lua-cli 3.39.3 → 3.39.4

package/dist/api-exports.d.ts

@@ -1927,6 +1927,37 @@ export declare function defineTrigger<T = any>(config: LuaTriggerConfig<T>): Lua
  */
 export declare function defineVoice(config: LuaVoiceConfig): LuaVoice;
 
+/**
+ * Define a web app on the agent.
+ *
+ * @example
+ * ```typescript
+ * import { defineWebApp, route, json } from 'lua-cli';
+ * import { z } from 'zod';
+ *
+ * export default defineWebApp({
+ *   name: 'ops-dashboard',
+ *   description: 'Open tickets per shop',
+ *   pages: { root: './web', nav: [{ path: '/', label: 'Overview' }] },
+ *   routes: {
+ *     'GET /tickets': route({
+ *       query: z.object({ status: z.enum(['open', 'closed']).default('open') }),
+ *       handler: async ({ query }) => ({ items: (await Data.get('tickets', { filter: { status: query.status } })).data }),
+ *     }),
+ *     'POST /tickets/:id/close': route({
+ *       params: z.object({ id: z.string() }),
+ *       body: z.object({ note: z.string().max(500) }),
+ *       handler: async ({ params, body, auth }) => {
+ *         await Data.patch('tickets', params.id, { set: { status: 'closed', closedBy: auth.userId, note: body.note } });
+ *         return json(undefined, 204);
+ *       },
+ *     }),
+ *   },
+ * });
+ * ```
+ */
+export declare function defineWebApp(config: LuaWebAppConfig): LuaWebApp;
+
 export declare function defineWorkflow(cfg: LuaWorkflowConfig, build: (wf: LuaWorkflowBuilder) => LuaWorkflow): LuaWorkflow;
 
 /**
@@ -3125,6 +3156,11 @@ declare interface JobVersion {
     metadata?: Record<string, any>;
 }
 
+/**
+ * Build a JSON `Response`. `json(undefined, 204)` answers with no body.
+ */
+export declare function json(data: unknown, status?: number, headers?: Record<string, string>): Response;
+
 export { JsonSchema }
 
 export { KnowledgeBindingSpec }
@@ -3394,6 +3430,9 @@ export declare interface LuaAgentConfig {
  */
 export declare type LuaAgentModel = string | ((request: LuaRequest) => string | Promise<string>);
 
+/** The signed-in person a route runs for (never an API key, never anonymous). */
+export declare type LuaAuth = WebRouteAuth;
+
 /**
  * LuaDevice class — represents an external device that an agent can communicate with.
  *
@@ -5088,6 +5127,37 @@ export declare interface LuaVoiceTurnContext {
     }): void;
 }
 
+/**
+ * Lua Web App — the class form of `defineWebApp` (consistent with
+ * `LuaTrigger` / `defineTrigger`). Validates the definition eagerly so a
+ * mistake fails at `lua compile`, not at first request.
+ */
+export declare class LuaWebApp {
+    private readonly config;
+    constructor(config: LuaWebAppConfig);
+    getName(): string;
+    getDescription(): string | undefined;
+    getPages(): WebAppPages;
+    getBranding(): WebAppBranding | undefined;
+    getRoutes(): Record<string, RouteDefinition<any, any, any>>;
+    getFetch(): LuaWebAppConfig['fetch'];
+    getConfig(): LuaWebAppConfig;
+}
+
+export declare interface LuaWebAppConfig {
+    /** URL-safe name: `^[a-z][a-z0-9-]*$`. The app's identifier on the agent. */
+    name: string;
+    description?: string;
+    pages: WebAppPages;
+    branding?: WebAppBranding;
+    /** Typed route handlers keyed by `'<METHOD> /<path>'`. */
+    routes?: Record<string, RouteDefinition<any, any, any>>;
+    /** Escape hatch: a Web-standard `fetch` handler (Hono, itty-router, …) for
+     *  paths no route matches. Apps that use only `fetch` forgo manifest-driven
+     *  route access and the typed client. */
+    fetch?: (request: Request) => Promise<Response> | Response;
+}
+
 /**
  * Lua Webhook class.
  * Main class for building webhooks with validated inputs.
@@ -6468,6 +6538,46 @@ declare type ResumeStepResult = {
  *  `maxBackoffSeconds` (default 3600) only meaningful with 'exponential' (`backoff-invalid` otherwise). */
 export declare type RetryPolicy = WorkflowRetryPolicy;
 
