@ -6208,11 +6445,11 @@ function retryBackoffs() {
   }
   return WORKFLOW_RETRY_BACKOFFS;
 }
-function sleepUntilUnsupportedMessage(id) {
-  return `the engine does not execute \`sleepUntil\` yet (node "${id}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
+function sleepUntilUnsupportedMessage(id2) {
+  return `the engine does not execute \`sleepUntil\` yet (node "${id2}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id2}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
 }
-function armSubrunUnsupportedMessage(id, workflowId) {
-  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
+function armSubrunUnsupportedMessage(id2, workflowId) {
+  return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id2}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
 }
 function fillPolicy(node, defaultTimeout) {
   if (node.tier === void 0 && node.workspace !== void 0 && node.workspace !== "inherit") node.tier = "job";
@@ -6472,20 +6709,20 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
-  const checkId = /* @__PURE__ */ __name4((id, path26) => {
+  const checkId = /* @__PURE__ */ __name4((id2, path26) => {
     nodeCount += 1;
-    if (seen.has(id)) {
-      err("duplicate-step-id", `step id "${id}" is declared twice (first at ${seen.get(id)})`, path26, id);
+    if (seen.has(id2)) {
+      err("duplicate-step-id", `step id "${id2}" is declared twice (first at ${seen.get(id2)})`, path26, id2);
     } else {
-      seen.set(id, path26);
+      seen.set(id2, path26);
     }
   }, "checkId");
   const checkPolicyEnums = /* @__PURE__ */ __name4((node, path26) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     const check = /* @__PURE__ */ __name4((member, allowed) => {
       const value22 = node[member];
       if (value22 === void 0 || typeof value22 === "string" && allowed.includes(value22)) return;
-      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path26}.${member}`, id);
+      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path26}.${member}`, id2);
     }, "check");
     check("sideEffects", WORKFLOW_SIDE_EFFECTS);
     check("jobResources", WORKFLOW_JOB_RESOURCES);
@@ -6493,46 +6730,46 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const checkRetry = /* @__PURE__ */ __name4((node, path26) => {
     const r = node.retry;
     if (!r) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     const unknown = unknownWorkflowRetryMembers(r);
-    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path26}.retry`, id);
+    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path26}.retry`, id2);
     if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
       const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path26}.retry.maxAttempts`, id);
+      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path26}.retry.maxAttempts`, id2);
     }
     const backoffs = retryBackoffs();
     if (r.backoff !== void 0 && !backoffs.includes(r.backoff)) {
       const list = backoffs.map((b) => `'${b}'`).join(" | ");
-      err("backoff-invalid", `retry.backoff must be ${list}`, `${path26}.retry.backoff`, id);
+      err("backoff-invalid", `retry.backoff must be ${list}`, `${path26}.retry.backoff`, id2);
     }
     if (r.backoffSeconds !== void 0 && r.backoffSeconds < 0) {
-      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path26}.retry.backoffSeconds`, id);
+      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path26}.retry.backoffSeconds`, id2);
     }
     if (r.maxBackoffSeconds !== void 0) {
       if (r.backoff !== "exponential") {
-        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path26}.retry`, id);
+        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path26}.retry`, id2);
       } else if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) {
-        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path26}.retry.maxBackoffSeconds`, id);
+        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path26}.retry.maxBackoffSeconds`, id2);
       }
     }
   }, "checkRetry");
   const checkTimeout = /* @__PURE__ */ __name4((node, path26) => {
     const t = node.timeoutSeconds;
     if (t === void 0) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (!Number.isInteger(t) || t < 1) {
-      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path26}.timeoutSeconds`, id);
+      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path26}.timeoutSeconds`, id2);
       return;
     }
     if (node.tier === "job") {
       const cap = node.type === "agent" ? caps.maxJobTimeoutSeconds : caps.maxJobSegmentSeconds;
       if (t > cap) {
-        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path26}.timeoutSeconds`, id);
+        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path26}.timeoutSeconds`, id2);
       } else if (node.type === "agent" && t > caps.maxJobSegmentSeconds && !node.workspace) {
-        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path26}.timeoutSeconds`, id);
+        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path26}.timeoutSeconds`, id2);
       }
     } else if (t > caps.maxWorkerTimeoutSeconds) {
-      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path26}.timeoutSeconds`, id);
+      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path26}.timeoutSeconds`, id2);
     }
   }, "checkTimeout");
   const checkSpecialistRole = /* @__PURE__ */ __name4((node, path26) => {
@@ -6596,32 +6833,32 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     return void 0;
   }, "jobClassifiablePin");
   const checkTier = /* @__PURE__ */ __name4((node, path26) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (node.workspace && node.workspace !== "inherit" && node.tier !== void 0 && node.tier !== "job") {
-      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path26}.workspace`, id);
+      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path26}.workspace`, id2);
     }
     if (node.harness !== void 0 && node.tier !== "job") {
-      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path26}.harness`, id);
+      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path26}.harness`, id2);
     }
     const provider = node.type === "agent" ? classifyModelProvider(jobClassifiablePin(node.model)) : null;
     if (node.harness === "claude-code" && provider !== null && provider !== "anthropic") {
-      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path26}.harness`, id);
+      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path26}.harness`, id2);
     }
     if (isJobTier(node) && provider !== null && opts.policy?.jobProviders && !opts.policy.jobProviders.includes(provider)) {
-      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path26}.model`, id);
+      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path26}.model`, id2);
     }
   }, "checkTier");
   const checkModel = /* @__PURE__ */ __name4((node, path26) => {
     if (node.type !== "agent" || typeof node.model !== "string") return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     const parsed = parseModelTemplate(node.model);
     if (parsed.kind === "invalid") {
-      err("model-template-invalid", parsed.message, `${path26}.model`, id);
+      err("model-template-invalid", parsed.message, `${path26}.model`, id2);
       return;
     }
     if (parsed.kind === "template" && parsed.template.default === void 0) {
       if (isJobTier(node)) {
-        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path26}.model`, id);
+        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path26}.model`, id2);
       }
       return;
     }
@@ -6634,12 +6871,12 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (registry === "unavailable") {
       const trimmed2 = pin.trim();
       if (trimmed2 && !normalizeModelId(trimmed2, []).ok) {
-        warn("model-unresolved", inContext(`model "${trimmed2}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path26}.model`, id);
+        warn("model-unresolved", inContext(`model "${trimmed2}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path26}.model`, id2);
       }
       return;
     }
     const resolved = normalizeModelId(pin, registry);
-    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path26}.model`, id);
+    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path26}.model`, id2);
   }, "checkModel");
   const checkTaskClass = /* @__PURE__ */ __name4((node, path26) => {
     if (node.type !== "agent" || node.taskClass === void 0) return;
@@ -6648,46 +6885,46 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     err("task-class-without-model", `taskClass '${String(node.taskClass)}' needs a \`model\` on a pushed definition \u2014 write a class (model: 'class/fast' | 'class/balanced' | 'class/strong') or an approved provider/model code; nothing maps a task class to a model at dispatch, so a step with neither would run on the agent\u2019s own model`, `${path26}.taskClass`, singleId(node));
   }, "checkTaskClass");
   const checkWorkspace = /* @__PURE__ */ __name4((node, path26) => {
-    const id = singleId(node);
+    const id2 = singleId(node);
     const ws = workspaceOf(node);
     if (isJobTier(node) && opts.policy && opts.policy.jobTier !== true) {
-      err("job-tier-disabled", `"${id}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path26}.tier`, id);
+      err("job-tier-disabled", `"${id2}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path26}.tier`, id2);
     }
     const tools = jobToolsOf(node);
     if (tools !== void 0) {
       if (!isJobTier(node)) {
-        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path26}.jobTools`, id);
+        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path26}.jobTools`, id2);
       }
       const unknown = (Array.isArray(tools) ? tools : [
         tools
       ]).filter((t) => !WORKFLOW_JOB_TOOLS.includes(t));
       if (unknown.length > 0) {
-        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path26}.jobTools`, id);
+        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path26}.jobTools`, id2);
       }
       if (node.type === "agent" && (Array.isArray(tools) ? tools : [
         tools
       ]).includes("gh")) {
-        warn("gh-on-coding-turn", `"${id}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path26}.jobTools`, id);
+        warn("gh-on-coding-turn", `"${id2}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path26}.jobTools`, id2);
       }
     }
     if (node.type === "agent" && ws && ws !== "inherit" && ws.mount === "ro" && Array.isArray(tools) && effectiveJobTools(tools, true).length === 0) {
-      warn("ro-step-has-no-tools", `"${id}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path26}.jobTools`, id);
+      warn("ro-step-has-no-tools", `"${id2}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path26}.jobTools`, id2);
     }
     if (ws && ws !== "inherit") {
       if (!envelopeWorkspace && !opts.mayInherit) {
-        err("workspace-not-declared", `"${id}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path26}.workspace`, id);
+        err("workspace-not-declared", `"${id2}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path26}.workspace`, id2);
       }
       if (ws.isolation === "worktree" && envelopeWorkspace?.kind === "empty") {
-        err("worktree-requires-git-workspace", `"${id}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path26}.workspace.isolation`, id);
+        err("worktree-requires-git-workspace", `"${id2}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path26}.workspace.isolation`, id2);
       }
     }
     if (node.type === "workflow" && ws === "inherit") {
       if (!envelopeWorkspace) {
-        err("workspace-inherit-without-parent-workspace", `"${id}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path26}.workspace`, id);
+        err("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path26}.workspace`, id2);
       }
       const child = opts.resolveWorkflow?.(node.workflowId);
       if (child?.workspace) {
-        err("workspace-inherit-conflict", `"${id}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path26}.workspace`, id);
+        err("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path26}.workspace`, id2);
       }
     }
   }, "checkWorkspace");
@@ -6696,20 +6933,20 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const schema = node.type === "step" ? node.step.outputSchema : node.type === "agent" ? node.outputSchema : void 0;
     if (schema !== void 0) outputSchemas.set(singleId(node), schema);
   }, "recordOutputSchema");
-  const checkMapMembers = /* @__PURE__ */ __name4((cfg, basePath, id) => {
+  const checkMapMembers = /* @__PURE__ */ __name4((cfg, basePath, id2) => {
     for (const m of malformedMapMembers(cfg)) {
-      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id, m), `${basePath}.${m.member}`, id);
+      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id2, m), `${basePath}.${m.member}`, id2);
     }
   }, "checkMapMembers");
