lua-cli 3.39.2 → 3.39.4

package/dist/api-exports.js

@@ -135,6 +135,9 @@ function isInteractiveTurn(turn) {
 function removeNavigateBlock(input) {
   return input.replace(/::: navigate[\s\S]*?:::/g, "").trim();
 }
+function removeHiddenBlocks(input) {
+  return input.replace(/::: hide\b[\s\S]*?:::/gi, "").replace(/::: hide\b[\s\S]*$/gi, "").trim();
+}
 function transformChatHistoryContentParts(parts) {
   const content = [];
   for (const rawPart of parts ?? []) {
@@ -764,6 +767,7 @@ function utf8Bytes(value3) {
 }
 function isPlainFieldKey(key) {
   if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
+  if (key === LOG_FIELDS_CLAMPED_KEY) return false;
   return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
 }
 function describeAgentLogFieldsViolation(value3) {
@@ -1989,7 +1993,44 @@ function parseOnboardingFlow(value3) {
 function parsePublishedOnboardingResponse(value3) {
   return getPublishedOnboardingResponseSchema.parse(value3);
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema;
+function isForwardableWebRouteRequestHeader(name) {
+  const n2 = name.toLowerCase();
+  return WEB_ROUTE_REQUEST_HEADER_ALLOWLIST.includes(n2) || n2.startsWith("x-lua-");
+}
+function isForwardableWebRouteResponseHeader(name) {
+  const n2 = name.toLowerCase();
+  if (n2 === "set-cookie") return false;
+  return WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST.includes(n2) || n2.startsWith("x-lua-");
+}
+function isWebRouteBody(value3) {
+  if (!value3 || typeof value3 !== "object") return false;
+  const b = value3;
+  if (b.kind === "json") return "value" in b;
+  if (b.kind === "text" || b.kind === "base64") return typeof b.value === "string";
+  return false;
+}
+function isWebRouteInput(value3) {
+  if (!value3 || typeof value3 !== "object") return false;
+  const v = value3;
+  if (v.v !== WEB_ROUTE_PROTOCOL_VERSION) return false;
+  const r = v.request;
+  if (!r || typeof r !== "object") return false;
+  if (!WEB_ROUTE_METHODS.includes(String(r.method))) return false;
+  if (typeof r.path !== "string" || !r.path.startsWith("/")) return false;
+  if (!r.params || typeof r.params !== "object") return false;
+  if (!r.query || typeof r.query !== "object") return false;
+  if (!r.headers || typeof r.headers !== "object") return false;
+  if (r.body !== void 0) {
+    if (r.method === "GET") return false;
+    if (!isWebRouteBody(r.body)) return false;
+  }
+  const a = v.auth;
+  if (!a || typeof a.userId !== "string" || typeof a.orgId !== "string" || typeof a.agentId !== "string") return false;
+  const app = v.app;
+  if (!app || typeof app.id !== "string" || typeof app.name !== "string" || typeof app.origin !== "string") return false;
+  return true;
+}
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -2098,6 +2139,8 @@ var init_dist = __esm({
     __name2(isInteractiveTurn, "isInteractiveTurn");
     __name(removeNavigateBlock, "removeNavigateBlock");
     __name2(removeNavigateBlock, "removeNavigateBlock");
+    __name(removeHiddenBlocks, "removeHiddenBlocks");
+    __name2(removeHiddenBlocks, "removeHiddenBlocks");
     __name(transformChatHistoryContentParts, "transformChatHistoryContentParts");
     __name2(transformChatHistoryContentParts, "transformChatHistoryContentParts");
     RICH_PARTS_MESSAGE_ID_PREFIX = "rich-parts:";
@@ -2689,6 +2732,7 @@ This text is who you are for this person. As you learn them, their name, their w
       "skill",
       "job",
       "webhook",
+      "web-route",
       "trigger",
       "preprocessor",
       "postprocessor",
@@ -4380,6 +4424,39 @@ listed here; never invent a target.`;
     __name2(parseOnboardingFlow, "parseOnboardingFlow");
     __name(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