+/**
+ * Declare a route. Identity at runtime; exists so the compiler can see the
+ * schemas and the handler, and so `RouteContext` is inferred from them.
+ */
+export declare function route<P = Record<string, string>, Q = Record<string, string | string[]>, B = unknown>(def: RouteDefinition<P, Q, B>): RouteDefinition<P, Q, B>;
+
+/** What a route handler receives. `params`, `query` and `body` are already
+ *  validated by the route's schemas when those are declared. */
+export declare interface RouteContext<P = Record<string, string>, Q = Record<string, string | string[]>, B = unknown> {
+    params: P;
+    query: Q;
+    body: B;
+    /** Lower-cased, allow-listed request headers. */
+    headers: Record<string, string>;
+    method: WebRouteMethod;
+    path: string;
+    /** The matched route key. */
+    route?: string;
+    auth: LuaAuth;
+    app: WebRouteApp;
+    /** The Web `Request` the gateway received, for handlers that want it. */
+    request: Request;
+}
+
+export declare interface RouteDefinition<P = Record<string, string>, Q = Record<string, string | string[]>, B = unknown> {
+    description?: string;
+    /** Zod schema for path parameters; a failure answers 400 `VALIDATION`. */
+    params?: ZodType<P>;
+    /** Zod schema for query parameters; a failure answers 400 `VALIDATION`. */
+    query?: ZodType<Q>;
+    /** Zod schema for the request body; a failure answers 400 `VALIDATION`. */
+    body?: ZodType<B>;
+    /** Response schemas by status, for the typed client (not enforced at runtime). */
+    responses?: Record<number, ZodType>;
+    handler: (ctx: RouteContext<P, Q, B>) => Promise<RouteHandlerResult> | RouteHandlerResult;
+}
+
+/** A handler returns a Web `Response`, `undefined` (→ 204) or any JSON value (→ 200). */
+export declare type RouteHandlerResult = Response | undefined | unknown;
+
 export declare const rows: (s: LuaWorkflowStep<any, any, any> | string, path: string, page: {
     offset: number;
     limit: number;
@@ -7320,6 +7430,60 @@ export declare interface WaitForSignalOptions {
     acceptedSources?: Array<'webhook' | 'api' | 'user' | 'agent'>;
 }
 
+/**
+ * Per-app additions to the gateway's strict Content-Security-Policy
+ * (`defineWebApp({ pages: { csp } })`, PRD 7.10.11). This camelCase shape is
+ * what lua-cli writes, what `webAppVersion.csp` stores and what the gateway
+ * reads; the gateway alone maps each key to its directive (`scriptSrc` →
+ * `script-src`, …). A key outside this list is ignored by the gateway.
+ */
+declare const WEB_APP_CSP_KEYS: readonly ["scriptSrc", "styleSrc", "imgSrc", "connectSrc", "fontSrc", "frameSrc", "workerSrc"];
+
+export declare const WEB_APP_NAME_PATTERN: RegExp;
+
+declare const WEB_ROUTE_METHODS: readonly ["GET", "POST", "PUT", "PATCH", "DELETE"];
+
+/** `defineWebApp({ branding })`, as lua-cli writes it and the version stores it. */
+export declare interface WebAppBranding {
+    /** Display name in the shells; defaults to the app name. */
+    name?: string;
+    /** Path to a logo inside the pages project, shipped as an asset. */
+    logo?: string;
+    /** Accent color (any CSS color; OKLCH preferred). */
+    accent?: string;
+}
+
+/** Per-app additions to the gateway's strict Content-Security-Policy (PRD 7.10.11),
+ *  in the one camelCase shape lua-cli stores and the gateway reads. */
+export declare type WebAppCsp = WebAppCsp_2;
+
+declare type WebAppCsp_2 = Partial<Record<WebAppCspKey, string[]>>;
+
+declare type WebAppCspKey = (typeof WEB_APP_CSP_KEYS)[number];
+
+/** One navigation entry of a web app (`defineWebApp({ pages: { nav } })`): drives the
+ *  app's nav rail and the shells' Apps tile. Written by lua-cli, stored on the version. */
+export declare interface WebAppNavItem {
+    /** Client route path inside the app, e.g. `/tickets`. */
+    path: string;
+    label: string;
+    /** An icon name from the design system's curated set. */
+    icon?: string;
+}
+
+export declare interface WebAppPages {
+    /** The Vite project directory, relative to the app definition (usually `./web`). */
+    root: string;
+    /** Serve the entry HTML for every non-asset path (client-side routing). Default true. */
+    spa?: boolean;
+    /** Navigation the app and the shells agree on; drives the app's nav rail and the Apps hub tile. */
+    nav?: WebAppNavItem[];
+    csp?: WebAppCsp;
+}
+
+/** Route keys are `'<METHOD> /<path>'`, e.g. `'POST /tickets/:id/close'`. */
+export declare type WebAppRouteKey = `${WebRouteMethod} /${string}`;
+
 /**
  * Webhook request information from channel integrations.
  * Contains the raw webhook payload from the channel provider.
@@ -7329,6 +7493,40 @@ export declare interface WebhookRequest {
     payload: any;
 }
 