   const checkInputShape = /* @__PURE__ */ __name4((node, path26) => {
     const input = node.input;
     if (input === void 0) return;
-    const id = singleId(node);
+    const id2 = singleId(node);
     if (input !== null && typeof input === "object" && !Array.isArray(input)) {
-      checkMapMembers(input, `${path26}.input`, id);
+      checkMapMembers(input, `${path26}.input`, id2);
       return;
     }
-    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path26}.input`, id);
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path26}.input`, id2);
   }, "checkInputShape");
   const checkBodyInput = /* @__PURE__ */ __name4((body, path26, container) => {
     if (body.type === "workflow" || body.input === void 0) return;
@@ -7000,7 +7237,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       default:
         err("invalid-envelope", `unknown entry type "${entry.type}"`, path26);
     }
-    for (const id of declared) upstream.add(id);
+    for (const id2 of declared) upstream.add(id2);
   });
   if (nodeCount > caps.maxNodes) {
     err("cap-exceeded", `${nodeCount} nodes exceeds the static cap of ${caps.maxNodes}`, "definition.graph");
@@ -7075,19 +7312,19 @@ function hashGraph(g) {
 function compilePlan(g) {
   const steps = {};
   const order = [];
-  const addNode = /* @__PURE__ */ __name4((id, node) => {
-    if (id in steps) {
-      throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id}" in definition.graph`);
+  const addNode = /* @__PURE__ */ __name4((id2, node) => {
+    if (id2 in steps) {
+      throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id2}" in definition.graph`);
     }
-    steps[id] = node;
-    order.push(id);
+    steps[id2] = node;
+    order.push(id2);
   }, "addNode");
   let prevTails = [];
   const foreachJoinToEntry = /* @__PURE__ */ new Map();
   g.definition.graph.forEach((entry, entryIndex) => {
     if (isArmStep(entry)) {
-      const id = armStepId(entry);
-      addNode(id, {
+      const id2 = armStepId(entry);
+      addNode(id2, {
         kind: armStepKind(entry),
         dependsOn: prevTails,
         downstream: [],
@@ -7095,7 +7332,7 @@ function compilePlan(g) {
         entry
       });
       prevTails = [
-        id
+        id2
       ];
       return;
     }
@@ -7234,10 +7471,10 @@ function compilePlan(g) {
         throw new WorkflowPlanError("unknown-entry-type", `Unknown graph entry type "${entry.type}" at definition.graph[${entryIndex}]`);
     }
   });
-  for (const id of order) {
-    for (const dep of steps[id].dependsOn) {
+  for (const id2 of order) {
+    for (const dep of steps[id2].dependsOn) {
       const target = steps[dep] ?? (foreachJoinToEntry.has(dep) ? steps[foreachJoinToEntry.get(dep)] : void 0);
-      target?.downstream.push(id);
+      target?.downstream.push(id2);
     }
   }
   return {
@@ -7403,15 +7640,15 @@ function renderRef(ref) {
   return ref.path;
 }
 function step(s) {
-  const id = stepIdOf(s);
+  const id2 = stepIdOf(s);
   return {
     path: /* @__PURE__ */ __name4((p) => ({
-      path: p === "" ? `stepResults.${id}` : `stepResults.${id}.${p}`
+      path: p === "" ? `stepResults.${id2}` : `stepResults.${id2}.${p}`
     }), "path")
   };
 }
-function stepOf(id) {
-  return step(id);
+function stepOf(id2) {
+  return step(id2);
 }
 function init(path26) {
   return {
@@ -7493,18 +7730,18 @@ function resolvePlacements(calls) {
   const declared = /* @__PURE__ */ new Map();
   const placedBy = /* @__PURE__ */ new Map();
   const allIds = /* @__PURE__ */ new Map();
-  const claimId = /* @__PURE__ */ __name4((id, callIndex) => {
-    const first = allIds.get(id);
+  const claimId = /* @__PURE__ */ __name4((id2, callIndex) => {
+    const first = allIds.get(id2);
     if (first !== void 0 && first !== callIndex) {
       issues.push({
         code: "duplicate-step-id",
-        message: `step id "${id}" is declared more than once (calls #${first} and #${callIndex})`,
+        message: `step id "${id2}" is declared more than once (calls #${first} and #${callIndex})`,
         callIndex,
-        stepId: id
+        stepId: id2
       });
       return;
     }
-    allIds.set(id, callIndex);
+    allIds.set(id2, callIndex);
   }, "claimId");
   calls.forEach((call, i) => {
     switch (call.kind) {
@@ -7516,7 +7753,7 @@ function resolvePlacements(calls) {
         });
         break;
       case "entry":
-        for (const id of entryIds(call.entry)) claimId(id, i);
+        for (const id2 of entryIds(call.entry)) claimId(id2, i);
         break;
       case "parallel":
         for (const arm of call.arms) if ("node" in arm) claimId(nodeIdOf(arm.node), i);
@@ -7535,42 +7772,42 @@ function resolvePlacements(calls) {
   });
   const armMapPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!ref.armMap || node.type === "mapping" || isHitlNode2(node)) return void 0;
-    const id = nodeIdOf(node);
+    const id2 = nodeIdOf(node);
     if ((container === "foreach" || container === "loop") && node.type !== "workflow") {
       return {
         code: "mapping-placement",
-        message: container === "foreach" ? `foreach body "${id}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
+        message: container === "foreach" ? `foreach body "${id2}": a [map, step] body is not supported \u2014 the body receives each item as its input; map the items before the foreach instead (foreach(step, { items: \u2026 }) or a .map() before it)` : `loop body "${id2}": a [map, step] body is not supported \u2014 the body receives the previous output as its input; put the .map() before the loop instead`,
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     if (node.input !== void 0) {
       return {
         code: "mapping-placement",
-        message: `"${id}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
+        message: `"${id2}": the [map, step] arm mapping and the node's own input map would both bind its input \u2014 keep one (drop the arm map, or the \`input\` on the declaration)`,
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     return void 0;
   }, "armMapPlacementIssue");
   const hitlPlacementIssue = /* @__PURE__ */ __name4((node, ref, i, container) => {
     if (!isHitlNode2(node)) return void 0;
-    const id = node.id;
+    const id2 = node.id;
     if (ref.armMap) {
       return {
         code: "node-type-unsupported-in-container",
-        message: workflowHitlArmShapeMessage(node.type, id, "mapped-arm"),
+        message: workflowHitlArmShapeMessage(node.type, id2, "mapped-arm"),
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     if (container !== "place" && !workflowContainerRunsHitlArm(container)) {
       return {
         code: "node-type-unsupported-in-container",
-        message: workflowHitlArmUnsupportedMessage(node.type, id, container),
+        message: workflowHitlArmUnsupportedMessage(node.type, id2, container),
         callIndex: i,
-        stepId: id
+        stepId: id2
       };
     }
     return void 0;
@@ -7676,8 +7913,8 @@ function resolvePlacements(calls) {
         graph.push(call.entry);
         return;
       case "declare": {
-        const id = nodeIdOf(call.node);
-        if (placedBy.has(id)) return;
+        const id2 = nodeIdOf(call.node);
+        if (placedBy.has(id2)) return;
         graph.push(call.node);
         return;
       }
@@ -7808,14 +8045,14 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
   const seeded = [];
   const unseeded = [];
   const known = new Set(Object.keys(targetPlan.steps));
-  const parentOf = /* @__PURE__ */ __name4((id) => {
-    const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id);
+  const parentOf = /* @__PURE__ */ __name4((id2) => {
+    const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id2);
     return m ? m[1] : void 0;
   }, "parentOf");
-  const dependsOf = /* @__PURE__ */ __name4((id) => {
-    const node = targetPlan.steps[id];
+  const dependsOf = /* @__PURE__ */ __name4((id2) => {
+    const node = targetPlan.steps[id2];
     if (node) return node.dependsOn;
-    const parent = parentOf(id);
+    const parent = parentOf(id2);
     return parent && targetPlan.steps[parent] ? [
       parent
     ] : [];
@@ -7828,23 +8065,23 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
       walk22.push(s.stepId);
     }
   }
-  for (const id of walk22) {
-    const row2 = byId.get(id);
+  for (const id2 of walk22) {
+    const row2 = byId.get(id2);
     if (!row2 || row2.status !== "completed") continue;
-    if (!dependsOf(id).every((d) => seededIds.has(d))) {
-      unseeded.push(id);
+    if (!dependsOf(id2).every((d) => seededIds.has(d))) {
+      unseeded.push(id2);
       continue;
     }
-    seededIds.add(id);
+    seededIds.add(id2);
     seeded.push({
-      stepId: id,
+      stepId: id2,
       output: row2.output,
       attempt: row2.attempt ?? 1,
       effects: row2.effects ?? {}
     });
   }
   const dropped = steps.filter((s) => s.status === "completed" && !known.has(s.stepId) && !(parentOf(s.stepId) && known.has(parentOf(s.stepId)))).map((s) => s.stepId);
-  const firstPending = targetPlan.order.find((id) => !seededIds.has(id));
+  const firstPending = targetPlan.order.find((id2) => !seededIds.has(id2));
   const graphChanged = !!(opts.targetGraphHash && run.graphHash && opts.targetGraphHash !== run.graphHash);
   return {
     sourceRunId: run.id,
@@ -7899,37 +8136,37 @@ function replayLedger(g, ledger) {
     startedAt: 0,
     ...ledger.requestContext
   };
-  const ctxFor = /* @__PURE__ */ __name4((id) => ({
+  const ctxFor = /* @__PURE__ */ __name4((id2) => ({
     initData: ledger.initData,
-    stepResults: ancestorResults(plan, id, rows22),
+    stepResults: ancestorResults(plan, id2, rows22),
     state: ledger.state ?? {},
     requestContext
   }), "ctxFor");
   const verdicts = [];
-  for (const id of plan.order) {
-    const node = plan.steps[id];
-    const recorded = rows22.get(id);
+  for (const id2 of plan.order) {
+    const node = plan.steps[id2];
+    const recorded = rows22.get(id2);
     if (!recorded || recorded.status === "pending" || recorded.status === "skipped") continue;
     if (node.kind === "branch") {
       const entry = node.entry;
-      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id));
+      const taken = selectBranchArms(branchSpecFromConditional(entry), ctxFor(id2));
       const recordedTaken = recorded.taken ?? inferTaken(entry, rows22);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "branch",
         recorded: recordedTaken,
         local: taken,
         diverged: canonical(recordedTaken) !== canonical(taken)
       });
-    } else if (node.kind === "map" && !id.endsWith(".join") && recorded.status === "completed") {
+    } else if (node.kind === "map" && !id2.endsWith(".join") && recorded.status === "completed") {
       const entry = node.entry;
-      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id), ctxFor(id));
+      const resolved = resolveMapping(parseMapConfig(entry.mapConfig, id2), ctxFor(id2));
       const local = "error" in resolved ? {
         error: resolved.error,
         key: resolved.key
       } : resolved.value;
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "map",
         recorded: recorded.output,
         local,
@@ -7938,11 +8175,11 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "foreach") {
       const entry = node.entry;
       const source = node.dependsOn[0];
-      const items = source ? ctxFor(id).stepResults[source] : void 0;
+      const items = source ? ctxFor(id2).stepResults[source] : void 0;
       const local = Array.isArray(items) ? items.length : void 0;
       const recordedCount = recorded.itemCount ?? countChildren(entry, rows22);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "foreach",
         recorded: recordedCount,
         local,
@@ -7951,7 +8188,7 @@ function replayLedger(g, ledger) {
     } else if (node.kind === "subrun" && recorded.status === "completed" && recorded.child) {
       const local = subrunSettledOutput(recorded.child);
       verdicts.push({
-        stepId: id,
+        stepId: id2,
         kind: "subrun",
         recorded: recorded.output,
         local,
@@ -7977,7 +8214,7 @@ function replayResultOf(row2, node) {
   }
   return void 0;
 }
-function ancestorResults(plan, id, rows22) {
+function ancestorResults(plan, id2, rows22) {
   const out = {};
   const joinAliased = /* @__PURE__ */ new Set();
   const seen = /* @__PURE__ */ new Set();
@@ -8026,7 +8263,7 @@ function ancestorResults(plan, id, rows22) {
       walk22(node.dependsOn);
     }
   }, "walk");
-  walk22(plan.steps[id]?.dependsOn ?? []);
+  walk22(plan.steps[id2]?.dependsOn ?? []);
   return out;
 }
 function inferTaken(entry, rows22) {
@@ -8036,15 +8273,15 @@ function inferTaken(entry, rows22) {
       entry.otherwise
     ] : []
   ];
-  return arms.map(branchArmId).filter((id) => {
-    const r = rows22.get(id);
+  return arms.map(branchArmId).filter((id2) => {
