lua-cli 3.40.0 → 3.41.0

package/dist/index.js

@@ -1752,24 +1752,24 @@ function composePresetEndpoint(type, endpoint) {
     reason: "invalid_url"
   };
   const origin = url.origin;
-  const path26 = url.pathname.replace(/\/+$/, "");
+  const path27 = url.pathname.replace(/\/+$/, "");
   if (!rule.segment) {
-    const base2 = path26.endsWith(rule.path) ? path26.slice(0, path26.length - rule.path.length) : path26;
+    const base2 = path27.endsWith(rule.path) ? path27.slice(0, path27.length - rule.path.length) : path27;
     return {
       ok: true,
       endpoint: `${origin}${base2}${rule.path}`
     };
   }
   const marker = `${rule.path}/`;
-  const at = path26.indexOf(marker);
+  const at = path27.indexOf(marker);
   if (at < 0) {
     return {
       ok: false,
       reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
     };
   }
-  const base = path26.slice(0, at);
-  const afterMarker = path26.slice(at + marker.length);
+  const base = path27.slice(0, at);
+  const afterMarker = path27.slice(at + marker.length);
   const rest = rule.suffix && afterMarker.endsWith(rule.suffix) ? afterMarker.slice(0, afterMarker.length - rule.suffix.length) : afterMarker;
   if (!rest || rest.includes("/")) {
     return {
@@ -2467,7 +2467,7 @@ function scheduledWorkflowRunId(jobId, scheduledTime) {
 }
 function renderWorkflowScheduleKeyTemplate(template3, ctx) {
   if (!template3) return void 0;
-  const read = /* @__PURE__ */ __name2((path26) => path26.split(".").reduce((o, k) => o && typeof o === "object" ? o[k] : void 0, ctx.input), "read");
+  const read = /* @__PURE__ */ __name2((path27) => path27.split(".").reduce((o, k) => o && typeof o === "object" ? o[k] : void 0, ctx.input), "read");
   let unresolved = false;
   const out = template3.replace(/\$\{\s*([a-zA-Z0-9_.]+)\s*\}/g, (_m, expr) => {
     let v = "";
@@ -3337,7 +3337,15 @@ function sortVerdictReasons(reasons) {
     ...reasons
   ].sort((a, b) => REVIEW_VERDICT_REASON_ORDER.indexOf(a.kind) - REVIEW_VERDICT_REASON_ORDER.indexOf(b.kind));
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, PLATFORM_INVOCATION_CALLERS, SUPERVISION_OPS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER;
+function envTemplatePlaceholder(key) {
+  if (ENV_TEMPLATE_SECRET_KEY_RE.test(key)) {
+    throw new Error(`env-template-secret-key: \`${key}\` looks like a secret \u2014 read it with env('${key}') inside execute instead`);
+  }
+  return {
+    __envRef: key
+  };
+}
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, PLATFORM_INVOCATION_CALLERS, SUPERVISION_OPS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -6046,6 +6054,9 @@ listed here; never invent a target.`;
     ];
     __name(sortVerdictReasons, "sortVerdictReasons");
     __name2(sortVerdictReasons, "sortVerdictReasons");
+    ENV_TEMPLATE_SECRET_KEY_RE = /(SECRET|TOKEN|KEY|PASSWORD)$/;
+    __name(envTemplatePlaceholder, "envTemplatePlaceholder");
+    __name2(envTemplatePlaceholder, "envTemplatePlaceholder");
   }
 });
 
@@ -6675,16 +6686,110 @@ function workflowJobPluginsProblem(plugins) {
   if (new Set(plugins).size !== plugins.length) return "plugins must not repeat";
   return null;
 }
-function workflowJobTargetProblem(target, plugins) {
+function workflowJobTargetTemplatePath(binding) {
+  if (!binding || typeof binding !== "object" || Array.isArray(binding)) return null;
+  const keys = Object.keys(binding);
+  const tpl = binding.template;
+  if (keys.length !== 1 || typeof tpl !== "string" || tpl.length > 512) return null;
+  const m = WORKFLOW_JOB_TARGET_TEMPLATE_RE.exec(tpl.trim());
+  if (!m) return null;
+  const names = m[1].split(".").map((seg) => seg.replace(/\[(?:0|[1-9]\d*)\]/g, ""));
+  if (names.some((n2) => n2 === "__proto__" || n2 === "prototype" || n2 === "constructor")) return null;
+  return m[1].split(".").every((seg) => TARGET_PATH_SEGMENT_RE.test(seg)) ? m[1] : null;
+}
+function isWorkflowJobTargetTemplate(target) {
+  const agentId = target?.agentId;
+  return !!agentId && typeof agentId === "object";
+}
+function workflowJobLuaApiProblem(luaApi, nodeType, tier) {
+  if (luaApi === void 0) return null;
+  if (luaApi !== true) return "`luaApi` must be exactly true";
+  if (nodeType !== "code") return "`luaApi` is legal on code steps only (an agent step uses `plugins`)";
+  if (tier !== "job") return "`luaApi` requires tier:'job'";
+  return null;
+}
+function workflowJobUsesLuaApi(step3) {
+  return Array.isArray(step3.plugins) && step3.plugins.length > 0 || step3.kind === "code" && step3.luaApi === true;
+}
+function workflowJobTargetProblem(target, plugins, luaApi) {
   if (target === void 0) return null;
   if (!target || typeof target !== "object" || Array.isArray(target)) return "target must be { agentId }";
   const keys = Object.keys(target);
   const agentId = target.agentId;
-  if (keys.length !== 1 || typeof agentId !== "string" || !agentId.trim() || agentId.length > 256) return "target must be exactly { agentId: <non-empty string> }";
-  if (!Array.isArray(plugins) || plugins.length === 0) return "`target` is legal only beside `plugins`";
+  if (keys.length !== 1 || !("agentId" in target)) return "target must be exactly { agentId }";
+  if (typeof agentId === "string") {
+    if (!agentId.trim() || agentId.length > 256) return "target must be exactly { agentId: <non-empty string> }";
+    if (agentId.includes("${")) return "a run-input target is written template('${initData.<path>}'), never a string with ${\u2026}";
+  } else if (workflowJobTargetTemplatePath(agentId) === null) {
+    return "target.agentId must be a static id or template('${initData.<path>}') \u2014 exactly one initData placeholder, no default";
+  }
+  const hasPlugins = Array.isArray(plugins) && plugins.length > 0;
+  if (!hasPlugins && luaApi !== true) return "`target` is legal only beside `plugins` or `luaApi: true`";
   return null;
 }
-var __defProp3, __name3, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_READ_ONLY_DROPPED, WORKFLOW_JOB_DEFAULT_TOOLS, WORKFLOW_JOB_PLUGINS, WORKFLOW_JOB_PLUGIN_ROOT, WORKFLOW_JOB_PLUGINS_MAX;
+function readInitDataPath(root, path27) {
+  let cur = root;
+  for (const seg of path27.split(".")) {
+    const name = seg.replace(/\[(?:0|[1-9]\d*)\]/g, "");
+    const indexes = [
+      ...seg.matchAll(/\[(0|[1-9]\d*)\]/g)
+    ].map((x) => Number(x[1]));
+    if (cur === null || typeof cur !== "object" || !Object.prototype.hasOwnProperty.call(cur, name)) return void 0;
+    cur = cur[name];
+    for (const i of indexes) {
+      if (!Array.isArray(cur) || i >= cur.length) return void 0;
+      cur = cur[i];
+    }
+  }
+  return cur;
+}
+function renderWorkflowJobTarget(target, initData) {
+  const agentId = target?.agentId;