+/** The app the handler belongs to, for `ctx.app` and log correlation. */
+declare interface WebRouteApp {
+    id: string;
+    name: string;
+    version: string;
+    /** Monotonic deployment ordinal of the app version being executed. */
+    deployment: number;
+    /** The app origin, e.g. `https://ops-dashboard-7f3a.apps.heylua.ai`; the
+     *  wrapper builds the Web `Request` URL against it. */
+    origin: string;
+    /** True for preview/sandbox deployments (reserved; always false in the MVP). */
+    preview: boolean;
+}
+
+/** The caller, as the gateway resolved it. Mirrors the shells' principal:
+ *  a first-party Lua session, never an API key, never anonymous. `roles` and
+ *  `scopes` are the effective ones on the app's agent target. */
+declare interface WebRouteAuth {
+    userId: string;
+    orgId: string;
+    agentId: string;
+    subjectType: 'user';
+    credentialType: 'firstPartySession';
+    sessionId?: string;
+    roles: string[];
+    scopes: string[];
+    name?: string;
+    email?: string;
+    /** ISO timestamp the session token expires at, when known. */
+    expiresAt?: string;
+}
+
+declare type WebRouteMethod = (typeof WEB_ROUTE_METHODS)[number];
+
 /** Body of POST /developer/agents/:agentId/channels/whatsapp/reaction */
 export declare interface WhatsAppReactionSendInput {
     to: {

package/dist/api-exports.js

@@ -135,6 +135,9 @@ function isInteractiveTurn(turn) {
 function removeNavigateBlock(input) {
   return input.replace(/::: navigate[\s\S]*?:::/g, "").trim();
 }
+function removeHiddenBlocks(input) {
+  return input.replace(/::: hide\b[\s\S]*?:::/gi, "").replace(/::: hide\b[\s\S]*$/gi, "").trim();
+}
 function transformChatHistoryContentParts(parts) {
   const content = [];
   for (const rawPart of parts ?? []) {
@@ -1990,7 +1993,44 @@ function parseOnboardingFlow(value3) {
 function parsePublishedOnboardingResponse(value3) {
   return getPublishedOnboardingResponseSchema.parse(value3);
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema;
+function isForwardableWebRouteRequestHeader(name) {
+  const n2 = name.toLowerCase();
+  return WEB_ROUTE_REQUEST_HEADER_ALLOWLIST.includes(n2) || n2.startsWith("x-lua-");
+}
+function isForwardableWebRouteResponseHeader(name) {
+  const n2 = name.toLowerCase();
+  if (n2 === "set-cookie") return false;
+  return WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST.includes(n2) || n2.startsWith("x-lua-");
+}
+function isWebRouteBody(value3) {
+  if (!value3 || typeof value3 !== "object") return false;
+  const b = value3;
+  if (b.kind === "json") return "value" in b;
+  if (b.kind === "text" || b.kind === "base64") return typeof b.value === "string";
+  return false;
+}
+function isWebRouteInput(value3) {
+  if (!value3 || typeof value3 !== "object") return false;
+  const v = value3;
+  if (v.v !== WEB_ROUTE_PROTOCOL_VERSION) return false;
+  const r = v.request;
+  if (!r || typeof r !== "object") return false;
+  if (!WEB_ROUTE_METHODS.includes(String(r.method))) return false;
+  if (typeof r.path !== "string" || !r.path.startsWith("/")) return false;
+  if (!r.params || typeof r.params !== "object") return false;
+  if (!r.query || typeof r.query !== "object") return false;
+  if (!r.headers || typeof r.headers !== "object") return false;
+  if (r.body !== void 0) {
+    if (r.method === "GET") return false;
+    if (!isWebRouteBody(r.body)) return false;
+  }
+  const a = v.auth;
+  if (!a || typeof a.userId !== "string" || typeof a.orgId !== "string" || typeof a.agentId !== "string") return false;
+  const app = v.app;
+  if (!app || typeof app.id !== "string" || typeof app.name !== "string" || typeof app.origin !== "string") return false;
+  return true;
+}
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -2099,6 +2139,8 @@ var init_dist = __esm({
     __name2(isInteractiveTurn, "isInteractiveTurn");
     __name(removeNavigateBlock, "removeNavigateBlock");
     __name2(removeNavigateBlock, "removeNavigateBlock");
+    __name(removeHiddenBlocks, "removeHiddenBlocks");
+    __name2(removeHiddenBlocks, "removeHiddenBlocks");
     __name(transformChatHistoryContentParts, "transformChatHistoryContentParts");
     __name2(transformChatHistoryContentParts, "transformChatHistoryContentParts");
     RICH_PARTS_MESSAGE_ID_PREFIX = "rich-parts:";
@@ -2690,6 +2732,7 @@ This text is who you are for this person. As you learn them, their name, their w
       "skill",
       "job",
       "webhook",
+      "web-route",
       "trigger",
       "preprocessor",
       "postprocessor",
@@ -4381,6 +4424,39 @@ listed here; never invent a target.`;
     __name2(parseOnboardingFlow, "parseOnboardingFlow");
     __name(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
     __name2(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
+    WEB_ROUTE_PROTOCOL_VERSION = 1;
+    WEB_ROUTE_METHODS = [
+      "GET",
+      "POST",
+      "PUT",
+      "PATCH",
+      "DELETE"
+    ];
+    WEB_ROUTE_REQUEST_HEADER_ALLOWLIST = [
+      "accept",
+      "accept-language",
+      "content-type",
+      "if-none-match",
+      "idempotency-key"
+    ];
+    WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST = [
+      "content-type",
+      "cache-control",
+      "etag",
+      "location",
+      "content-disposition",
+      "content-language"
+    ];
+    __name(isForwardableWebRouteRequestHeader, "isForwardableWebRouteRequestHeader");
+    __name2(isForwardableWebRouteRequestHeader, "isForwardableWebRouteRequestHeader");
+    __name(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
+    __name2(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
+    WEB_ROUTE_MAX_REQUEST_BODY_BYTES = 1 * 1024 * 1024;
+    WEB_ROUTE_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+    __name(isWebRouteBody, "isWebRouteBody");
+    __name2(isWebRouteBody, "isWebRouteBody");
+    __name(isWebRouteInput, "isWebRouteInput");
+    __name2(isWebRouteInput, "isWebRouteInput");
   }
 });
 