+    const r = rows22.get(id2);
     return r !== void 0 && r.status !== "skipped" && r.status !== "pending";
   });
 }
 function countChildren(entry, rows22) {
   const body = branchArmId(entry.step);
   let n2 = 0;
-  for (const id of rows22.keys()) if (id.startsWith(`${body}[`)) n2 += 1;
+  for (const id2 of rows22.keys()) if (id2.startsWith(`${body}[`)) n2 += 1;
   return n2;
 }
 function isTerminalRunStatus(status) {
@@ -9312,8 +9549,8 @@ var init_dist2 = __esm({
     fromKnowledge = /* @__PURE__ */ __name4((k) => ({
       knowledge: k
     }), "fromKnowledge");
-    SideEffectsSchema = z6.enum(WORKFLOW_SIDE_EFFECTS);
-    JobResourcesSchema = z6.enum(WORKFLOW_JOB_RESOURCES);
+    SideEffectsSchema = z7.enum(WORKFLOW_SIDE_EFFECTS);
+    JobResourcesSchema = z7.enum(WORKFLOW_JOB_RESOURCES);
     WORKFLOW_MODEL_TEMPLATE_ROOT = "initData";
     WORKFLOW_MODEL_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*(?:\|([^}]*))?\}$/;
     PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
@@ -9746,7 +9983,7 @@ var init_dist2 = __esm({
     __name(replayLedger, "replayLedger");
     __name4(replayLedger, "replayLedger");
     JOIN = ".join";
-    entryOfJoin = /* @__PURE__ */ __name4((id) => id.endsWith(JOIN) ? id.slice(0, -JOIN.length) : void 0, "entryOfJoin");
+    entryOfJoin = /* @__PURE__ */ __name4((id2) => id2.endsWith(JOIN) ? id2.slice(0, -JOIN.length) : void 0, "entryOfJoin");
     __name(replayResultOf, "replayResultOf");
     __name4(replayResultOf, "replayResultOf");
     __name(ancestorResults, "ancestorResults");
@@ -10035,8 +10272,8 @@ function createStep(s) {
 function step2(s) {
   return step(typeof s === "string" ? s : s.id);
 }
-function stepOf2(id) {
-  return stepOf(id);
+function stepOf2(id2) {
+  return stepOf(id2);
 }
 function schemaToJson(schema) {
   if (schema === void 0 || schema === null) return void 0;
@@ -10243,16 +10480,16 @@ var init_workflow = __esm({
       if (!isPredicate(p)) throw new LuaWorkflowBuildError("closure-predicate", `${where}: not a LuaPredicate`, "build predicates with eq/gt/inSet/exists/and/or/not");
       return p;
     }, "assertPredicate");
-    assertRetry = /* @__PURE__ */ __name((r, id) => {
+    assertRetry = /* @__PURE__ */ __name((r, id2) => {
       if (!r) return;
       if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
         const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-        throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
+        throw new LuaWorkflowBuildError(over ? "cap-exceeded" : "invalid-envelope", `"${id2}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
       }
-      if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
+      if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
       if (r.maxBackoffSeconds !== void 0) {
-        if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
-        if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds`);
+        if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
+        if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) throw new LuaWorkflowBuildError("backoff-invalid", `"${id2}": retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds`);
       }
     }, "assertRetry");
     assertTimeout = /* @__PURE__ */ __name((node) => {
@@ -10450,8 +10687,8 @@ var init_workflow = __esm({
           ref: arm
         };
         if (arm && typeof arm === "object" && isHitlEntry(arm)) {
-          const id = arm.id;
-          throw new LuaWorkflowBuildError("invalid-step", `${where}: an approval / waitForSignal arm is placed by id \u2014 declare it with .approval(${JSON.stringify(id ?? "id")}, \u2026) / .waitForSignal(\u2026) and pass the id string`);
+          const id2 = arm.id;
+          throw new LuaWorkflowBuildError("invalid-step", `${where}: an approval / waitForSignal arm is placed by id \u2014 declare it with .approval(${JSON.stringify(id2 ?? "id")}, \u2026) / .waitForSignal(\u2026) and pass the id string`);
         }
         return {
           node: this.registerStep(arm, where)
@@ -10571,14 +10808,14 @@ var init_workflow = __esm({
         assertNoClosure(mapping, "map()");
         this.recordEnvRefs(mapping);
         this.mapCount += 1;
-        let id = opts?.id;
-        if (id === void 0) {
+        let id2 = opts?.id;
+        if (id2 === void 0) {
           this.unnamedMaps += 1;
-          id = `map_${this.mapCount}`;
+          id2 = `map_${this.mapCount}`;
         }
         const node = {
           type: "mapping",
-          id,
+          id: id2,
           mapConfig: canonicalJson(mapping)
         };
         return this.push({
@@ -10589,12 +10826,12 @@ var init_workflow = __esm({
       sleep(ms, opts) {
         if (typeof ms !== "number" || !Number.isFinite(ms) || ms < 0) throw new LuaWorkflowBuildError("invalid-envelope", "sleep(ms) takes a literal non-negative number");
         this.sleepCount += 1;
-        const id = opts?.id ?? `sleep_${this.sleepCount}`;
+        const id2 = opts?.id ?? `sleep_${this.sleepCount}`;
         return this.push({
           kind: "entry",
           entry: defined({
             type: "sleep",
-            id,
+            id: id2,
             duration: ms,
             businessHours: opts?.businessHours
           })
@@ -10602,13 +10839,13 @@ var init_workflow = __esm({
       }
       sleepUntil(iso, opts) {
         this.sleepCount += 1;
-        const id = opts?.id ?? `sleep_${this.sleepCount}`;
+        const id2 = opts?.id ?? `sleep_${this.sleepCount}`;
         if (typeof iso === "string") {
           return this.push({
             kind: "entry",
             entry: defined({
               type: "sleepUntil",
-              id,
+              id: id2,
               date: iso,
               businessHours: opts?.businessHours,
               round: opts?.round
@@ -10621,7 +10858,7 @@ var init_workflow = __esm({
           kind: "entry",
           entry: {
             type: "mapping",
-            id: `${id}_at`,
+            id: `${id2}_at`,
             mapConfig: canonicalJson({
               date: {
                 template: iso.template
@@ -10633,9 +10870,9 @@ var init_workflow = __esm({
           kind: "entry",
           entry: defined({
             type: "sleepUntil",
-            id,
+            id: id2,
             dateFrom: {
-              step: `${id}_at`,
+              step: `${id2}_at`,
               path: "date"
             },
             businessHours: opts?.businessHours,
@@ -10643,35 +10880,35 @@ var init_workflow = __esm({
           })
         });
       }
-      agentStep(id, opts) {
-        this.assertId(id, "agentStep()");
+      agentStep(id2, opts) {
+        this.assertId(id2, "agentStep()");
         if (!opts || typeof opts.agentId !== "string" && !(opts.agentId && typeof opts.agentId === "object" && "__envRef" in opts.agentId)) {
-          throw new LuaWorkflowBuildError("invalid-envelope", `agentStep("${id}") needs an agentId`);
+          throw new LuaWorkflowBuildError("invalid-envelope", `agentStep("${id2}") needs an agentId`);
         }
         const tier = opts.tier ?? (opts.workspace ? "job" : void 0);
-        if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id}": a step mounting a workspace must be tier:'job'`);
-        if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id}": harness is only legal on a tier:'job' agent step`);
-        if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
+        if (opts.workspace && opts.tier !== void 0 && opts.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${id2}": a step mounting a workspace must be tier:'job'`);
+        if (opts.harness !== void 0 && tier !== "job") throw new LuaWorkflowBuildError("harness-requires-job-tier", `"${id2}": harness is only legal on a tier:'job' agent step`);
+        if (opts.toolScope?.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${id2}": toolScope.jobTools require tier:'job' (job-tools-require-job-tier)`);
         for (const m of WORKFLOW_JOB_RANGE_MEMBERS) {
           if (opts[m] === void 0) continue;
-          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id}": ${m} is only legal on a tier:'job' agent step`);
+          if (tier !== "job") throw new LuaWorkflowBuildError("max-turns-requires-job-tier", `"${id2}": ${m} is only legal on a tier:'job' agent step`);
           if (!isWithinWorkflowJobRange(m, opts[m])) {
             const { min, max } = WORKFLOW_JOB_RANGES[m];
-            throw new LuaWorkflowBuildError("max-turns-invalid", `"${id}": ${m} must be an integer ${min}..${max}`);
+            throw new LuaWorkflowBuildError("max-turns-invalid", `"${id2}": ${m} must be an integer ${min}..${max}`);
           }
         }
         assertTimeout({
-          id,
+          id: id2,
           timeoutSeconds: opts.timeoutSeconds,
           tier,
           workspace: opts.workspace,
           kind: "agent"
         });
-        assertRetry(opts.retry, id);
+        assertRetry(opts.retry, id2);
         this.recordEnvRefs(opts.agentId, opts.prompt);
         const node = defined({
           type: "agent",
-          id,
+          id: id2,
           agentId: opts.agentId,
           promptTemplate: templateText(opts.prompt),
           outputSchema: schemaToJson(opts.outputSchema),
@@ -10699,30 +10936,30 @@ var init_workflow = __esm({
           node
         });
       }
-      specialistStep(id, opts) {
-        this.assertId(id, "specialistStep()");
+      specialistStep(id2, opts) {
+        this.assertId(id2, "specialistStep()");
         const role = opts?.role;
-        if (!role || typeof role !== "object") throw new LuaWorkflowBuildError("invalid-envelope", `specialistStep("${id}") needs a role`);
+        if (!role || typeof role !== "object") throw new LuaWorkflowBuildError("invalid-envelope", `specialistStep("${id2}") needs a role`);
         if (role.ref !== void 0 && (role.name !== void 0 || role.instructions !== void 0 || role.tools !== void 0)) {
-          throw new LuaWorkflowBuildError("role-ref-and-inline", `"${id}": role is EITHER { ref } OR the inline { name, instructions, tools } shape`);
+          throw new LuaWorkflowBuildError("role-ref-and-inline", `"${id2}": role is EITHER { ref } OR the inline { name, instructions, tools } shape`);
         }
         if (role.ref === void 0) {
           if (typeof role.instructions !== "string" || role.instructions.length > WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS) {
-            throw new LuaWorkflowBuildError("ephemeral-role-too-long", `"${id}": role.instructions must be \u2264 ${WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS} chars`);
+            throw new LuaWorkflowBuildError("ephemeral-role-too-long", `"${id2}": role.instructions must be \u2264 ${WORKFLOW_SPECIALIST_ROLE_MAX_INSTRUCTIONS} chars`);
           }
-          if (!Array.isArray(role.tools)) throw new LuaWorkflowBuildError("invalid-envelope", `"${id}": role.tools must be an array ([] = no tools)`);
-          if (role.tools.length > 64) throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": role.tools exceeds 64 entries`);
+          if (!Array.isArray(role.tools)) throw new LuaWorkflowBuildError("invalid-envelope", `"${id2}": role.tools must be an array ([] = no tools)`);
+          if (role.tools.length > 64) throw new LuaWorkflowBuildError("cap-exceeded", `"${id2}": role.tools exceeds 64 entries`);
         }
         assertTimeout({
-          id,
+          id: id2,
           timeoutSeconds: opts.timeoutSeconds,
           kind: "agent"
         });
-        assertRetry(opts.retry, id);
+        assertRetry(opts.retry, id2);
         this.recordEnvRefs(opts.prompt);
         const node = defined({
           type: "agent",
-          id,
+          id: id2,
           agentId: "$self",
           role: role.ref !== void 0 ? {
             ref: role.ref
@@ -10745,20 +10982,20 @@ var init_workflow = __esm({
           node
         });
       }
-      toolStep(id, tool, opts = {}) {
-        this.assertId(id, "toolStep()");
-        if (!tool || typeof tool !== "object" || typeof tool.name !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `toolStep("${id}") needs a LuaTool`);
-        assertNoClosure(opts.input, `toolStep("${id}").input`);
+      toolStep(id2, tool, opts = {}) {
+        this.assertId(id2, "toolStep()");
+        if (!tool || typeof tool !== "object" || typeof tool.name !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `toolStep("${id2}") needs a LuaTool`);
+        assertNoClosure(opts.input, `toolStep("${id2}").input`);
         this.recordEnvRefs(opts.input);
         assertTimeout({
-          id,
+          id: id2,
           timeoutSeconds: opts.timeoutSeconds,
           kind: "tool"
         });
-        assertRetry(opts.retry, id);
+        assertRetry(opts.retry, id2);
         const node = defined({
           type: "tool",
-          id,
+          id: id2,
           toolId: tool.name,
           input: opts.input,