+  if (target === void 0 || target === null || agentId === void 0) return {
+    ok: true,
+    agentId: void 0,
+    templated: false
+  };
+  if (typeof agentId === "string") {
+    if (!agentId.trim() || agentId.includes("${")) return {
+      ok: false,
+      reason: "invalid",
+      message: "target.agentId is invalid"
+    };
+    return {
+      ok: true,
+      agentId,
+      templated: false
+    };
+  }
+  const path27 = workflowJobTargetTemplatePath(agentId);
+  if (path27 === null) return {
+    ok: false,
+    reason: "invalid",
+    message: "target.agentId is not a valid initData template"
+  };
+  const value3 = readInitDataPath(initData, path27);
+  if (value3 === void 0 || value3 === null) {
+    return {
+      ok: false,
+      reason: "unbound",
+      message: `target_unresolved: the run input has no initData.${path27}`
+    };
+  }
+  if (typeof value3 !== "string" || !value3.trim() || value3.length > 256 || /\s/.test(value3.trim())) {
+    return {
+      ok: false,
+      reason: "empty",
+      message: `target_unresolved: initData.${path27} is not a non-empty agent id`
+    };
+  }
+  return {
+    ok: true,
+    agentId: value3.trim(),
+    templated: true
+  };
+}
+var __defProp3, __name3, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_READ_ONLY_DROPPED, WORKFLOW_JOB_DEFAULT_TOOLS, WORKFLOW_JOB_PLUGINS, WORKFLOW_JOB_PLUGIN_ROOT, WORKFLOW_JOB_PLUGINS_MAX, WORKFLOW_JOB_TARGET_TEMPLATE_RE, TARGET_PATH_SEGMENT_RE;
 var init_workflow_job_tools = __esm({
   "../shared-types/dist/workflow-job-tools.mjs"() {
     "use strict";
@@ -6730,8 +6835,22 @@ var init_workflow_job_tools = __esm({
     __name3(workflowJobPluginDir, "workflowJobPluginDir");
     __name(workflowJobPluginsProblem, "workflowJobPluginsProblem");
     __name3(workflowJobPluginsProblem, "workflowJobPluginsProblem");
+    WORKFLOW_JOB_TARGET_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*\}$/;
+    TARGET_PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
+    __name(workflowJobTargetTemplatePath, "workflowJobTargetTemplatePath");
+    __name3(workflowJobTargetTemplatePath, "workflowJobTargetTemplatePath");
+    __name(isWorkflowJobTargetTemplate, "isWorkflowJobTargetTemplate");
+    __name3(isWorkflowJobTargetTemplate, "isWorkflowJobTargetTemplate");
+    __name(workflowJobLuaApiProblem, "workflowJobLuaApiProblem");
+    __name3(workflowJobLuaApiProblem, "workflowJobLuaApiProblem");
+    __name(workflowJobUsesLuaApi, "workflowJobUsesLuaApi");
+    __name3(workflowJobUsesLuaApi, "workflowJobUsesLuaApi");
     __name(workflowJobTargetProblem, "workflowJobTargetProblem");
     __name3(workflowJobTargetProblem, "workflowJobTargetProblem");
+    __name(readInitDataPath, "readInitDataPath");
+    __name3(readInitDataPath, "readInitDataPath");
+    __name(renderWorkflowJobTarget, "renderWorkflowJobTarget");
+    __name3(renderWorkflowJobTarget, "renderWorkflowJobTarget");
   }
 });
 
@@ -6769,13 +6888,13 @@ function parseTemplatePlaceholder(rawExpr) {
     rest: dot === -1 ? "" : rawExpr.slice(dot + 1)
   };
 }
-function traverseMappingPath(root, path26, errorLabel2) {
-  if (path26 === "" || path26 === ".") return root;
-  const parts = path26.split(".");
+function traverseMappingPath(root, path27, errorLabel2) {
+  if (path27 === "" || path27 === ".") return root;
+  const parts = path27.split(".");
   let value22 = root;
   for (const part of parts) {
     if (typeof value22 === "object" && value22 !== null) value22 = value22[part];
-    else throw new WorkflowTemplateError(`Invalid path ${path26} in ${errorLabel2}`, path26);
+    else throw new WorkflowTemplateError(`Invalid path ${path27} in ${errorLabel2}`, path27);
   }
   return value22;
 }
@@ -6960,11 +7079,11 @@ function parseModelTemplate(model) {
       message: modelTemplateInvalidMessage(model, why)
     };
   }
-  const path26 = m[1];
-  if (!path26.split(".").every((seg) => PATH_SEGMENT_RE.test(seg))) {
+  const path27 = m[1];
+  if (!path27.split(".").every((seg) => PATH_SEGMENT_RE.test(seg))) {
     return {
       kind: "invalid",
-      message: modelTemplateInvalidMessage(model, `the path \`${path26}\` is not a dotted path of names and canonical [n] indexes`)
+      message: modelTemplateInvalidMessage(model, `the path \`${path27}\` is not a dotted path of names and canonical [n] indexes`)
     };
   }
   if (m[2] !== void 0) {
@@ -6983,7 +7102,7 @@ function parseModelTemplate(model) {
       kind: "template",
       template: {
         placeholder: trimmed2,
-        path: path26,
+        path: path27,
         default: dflt
       }
     };
@@ -6992,7 +7111,7 @@ function parseModelTemplate(model) {
     kind: "template",
     template: {
       placeholder: trimmed2,
-      path: path26
+      path: path27
     }
   };
 }
@@ -7009,9 +7128,9 @@ function staticModelPin(model) {
   if (parsed.kind === "template") return parsed.template.default;
   return void 0;
 }
-function readPath(root, path26) {
+function readPath(root, path27) {
   let cur = root;
-  for (const seg of path26.split(".")) {
+  for (const seg of path27.split(".")) {
     const name = seg.replace(/\[(?:0|[1-9]\d*)\]/g, "");
     const indexes = [
       ...seg.matchAll(/\[(0|[1-9]\d*)\]/g)
@@ -7046,17 +7165,17 @@ function renderModelTemplate(model, initData) {
     model,
     source: "static"
   };
-  const { placeholder, path: path26 } = parsed.template;
+  const { placeholder, path: path27 } = parsed.template;
   if (initData !== void 0 && initData !== null && (typeof initData !== "object" || Array.isArray(initData))) {
     return {
       ok: false,
       placeholder,
-      path: path26,
+      path: path27,
       reason: "input-not-object",
       message: modelTemplateInputNotObjectMessage(placeholder, initData)
     };
   }
-  const value22 = readPath(initData, path26);
+  const value22 = readPath(initData, path27);
   const reason = value22 === void 0 || value22 === null ? "unbound" : typeof value22 !== "string" ? "not-a-string" : value22.trim() ? null : "empty";
   if (reason === null) return {
     ok: true,
@@ -7071,14 +7190,14 @@ function renderModelTemplate(model, initData) {
   return {
     ok: false,
     placeholder,
-    path: path26,
+    path: path27,
     reason,
-    message: modelTemplateUnboundMessage(placeholder, path26, reason)
+    message: modelTemplateUnboundMessage(placeholder, path27, reason)
   };
 }
-function modelTemplateUnboundMessage(placeholder, path26, reason) {
-  const what = reason === "unbound" ? `the run input has no ${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path26}` : reason === "empty" ? `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path26} is empty on the run input` : `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path26} on the run input is not a string`;