     __name2(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
+    WEB_ROUTE_PROTOCOL_VERSION = 1;
+    WEB_ROUTE_METHODS = [
+      "GET",
+      "POST",
+      "PUT",
+      "PATCH",
+      "DELETE"
+    ];
+    WEB_ROUTE_REQUEST_HEADER_ALLOWLIST = [
+      "accept",
+      "accept-language",
+      "content-type",
+      "if-none-match",
+      "idempotency-key"
+    ];
+    WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST = [
+      "content-type",
+      "cache-control",
+      "etag",
+      "location",
+      "content-disposition",
+      "content-language"
+    ];
+    __name(isForwardableWebRouteRequestHeader, "isForwardableWebRouteRequestHeader");
+    __name2(isForwardableWebRouteRequestHeader, "isForwardableWebRouteRequestHeader");
+    __name(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
+    __name2(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
+    WEB_ROUTE_MAX_REQUEST_BODY_BYTES = 1 * 1024 * 1024;
+    WEB_ROUTE_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+    __name(isWebRouteBody, "isWebRouteBody");
+    __name2(isWebRouteBody, "isWebRouteBody");
+    __name(isWebRouteInput, "isWebRouteInput");
+    __name2(isWebRouteInput, "isWebRouteInput");
   }
 });
 
@@ -9852,8 +9929,8 @@ function uidFromFirebaseIdToken(idToken) {
   if (parsed.success) return parsed.data.sub;
   throw new Error(INVALID_FIREBASE_SESSION);
 }
-function parseFirebaseSession(json, now = Date.now()) {
-  const customTokenResponse = customTokenResponseSchema.safeParse(json);
+function parseFirebaseSession(json2, now = Date.now()) {
+  const customTokenResponse = customTokenResponseSchema.safeParse(json2);
   if (customTokenResponse.success) {
     const { idToken: idToken2, refreshToken: refreshToken2, expiresIn: expiresIn2, localId } = customTokenResponse.data;
     return {
@@ -9863,7 +9940,7 @@ function parseFirebaseSession(json, now = Date.now()) {
       uid: localId ?? uidFromFirebaseIdToken(idToken2)
     };
   }
-  const refreshResponse = refreshResponseSchema.safeParse(json);
+  const refreshResponse = refreshResponseSchema.safeParse(json2);
   if (!refreshResponse.success) throw new Error(INVALID_FIREBASE_SESSION);
   const { id_token: idToken, refresh_token: refreshToken, expires_in: expiresIn, user_id: uid } = refreshResponse.data;
   return {
@@ -11345,8 +11422,8 @@ function buildSourceArchive(files) {
     map[entryFile] = source;
   }
   if (Object.keys(map).length === 0) return null;
-  const json = JSON.stringify(map);
-  const gz = zlib.gzipSync(Buffer.from(json, "utf-8"));
+  const json2 = JSON.stringify(map);
+  const gz = zlib.gzipSync(Buffer.from(json2, "utf-8"));
   return gz.toString("base64");
 }
 function getPrimitivesByKind(manifest, kind) {
@@ -16269,8 +16346,8 @@ var init_workflow_api_service = __esm({
       }
     }, "assertBoundAgent");
     pathId = /* @__PURE__ */ __name((id2) => encodeURIComponent(id2), "pathId");
-    unavailable = /* @__PURE__ */ __name((member, route) => async () => {
-      throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route} lands with a later wave)`, 501);
+    unavailable = /* @__PURE__ */ __name((member, route2) => async () => {
+      throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route2} lands with a later wave)`, 501);
     }, "unavailable");
     __name(createWorkflowsRuntime, "createWorkflowsRuntime");
     WorkflowApi = class extends HttpClient {
@@ -17726,6 +17803,91 @@ function defineVoice(config) {
 }
 __name(defineVoice, "defineVoice");
 
+// src/types/web-app.ts
+init_dist();
+var WEB_APP_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+var ROUTE_KEY_PATTERN = new RegExp(`^(${WEB_ROUTE_METHODS.join("|")}) /\\S*$`);