           timeoutSeconds: opts.timeoutSeconds,
@@ -10772,34 +11009,34 @@ var init_workflow = __esm({
           node
         });
       }
-      approval(id, opts) {
-        this.assertId(id, "approval()");
-        if (!opts || typeof opts.title !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `approval("${id}") needs a title`);
+      approval(id2, opts) {
+        this.assertId(id2, "approval()");
+        if (!opts || typeof opts.title !== "string") throw new LuaWorkflowBuildError("invalid-envelope", `approval("${id2}") needs a title`);
         if (opts.approver === "creator" && opts.excludeInitiator === true) {
-          throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
+          throw new LuaWorkflowBuildError("approver-excludes-only-candidate", `"${id2}": approver:'creator' with excludeInitiator:true always excludes the only candidate`);
         }
         const editable = approvalEditable(opts);
-        if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id}": \`fourEyes\` requires editable:true`);
+        if (opts.fourEyes !== void 0 && !editable) throw new LuaWorkflowBuildError("four-eyes-requires-editable", `"${id2}": \`fourEyes\` requires editable:true`);
         if (opts.editable === false && Array.isArray(opts.editablePaths) && opts.editablePaths.length > 0) {
-          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": \`editablePaths\` beside editable:false is contradictory \u2014 drop the paths or set editable:true`);
         } else if ((opts.editablePaths !== void 0 || opts.editedPayloadSchema !== void 0) && !editable) {
-          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
+          throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": \`editablePaths\` / \`editedPayloadSchema\` require editable:true (a non-empty editablePaths implies it)`);
         }
         for (const p of opts.editablePaths ?? []) {
-          if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
+          if (!EDITABLE_PATH_RE2.test(p)) throw new LuaWorkflowBuildError("editable-path-invalid", `"${id2}": editablePaths entry "${p}" is outside the grammar seg(.seg)* with [*]/[n] selectors`);
         }
         if (Array.isArray(opts.onTimeout)) {
           const chain = opts.onTimeout;
           const hops = chain.filter((h) => typeof h === "object");
-          if (hops.length > 3) throw new LuaWorkflowBuildError("escalation-chain-too-long", `"${id}": an onTimeout chain carries at most 3 escalation hops`);
+          if (hops.length > 3) throw new LuaWorkflowBuildError("escalation-chain-too-long", `"${id2}": an onTimeout chain carries at most 3 escalation hops`);
           const last = chain[chain.length - 1];
-          if (last === void 0 || typeof last === "object") throw new LuaWorkflowBuildError("escalation-chain-not-terminal", `"${id}": an onTimeout chain must end in a terminal member`);
+          if (last === void 0 || typeof last === "object") throw new LuaWorkflowBuildError("escalation-chain-not-terminal", `"${id2}": an onTimeout chain must end in a terminal member`);
         }
-        if (typeof opts.details === "function") throw new LuaWorkflowBuildError("closure-binding", `approval("${id}").details must be template(...)`);
+        if (typeof opts.details === "function") throw new LuaWorkflowBuildError("closure-binding", `approval("${id2}").details must be template(...)`);
         this.recordEnvRefs(opts.details, opts.timeoutHours, opts.approver);
         const node = defined({
           type: "approval",
-          id,
+          id: id2,
           title: opts.title,
           details: opts.details ? templateText(opts.details) : void 0,
           approver: opts.approver,
@@ -10821,13 +11058,13 @@ var init_workflow = __esm({
           node
         });
       }
-      waitForSignal(id, opts) {
-        this.assertId(id, "waitForSignal()");
-        if (!opts || typeof opts.signal !== "string" || opts.signal.length === 0) throw new LuaWorkflowBuildError("invalid-envelope", `waitForSignal("${id}") needs a signal name`);
+      waitForSignal(id2, opts) {
+        this.assertId(id2, "waitForSignal()");
+        if (!opts || typeof opts.signal !== "string" || opts.signal.length === 0) throw new LuaWorkflowBuildError("invalid-envelope", `waitForSignal("${id2}") needs a signal name`);
         this.recordEnvRefs(opts.timeoutHours);
         const node = defined({
           type: "waitForSignal",
-          id,
+          id: id2,
           signal: opts.signal,
           schema: schemaToJson(opts.schema),
           timeoutHours: opts.timeoutHours,
@@ -10840,28 +11077,28 @@ var init_workflow = __esm({
           node
         });
       }
-      workflow(id, ref, input, opts) {
-        this.assertId(id, "workflow()");
-        assertRetry(opts?.retry, id);
+      workflow(id2, ref, input, opts) {
+        this.assertId(id2, "workflow()");
+        assertRetry(opts?.retry, id2);
         const name = typeof ref === "string" ? ref : ref instanceof LuaWorkflow ? ref.getName() : void 0;
-        if (!name) throw new LuaWorkflowBuildError("invalid-envelope", `workflow("${id}") needs a LuaWorkflow or a workflow name`);
+        if (!name) throw new LuaWorkflowBuildError("invalid-envelope", `workflow("${id2}") needs a LuaWorkflow or a workflow name`);
         if (opts?.workspace === "inherit") {
-          if (!this.config.workspace) throw new LuaWorkflowBuildError("workspace-inherit-without-parent-workspace", `"${id}": workspace:'inherit' but the parent createWorkflow declares no workspace`);
-          if (ref instanceof LuaWorkflow && ref.getConfig().workspace) throw new LuaWorkflowBuildError("workspace-inherit-conflict", `"${id}": workspace:'inherit' on a workflow that declares its own workspace`);
+          if (!this.config.workspace) throw new LuaWorkflowBuildError("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent createWorkflow declares no workspace`);
+          if (ref instanceof LuaWorkflow && ref.getConfig().workspace) throw new LuaWorkflowBuildError("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on a workflow that declares its own workspace`);
         }
-        assertNoClosure(input, `workflow("${id}").input`);
+        assertNoClosure(input, `workflow("${id2}").input`);
         this.recordEnvRefs(input);
         this.nestedRefs.push(opts?.workspace === "inherit" ? {
-          id,
+          id: id2,
           name,
           workspace: "inherit"
         } : {
-          id,
+          id: id2,
           name
         });
         const node = defined({
           type: "workflow",
-          id,
+          id: id2,
           workflowId: name,
           input,
           workspace: opts?.workspace,
@@ -10940,8 +11177,8 @@ var init_workflow = __esm({
           });
         }
       }
-      assertId(id, where) {
-        if (typeof id !== "string" || !STEP_ID_RE.test(id)) throw new LuaWorkflowBuildError("invalid-step-id", `${where}: id "${String(id)}" must match ${STEP_ID_RE}`);
+      assertId(id2, where) {
+        if (typeof id2 !== "string" || !STEP_ID_RE.test(id2)) throw new LuaWorkflowBuildError("invalid-step-id", `${where}: id "${String(id2)}" must match ${STEP_ID_RE}`);
       }
     };
     EDITABLE_PATH_RE2 = /^[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?(\.[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?)*$/;
@@ -11197,7 +11434,7 @@ async function* parseSseStream(body, signal) {
   const decoder = new TextDecoder();
   let buffer = "";
   const flush = /* @__PURE__ */ __name((block) => {
-    let id;
+    let id2;
     let event = "message";
     const data = [];
     for (const rawLine of block.split("\n")) {
@@ -11207,11 +11444,11 @@ async function* parseSseStream(body, signal) {
       const field = colon === -1 ? line : line.slice(0, colon);
       let value3 = colon === -1 ? "" : line.slice(colon + 1);
       if (value3.startsWith(" ")) value3 = value3.slice(1);
-      if (field === "id") id = value3;
+      if (field === "id") id2 = value3;
       else if (field === "event") event = value3;
       else if (field === "data") data.push(value3);
     }
-    if (data.length === 0 && id === void 0 && event === "message") return void 0;
+    if (data.length === 0 && id2 === void 0 && event === "message") return void 0;
     const joined = data.join("\n");
     let parsed = joined;
     try {
@@ -11220,7 +11457,7 @@ async function* parseSseStream(body, signal) {
       parsed = joined;
     }
     return {
-      id,
+      id: id2,
       event,
       data: parsed
     };
@@ -12739,11 +12976,17 @@ var init_base_handler = __esm({
       /**
       * Phase 2 of parallel sync: apply fetched data to YAML.
       * Optionally creates missing primitives on server if apiKey+agentId provided.
+      *
+      * PRO-2150 — `apiCredentials.registerOnly` drops the two writes that overwrite what the developer
+      * pinned (the server-only orphan stubs in Part 1, and the version reconciliation half of Part 2)
+      * while keeping id linking and create-on-server. `lua chat` uses it: it needs the skills'/processors'
+      * server ids to exist before the sandbox push, and nothing else.
       */
       async applySyncToYaml(serverData, config, manifest, apiCredentials) {
         const messages = [];
         let yamlUpdated = false;
         let orphanedCount = 0;
+        const registerOnly = apiCredentials?.registerOnly === true;
         try {
           if (!serverData.serverItems) {
             if (serverData.fetchError) {
@@ -12771,10 +13014,10 @@ var init_base_handler = __esm({
             messages.push(msg);
             console.log(msg);
           }
-          const orphans = serverData.serverItems.filter((item) => {
-            const id = item.id;
+          const orphans = registerOnly ? [] : serverData.serverItems.filter((item) => {
+            const id2 = item.id;
             const name = item.name;
-            return !yamlById.has(id) && !yamlByName.has(name) && this.isActive(item) && this.shouldConsiderForOrphan(item);
+            return !yamlById.has(id2) && !yamlByName.has(name) && this.isActive(item) && this.shouldConsiderForOrphan(item);
           });
           if (orphans.length > 0) {
             const stubs = orphans.map((item) => this.cleanItem({
@@ -12798,7 +13041,9 @@ var init_base_handler = __esm({
 `);
             orphanedCount = orphans.length;
           }
-          const { items: updatedItems, changed, msgs } = this.syncFromServer(yamlItems, serverByName);
+          const { items: updatedItems, changed, msgs } = this.syncFromServer(yamlItems, serverByName, {
+            syncVersions: !registerOnly
+          });
           messages.push(...msgs);
           if (changed) {
             yamlUpdated = true;
@@ -12990,7 +13235,7 @@ var init_base_handler = __esm({
         const result = /* @__PURE__ */ new Map();
         const { serverItems } = await this.fetchServerState(apiKey, agentId);
         if (!serverItems) {
-          entityIds.forEach((id) => result.set(id, null));
+          entityIds.forEach((id2) => result.set(id2, null));
           return result;
         }
         for (const entityId of entityIds) {
@@ -13024,8 +13269,8 @@ var init_base_handler = __esm({
         const yamlById = /* @__PURE__ */ new Map();
         const yamlByName = /* @__PURE__ */ new Map();
         for (const item of yamlItems) {
-          const id = this.getItemId(item);
-          if (id) yamlById.set(id, item);
+          const id2 = this.getItemId(item);
+          if (id2) yamlById.set(id2, item);
           yamlByName.set(item.name, item);
         }
         const serverByName = /* @__PURE__ */ new Map();
@@ -13041,7 +13286,8 @@ var init_base_handler = __esm({
       /**
       * For each YAML item, match to server by name, populate missing IDs, update versions.
       */
-      syncFromServer(yamlItems, serverByName) {
+      syncFromServer(yamlItems, serverByName, options) {
+        const syncVersions = options?.syncVersions !== false;
         const msgs = [];
         let changed = false;
         const idField = this.yamlConfig.idField;
@@ -13062,7 +13308,7 @@ var init_base_handler = __esm({
             };
           }
           const versions = serverItem.versions;
-          if (Array.isArray(versions) && versions.length > 0) {
+          if (syncVersions && Array.isArray(versions) && versions.length > 0) {
             const activeVersion = this.getActiveVersion(serverItem);
             const currentVersion = item.version;
             if (activeVersion && activeVersion !== currentVersion) {
@@ -13116,11 +13362,15 @@ var init_base_handler = __esm({
           };
         }
       }
-      /** Phase 2 of parallel sync: apply fetched data to YAML (orphan detection only for non-versioned) */
-      async applySyncToYaml(serverData, config, manifest) {
+      /**
+      * Phase 2 of parallel sync: apply fetched data to YAML (orphan detection only for non-versioned).
