lua-cli 3.39.3 → 3.39.4

package/dist/index.js

@@ -957,6 +957,9 @@ function isInteractiveTurn(turn) {
 function removeNavigateBlock(input) {
   return input.replace(/::: navigate[\s\S]*?:::/g, "").trim();
 }
+function removeHiddenBlocks(input) {
+  return input.replace(/::: hide\b[\s\S]*?:::/gi, "").replace(/::: hide\b[\s\S]*$/gi, "").trim();
+}
 function transformChatHistoryContentParts(parts) {
   const content = [];
   for (const rawPart of parts ?? []) {
@@ -2812,7 +2815,44 @@ function parseOnboardingFlow(value3) {
 function parsePublishedOnboardingResponse(value3) {
   return getPublishedOnboardingResponseSchema.parse(value3);
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema;
+function isForwardableWebRouteRequestHeader(name) {
+  const n2 = name.toLowerCase();
+  return WEB_ROUTE_REQUEST_HEADER_ALLOWLIST.includes(n2) || n2.startsWith("x-lua-");
+}
+function isForwardableWebRouteResponseHeader(name) {
+  const n2 = name.toLowerCase();
+  if (n2 === "set-cookie") return false;
+  return WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST.includes(n2) || n2.startsWith("x-lua-");
+}
+function isWebRouteBody(value3) {
+  if (!value3 || typeof value3 !== "object") return false;
+  const b = value3;
+  if (b.kind === "json") return "value" in b;
+  if (b.kind === "text" || b.kind === "base64") return typeof b.value === "string";
+  return false;
+}
+function isWebRouteInput(value3) {
+  if (!value3 || typeof value3 !== "object") return false;
+  const v = value3;
+  if (v.v !== WEB_ROUTE_PROTOCOL_VERSION) return false;
+  const r = v.request;
+  if (!r || typeof r !== "object") return false;
+  if (!WEB_ROUTE_METHODS.includes(String(r.method))) return false;
+  if (typeof r.path !== "string" || !r.path.startsWith("/")) return false;
+  if (!r.params || typeof r.params !== "object") return false;
+  if (!r.query || typeof r.query !== "object") return false;
+  if (!r.headers || typeof r.headers !== "object") return false;
+  if (r.body !== void 0) {
+    if (r.method === "GET") return false;
+    if (!isWebRouteBody(r.body)) return false;
+  }
+  const a = v.auth;
+  if (!a || typeof a.userId !== "string" || typeof a.orgId !== "string" || typeof a.agentId !== "string") return false;
+  const app = v.app;
+  if (!app || typeof app.id !== "string" || typeof app.name !== "string" || typeof app.origin !== "string") return false;
+  return true;
+}
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -2912,6 +2952,8 @@ var init_dist = __esm({
     __name2(isInteractiveTurn, "isInteractiveTurn");
     __name(removeNavigateBlock, "removeNavigateBlock");
     __name2(removeNavigateBlock, "removeNavigateBlock");
+    __name(removeHiddenBlocks, "removeHiddenBlocks");
+    __name2(removeHiddenBlocks, "removeHiddenBlocks");
     __name(transformChatHistoryContentParts, "transformChatHistoryContentParts");
     __name2(transformChatHistoryContentParts, "transformChatHistoryContentParts");
     RICH_PARTS_MESSAGE_ID_PREFIX = "rich-parts:";
@@ -3544,6 +3586,7 @@ This text is who you are for this person. As you learn them, their name, their w
       "skill",
       "job",
       "webhook",
+      "web-route",
       "trigger",
       "preprocessor",
       "postprocessor",
@@ -5309,6 +5352,39 @@ listed here; never invent a target.`;
     __name2(parseOnboardingFlow, "parseOnboardingFlow");
     __name(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
     __name2(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
+    WEB_ROUTE_PROTOCOL_VERSION = 1;
+    WEB_ROUTE_METHODS = [
+      "GET",
+      "POST",
+      "PUT",
+      "PATCH",
+      "DELETE"
+    ];
+    WEB_ROUTE_REQUEST_HEADER_ALLOWLIST = [
+      "accept",
+      "accept-language",
+      "content-type",
+      "if-none-match",
+      "idempotency-key"
+    ];
+    WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST = [
+      "content-type",
+      "cache-control",
+      "etag",
+      "location",
+      "content-disposition",
+      "content-language"
+    ];
+    __name(isForwardableWebRouteRequestHeader, "isForwardableWebRouteRequestHeader");
+    __name2(isForwardableWebRouteRequestHeader, "isForwardableWebRouteRequestHeader");
+    __name(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
+    __name2(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
+    WEB_ROUTE_MAX_REQUEST_BODY_BYTES = 1 * 1024 * 1024;
+    WEB_ROUTE_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+    __name(isWebRouteBody, "isWebRouteBody");
+    __name2(isWebRouteBody, "isWebRouteBody");
+    __name(isWebRouteInput, "isWebRouteInput");
+    __name2(isWebRouteInput, "isWebRouteInput");
   }
 });
 
@@ -30995,17 +31071,34 @@ var PersonaApi = class extends HttpClient {
     return this.httpGet(`/developer/agents/${this.agentId}/persona/versions${statusParam}`, {});
   }
   /**
-  * Creates a new persona version
+  * Creates a new persona version.