-  return `model placeholder "${placeholder}" is unbound \u2014 ${what} and the placeholder declares no default; pass one in the run input or write \${${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path26}|<provider/model>}`;
+function modelTemplateUnboundMessage(placeholder, path27, reason) {
+  const what = reason === "unbound" ? `the run input has no ${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path27}` : reason === "empty" ? `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path27} is empty on the run input` : `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path27} on the run input is not a string`;
+  return `model placeholder "${placeholder}" is unbound \u2014 ${what} and the placeholder declares no default; pass one in the run input or write \${${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path27}|<provider/model>}`;
 }
 function modelTemplateInputNotObjectMessage(placeholder, initData) {
   const type = Array.isArray(initData) ? "an array" : `a ${typeof initData}`;
@@ -7118,22 +7237,22 @@ function validateApproverBlock(node, opts = {
   path: "approval"
 }) {
   const issues = [];
-  const push = /* @__PURE__ */ __name4((code, path26, message, severity = "error") => issues.push({
+  const push = /* @__PURE__ */ __name4((code, path27, message, severity = "error") => issues.push({
     code,
-    path: path26,
+    path: path27,
     severity,
     message
   }), "push");
-  const checkSpec = /* @__PURE__ */ __name4((spec, path26) => {
+  const checkSpec = /* @__PURE__ */ __name4((spec, path27) => {
     const r = ApproverSpecSchema.safeParse(spec);
     if (!r.success) {
       const users = spec?.users;
-      if (Array.isArray(users) && users.length > APPROVER_SPEC_MAX_USERS) push("cap-exceeded", path26, `at most ${APPROVER_SPEC_MAX_USERS} users`);
+      if (Array.isArray(users) && users.length > APPROVER_SPEC_MAX_USERS) push("cap-exceeded", path27, `at most ${APPROVER_SPEC_MAX_USERS} users`);
       else {
         const refusal2 = describeApproverSpecRefusal(spec);
         issues.push({
           code: "approver-invalid",
-          path: path26,
+          path: path27,
           severity: "error",
           message: refusal2.message,
           repair: {
@@ -7146,12 +7265,12 @@ function validateApproverBlock(node, opts = {
     }
     const s = r.data;
     if (typeof s === "object") {
-      if ("governance" in s && !opts.governanceEnabled) push("approver-governance-unavailable", path26, "governance reviewer routing is not enabled for this deployment");
-      if ("group" in s && typeof s.group === "string" && !opts.scimEnabled && opts.idpGroups?.includes(s.group)) push("approver-idp-group-unavailable", path26, "IdP-group approvers are not enabled for this deployment");
+      if ("governance" in s && !opts.governanceEnabled) push("approver-governance-unavailable", path27, "governance reviewer routing is not enabled for this deployment");
+      if ("group" in s && typeof s.group === "string" && !opts.scimEnabled && opts.idpGroups?.includes(s.group)) push("approver-idp-group-unavailable", path27, "IdP-group approvers are not enabled for this deployment");
       const binding = "users" in s ? s.users : "role" in s ? s.role : "group" in s ? s.group : void 0;
       if (isTemplateBinding(binding)) {
-        if (!bindingRootsOk(binding.template)) push("approver-binding-invalid", `${path26}.template`, "binding root must be initData / stepResults / requestContext / state");
-        if ("users" in s && opts.customerReachable) push("approver-binding-customer-reachable", `${path26}.users`, "a customer-reachable workflow may not bind its approver list");
+        if (!bindingRootsOk(binding.template)) push("approver-binding-invalid", `${path27}.template`, "binding root must be initData / stepResults / requestContext / state");
+        if ("users" in s && opts.customerReachable) push("approver-binding-customer-reachable", `${path27}.users`, "a customer-reachable workflow may not bind its approver list");
       }
     }
   }, "checkSpec");
@@ -7207,6 +7326,15 @@ function liftRenderedApprover(row2, rendered) {
     group: text
   };
 }
+function approverUsersOf(users) {
+  if (Array.isArray(users)) {
+    if (users.length === 0 || users.length > APPROVER_SPEC_MAX_USERS) return null;
+    return users.every((m) => typeof m === "string" && m.length > 0 && m.length <= 128) ? users : null;
+  }
+  if (typeof users !== "string") return null;
+  const lifted = liftRenderedApprover("users", users);
+  return lifted && "users" in lifted ? lifted.users : null;
+}
 function workspaceTemplatePath(template22) {
   const key = template22.trim();
   const expr = WORKSPACE_TEMPLATE_EXPR_RE.exec(key);
@@ -7327,8 +7455,8 @@ function withDefaultsFilled(g) {
 function isConnectionKeyShaped(value22) {
   return WORKFLOW_CONNECTION_KEY_RE.test(value22) && !CONNECTION_ID_HEX_RE.test(value22);
 }
-function connectionKeyUndeclaredMessage(path26, key) {
-  return `${path26} '${key}' is neither a connection id nor a declared connections[].key \u2014 declare it: connections: [{ key: '${key}', integrationType: '<catalog slug, e.g. github>' }] and it resolves on any agent`;
+function connectionKeyUndeclaredMessage(path27, key) {
+  return `${path27} '${key}' is neither a connection id nor a declared connections[].key \u2014 declare it: connections: [{ key: '${key}', integrationType: '<catalog slug, e.g. github>' }] and it resolves on any agent`;
 }
 function classifyModelProvider(model) {
   const m = (model ?? "").trim().toLowerCase();
@@ -7338,10 +7466,10 @@ function classifyModelProvider(model) {
   if (/^(google\/|gemini)/.test(m)) return "google";
   return null;
 }
-function schemaAtPath(schema, path26) {
+function schemaAtPath(schema, path27) {
   let cur = schema;
   if (!cur || typeof cur !== "object") return void 0;
-  for (const seg of path26.split(".").filter(Boolean)) {
+  for (const seg of path27.split(".").filter(Boolean)) {
     const props = cur.properties;
     const next = props?.[seg];
     if (!next || typeof next !== "object") return void 0;
@@ -7408,21 +7536,21 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   static: true
 }) {
   const issues = [];
-  const err = /* @__PURE__ */ __name4((code, message, path26, stepId) => {
+  const err = /* @__PURE__ */ __name4((code, message, path27, stepId) => {
     issues.push({
       code,
       message,
       severity: "error",
-      path: path26,
+      path: path27,
       stepId
     });
   }, "err");
-  const warn = /* @__PURE__ */ __name4((code, message, path26, stepId) => {