+      * PRO-2150: `registerOnly` suppresses the server-only stub rows — the only write this override makes.
+      */
+      async applySyncToYaml(serverData, config, manifest, apiCredentials) {
         const messages = [];
         let yamlUpdated = false;
         let orphanedCount = 0;
+        const registerOnly = apiCredentials?.registerOnly === true;
         try {
           if (!serverData.serverItems) {
             if (serverData.fetchError) {
@@ -13146,10 +13396,10 @@ var init_base_handler = __esm({
             i
           ]));
           const manifestNames = manifest ? new Set(getPrimitivesByKind(manifest, this.kind).map((p) => p.name)) : /* @__PURE__ */ new Set();
-          const orphans = serverData.serverItems.filter((item) => {
-            const id = item.id;
+          const orphans = registerOnly ? [] : serverData.serverItems.filter((item) => {
+            const id2 = item.id;
             const name = item.name;
-            return !yamlById.has(id) && !yamlByName.has(name) && !manifestNames.has(name) && this.isActive(item);
+            return !yamlById.has(id2) && !yamlByName.has(name) && !manifestNames.has(name) && this.isActive(item);
           });
           if (orphans.length > 0) {
             const stubs = orphans.map((item) => this.cleanItem({
@@ -13211,17 +13461,17 @@ var init_base_handler = __esm({
       * using the handler's configured idField. Creates a new YAML entry if none
       * exists yet (first-push case).
       */
-      persistItemId(name, id) {
+      persistItemId(name, id2) {
         const config = readYamlConfig();
         const items = this.getFromYaml(config);
         const idField = this.yamlConfig.idField;
         const existing = items.find((i) => i.name === name);
         if (existing) {
-          existing[idField] = id;
+          existing[idField] = id2;
         } else {
           items.push({
             name,
-            [idField]: id
+            [idField]: id2
           });
         }
         this.updateYaml(items, config);
@@ -15276,7 +15526,7 @@ async function ensureSchemaConverterReady() {
   await loadVendor();
 }
 async function zodToJsonSchema2(schemaNode) {
-  const { z: z8, zodToJsonSchema: convertSchema } = await loadVendor();
+  const { z: z9, zodToJsonSchema: convertSchema } = await loadVendor();
   try {
     const sourceFile = schemaNode.getSourceFile();
     const project = sourceFile.getProject();
@@ -15289,7 +15539,7 @@ async function zodToJsonSchema2(schemaNode) {
       environment: {
         preset: "NODE",
         extra: {
-          z: z8
+          z: z9
         }
       },
       policy: {
@@ -15337,10 +15587,10 @@ function cleanJsonSchema(schema) {
   return cleanSchema;
 }
 async function zodStringToJsonSchema(zodSchemaCode) {
-  const { z: z8, zodToJsonSchema: convertSchema } = await loadVendor();
+  const { z: z9, zodToJsonSchema: convertSchema } = await loadVendor();
   try {
     const evalFunction = new Function("z", `return ${zodSchemaCode}`);
-    const zodSchema = evalFunction(z8);
+    const zodSchema = evalFunction(z9);
     const jsonSchema = convertSchema(zodSchema, {
       target: "jsonSchema7"
     });
@@ -19764,24 +20014,24 @@ function buildSandboxGlobals() {
     undefined: void 0
   };
 }
-function isRequireBlocklisted(id) {
-  return REQUIRE_BLOCKLIST.has(id) || BLOCKLISTED_PACKAGES.some((name) => id.startsWith(`${name}/`));
+function isRequireBlocklisted(id2) {
+  return REQUIRE_BLOCKLIST.has(id2) || BLOCKLISTED_PACKAGES.some((name) => id2.startsWith(`${name}/`));
 }
 function buildSandboxRequire(opts) {
   const realRequire = createRequire(path6.join(opts.cwd, "package.json"));
-  const wrapped = /* @__PURE__ */ __name6((id) => {
-    if (isRequireBlocklisted(id)) {
+  const wrapped = /* @__PURE__ */ __name6((id2) => {
+    if (isRequireBlocklisted(id2)) {
       const evt = {
         event: "sandbox_require_blocklisted",
-        module: id,
+        module: id2,
         mode: opts.mode
       };
       opts.onSecurityEvent?.(evt);
       if (opts.mode === "enforce") {
-        throw new Error(`require('${id}') is not available in the Lua sandbox. If you have a legitimate use case, contact support.`);
+        throw new Error(`require('${id2}') is not available in the Lua sandbox. If you have a legitimate use case, contact support.`);
       }
     }
-    return realRequire(id);
+    return realRequire(id2);
   }, "wrapped");
   wrapped.resolve = realRequire.resolve;
   wrapped.cache = realRequire.cache;
@@ -20453,25 +20703,25 @@ function createBaseSandboxContext(opts) {
     } : {}
   };
   const wrappedModuleCache = /* @__PURE__ */ new Map();
-  const requireWithEgress = /* @__PURE__ */ __name6((id) => {
-    const result = sandboxRequire(id);
+  const requireWithEgress = /* @__PURE__ */ __name6((id2) => {
+    const result = sandboxRequire(id2);
     if (egressMode === "off") return result;
-    if (wrappedModuleCache.has(id)) return wrappedModuleCache.get(id);
+    if (wrappedModuleCache.has(id2)) return wrappedModuleCache.get(id2);
     let wrapped = result;
-    if (id === "http" || id === "node:http") {
+    if (id2 === "http" || id2 === "node:http") {
       wrapped = wrapHttpModule(result, egressOpts);
-    } else if (id === "https" || id === "node:https") {
+    } else if (id2 === "https" || id2 === "node:https") {
       wrapped = wrapHttpsModule(result, egressOpts);
-    } else if (id === "net" || id === "node:net") {
+    } else if (id2 === "net" || id2 === "node:net") {
       wrapped = wrapNetModule(result, egressOpts);
-    } else if (id === "tls" || id === "node:tls") {
+    } else if (id2 === "tls" || id2 === "node:tls") {
       wrapped = wrapTlsModule(result, egressOpts);
-    } else if (id === "http2" || id === "node:http2") {
+    } else if (id2 === "http2" || id2 === "node:http2") {
       wrapped = wrapHttp2Module(result, egressOpts);
     } else {
       return result;
     }
-    wrappedModuleCache.set(id, wrapped);
+    wrappedModuleCache.set(id2, wrapped);
     return wrapped;
   }, "requireWithEgress");
   requireWithEgress.resolve = sandboxRequire.resolve;
@@ -20723,7 +20973,7 @@ var init_dist4 = __esm({
     SANDBOX_FAKE_FILENAME = "/index.ts";
     BLOCKLISTED_PACKAGES = [
       ...REQUIRE_BLOCKLIST
-    ].filter((id) => !id.startsWith("node:") && !builtinModules.includes(id));
+    ].filter((id2) => !id2.startsWith("node:") && !builtinModules.includes(id2));
     __name(isRequireBlocklisted, "isRequireBlocklisted");
     __name6(isRequireBlocklisted, "isRequireBlocklisted");
     __name(buildSandboxRequire, "buildSandboxRequire");
@@ -21508,12 +21758,12 @@ function createSerializationContext() {
     }, "template")
   });
   const cryptoFacade = deterministicCrypto();
-  const sandboxRequire = /* @__PURE__ */ __name((id) => {
-    if (id === "zod") return zodModule;
-    if (id === "crypto" || id === "node:crypto") return cryptoFacade;
-    throw Object.assign(new Error(`${NOT_STATIC}: require('${id}') is not available in the serialization sandbox`), {
+  const sandboxRequire = /* @__PURE__ */ __name((id2) => {
+    if (id2 === "zod") return zodModule;
+    if (id2 === "crypto" || id2 === "node:crypto") return cryptoFacade;
+    throw Object.assign(new Error(`${NOT_STATIC}: require('${id2}') is not available in the serialization sandbox`), {
       code: NOT_STATIC,
-      offendingGlobal: `require('${id}')`
+      offendingGlobal: `require('${id2}')`
     });
   }, "sandboxRequire");
   const facades = {};
@@ -21709,9 +21959,9 @@ function callDeclaredIds(call, mapCounter) {
     case "foreach":
     case "dowhile":
     case "dountil": {
-      const id = stepRefId(args2[0]);
-      return id ? [
-        id
+      const id2 = stepRefId(args2[0]);
+      return id2 ? [
+        id2
       ] : [];
     }
     case "parallel": {
@@ -21726,8 +21976,8 @@ function callDeclaredIds(call, mapCounter) {
       if (arr && Node17.isArrayLiteralExpression(arr)) {
         for (const el of arr.getElements()) {
           if (Node17.isArrayLiteralExpression(el)) {
-            const id = stepRefId(el.getElements()[1]);
-            if (id) ids.push(id);
+            const id2 = stepRefId(el.getElements()[1]);
+            if (id2) ids.push(id2);
           }
         }
       }
@@ -21749,18 +21999,18 @@ function callDeclaredIds(call, mapCounter) {
       ];
       if (name === "sleep" || name === "sleepUntil") {
         const opts = args2[1];
-        const id = opts && Node17.isObjectLiteralExpression(opts) ? extractStringProperty(opts, "id") : void 0;
+        const id2 = opts && Node17.isObjectLiteralExpression(opts) ? extractStringProperty(opts, "id") : void 0;
         return [
-          id ?? `sleep_${++mapCounter.n}`
+          id2 ?? `sleep_${++mapCounter.n}`
         ];
       }
       return [];
     }
     case "map": {
       const opts = args2[1];
-      const id = opts && Node17.isObjectLiteralExpression(opts) ? extractStringProperty(opts, "id") : void 0;
+      const id2 = opts && Node17.isObjectLiteralExpression(opts) ? extractStringProperty(opts, "id") : void 0;
       return [
-        id ?? `map_${++mapCounter.n}`
+        id2 ?? `map_${++mapCounter.n}`
       ];
     }
     default:
@@ -21777,7 +22027,7 @@ function stampSources(sourceFile, exportName, rootDir) {
   };
   for (const call of calls) {
     const { line, column } = sourceFile.getLineAndColumnAtPos(call.getStart());
-    for (const id of callDeclaredIds(call, counter)) if (!out.has(id)) out.set(id, {
+    for (const id2 of callDeclaredIds(call, counter)) if (!out.has(id2)) out.set(id2, {
       file,
       line,
       col: column
@@ -21806,7 +22056,7 @@ function collectBuilderCalls(expr) {
 function serializeViaAst(sourceFile, exportName) {
   const expr = locateWorkflowExpression(sourceFile, exportName);
   if (!expr) return void 0;
-  const z8 = zodModule.z;
+  const z9 = zodModule.z;
   const committed = [];
   const prev = __workflowCommitHook.onCommit;
   __workflowCommitHook.onCommit = (wf) => committed.push(wf);
@@ -21819,7 +22069,7 @@ function serializeViaAst(sourceFile, exportName) {
         preset: "NODE",
         extra: {
           ...PRIMITIVE_SHIMS,
-          z: z8,
+          z: z9,
           env: Object.assign(() => "", {
             template: /* @__PURE__ */ __name((k) => ({
               __envRef: k
@@ -21870,13 +22120,13 @@ function sketchTopology(sourceFile, exportName, name, description) {
   const seen = /* @__PURE__ */ new Set();
   const graph = [];
   for (const call of calls) {
-    for (const id of callDeclaredIds(call, counter)) {
-      if (seen.has(id)) continue;
-      seen.add(id);
+    for (const id2 of callDeclaredIds(call, counter)) {
+      if (seen.has(id2)) continue;
+      seen.add(id2);
       graph.push({
         type: "step",
         step: {
-          id
+          id: id2
         }
       });
     }
@@ -21909,9 +22159,9 @@ function sketchTopology(sourceFile, exportName, name, description) {
 }
 function metaOf(node, sources) {