+function route(def) {
+  if (typeof def.handler !== "function") {
+    throw new Error("route() requires a `handler` function.");
+  }
+  return def;
+}
+__name(route, "route");
+function json(data, status = 200, headers = {}) {
+  const hasBody = data !== void 0 && status !== 204 && status !== 304;
+  return new Response(hasBody ? JSON.stringify(data) : null, {
+    status,
+    headers: hasBody ? {
+      "content-type": "application/json",
+      ...headers
+    } : headers
+  });
+}
+__name(json, "json");
+var LuaWebApp = class {
+  static {
+    __name(this, "LuaWebApp");
+  }
+  config;
+  constructor(config) {
+    if (!config || typeof config !== "object") {
+      throw new Error("defineWebApp requires a configuration object.");
+    }
+    if (typeof config.name !== "string" || !WEB_APP_NAME_PATTERN.test(config.name)) {
+      throw new Error(`defineWebApp: \`name\` must match ${WEB_APP_NAME_PATTERN} (lower-case letters, digits and dashes, starting with a letter); got ${JSON.stringify(config.name)}.`);
+    }
+    if (!config.pages || typeof config.pages.root !== "string" || !config.pages.root.trim()) {
+      throw new Error(`defineWebApp(${config.name}): \`pages.root\` (the Vite project directory) is required.`);
+    }
+    const hasRoutes = !!config.routes && Object.keys(config.routes).length > 0;
+    const hasFetch = typeof config.fetch === "function";
+    if (!hasRoutes && !hasFetch) {
+      throw new Error(`defineWebApp(${config.name}): declare at least one entry in \`routes\` or a \`fetch\` handler.`);
+    }
+    for (const key of Object.keys(config.routes ?? {})) {
+      if (!ROUTE_KEY_PATTERN.test(key)) {
+        throw new Error(`defineWebApp(${config.name}): route key ${JSON.stringify(key)} must look like 'GET /path' (${WEB_ROUTE_METHODS.join(", ")}, one space, a path starting with /).`);
+      }
+      const def = config.routes[key];
+      if (!def || typeof def.handler !== "function") {
+        throw new Error(`defineWebApp(${config.name}): route ${JSON.stringify(key)} has no \`handler\` function.`);
+      }
+    }
+    for (const item of config.pages.nav ?? []) {
+      if (typeof item?.path !== "string" || !item.path.startsWith("/") || typeof item?.label !== "string") {
+        throw new Error(`defineWebApp(${config.name}): every \`pages.nav\` item needs a \`path\` starting with / and a \`label\`.`);
+      }
+    }
+    this.config = config;
+  }
+  getName() {
+    return this.config.name;
+  }
+  getDescription() {
+    return this.config.description;
+  }
+  getPages() {
+    return this.config.pages;
+  }
+  getBranding() {
+    return this.config.branding;
+  }
+  getRoutes() {
+    return this.config.routes ?? {};
+  }
+  getFetch() {
+    return this.config.fetch;
+  }
+  getConfig() {
+    return this.config;
+  }
+};
+function defineWebApp(config) {
+  return new LuaWebApp(config);
+}
+__name(defineWebApp, "defineWebApp");
+
 // src/api-exports.ts
 init_workflow();
 init_dist();
@@ -18499,6 +18661,7 @@ export {
   LuaTrigger,
   LuaVoice,
   LuaVoiceTool,
+  LuaWebApp,
   LuaWebhook,
   LuaWorkflow,
   LuaWorkflowBuildError,
@@ -18515,6 +18678,7 @@ export {
   User,
   UserDataInstance,
   Voice,
+  WEB_APP_NAME_PATTERN,
   Workflows,
   and2 as and,
   createStep,
@@ -18523,6 +18687,7 @@ export {
   defineDeviceTrigger,
   defineTrigger,
   defineVoice,
+  defineWebApp,
   defineWorkflow,
   env,
   eq2 as eq,
@@ -18536,6 +18701,7 @@ export {
   gte2 as gte,
   inSet2 as inSet,
   init2 as init,
+  json,
   lit2 as lit,
   log,
   lt2 as lt,
@@ -18545,6 +18711,7 @@ export {
   notExists2 as notExists,
   notIn2 as notIn,
   or2 as or,
+  route,
   rows2 as rows,
   state2 as state,
   step2 as step,