+  const warn = /* @__PURE__ */ __name4((code, message, path27, stepId) => {
     issues.push({
       code,
       message,
       severity: "warning",
-      path: path26,
+      path: path27,
       stepId
     });
   }, "warn");
@@ -7458,19 +7586,19 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     err("connection-declaration-invalid", "`connections` must be an array of { key, integrationType }", "connections");
   }
   (Array.isArray(g.connections) ? g.connections : []).forEach((c, i) => {
-    const path26 = `connections.${i}`;
+    const path27 = `connections.${i}`;
     const key = c?.key;
     const integrationType = c?.integrationType;
     if (typeof key !== "string" || !WORKFLOW_CONNECTION_KEY_RE.test(key)) {
-      err("connection-declaration-invalid", `connections[${i}].key must match ${WORKFLOW_CONNECTION_KEY_RE}`, `${path26}.key`);
+      err("connection-declaration-invalid", `connections[${i}].key must match ${WORKFLOW_CONNECTION_KEY_RE}`, `${path27}.key`);
       return;
     }
     if (ownKeys.has(key)) {
-      err("connection-declaration-invalid", `connections[${i}].key "${key}" is declared twice`, `${path26}.key`);
+      err("connection-declaration-invalid", `connections[${i}].key "${key}" is declared twice`, `${path27}.key`);
       return;
     }
     if (typeof integrationType !== "string" || !integrationType.trim()) {
-      err("connection-declaration-invalid", `connections[${i}] ("${key}") needs an integrationType (the catalog slug, e.g. 'github')`, `${path26}.integrationType`);
+      err("connection-declaration-invalid", `connections[${i}] ("${key}") needs an integrationType (the catalog slug, e.g. 'github')`, `${path27}.integrationType`);
       return;
     }
     ownKeys.add(key);
@@ -7484,112 +7612,112 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
-  const checkId = /* @__PURE__ */ __name4((id2, path26) => {
+  const checkId = /* @__PURE__ */ __name4((id2, path27) => {
     nodeCount += 1;
     if (seen.has(id2)) {
-      err("duplicate-step-id", `step id "${id2}" is declared twice (first at ${seen.get(id2)})`, path26, id2);
+      err("duplicate-step-id", `step id "${id2}" is declared twice (first at ${seen.get(id2)})`, path27, id2);
     } else {
-      seen.set(id2, path26);
+      seen.set(id2, path27);
     }
   }, "checkId");
-  const checkPolicyEnums = /* @__PURE__ */ __name4((node, path26) => {
+  const checkPolicyEnums = /* @__PURE__ */ __name4((node, path27) => {
     const id2 = singleId(node);
     const check = /* @__PURE__ */ __name4((member, allowed) => {
       const value22 = node[member];
       if (value22 === void 0 || typeof value22 === "string" && allowed.includes(value22)) return;
-      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path26}.${member}`, id2);
+      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path27}.${member}`, id2);
     }, "check");
     check("sideEffects", WORKFLOW_SIDE_EFFECTS);
     check("jobResources", WORKFLOW_JOB_RESOURCES);
   }, "checkPolicyEnums");
-  const checkRetry = /* @__PURE__ */ __name4((node, path26) => {
+  const checkRetry = /* @__PURE__ */ __name4((node, path27) => {
     const r = node.retry;
     if (!r) return;
     const id2 = singleId(node);
     const unknown = unknownWorkflowRetryMembers(r);
-    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path26}.retry`, id2);
+    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path27}.retry`, id2);
     if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
       const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path26}.retry.maxAttempts`, id2);
+      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path27}.retry.maxAttempts`, id2);
     }
     const backoffs = retryBackoffs();
     if (r.backoff !== void 0 && !backoffs.includes(r.backoff)) {
       const list = backoffs.map((b) => `'${b}'`).join(" | ");
-      err("backoff-invalid", `retry.backoff must be ${list}`, `${path26}.retry.backoff`, id2);
+      err("backoff-invalid", `retry.backoff must be ${list}`, `${path27}.retry.backoff`, id2);
     }
     if (r.backoffSeconds !== void 0 && r.backoffSeconds < 0) {
-      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path26}.retry.backoffSeconds`, id2);
+      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path27}.retry.backoffSeconds`, id2);
     }
     if (r.maxBackoffSeconds !== void 0) {
       if (r.backoff !== "exponential") {
-        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path26}.retry`, id2);
+        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path27}.retry`, id2);
       } else if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) {
-        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path26}.retry.maxBackoffSeconds`, id2);
+        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path27}.retry.maxBackoffSeconds`, id2);
       }
     }
   }, "checkRetry");
-  const checkTimeout = /* @__PURE__ */ __name4((node, path26) => {
+  const checkTimeout = /* @__PURE__ */ __name4((node, path27) => {
     const t = node.timeoutSeconds;
     if (t === void 0) return;
     const id2 = singleId(node);
     if (!Number.isInteger(t) || t < 1) {
-      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path26}.timeoutSeconds`, id2);
+      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path27}.timeoutSeconds`, id2);
       return;
     }
     if (node.tier === "job") {
       const cap = node.type === "agent" ? caps.maxJobTimeoutSeconds : caps.maxJobSegmentSeconds;
       if (t > cap) {
-        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path26}.timeoutSeconds`, id2);
+        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path27}.timeoutSeconds`, id2);
       } else if (node.type === "agent" && t > caps.maxJobSegmentSeconds && !node.workspace) {
-        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path26}.timeoutSeconds`, id2);
+        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path27}.timeoutSeconds`, id2);
       }
     } else if (t > caps.maxWorkerTimeoutSeconds) {
-      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path26}.timeoutSeconds`, id2);
+      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path27}.timeoutSeconds`, id2);
     }
   }, "checkTimeout");
-  const checkSpecialistRole = /* @__PURE__ */ __name4((node, path26) => {
+  const checkSpecialistRole = /* @__PURE__ */ __name4((node, path27) => {
     const role = node.role;
     const hasRef = typeof role.ref === "string";
     const hasInline = role.name !== void 0 || role.instructions !== void 0 || Array.isArray(role.tools) && role.tools.length > 0;
     if (hasRef && hasInline) {