   const n2 = node;
-  const id = n2.type === "step" ? n2.step.id : n2.id;
+  const id2 = n2.type === "step" ? n2.step.id : n2.id;
   const meta = {
-    id,
+    id: id2,
     kind: kindOf(n2.type)
   };
   const pick = /* @__PURE__ */ __name((k, v) => {
@@ -21951,7 +22201,7 @@ function metaOf(node, sources) {
     pick("itemTimeout", n2.itemTimeout);
   }
   if (n2.type === "waitForSignal") pick("outputSchema", n2.schema);
-  const src = sources.get(id);
+  const src = sources.get(id2);
   if (src) meta.source = src;
   return meta;
 }
@@ -22251,8 +22501,8 @@ function collectDeclaredStepIds(sourceFile) {
     if (callee.getText() !== "createStep") continue;
     const cfg = init3.getArguments()[0];
     if (cfg && Node18.isObjectLiteralExpression(cfg)) {
-      const id = extractStringProperty(cfg, "id");
-      if (id) ids.push(id);
+      const id2 = extractStringProperty(cfg, "id");
+      if (id2) ids.push(id2);
     }
   }
   return ids;
@@ -22665,14 +22915,14 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
           source: w.stepId ? sources.get(w.stepId) : void 0
         });
         const graphIds = new Set(collectGraphIds(graph));
-        for (const id of metadata.metadata.declaredStepIds ?? []) {
-          if (!graphIds.has(id) && tier.topology !== "sketch") {
+        for (const id2 of metadata.metadata.declaredStepIds ?? []) {
+          if (!graphIds.has(id2) && tier.topology !== "sketch") {
             issues.push({
               code: WORKFLOW_COMPILE_CODES.UNPLACED_STEP,
-              message: `createStep "${id}" is declared in ${relative(rootDir, metadata.sourcePath)} but placed in no workflow of the project (compiled with "${metadata.name}"; error at push \u2014 lua push workflow refuses the version: place it in a chain or delete the declaration)`,
+              message: `createStep "${id2}" is declared in ${relative(rootDir, metadata.sourcePath)} but placed in no workflow of the project (compiled with "${metadata.name}"; error at push \u2014 lua push workflow refuses the version: place it in a chain or delete the declaration)`,
               severity: "warning",
-              stepId: id,
-              source: sources.get(id)
+              stepId: id2,
+              source: sources.get(id2)
             });
           }
         }
@@ -22731,7 +22981,7 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
         const inheritTargets2 = new Set(workflows.flatMap((p) => p.graph?.inheritRefs ?? []));
         for (const p of workflows) if (p.graph && inheritTargets2.has(p.name)) p.graph = applyInheritCandidate(p.graph);
         const placed = /* @__PURE__ */ new Set();
-        for (const p of workflows) for (const id of collectGraphIds(p.graph.graph)) placed.add(id);
+        for (const p of workflows) for (const id2 of collectGraphIds(p.graph.graph)) placed.add(id2);
         for (const p of workflows) {
           if (!p.graph) continue;
           p.graph.issues = p.graph.issues.filter((i) => i.code !== WORKFLOW_COMPILE_CODES.UNPLACED_STEP || !i.stepId || !placed.has(i.stepId));
@@ -27640,7 +27890,7 @@ var init_workflow_api_service = __esm({
         throw new WorkflowApiError("FORBIDDEN", `Workflows.${member}: goals are scoped to the bound agent ${api.agentId}`, 403);
       }
     }, "assertBoundAgent");
-    pathId = /* @__PURE__ */ __name((id) => encodeURIComponent(id), "pathId");
+    pathId = /* @__PURE__ */ __name((id2) => encodeURIComponent(id2), "pathId");
     unavailable = /* @__PURE__ */ __name((member, route) => async () => {
       throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route} lands with a later wave)`, 501);
     }, "unavailable");
@@ -29025,9 +29275,10 @@ var init_mcp_server_handler = __esm({
       *   1. Link its id into an existing YAML entry by name if the id is missing.
       *   2. Append a new YAML entry if no local match by id or name exists.
       */
-      async applySyncToYaml(serverData, config, _manifest) {
+      async applySyncToYaml(serverData, config, _manifest, apiCredentials) {
         const messages = [];
         let yamlUpdated = false;
+        const registerOnly = apiCredentials?.registerOnly === true;
         if (!serverData.serverItems) {
           if (serverData.fetchError) {
             console.error(`\u274C Error syncing server ${this.displayNamePlural}: ${serverData.fetchError}`);
@@ -29050,32 +29301,33 @@ var init_mcp_server_handler = __esm({
           const idToIndex = /* @__PURE__ */ new Map();
           const nameToIndex = /* @__PURE__ */ new Map();
           items.forEach((item, idx) => {
-            const id = getId(item);
-            if (id) idToIndex.set(id, idx);
+            const id2 = getId(item);
+            if (id2) idToIndex.set(id2, idx);
             nameToIndex.set(item.name, idx);
           });
           for (const serverItem of syncableServers) {
-            const id = serverItem.id;
+            const id2 = serverItem.id;
             const name = serverItem.name;
-            if (idToIndex.has(id)) continue;
+            if (idToIndex.has(id2)) continue;
             const nameIdx = nameToIndex.get(name);
             if (nameIdx !== void 0) {
               if (!getId(items[nameIdx])) {
-                items[nameIdx][idField] = id;
-                idToIndex.set(id, nameIdx);
-                const msg2 = `\u{1F517} Linked "${name}" ${this.displayName} to server (ID: ${id})`;
+                items[nameIdx][idField] = id2;
+                idToIndex.set(id2, nameIdx);
+                const msg2 = `\u{1F517} Linked "${name}" ${this.displayName} to server (ID: ${id2})`;
                 messages.push(msg2);
                 console.log(msg2);
                 yamlUpdated = true;
               }
               continue;
             }
+            if (registerOnly) continue;
             const newItem = {
               name,
-              mcpServerId: id
+              mcpServerId: id2
             };
             items.push(newItem);
-            idToIndex.set(id, items.length - 1);
+            idToIndex.set(id2, items.length - 1);
             nameToIndex.set(name, items.length - 1);
             const msg = `\u{1F4E5} Added "${name}" ${this.displayName} from server`;
             messages.push(msg);
@@ -35693,7 +35945,7 @@ function coerceAgentStepOutput(schema, reply) {
 }
 __name(coerceAgentStepOutput, "coerceAgentStepOutput");
 var armId2 = /* @__PURE__ */ __name((arm) => arm.type === "step" ? arm.step.id : arm.id, "armId");
-var baseIdOf = /* @__PURE__ */ __name((id) => id.replace(/(\[\d+\]|#\d+)$/, ""), "baseIdOf");
+var baseIdOf = /* @__PURE__ */ __name((id2) => id2.replace(/(\[\d+\]|#\d+)$/, ""), "baseIdOf");
 var outputSchemaOf = /* @__PURE__ */ __name((entry) => {
   if (!entry) return void 0;
   if (entry.type === "step") return entry.step.outputSchema;
@@ -35797,36 +36049,36 @@ async function runWorkflowLocallyInner(rawOpts) {
       runtimeBodies.set(body.type === "step" ? body.step.id : body.id, body);
     }
   }
-  for (const [id, out] of Object.entries(opts.stepOutputs ?? {})) {
-    const node = plan.steps[id];
-    const body = node ? void 0 : runtimeBodies.get(id);
-    if (!node && !body) throw new WorkflowLocalUsageError("unknown-step", `--step-output: unknown step "${id}"`, id);
+  for (const [id2, out] of Object.entries(opts.stepOutputs ?? {})) {
+    const node = plan.steps[id2];
+    const body = node ? void 0 : runtimeBodies.get(id2);
+    if (!node && !body) throw new WorkflowLocalUsageError("unknown-step", `--step-output: unknown step "${id2}"`, id2);
     const schema = outputSchemaOf(node?.entry ?? body);
     const issues = schema ? validateJsonSchema(schema, out) : [];
     if (issues.length) {
-      throw new WorkflowLocalUsageError("step-output-schema", `--step-output ${id}: ${issues.join("; ")}`, id);
+      throw new WorkflowLocalUsageError("step-output-schema", `--step-output ${id2}: ${issues.join("; ")}`, id2);
     }
   }
-  const approvalEntryOf = /* @__PURE__ */ __name((id) => {
-    const node = plan.steps[id];
+  const approvalEntryOf = /* @__PURE__ */ __name((id2) => {
+    const node = plan.steps[id2];
     if (node?.kind === "approval") return node.entry;
-    const body = runtimeBodies.get(id) ?? runtimeBodies.get(baseIdOf(id));
+    const body = runtimeBodies.get(id2) ?? runtimeBodies.get(baseIdOf(id2));
     return body?.type === "approval" ? body : void 0;
   }, "approvalEntryOf");
-  for (const [id, answer] of Object.entries(opts.approvals ?? {})) {
-    const entry = approvalEntryOf(id);
+  for (const [id2, answer] of Object.entries(opts.approvals ?? {})) {
+    const entry = approvalEntryOf(id2);
     if (!entry) {
-      throw new WorkflowLocalUsageError("unknown-approval", `--approve/--deny: "${id}" is not an approval step`, id);
+      throw new WorkflowLocalUsageError("unknown-approval", `--approve/--deny: "${id2}" is not an approval step`, id2);
     }
     if (answer.decision === "approve" && answer.payload !== void 0) {
       const editable = entry.editablePaths ?? [];
       if (!entry.editable && editable.length === 0) {
-        throw new WorkflowLocalUsageError("approval-not-editable", `--approve ${id}: the approval is not editable`, id);
+        throw new WorkflowLocalUsageError("approval-not-editable", `--approve ${id2}: the approval is not editable`, id2);
       }
       if (entry.editedPayloadSchema) {
         const issues = validateJsonSchema(entry.editedPayloadSchema, answer.payload);
         if (issues.length) {
-          throw new WorkflowLocalUsageError("edited-payload-schema", `--approve ${id}: ${issues.join("; ")}`, id);
+          throw new WorkflowLocalUsageError("edited-payload-schema", `--approve ${id2}: ${issues.join("; ")}`, id2);
         }
       }
     }
@@ -35873,9 +36125,9 @@ async function runWorkflowLocallyInner(rawOpts) {
   }, "emit");
   const stamp = /* @__PURE__ */ __name(() => new Date(clock).toISOString().slice(11, 19), "stamp");
   const rows3 = /* @__PURE__ */ new Map();
-  const addRow = /* @__PURE__ */ __name((id, node, dependsOn, downstream, extra = {}) => {
+  const addRow = /* @__PURE__ */ __name((id2, node, dependsOn, downstream, extra = {}) => {
     const row2 = {
-      stepId: id,
+      stepId: id2,
       kind: node.kind,
       status: "pending",
       attempt: 0,
@@ -35885,12 +36137,12 @@ async function runWorkflowLocallyInner(rawOpts) {
       unsatisfied: dependsOn.length,
       ...extra
     };
-    rows3.set(id, row2);
+    rows3.set(id2, row2);
     return row2;
   }, "addRow");
-  for (const id of plan.order) {
-    const node = plan.steps[id];
-    addRow(id, node, [
+  for (const id2 of plan.order) {
+    const node = plan.steps[id2];
+    addRow(id2, node, [
       ...node.dependsOn
     ], [
       ...node.downstream
@@ -36093,14 +36345,14 @@ async function runWorkflowLocallyInner(rawOpts) {
       suspendData,
       // LUA-706: a run without input reads `null` — the pod's and the worker's rule (never `undefined`).