@@ -9853,8 +9929,8 @@ function uidFromFirebaseIdToken(idToken) {
   if (parsed.success) return parsed.data.sub;
   throw new Error(INVALID_FIREBASE_SESSION);
 }
-function parseFirebaseSession(json, now = Date.now()) {
-  const customTokenResponse = customTokenResponseSchema.safeParse(json);
+function parseFirebaseSession(json2, now = Date.now()) {
+  const customTokenResponse = customTokenResponseSchema.safeParse(json2);
   if (customTokenResponse.success) {
     const { idToken: idToken2, refreshToken: refreshToken2, expiresIn: expiresIn2, localId } = customTokenResponse.data;
     return {
@@ -9864,7 +9940,7 @@ function parseFirebaseSession(json, now = Date.now()) {
       uid: localId ?? uidFromFirebaseIdToken(idToken2)
     };
   }
-  const refreshResponse = refreshResponseSchema.safeParse(json);
+  const refreshResponse = refreshResponseSchema.safeParse(json2);
   if (!refreshResponse.success) throw new Error(INVALID_FIREBASE_SESSION);
   const { id_token: idToken, refresh_token: refreshToken, expires_in: expiresIn, user_id: uid } = refreshResponse.data;
   return {
@@ -11346,8 +11422,8 @@ function buildSourceArchive(files) {
     map[entryFile] = source;
   }
   if (Object.keys(map).length === 0) return null;
-  const json = JSON.stringify(map);
-  const gz = zlib.gzipSync(Buffer.from(json, "utf-8"));
+  const json2 = JSON.stringify(map);
+  const gz = zlib.gzipSync(Buffer.from(json2, "utf-8"));
   return gz.toString("base64");
 }
 function getPrimitivesByKind(manifest, kind) {
@@ -16270,8 +16346,8 @@ var init_workflow_api_service = __esm({
       }
     }, "assertBoundAgent");
     pathId = /* @__PURE__ */ __name((id2) => encodeURIComponent(id2), "pathId");
-    unavailable = /* @__PURE__ */ __name((member, route) => async () => {
-      throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route} lands with a later wave)`, 501);
+    unavailable = /* @__PURE__ */ __name((member, route2) => async () => {
+      throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route2} lands with a later wave)`, 501);
     }, "unavailable");
     __name(createWorkflowsRuntime, "createWorkflowsRuntime");
     WorkflowApi = class extends HttpClient {
@@ -17727,6 +17803,91 @@ function defineVoice(config) {
 }
 __name(defineVoice, "defineVoice");
 