-      err("role-ref-and-inline", "a role is either `{ref}` or inline `{name, instructions, tools}`, never both", `${path26}.role`, node.id);
+      err("role-ref-and-inline", "a role is either `{ref}` or inline `{name, instructions, tools}`, never both", `${path27}.role`, node.id);
     }
     if (node.agentId !== "$self") {
-      err("ephemeral-base-not-self", "a role runs on the owner only: use '$self'", `${path26}.agentId`, node.id);
+      err("ephemeral-base-not-self", "a role runs on the owner only: use '$self'", `${path27}.agentId`, node.id);
     }
     if (opts.policy && opts.policy.ephemeralSpecialists !== true) {
-      err("ephemeral-specialists-disabled", "ephemeral specialists are off for this org/agent (workflowPolicy.ephemeralSpecialists)", `${path26}.role`, node.id);
+      err("ephemeral-specialists-disabled", "ephemeral specialists are off for this org/agent (workflowPolicy.ephemeralSpecialists)", `${path27}.role`, node.id);
     }
     let tools = Array.isArray(role.tools) ? role.tools.filter((t) => typeof t === "string") : [];
     if (hasRef && opts.roleLibrary) {
       const saved = opts.roleLibrary.get(role.ref);
       if (!saved) {
-        err("role-ref-unknown", `no saved role \`${role.ref}\` in the owner's library`, `${path26}.role.ref`, node.id);
+        err("role-ref-unknown", `no saved role \`${role.ref}\` in the owner's library`, `${path27}.role.ref`, node.id);
       } else {
         tools = saved.tools ?? [];
         if (typeof role.roleHash === "string" && saved.roleHash && role.roleHash !== saved.roleHash) {
-          warn("role-ref-stale", `saved role \`${role.ref}\` changed since this version was frozen`, `${path26}.role.ref`, node.id);
+          warn("role-ref-stale", `saved role \`${role.ref}\` changed since this version was frozen`, `${path27}.role.ref`, node.id);
         }
       }
     }
     if (tools.length && opts.toolCatalog) {
       const missing = tools.filter((t) => !opts.toolCatalog.has(t));
       if (missing.length) {
-        err("ephemeral-tools-not-subset", `role tools not in the owner's catalog: ${missing.join(", ")}`, `${path26}.role.tools`, node.id);
+        err("ephemeral-tools-not-subset", `role tools not in the owner's catalog: ${missing.join(", ")}`, `${path27}.role.tools`, node.id);
       }
     }
   }, "checkSpecialistRole");
-  const checkRequiredConnections = /* @__PURE__ */ __name4((node, path26) => {
+  const checkRequiredConnections = /* @__PURE__ */ __name4((node, path27) => {
     const required = node.requiredConnections;
     if (!Array.isArray(required)) return;
     const undeclared = required.filter(undeclaredKey);
     if (undeclared.length) {
-      err("connection-key-undeclared", connectionKeyUndeclaredMessage(`${path26}.requiredConnections`, undeclared[0]) + (undeclared.length > 1 ? ` (also undeclared: ${JSON.stringify(undeclared.slice(1))})` : ""), `${path26}.requiredConnections`, singleId(node));
+      err("connection-key-undeclared", connectionKeyUndeclaredMessage(`${path27}.requiredConnections`, undeclared[0]) + (undeclared.length > 1 ? ` (also undeclared: ${JSON.stringify(undeclared.slice(1))})` : ""), `${path27}.requiredConnections`, singleId(node));
     }
     if (!opts.connectionIds) return;
     const unknown = required.filter((c) => typeof c !== "string" || !declaredKeys.has(c) && !opts.connectionIds.has(c));
     if (unknown.length) {
-      err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are neither declared connections[].key values nor connections the owner can mount`, `${path26}.requiredConnections`, singleId(node));
+      err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are neither declared connections[].key values nor connections the owner can mount`, `${path27}.requiredConnections`, singleId(node));
     }
   }, "checkRequiredConnections");
   const jobClassifiablePin = /* @__PURE__ */ __name4((model) => {
@@ -7607,33 +7735,33 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     return void 0;
   }, "jobClassifiablePin");
-  const checkTier = /* @__PURE__ */ __name4((node, path26) => {
+  const checkTier = /* @__PURE__ */ __name4((node, path27) => {
     const id2 = singleId(node);
     if (node.workspace && node.workspace !== "inherit" && node.tier !== void 0 && node.tier !== "job") {
-      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path26}.workspace`, id2);
+      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path27}.workspace`, id2);
     }
     if (node.harness !== void 0 && node.tier !== "job") {
-      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path26}.harness`, id2);
+      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path27}.harness`, id2);
     }
     const provider = node.type === "agent" ? classifyModelProvider(jobClassifiablePin(node.model)) : null;
     if (node.harness === "claude-code" && provider !== null && provider !== "anthropic") {
-      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path26}.harness`, id2);
+      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path27}.harness`, id2);
     }
     if (isJobTier(node) && provider !== null && opts.policy?.jobProviders && !opts.policy.jobProviders.includes(provider)) {
-      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path26}.model`, id2);
+      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path27}.model`, id2);
     }
   }, "checkTier");
-  const checkModel = /* @__PURE__ */ __name4((node, path26) => {
+  const checkModel = /* @__PURE__ */ __name4((node, path27) => {
     if (node.type !== "agent" || typeof node.model !== "string") return;
     const id2 = singleId(node);
     const parsed = parseModelTemplate(node.model);
     if (parsed.kind === "invalid") {
-      err("model-template-invalid", parsed.message, `${path26}.model`, id2);
+      err("model-template-invalid", parsed.message, `${path27}.model`, id2);
       return;
     }
     if (parsed.kind === "template" && parsed.template.default === void 0) {
       if (isJobTier(node)) {
-        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path26}.model`, id2);
+        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path27}.model`, id2);
       }
       return;
     }
@@ -7646,80 +7774,85 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (registry === "unavailable") {
       const trimmed2 = pin.trim();
       if (trimmed2 && !normalizeModelId(trimmed2, []).ok) {
-        warn("model-unresolved", inContext(`model "${trimmed2}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path26}.model`, id2);
+        warn("model-unresolved", inContext(`model "${trimmed2}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path27}.model`, id2);
       }
       return;
     }