       getInitData: /* @__PURE__ */ __name(() => opts.input === void 0 ? null : opts.input, "getInitData"),
-      getStepResult: /* @__PURE__ */ __name((id) => {
-        if (!(id in stepResults)) {
-          const err = Object.assign(new Error(`step "${id}" is not a completed ancestor of "${row2.stepId}"`), {
+      getStepResult: /* @__PURE__ */ __name((id2) => {
+        if (!(id2 in stepResults)) {
+          const err = Object.assign(new Error(`step "${id2}" is not a completed ancestor of "${row2.stepId}"`), {
             code: "STEP_RESULT_NOT_ANCESTOR"
           });
           throw err;
         }
-        return stepResults[id];
+        return stepResults[id2];
       }, "getStepResult"),
       state: {
         get: /* @__PURE__ */ __name((k) => ledger.state[k], "get"),
@@ -36163,15 +36415,15 @@ async function runWorkflowLocallyInner(rawOpts) {
     return new StepFailure("input_schema_invalid", `input does not match inputSchema of "${single.step.id}" \u2014 the previous node does not emit what the step declares: ${issues.join("; ")}`);
   }, "stepInputIssue");
   const agentReply = /* @__PURE__ */ __name(async (row2, single, input) => {
-    const id = row2.stepId;
-    const fixture = opts.fixturesDir ? readFixture(id, row2.attempt) : void 0;
+    const id2 = row2.stepId;
+    const fixture = opts.fixturesDir ? readFixture(id2, row2.attempt) : void 0;
     if (opts.fixturesDir) return fixture;
     const prompt = renderPrompt(single);
     if (opts.agents === "live") {
       if (!opts.agentInvoke) throw new StepFailure("AGENTS_LIVE_UNAVAILABLE", "--agents live needs a dev API session");
       const t0 = Date.now();
-      const out = await withWall(id, single, () => opts.agentInvoke(single, prompt, input));
-      record(id, row2.attempt, {
+      const out = await withWall(id2, single, () => opts.agentInvoke(single, prompt, input));
+      record(id2, row2.attempt, {
         prompt,
         input
       }, out, Date.now() - t0);
@@ -36186,8 +36438,8 @@ async function runWorkflowLocallyInner(rawOpts) {
         elapsedS += wallS;
         clock += wallS * 1e3;
         const requeued = s < segments;
-        const nextSession = `session-${id}-s${s}`;
-        emit3("step.checkpointed", id, {
+        const nextSession = `session-${id2}-s${s}`;
+        emit3("step.checkpointed", id2, {
           segment: s,
           segmentsMax: segments,
           headSha: `local${s}`,
@@ -36203,7 +36455,7 @@ async function runWorkflowLocallyInner(rawOpts) {
           sessionRef: nextSession,
           reason: requeued ? "segment_boundary" : "interval"
         });
-        say(`[${stamp()}] ${id} \xB7 checkpointed \xB7 segment ${s}/${segments}${requeued ? ` \u2192 re-queued (resume ${nextSession})` : ""}`);
+        say(`[${stamp()}] ${id2} \xB7 checkpointed \xB7 segment ${s}/${segments}${requeued ? ` \u2192 re-queued (resume ${nextSession})` : ""}`);
         sessionRef = nextSession;
       }
       return {
@@ -36220,16 +36472,16 @@ async function runWorkflowLocallyInner(rawOpts) {
     object: stubFromSchema(single.outputSchema)
   } : {}, "fakeObject");
   const executeSingle = /* @__PURE__ */ __name(async (row2, single, rawInput) => {
-    const id = row2.stepId;
+    const id2 = row2.stepId;
     const input = nodeInputFor(row2, single, rawInput);
     const drift = stepInputIssue(single, input);
     if (drift) throw drift;
-    if (opts.stepOutputs && id in opts.stepOutputs) {
-      say(`[${stamp()}] ${id} \xB7 step-output supplied \u2014 execute skipped`);
-      return opts.stepOutputs[id];
+    if (opts.stepOutputs && id2 in opts.stepOutputs) {
+      say(`[${stamp()}] ${id2} \xB7 step-output supplied \u2014 execute skipped`);
+      return opts.stepOutputs[id2];
     }
-    const baseId = baseIdOf(id);
-    if (opts.stepOutputs && baseId !== id && baseId in opts.stepOutputs) return opts.stepOutputs[baseId];
+    const baseId = baseIdOf(id2);
+    if (opts.stepOutputs && baseId !== id2 && baseId in opts.stepOutputs) return opts.stepOutputs[baseId];
     switch (single.type) {
       case "step": {
         const def = opts.steps[single.step.id];
@@ -36240,22 +36492,22 @@ async function runWorkflowLocallyInner(rawOpts) {
         let suspendData;
         for (; ; ) {
           try {
-            return await withWall(id, single, (signal) => def.execute(buildCtx(row2, single, input, resumeData, suspendData, signal)));
+            return await withWall(id2, single, (signal) => def.execute(buildCtx(row2, single, input, resumeData, suspendData, signal)));
           } catch (e) {
             if (e instanceof SuspendSignal) {
               row2.status = "suspended";
-              emit3("step.suspended", id, {
+              emit3("step.suspended", id2, {
                 kind: "input"
               });
-              say(`[${stamp()}] ${id} \xB7 suspended \xB7 awaiting resumeData`);
+              say(`[${stamp()}] ${id2} \xB7 suspended \xB7 awaiting resumeData`);
               if (!opts.prompt) {
-                throw new WorkflowLocalUsageError("RESUME_UNANSWERED", `step "${id}" suspended and no resumeData is available offline (interactive stdin required)`, id);
+                throw new WorkflowLocalUsageError("RESUME_UNANSWERED", `step "${id2}" suspended and no resumeData is available offline (interactive stdin required)`, id2);
               }
               suspendData = e.payload;
-              resumeData = await opts.prompt("resume", id, e.payload);
+              resumeData = await opts.prompt("resume", id2, e.payload);
               const schema = single.step.resumeSchema;
               const issues = schema ? validateJsonSchema(schema, resumeData) : [];
-              if (issues.length) throw new WorkflowLocalUsageError("resume-schema", `resumeData for ${id}: ${issues.join("; ")}`, id);
+              if (issues.length) throw new WorkflowLocalUsageError("resume-schema", `resumeData for ${id2}: ${issues.join("; ")}`, id2);
               row2.status = "running";
               continue;
             }
@@ -36272,17 +36524,17 @@ async function runWorkflowLocallyInner(rawOpts) {
         return coerced.output;
       }
       case "tool": {
-        if (opts.fixturesDir) return readFixture(id, row2.attempt);
+        if (opts.fixturesDir) return readFixture(id2, row2.attempt);
         if (!opts.toolInvoke) {
-          throw new StepFailure("TOOL_NOT_AVAILABLE_OFFLINE", `tool step "${id}" (${single.toolId}) \u2014 supply --step-output ${id}=<json> or --fixtures`);
+          throw new StepFailure("TOOL_NOT_AVAILABLE_OFFLINE", `tool step "${id2}" (${single.toolId}) \u2014 supply --step-output ${id2}=<json> or --fixtures`);
         }
         const t0 = Date.now();
-        const out = await withWall(id, single, () => opts.toolInvoke(single, input));
-        record(id, row2.attempt, input, out, Date.now() - t0);
+        const out = await withWall(id2, single, () => opts.toolInvoke(single, input));
+        record(id2, row2.attempt, input, out, Date.now() - t0);
         return out;
       }
       case "workflow": {
-        throw new StepFailure("SUBRUN_NOT_SUPPORTED_OFFLINE", `nested workflow "${single.workflowId}" cannot run offline \u2014 supply --step-output ${id}=<json>`);
+        throw new StepFailure("SUBRUN_NOT_SUPPORTED_OFFLINE", `nested workflow "${single.workflowId}" cannot run offline \u2014 supply --step-output ${id2}=<json>`);
       }
     }
   }, "executeSingle");
@@ -36953,7 +37205,7 @@ async function runWorkflowLocallyInner(rawOpts) {
   }
   const lastId = [
     ...plan.order
-  ].reverse().find((id) => rows3.get(id)?.status === "completed");
+  ].reverse().find((id2) => rows3.get(id2)?.status === "completed");
   const tail = lastId ? rows3.get(lastId) : void 0;
   const tailOutput = tail && tail.node.kind !== "branch" && tail.node.kind !== "foreach" ? tail.output : lastId ? stepResults[joinIdOf(lastId)] ?? tail?.output : void 0;
   const output = tailOutput;
@@ -36988,9 +37240,9 @@ async function runWorkflowLocallyInner(rawOpts) {
     timeline
   };
   function finalizeLedger() {
-    for (const [id, r] of rows3) {
-      ledger.steps[id] = {
-        stepId: id,
+    for (const [id2, r] of rows3) {
+      ledger.steps[id2] = {
+        stepId: id2,
         kind: r.kind,
         status: r.status,
         attempt: r.attempt,
@@ -37879,8 +38131,8 @@ var WorkflowHandler = class extends BaseVersionedHandler {
   staleYamlRows(yamlItems, serverItems, manifestNames) {
     const serverIds = new Set(serverItems.map((s) => s?.id));
     return yamlItems.filter((row2) => {
-      const id = this.getItemId(row2);
-      return !!id && !serverIds.has(id) && manifestNames.has(row2.name);
+      const id2 = this.getItemId(row2);
+      return !!id2 && !serverIds.has(id2) && manifestNames.has(row2.name);
     });
   }
   async publishVersion(apiKey, agentId, entityId, version) {
@@ -38025,7 +38277,7 @@ var WorkflowHandler = class extends BaseVersionedHandler {
 };
 var workflowHandler = new WorkflowHandler();
 function unplacedStepError(workflowName, stepIds) {
-  const list = stepIds.map((id) => `"${id}"`).join(", ");
+  const list = stepIds.map((id2) => `"${id2}"`).join(", ");
   return new CliError("unplaced_step", `workflow "${workflowName}" is not pushed: createStep ${list} ${stepIds.length === 1 ? "is" : "are"} declared in its source file but placed in no workflow (WORKFLOW_UNPLACED_STEP)`, {
     hint: `place ${stepIds.length === 1 ? "it" : "them"} in a chain (.then(step) / .parallel([...])) or delete the declaration, then push again \u2014 lua compile lists every unplaced step`
   });
@@ -38040,9 +38292,9 @@ __name(toolUnbundledError, "toolUnbundledError");
 function workflowNameTakenHint(name, error) {
   if (error?.code !== "WORKFLOW_NAME_TAKEN") return null;
   const holder = error.dynamic ? "a chat-composed (dynamic) workflow" : "an existing workflow";
-  const id = error.workflowId ? ` (${error.workflowId})` : "";
+  const id2 = error.workflowId ? ` (${error.workflowId})` : "";
   const see = error.dynamic ? "run `lua workflows list --all` to see it" : "run `lua workflows list` to see it";
-  return `workflow name "${name}" is held by ${holder}${id} \u2014 ${see}. Push does not replace it: rename this workflow, or delete the other one first.`;
+  return `workflow name "${name}" is held by ${holder}${id2} \u2014 ${see}. Push does not replace it: rename this workflow, or delete the other one first.`;
 }
 __name(workflowNameTakenHint, "workflowNameTakenHint");
 function workflowModelMemberError(workflowName, issues) {
@@ -38087,7 +38339,8 @@ async function compileCommand(options) {
     const debugMode = options?.debug || debugEnabled();
     const verboseMode = options?.verbose || debugMode;
     const doSync = options?.sync === true;
-    const doServerSync = options?.serverSync === true;
+    const registerOnly = options?.serverSync === "register-only";
+    const doServerSync = options?.serverSync === true || registerOnly;
     if (debugMode) {
       console.log("\u{1F41B} Debug mode enabled");
     }
@@ -38186,12 +38439,13 @@ async function compileCommand(options) {
     if (!doServerSync) {
       writeInfo("\u2139\uFE0F  Server sync skipped \u2014 nothing was sent to the server; `lua push` publishes.");