+  *
+  * PRO-2170: the route STAGES by default — creating a version does not change
+  * what the agent serves. `options.publish` is sent only when the caller
+  * passes it, so an omitted flag means "whatever the server's default is" and
+  * an explicit `false` pins the stage-only intent on the wire (what `lua push`
+  * sends, so a server that ever flips its default cannot silently publish a
+  * push again). Activation is `deployVersion`.
+  *
   * @param persona - The persona content (string or channel-aware object)
+  * @param options.publish - `true` = create and serve in one call; `false` = stage only
   * @returns Promise resolving to an ApiResponse with the created version
   */
-  async createVersion(persona) {
+  async createVersion(persona, options = {}) {
     return this.httpPost(`/developer/agents/${this.agentId}/persona/version`, {
-      persona
+      persona,
+      ...options.publish === void 0 ? {} : {
+        publish: options.publish
+      }
     }, {});
   }
   /**
-  * Deploys/activates a persona version to production
+  * Deploys/activates a persona version to production.
+  *
+  * PRO-2170: this is the ONLY path that changes the persona the agent serves.
+  * It re-points the agent, marks the version `published` and demotes the
+  * previously-published one to `staged`.
+  *
   * @param version - The version number to deploy
   * @returns Promise resolving to an ApiResponse with confirmation
   */
@@ -31025,9 +31118,15 @@ var PersonaApi = class extends HttpClient {
     return sorted[0];
   }
   /**
-  * Gets the latest published persona version (excludes drafts)
-  * This is the most recently pushed version, regardless of whether it's currently active.
-  * Use this for sync - code should match the latest push, not a rollback.
+  * Gets the latest published persona version.
+  *
+  * PRO-2170 changed what this means. It used to be "the most recently pushed
+  * version", because a push published every version it created. Now a push
+  * STAGES, so `published` is the version production SERVES, and a local
+  * persona ahead of it is genuine drift (`checkPersonaDrift`) — the same
+  * reading as a pushed-but-not-activated skill. Use `getLatestVersion` (all
+  * statuses) when you want the most recent push instead.
+  *
   * @returns Promise resolving to the latest published PersonaVersion or null if none exist
   */
   async getLatestPublishedVersion() {
@@ -31790,7 +31889,9 @@ var AgentHandler = class {
   }
   async pushPersona(ctx, persona) {
     const personaApi = new PersonaApi(BASE_URLS.API, ctx.apiKey, ctx.agentId);
-    const result = await personaApi.createVersion(persona);
+    const result = await personaApi.createVersion(persona, {
+      publish: false
+    });
     return {
       success: result.success,
       version: result.data?.version
@@ -33537,6 +33638,7 @@ async function executePushMode(context, drift, primitiveDrift) {
       const result = await agentHandler.pushPersona(context, drift.persona.localPersona);
       if (result.success) {
         writeSuccess(`\u2705 Persona version ${result.version} created on server`);
+        writeInfo(`   Staged, NOT activated \u2014 activate it with \`lua deploy persona --set-version ${result.version}\`.`);
       } else {
         console.error("\u274C Failed to push persona");
         syncFullySucceeded = false;
@@ -33745,6 +33847,7 @@ async function handlePersonaDriftInteractive(context, drift) {
       const result = await agentHandler.pushPersona(context, drift.localPersona);
       if (result.success) {
         writeSuccess(`\u2705 Persona version ${result.version} created on server`);
+        writeInfo(`   Staged, NOT activated \u2014 activate it with \`lua deploy persona --set-version ${result.version}\`.`);
       } else {
         console.error("\u274C Failed to push persona");
       }
@@ -42575,11 +42678,11 @@ function getDeployHint(type) {
   };
 }
 __name(getDeployHint, "getDeployHint");
-function writePersonaServedHint(version) {
-  writeInfo(`\u{1F4A1} Persona v${version} is now served \u2014 the push published it and pointed the agent at it.`);
-  writeInfo("   Roll back with `lua deploy persona` (pick an earlier version) or `lua persona production deploy --persona-version <n>`.");
+function writePersonaStagedHint(version) {
+  writeInfo(`\u{1F4A1} Persona v${version} staged \u2014 NOT activated. What the agent serves is unchanged.`);
+  writeInfo(`   Activate it with \`lua deploy persona --set-version ${version}\` (asks for confirmation first).`);
 }