     const resolved = normalizeModelId(pin, registry);
-    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path26}.model`, id2);
+    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path27}.model`, id2);
   }, "checkModel");
-  const checkTaskClass = /* @__PURE__ */ __name4((node, path26) => {
+  const checkTaskClass = /* @__PURE__ */ __name4((node, path27) => {
     if (node.type !== "agent" || node.taskClass === void 0) return;
     if (!opts.static) return;
     if (typeof node.model === "string" && node.model.trim()) return;
-    err("task-class-without-model", `taskClass '${String(node.taskClass)}' needs a \`model\` on a pushed definition \u2014 write a class (model: 'class/fast' | 'class/balanced' | 'class/strong') or an approved provider/model code; nothing maps a task class to a model at dispatch, so a step with neither would run on the agent\u2019s own model`, `${path26}.taskClass`, singleId(node));
+    err("task-class-without-model", `taskClass '${String(node.taskClass)}' needs a \`model\` on a pushed definition \u2014 write a class (model: 'class/fast' | 'class/balanced' | 'class/strong') or an approved provider/model code; nothing maps a task class to a model at dispatch, so a step with neither would run on the agent\u2019s own model`, `${path27}.taskClass`, singleId(node));
   }, "checkTaskClass");
-  const checkWorkspace = /* @__PURE__ */ __name4((node, path26) => {
+  const checkWorkspace = /* @__PURE__ */ __name4((node, path27) => {
     const id2 = singleId(node);
     const ws = workspaceOf(node);
     if (isJobTier(node) && opts.policy && opts.policy.jobTier !== true) {
-      err("job-tier-disabled", `"${id2}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path26}.tier`, id2);
+      err("job-tier-disabled", `"${id2}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path27}.tier`, id2);
     }
     const tools = jobToolsOf(node);
     if (tools !== void 0) {
       if (!isJobTier(node)) {
-        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path26}.jobTools`, id2);
+        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path27}.jobTools`, id2);
       }
       const unknown = (Array.isArray(tools) ? tools : [
         tools
       ]).filter((t) => !WORKFLOW_JOB_TOOLS.includes(t));
       if (unknown.length > 0) {
-        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path26}.jobTools`, id2);
+        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path27}.jobTools`, id2);
       }
       if (node.type === "agent" && (Array.isArray(tools) ? tools : [
         tools
       ]).includes("gh")) {
-        warn("gh-on-coding-turn", `"${id2}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path26}.jobTools`, id2);
+        warn("gh-on-coding-turn", `"${id2}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path27}.jobTools`, id2);
       }
     }
     const plugins = node.plugins;
     const target = node.target;
+    const luaApi = node.luaApi;
+    if (luaApi !== void 0) {
+      const problem = workflowJobLuaApiProblem(luaApi, node.type === "step" ? "code" : node.type, isJobTier(node) ? "job" : node.tier);
+      if (problem) err("lua-api-invalid", problem, `${path27}.luaApi`, id2);
+    }
     if (target !== void 0) {
-      const problem = workflowJobTargetProblem(target, plugins);
-      if (problem) err("target-invalid", problem, `${path26}.target`, id2);
+      const problem = workflowJobTargetProblem(target, plugins, luaApi);
+      if (problem) err("target-invalid", problem, `${path27}.target`, id2);
     }
     if (plugins !== void 0) {
       const problem = workflowJobPluginsProblem(plugins);
-      if (problem) err("plugins-invalid", problem, `${path26}.plugins`, id2);
-      if (node.type !== "agent") err("plugins-invalid", "`plugins` is legal on agent steps only", `${path26}.plugins`, id2);
+      if (problem) err("plugins-invalid", problem, `${path27}.plugins`, id2);
+      if (node.type !== "agent") err("plugins-invalid", "`plugins` is legal on agent steps only", `${path27}.plugins`, id2);
       else {
-        if (!isJobTier(node)) err("plugins-invalid", "`plugins` needs tier:'job'", `${path26}.plugins`, id2);
+        if (!isJobTier(node)) err("plugins-invalid", "`plugins` needs tier:'job'", `${path27}.plugins`, id2);
         const provider = classifyModelProvider(jobClassifiablePin(node.model));
-        if (node.harness === "generic" || provider !== null && provider !== "anthropic") err("plugins-invalid", "`plugins` run on the claude-code harness only (an Anthropic model, no `harness:'generic'`)", `${path26}.plugins`, id2);
+        if (node.harness === "generic" || provider !== null && provider !== "anthropic") err("plugins-invalid", "`plugins` run on the claude-code harness only (an Anthropic model, no `harness:'generic'`)", `${path27}.plugins`, id2);
         const w = workspaceOf(node);
         const ro = w !== void 0 && w !== "inherit" && w.mount === "ro";
         const declared = Array.isArray(tools) ? tools : void 0;
-        if (!effectiveJobTools(declared, ro).includes("shell")) err("plugins-invalid", "`plugins` need the `shell` job tool (the plugin drives lua-cli) \u2014 keep it in jobTools and mount rw", `${path26}.plugins`, id2);
+        if (!effectiveJobTools(declared, ro).includes("shell")) err("plugins-invalid", "`plugins` need the `shell` job tool (the plugin drives lua-cli) \u2014 keep it in jobTools and mount rw", `${path27}.plugins`, id2);
       }
     }
     if (node.type === "agent" && ws && ws !== "inherit" && ws.mount === "ro" && Array.isArray(tools) && effectiveJobTools(tools, true).length === 0) {
-      warn("ro-step-has-no-tools", `"${id2}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path26}.jobTools`, id2);
+      warn("ro-step-has-no-tools", `"${id2}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path27}.jobTools`, id2);
     }
     if (ws && ws !== "inherit") {
       if (!envelopeWorkspace && !opts.mayInherit) {
-        err("workspace-not-declared", `"${id2}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path26}.workspace`, id2);
+        err("workspace-not-declared", `"${id2}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path27}.workspace`, id2);
       }
       if (ws.isolation === "worktree" && envelopeWorkspace?.kind === "empty") {
-        err("worktree-requires-git-workspace", `"${id2}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path26}.workspace.isolation`, id2);
+        err("worktree-requires-git-workspace", `"${id2}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path27}.workspace.isolation`, id2);
       }
     }
     if (node.type === "workflow" && ws === "inherit") {
       if (!envelopeWorkspace) {