     } else if (apiKey && agentId) {
-      writeProgress("\u{1F504} Syncing with server...");
+      writeProgress(registerOnly ? "\u{1F504} Registering primitives with server (read-only for lua.skill.yaml versions)..." : "\u{1F504} Syncing with server...");
       const fetchResults = await Promise.all(syncableHandlers.map((h) => h.fetchServerState(apiKey, agentId)));
       for (let i = 0; i < syncableHandlers.length; i++) {
         const applyResult = await syncableHandlers[i].applySyncToYaml(fetchResults[i], syncConfig, result.manifest, {
           apiKey,
-          agentId
+          agentId,
+          registerOnly
         });
         if (applyResult.yamlUpdated) {
           syncConfig = readYamlConfig();
@@ -40081,24 +40335,24 @@ function parseSteeringFlags(flags) {
   const approvals = {};
   for (const raw of asList(flags.approve)) {
     const eq3 = raw.indexOf("=");
-    const id = (eq3 === -1 ? raw : raw.slice(0, eq3)).trim();
-    if (!id) throw new WorkflowLocalUsageError("usage", `--approve expects <id>[=@payload] (got "${raw}")`);
-    approvals[id] = {
+    const id2 = (eq3 === -1 ? raw : raw.slice(0, eq3)).trim();
+    if (!id2) throw new WorkflowLocalUsageError("usage", `--approve expects <id>[=@payload] (got "${raw}")`);
+    approvals[id2] = {
       decision: "approve",
-      payload: eq3 === -1 ? void 0 : parseJsonOrFile(raw.slice(eq3 + 1).trim(), `--approve ${id}`)
+      payload: eq3 === -1 ? void 0 : parseJsonOrFile(raw.slice(eq3 + 1).trim(), `--approve ${id2}`)
     };
   }
   for (const raw of asList(flags.deny)) {
     const eq3 = raw.indexOf("=");
-    const id = (eq3 === -1 ? raw : raw.slice(0, eq3)).trim();
-    if (!id) throw new WorkflowLocalUsageError("usage", `--deny expects <id>[=@reason] (got "${raw}")`);
-    if (approvals[id]) throw new WorkflowLocalUsageError("usage", `--deny ${id}: also passed to --approve`);
+    const id2 = (eq3 === -1 ? raw : raw.slice(0, eq3)).trim();
+    if (!id2) throw new WorkflowLocalUsageError("usage", `--deny expects <id>[=@reason] (got "${raw}")`);
+    if (approvals[id2]) throw new WorkflowLocalUsageError("usage", `--deny ${id2}: also passed to --approve`);
     let reason;
     if (eq3 !== -1) {
       const rhs = raw.slice(eq3 + 1).trim();
-      reason = rhs.startsWith("@") ? String(parseJsonOrFile(rhs, `--deny ${id}`)) : rhs;
+      reason = rhs.startsWith("@") ? String(parseJsonOrFile(rhs, `--deny ${id2}`)) : rhs;
     }
-    approvals[id] = {
+    approvals[id2] = {
       decision: "deny",
       reason
     };
@@ -43036,6 +43290,7 @@ async function pushAllCommand(options) {
   }
   const allResults = [];
   const toDeploy = [];
+  const stagedWorkflows = [];
   const failedItems = [];
   let deployFailedCount = 0;
   let personaPushResult = null;
@@ -43166,13 +43421,18 @@ ${icon} Pushing ${items.length} ${handler.displayName}(s)...`);
           entityId
         });
         writeSuccess(`  \u2705 ${item.name} v${newVersion} pushed`);
-        if (options.autoDeploy || handler.kind === PrimitiveKind.WORKFLOW) {
+        if (options.autoDeploy) {
           toDeploy.push({
             handler,
             name: item.name,
             version: newVersion,
             entityId
           });
+        } else if (handler.kind === PrimitiveKind.WORKFLOW) {
+          stagedWorkflows.push({
+            name: item.name,
+            version: newVersion
+          });
         }
       } catch (error) {
         if (AuthenticationError.isAuthenticationError(error)) throw error;
@@ -43221,8 +43481,7 @@ ${icon} Pushing ${items.length} ${handler.displayName}(s)...`);
     writePersonaServedHint(personaPushResult.version);
   }
   if (toDeploy.length > 0) {
-    const workflowsOnly = !options.autoDeploy;
-    writeProgress(workflowsOnly ? "\n\u{1F680} Activating workflow version(s) \u2014 workflows deploy on their own, not via `lua version promote`..." : "\n\u{1F680} Deploying all pushed versions to production...");
+    writeProgress("\n\u{1F680} Deploying all pushed versions to production...");
     writeInfo("\u23F1\uFE0F  Waiting for server to process versions (5 seconds)...\n");
     await new Promise((resolve7) => setTimeout(resolve7, 5e3));
     for (const item of toDeploy) {
@@ -43348,7 +43607,12 @@ Until the backup catches up, \`lua init\` for this agent will restore an older s
     // Agent-versioning telemetry.
     versioning_mode: "stage-all",
     granular_deprecation_warned: false,
-    auto_deploy_noop_warned: options.autoDeployNoopWarned || false
+    auto_deploy_noop_warned: options.autoDeployNoopWarned || false,
+    // PRO-2158: how many workflow versions this push uploaded WITHOUT activating. Before the fix this was
+    // always 0 because every workflow was published (and, via the server's scoped promote, silently moved
+    // the agent's active version). A rising count here against a flat `lua workflows deploy` rate is the
+    // signal that users are not finding the printed activation step.
+    workflows_staged_not_activated: stagedWorkflows.length
   });
   try {
     await tryGitCommit({
@@ -43363,6 +43627,11 @@ Until the backup catches up, \`lua init\` for this agent will restore an older s
     failedCount: failedItems.length + deployFailedCount
   });
   process.exitCode = pushAllExitCode(variant);
+  if (stagedWorkflows.length > 0) {
+    console.log("");
+    writeInfo(`\u2139\uFE0F  Workflow version(s) staged, NOT activated (workflows do not ride \`lua version promote\`). Activate each with:
+` + stagedWorkflows.map((w) => `     lua workflows deploy ${w.name} -v ${w.version}`).join("\n"));
+  }
   if (variant === "success") {
     console.log("");
     if (!options.suppressVersionCreateHint) {
@@ -45114,7 +45383,7 @@ async function setupChatEnvironment(chatEnv, config) {
   writeProgress("\u{1F504} Setting up sandbox environment...");
   writeProgress("\u{1F504} Compiling skill...");
   await compileCommand({
-    serverSync: true
+    serverSync: "register-only"
   });
   const manifest = loadManifest();
   const skills = getPrimitivesByKind(manifest, PrimitiveKind.SKILL);
@@ -56817,13 +57086,13 @@ function consentCardLines(consent) {
 }
 __name(consentCardLines, "consentCardLines");
 function printRun(run, withSteps) {
-  const id = runIdOf(run);
+  const id2 = runIdOf(run);
   console.log(`
-\u{1F9ED} Run ${id} \xB7 ${run.status}`);
+\u{1F9ED} Run ${id2} \xB7 ${run.status}`);
   console.log(`   Workflow: ${run.workflowId} @ ${run.workflowVersionId} (${shortHash(run.graphHash)})`);
   console.log(`   Trigger:  ${run.trigger}${run.correlationKey ? ` \xB7 correlation ${run.correlationKey}` : ""}${run.tags?.length ? ` \xB7 tags ${run.tags.join(",")}` : ""}`);
   console.log(`   Created:  ${when2(run.createdAt)}${run.startedAt ? ` \xB7 started ${when2(run.startedAt)}` : ""}${run.completedAt ? ` \xB7 completed ${when2(run.completedAt)}` : ""}`);
-  if (run.lineageId && run.lineageId !== id) console.log(`   Lineage:  ${run.lineageId}`);
+  if (run.lineageId && run.lineageId !== id2) console.log(`   Lineage:  ${run.lineageId}`);
   if (run.parentRunId) console.log(`   Parent:   ${run.parentRunId} \u2014 lua workflows status ${run.parentRunId} --steps`);
   const consent = consentLine(run.consent);
   if (consent) console.log(`   Consent:  ${consent}`);
@@ -56836,19 +57105,19 @@ function printRun(run, withSteps) {
     const kind = run.gate.kind;
     if (kind === "exception") {
       console.log(run.status === "running" ? "\n\u26A0\uFE0F  Needs a decision \u2014 a step is parked on an exception gate (the run continues past it):" : "\n\u26A0\uFE0F  Needs a decision \u2014 the run is parked on an exception gate:");
-      console.log(`   lua workflows retry-step ${id} --step <id>`);
-      console.log(`   lua workflows resolve-step ${id} --step <id> --outcome skip|complete|fail [--output <json|@file>]`);
+      console.log(`   lua workflows retry-step ${id2} --step <id>`);
+      console.log(`   lua workflows resolve-step ${id2} --step <id> --outcome skip|complete|fail [--output <json|@file>]`);
     } else if (kind === "budget") {
       console.log(`
 \u23F8\uFE0F  Paused \u2014 run budget reached (${budgetCopy(run)}):`);
-      console.log(`   lua workflows raise-budget ${id} --credits <n>   (<n> is the new cap in ${budgetEngineOf(run) === "seat" ? "actions" : "credits"})`);
+      console.log(`   lua workflows raise-budget ${id2} --credits <n>   (<n> is the new cap in ${budgetEngineOf(run) === "seat" ? "actions" : "credits"})`);
     } else if (kind === "billing") {
       for (const line of billingParkLines(run)) console.log(line);
     } else if (kind === "model_policy") {
       console.log(`
 \u23F8\uFE0F  Paused \u2014 a step's model request cannot be resolved under the current policy:`);
       if (run.gate?.code) console.log(`   ${run.gate.code}${run.gate.stepId ? ` \xB7 step ${run.gate.stepId}` : ""}`);
-      console.log(`   lua workflows clear-gate ${id} --kind model_policy`);
+      console.log(`   lua workflows clear-gate ${id2} --kind model_policy`);
     } else {
       console.log(`   Gate:     ${kind}${run.gate.reason ? ` (${run.gate.reason})` : ""}${run.gate.since ? ` since ${when2(run.gate.since)}` : ""}`);
     }
@@ -56864,7 +57133,7 @@ function printRun(run, withSteps) {
     const fetchable = outputRefLine(run.outputRef);
     if (fetchable) console.log(`   Download: ${fetchable}`);
   } else if (run.hasOutput) {
-    console.log(`   Output:   present \u2014 lua workflows status ${id} --steps`);
+    console.log(`   Output:   present \u2014 lua workflows status ${id2} --steps`);
   } else if (RUN_TERMINAL_STATUSES.has(run.status)) {
     const last = lastCompletedPreview(steps);
     console.log(`   Output:   (none${last ? "" : withSteps ? "" : " \u2014 pass --steps for per-step output previews"})`);
@@ -56909,7 +57178,7 @@ function printRun(run, withSteps) {
 }
 __name(printRun, "printRun");
 function billingParkLines(run) {
-  const id = runIdOf(run);
+  const id2 = runIdOf(run);
   const gate = run.gate ?? {
     kind: "billing"
   };
@@ -56920,7 +57189,7 @@ function billingParkLines(run) {
 \u23F8\uFE0F  Paused \u2014 payment required (${what})${step3}:`
   ];
   out.push("   top up the workspace (or ask a workspace admin to) \u2014 the run resumes on its own within a few minutes of the top-up");
-  out.push(`   to resume it right away after topping up: lua workflows retry-step ${id} --step ${gate.stepId ?? "<stepId>"}`);
+  out.push(`   to resume it right away after topping up: lua workflows retry-step ${id2} --step ${gate.stepId ?? "<stepId>"}`);
   if (typeof gate.expiresAt === "number") out.push(`   still unpaid at ${when2(gate.expiresAt)} \u21D2 the run fails`);
   return out;
 }
@@ -57757,8 +58026,8 @@ function actorLabel(by, now = Date.now()) {
   if (typeof by !== "object") return String(by);
   const a = by;
   const kind = a.subjectType ?? a.kind;
-  const id = a.name ?? a.subjectId ?? a.id;
-  const who = kind && id ? `${kind}:${id}` : kind ?? id;
+  const id2 = a.name ?? a.subjectId ?? a.id;
+  const who = kind && id2 ? `${kind}:${id2}` : kind ?? id2;
   if (!who) return void 0;
   const at = typeof a.at === "number" ? a.at : typeof a.at === "string" ? Date.parse(a.at) : NaN;
   return Number.isFinite(at) ? `${who} (${agoFrom(at, now)})` : who;