-__name(writePersonaServedHint, "writePersonaServedHint");
+__name(writePersonaStagedHint, "writePersonaStagedHint");
 async function promptVersionConfirmOrUpdate(currentVersion) {
   console.log(`
 Current version: ${currentVersion || "(none - first push)"}`);
@@ -43165,7 +43268,7 @@ Model: ${model}`);
       personaDeployWasAttempted = true;
       productionDeployedWithAutoDeploy = await deployPersonaVersionAfterPush(apiKey, agentId, result.persona.version, options.autoDeploy || false);
     } else {
-      writePersonaServedHint(result.persona.version);
+      writePersonaStagedHint(result.persona.version);
     }
   }
   const personaAutoDeployFailed = Boolean(options.autoDeploy && personaDeployEligible && personaDeployWasAttempted && !productionDeployedWithAutoDeploy);
@@ -43479,7 +43582,7 @@ ${icon} Pushing ${items.length} ${handler.displayName}(s)...`);
     };
   }
   if (personaPushResult && !options.autoDeploy) {
-    writePersonaServedHint(personaPushResult.version);
+    writePersonaStagedHint(personaPushResult.version);
   }
   if (toDeploy.length > 0) {
     writeProgress("\n\u{1F680} Deploying all pushed versions to production...");
@@ -44125,7 +44228,9 @@ async function deployPersonaVersion(apiKey, agentId, options) {
         name: "version",
         message: "Select a persona version to deploy:",
         choices: sortedVersions.map((v) => ({
-          name: `v${v.version}${v.isCurrent ? " (CURRENT)" : ""} \u2014 ${new Date(v.createdDate).toLocaleDateString()}`,
+          // PRO-2170: a push stages, so the list now contains versions that are
+          // NOT served. Mark them, or the only clue is the absence of (CURRENT).
+          name: `v${v.version}${v.isCurrent ? " (CURRENT)" : ""}${v.status === "staged" ? " (STAGED)" : v.status === "draft" ? " (DRAFT)" : ""} \u2014 ${new Date(v.createdDate).toLocaleDateString()}`,
           value: v.version
         }))
       }
@@ -46434,6 +46539,12 @@ init_compiler2();
 init_artifact_loader();
 init_analytics();
 init_cli_error();
+function versionStatusMarker(status) {
+  if (status === "draft") return "[DRAFT]";
+  if (status === "staged") return "[STAGED]";
+  return "";
+}
+__name(versionStatusMarker, "versionStatusMarker");
 async function personaCommand(env, action, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -46550,7 +46661,8 @@ function displayVersionsCore(versions) {
     const dateStr = date.toLocaleDateString();
     const timeStr = date.toLocaleTimeString();
     const currentMark = v.isCurrent ? " \u2B50 CURRENT" : "";
-    const status = v.status === "draft" ? " [DRAFT]" : "";
+    const marker = versionStatusMarker(v.status);
+    const status = marker ? ` ${marker}` : "";
     console.log(`  Version ${v.version}${status} - ${dateStr} ${timeStr}${currentMark}`);
   });
   console.log("\n" + "=".repeat(60));
@@ -46808,7 +46920,7 @@ async function listPersonaVersionsInteractive(context) {
         const date = new Date(version.createdDate);
         const dateStr = date.toLocaleDateString();
         const timeStr = date.toLocaleTimeString();
-        const status = version.status === "draft" ? "[DRAFT]" : "";
+        const status = versionStatusMarker(version.status);
         const currentMark = version.isCurrent ? " \u2B50 CURRENT" : "";
         return {
           name: `Version ${version.version} ${status} - (${dateStr}) ${timeStr} ${currentMark}`,
@@ -46827,7 +46939,7 @@ async function viewVersionDetailsInteractive(version) {
   console.log(`Persona Version ${version.version}`);
   console.log("=".repeat(60));
   console.log(`Created: ${date.toLocaleString()}`);
-  const versionStatus = version.status === "draft" ? "\u{1F528} DRAFT" : "";
+  const versionStatus = version.status === "draft" ? "\u{1F528} DRAFT" : version.status === "staged" ? "\u{1F4E4} STAGED (not served)" : "\u2B50 PUBLISHED";
   console.log(`Version Status: ${versionStatus}`);
   console.log(`Active Status: ${version.isCurrent ? "\u2B50 CURRENT" : "Available"}`);
   if (version.createdBy) {
@@ -46910,7 +47022,7 @@ async function deployPersonaVersionInteractive(context) {
         const dateStr = date.toLocaleDateString();
         const timeStr = date.toLocaleTimeString();
         const currentMark = v.isCurrent ? " \u2B50 CURRENTLY DEPLOYED" : "";
-        const status = v.status === "draft" ? "[DRAFT]" : "";
+        const status = versionStatusMarker(v.status);
         return {
           name: `Version ${v.version} ${status} - (${dateStr}) ${timeStr} ${currentMark}`,
           value: v.version