-        err("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path26}.workspace`, id2);
+        err("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path27}.workspace`, id2);
       }
       const child = opts.resolveWorkflow?.(node.workflowId);
       if (child?.workspace) {
-        err("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path26}.workspace`, id2);
+        err("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path27}.workspace`, id2);
       }
     }
   }, "checkWorkspace");
@@ -7733,165 +7866,165 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id2, m), `${basePath}.${m.member}`, id2);
     }
   }, "checkMapMembers");
-  const checkInputShape = /* @__PURE__ */ __name4((node, path26) => {
+  const checkInputShape = /* @__PURE__ */ __name4((node, path27) => {
     const input = node.input;
     if (input === void 0) return;
     const id2 = singleId(node);
     if (input !== null && typeof input === "object" && !Array.isArray(input)) {
-      checkMapMembers(input, `${path26}.input`, id2);
+      checkMapMembers(input, `${path27}.input`, id2);
       return;
     }
-    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path26}.input`, id2);
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path27}.input`, id2);
   }, "checkInputShape");
-  const checkBodyInput = /* @__PURE__ */ __name4((body, path26, container) => {
+  const checkBodyInput = /* @__PURE__ */ __name4((body, path27, container) => {
     if (body.type === "workflow" || body.input === void 0) return;
-    err("arm-input-unsupported", container === "foreach" ? `a foreach body receives each item as its input \u2014 drop \`input\` on "${singleId(body)}" and map the items before the foreach instead` : `a loop body receives the previous output as its input \u2014 drop \`input\` on "${singleId(body)}" and put the map before the loop instead`, `${path26}.input`, singleId(body));
+    err("arm-input-unsupported", container === "foreach" ? `a foreach body receives each item as its input \u2014 drop \`input\` on "${singleId(body)}" and map the items before the foreach instead` : `a loop body receives the previous output as its input \u2014 drop \`input\` on "${singleId(body)}" and put the map before the loop instead`, `${path27}.input`, singleId(body));
   }, "checkBodyInput");
-  const checkSingle = /* @__PURE__ */ __name4((node, path26, depth) => {
+  const checkSingle = /* @__PURE__ */ __name4((node, path27, depth) => {
     recordOutputSchema(node);
     if (node.type === "workflow" && (typeof node.workflowId !== "string" || node.workflowId.length === 0)) {
-      checkId(node.id, path26);
-      err("invalid-envelope", `\`workflowId\` must be a non-empty string naming the workflow to start (got ${JSON.stringify(node.workflowId)})`, `${path26}.workflowId`, node.id);
+      checkId(node.id, path27);
+      err("invalid-envelope", `\`workflowId\` must be a non-empty string naming the workflow to start (got ${JSON.stringify(node.workflowId)})`, `${path27}.workflowId`, node.id);
       return;
     }
     if (node.type === "workflow" && (node.workflowId.startsWith("$") || Array.isArray(node.graph))) {
-      checkId(node.id, path26);
-      err("node-type-unsupported-by-engine", armSubrunUnsupportedMessage(node.id, node.workflowId), path26, node.id);
+      checkId(node.id, path27);
+      err("node-type-unsupported-by-engine", armSubrunUnsupportedMessage(node.id, node.workflowId), path27, node.id);
       return;
     }
-    checkId(singleId(node), path26);
-    checkPolicyEnums(node, path26);
-    checkInputShape(node, path26);
-    checkTimeout(node, path26);
-    checkTier(node, path26);
-    checkModel(node, path26);
-    checkTaskClass(node, path26);
-    checkRetry(node, path26);
-    checkWorkspace(node, path26);
+    checkId(singleId(node), path27);
+    checkPolicyEnums(node, path27);
+    checkInputShape(node, path27);
+    checkTimeout(node, path27);
+    checkTier(node, path27);
+    checkModel(node, path27);
+    checkTaskClass(node, path27);
+    checkRetry(node, path27);
+    checkWorkspace(node, path27);
     if (!opts.static) {
-      if (node.type === "step") err("code-step-not-allowed", "code steps are static-only (03 \xA73.4.2)", path26, node.step.id);
+      if (node.type === "step") err("code-step-not-allowed", "code steps are static-only (03 \xA73.4.2)", path27, node.step.id);
       if (node.type === "agent" && node.systemPrompt !== void 0) {
-        err("persona-override-not-allowed", "`systemPrompt` is static-only (03 \xA73.4.2)", `${path26}.systemPrompt`, node.id);
+        err("persona-override-not-allowed", "`systemPrompt` is static-only (03 \xA73.4.2)", `${path27}.systemPrompt`, node.id);
       }
     }
     if (node.type === "agent" && node.role && node.systemPrompt !== void 0) {
-      err("ephemeral-persona-not-overridable", "a specialist role and systemPrompt cannot coexist", `${path26}.systemPrompt`, node.id);
+      err("ephemeral-persona-not-overridable", "a specialist role and systemPrompt cannot coexist", `${path27}.systemPrompt`, node.id);
     }
     if (node.type === "agent" && node.role && typeof node.role.instructions === "string" && node.role.instructions.length > 4e3) {
-      err("ephemeral-role-too-long", "role.instructions exceeds 4000 chars", `${path26}.role.instructions`, node.id);
+      err("ephemeral-role-too-long", "role.instructions exceeds 4000 chars", `${path27}.role.instructions`, node.id);
     }
     if (node.type === "agent" && node.role && (node.role.tools?.length ?? 0) > 64) {
-      err("cap-exceeded", "role.tools exceeds 64 entries", `${path26}.role.tools`, node.id);
+      err("cap-exceeded", "role.tools exceeds 64 entries", `${path27}.role.tools`, node.id);
     }
-    if (node.type === "agent" && node.role) checkSpecialistRole(node, path26);
-    checkRequiredConnections(node, path26);
+    if (node.type === "agent" && node.role) checkSpecialistRole(node, path27);
+    checkRequiredConnections(node, path27);
     if (node.type === "workflow" && node.kind === "subrun" && depth > caps.maxNestingDepth) {
-      err("cap-exceeded", `nesting depth ${depth} exceeds ${caps.maxNestingDepth}`, path26, node.id);
+      err("cap-exceeded", `nesting depth ${depth} exceeds ${caps.maxNestingDepth}`, path27, node.id);
     }
     if (node.type === "workflow" && typeof g.definition?.id === "string" && node.workflowId === g.definition.id) {
-      err("subrun-cycle", `"${node.id}" starts "${node.workflowId}", which is this workflow itself`, path26, node.id);
+      err("subrun-cycle", `"${node.id}" starts "${node.workflowId}", which is this workflow itself`, path27, node.id);
     }
     for (const ref of nodeStepRefs(node)) {
       if (!upstream.has(ref)) {