+// src/types/web-app.ts
+init_dist();
+var WEB_APP_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+var ROUTE_KEY_PATTERN = new RegExp(`^(${WEB_ROUTE_METHODS.join("|")}) /\\S*$`);
+function route(def) {
+  if (typeof def.handler !== "function") {
+    throw new Error("route() requires a `handler` function.");
+  }
+  return def;
+}
+__name(route, "route");
+function json(data, status = 200, headers = {}) {
+  const hasBody = data !== void 0 && status !== 204 && status !== 304;
+  return new Response(hasBody ? JSON.stringify(data) : null, {
+    status,
+    headers: hasBody ? {
+      "content-type": "application/json",
+      ...headers
+    } : headers
+  });
+}
+__name(json, "json");
+var LuaWebApp = class {
+  static {
+    __name(this, "LuaWebApp");
+  }
+  config;
+  constructor(config) {
+    if (!config || typeof config !== "object") {
+      throw new Error("defineWebApp requires a configuration object.");
+    }
+    if (typeof config.name !== "string" || !WEB_APP_NAME_PATTERN.test(config.name)) {
+      throw new Error(`defineWebApp: \`name\` must match ${WEB_APP_NAME_PATTERN} (lower-case letters, digits and dashes, starting with a letter); got ${JSON.stringify(config.name)}.`);
+    }
+    if (!config.pages || typeof config.pages.root !== "string" || !config.pages.root.trim()) {
+      throw new Error(`defineWebApp(${config.name}): \`pages.root\` (the Vite project directory) is required.`);
+    }
+    const hasRoutes = !!config.routes && Object.keys(config.routes).length > 0;
+    const hasFetch = typeof config.fetch === "function";
+    if (!hasRoutes && !hasFetch) {
+      throw new Error(`defineWebApp(${config.name}): declare at least one entry in \`routes\` or a \`fetch\` handler.`);
+    }
+    for (const key of Object.keys(config.routes ?? {})) {
+      if (!ROUTE_KEY_PATTERN.test(key)) {
+        throw new Error(`defineWebApp(${config.name}): route key ${JSON.stringify(key)} must look like 'GET /path' (${WEB_ROUTE_METHODS.join(", ")}, one space, a path starting with /).`);
+      }
+      const def = config.routes[key];
+      if (!def || typeof def.handler !== "function") {
+        throw new Error(`defineWebApp(${config.name}): route ${JSON.stringify(key)} has no \`handler\` function.`);
+      }
+    }
+    for (const item of config.pages.nav ?? []) {
+      if (typeof item?.path !== "string" || !item.path.startsWith("/") || typeof item?.label !== "string") {
+        throw new Error(`defineWebApp(${config.name}): every \`pages.nav\` item needs a \`path\` starting with / and a \`label\`.`);
+      }
+    }
+    this.config = config;
+  }
+  getName() {
+    return this.config.name;
+  }
+  getDescription() {
+    return this.config.description;
+  }
+  getPages() {
+    return this.config.pages;
+  }
+  getBranding() {
+    return this.config.branding;
+  }
+  getRoutes() {
+    return this.config.routes ?? {};
+  }
+  getFetch() {
+    return this.config.fetch;
+  }
+  getConfig() {
+    return this.config;
+  }
+};
+function defineWebApp(config) {
+  return new LuaWebApp(config);
+}
+__name(defineWebApp, "defineWebApp");
+
 // src/api-exports.ts
 init_workflow();
 init_dist();
@@ -18500,6 +18661,7 @@ export {
   LuaTrigger,
   LuaVoice,
   LuaVoiceTool,
+  LuaWebApp,
   LuaWebhook,
   LuaWorkflow,
   LuaWorkflowBuildError,
@@ -18516,6 +18678,7 @@ export {
   User,
   UserDataInstance,
   Voice,
+  WEB_APP_NAME_PATTERN,
   Workflows,
   and2 as and,
   createStep,
@@ -18524,6 +18687,7 @@ export {
   defineDeviceTrigger,
   defineTrigger,
   defineVoice,
+  defineWebApp,
   defineWorkflow,
   env,
   eq2 as eq,
@@ -18537,6 +18701,7 @@ export {
   gte2 as gte,
   inSet2 as inSet,
   init2 as init,
+  json,
   lit2 as lit,
   log,
   lt2 as lt,
@@ -18546,6 +18711,7 @@ export {
   notExists2 as notExists,
   notIn2 as notIn,
   or2 as or,
+  route,
   rows2 as rows,
   state2 as state,
   step2 as step,