-        err("template-reference-unresolved", `"${singleId(node)}" references stepResults.${ref}, which is not upstream`, path26, singleId(node));
+        err("template-reference-unresolved", `"${singleId(node)}" references stepResults.${ref}, which is not upstream`, path27, singleId(node));
       }
     }
   }, "checkSingle");
-  const checkHitl = /* @__PURE__ */ __name4((node, path26) => {
+  const checkHitl = /* @__PURE__ */ __name4((node, path27) => {
     if (node.type === "waitForSignal") {
       const w = node;
-      checkId(w.id, path26);
-      if (typeof w.signal !== "string" || w.signal.length === 0) err("invalid-envelope", "waitForSignal.signal is required", `${path26}.signal`, w.id);
+      checkId(w.id, path27);
+      if (typeof w.signal !== "string" || w.signal.length === 0) err("invalid-envelope", "waitForSignal.signal is required", `${path27}.signal`, w.id);
       return;
     }
     const a = node;
-    checkId(a.id, path26);
+    checkId(a.id, path27);
     if ((a.approver ?? "creator") === "creator" && a.excludeInitiator === true) {
-      err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path26, a.id);
+      err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path27, a.id);
     }
     const editable = approvalEditable(a);
     if (a.fourEyes !== void 0 && !editable) {
-      err("four-eyes-requires-editable", "`fourEyes` requires editable:true", `${path26}.fourEyes`, a.id);
+      err("four-eyes-requires-editable", "`fourEyes` requires editable:true", `${path27}.fourEyes`, a.id);
     }
     if (a.editable === false && Array.isArray(a.editablePaths) && a.editablePaths.length > 0) {
-      err("editable-path-invalid", "`editablePaths` beside editable:false is contradictory \u2014 drop the paths or set editable:true", `${path26}.editablePaths`, a.id);
+      err("editable-path-invalid", "`editablePaths` beside editable:false is contradictory \u2014 drop the paths or set editable:true", `${path27}.editablePaths`, a.id);
     } else if ((a.editablePaths !== void 0 || a.editedPayloadSchema !== void 0) && !editable) {
-      err("editable-path-invalid", "`editablePaths` / `editedPayloadSchema` require editable:true (a non-empty editablePaths implies it)", `${path26}.editablePaths`, a.id);
+      err("editable-path-invalid", "`editablePaths` / `editedPayloadSchema` require editable:true (a non-empty editablePaths implies it)", `${path27}.editablePaths`, a.id);
     }
     for (const p of a.editablePaths ?? []) {
-      if (!EDITABLE_PATH_RE.test(p)) err("editable-path-invalid", `editablePaths entry "${p}" is outside the seg(.seg)*[*]/[n] grammar`, `${path26}.editablePaths`, a.id);
+      if (!EDITABLE_PATH_RE.test(p)) err("editable-path-invalid", `editablePaths entry "${p}" is outside the seg(.seg)*[*]/[n] grammar`, `${path27}.editablePaths`, a.id);
     }
     if (Array.isArray(a.onTimeout)) {
       const chain = a.onTimeout;
       const hops = chain.filter((h) => typeof h === "object" && h !== null && "escalateTo" in h);
-      if (hops.length > 3) err("escalation-chain-too-long", "an onTimeout chain carries at most 3 escalation hops", `${path26}.onTimeout`, a.id);
+      if (hops.length > 3) err("escalation-chain-too-long", "an onTimeout chain carries at most 3 escalation hops", `${path27}.onTimeout`, a.id);
       const last = chain[chain.length - 1];
       if (last === void 0 || typeof last === "object" && last !== null && "escalateTo" in last) {
-        err("escalation-chain-not-terminal", "an onTimeout chain must end in a terminal member", `${path26}.onTimeout`, a.id);
+        err("escalation-chain-not-terminal", "an onTimeout chain must end in a terminal member", `${path27}.onTimeout`, a.id);
       }
     }
     if (typeof a.details === "string") {
       for (const ref of templateStepRefs(a.details)) {
-        if (!upstream.has(ref)) err("template-reference-unresolved", `"${a.id}" references stepResults.${ref}, which is not upstream`, path26, a.id);
+        if (!upstream.has(ref)) err("template-reference-unresolved", `"${a.id}" references stepResults.${ref}, which is not upstream`, path27, a.id);
       }
     }
   }, "checkHitl");
-  const checkHitlArm = /* @__PURE__ */ __name4((node, path26, container) => {
+  const checkHitlArm = /* @__PURE__ */ __name4((node, path27, container) => {
     if (!workflowContainerRunsHitlArm(container)) {
-      checkId(node.id, path26);
-      err("node-type-unsupported-in-container", workflowHitlArmUnsupportedMessage(node.type, node.id, container), path26, node.id);
+      checkId(node.id, path27);
+      err("node-type-unsupported-in-container", workflowHitlArmUnsupportedMessage(node.type, node.id, container), path27, node.id);
       return;
     }
-    checkHitl(node, path26);
+    checkHitl(node, path27);
   }, "checkHitlArm");
-  const checkArm = /* @__PURE__ */ __name4((arm, path26, depth, container) => {
+  const checkArm = /* @__PURE__ */ __name4((arm, path27, depth, container) => {
     if (arm.type === "mapping") {
-      checkId(arm.id, path26);
-      checkMapMembers(readMapConfig(arm.mapConfig), `${path26}.mapConfig`, arm.id);
+      checkId(arm.id, path27);
+      checkMapMembers(readMapConfig(arm.mapConfig), `${path27}.mapConfig`, arm.id);
       for (const ref of nodeStepRefs(arm)) {
-        if (!upstream.has(ref)) err("template-reference-unresolved", `"${arm.id}" references stepResults.${ref}, which is not upstream`, path26, arm.id);
+        if (!upstream.has(ref)) err("template-reference-unresolved", `"${arm.id}" references stepResults.${ref}, which is not upstream`, path27, arm.id);
       }
       return;
     }
     if (isHitlNode(arm)) {
-      checkHitlArm(arm, path26, container);
+      checkHitlArm(arm, path27, container);
       return;
     }
-    checkSingle(arm, path26, depth);
+    checkSingle(arm, path27, depth);
   }, "checkArm");
   graph.forEach((entry, i) => {
-    const path26 = `graph.${i}`;
+    const path27 = `graph.${i}`;
     const declared = [];
     switch (entry.type) {
       case "step":
       case "agent":
       case "tool":
       case "workflow":
-        checkSingle(entry, path26, 1);
+        checkSingle(entry, path27, 1);
         declared.push(singleId(entry));
         break;
       case "mapping":
-        checkId(entry.id, path26);
-        checkMapMembers(readMapConfig(entry.mapConfig), `${path26}.mapConfig`, entry.id);
+        checkId(entry.id, path27);
+        checkMapMembers(readMapConfig(entry.mapConfig), `${path27}.mapConfig`, entry.id);
         for (const ref of nodeStepRefs(entry)) {
-          if (!upstream.has(ref)) err("template-reference-unresolved", `"${entry.id}" references stepResults.${ref}, which is not upstream`, path26, entry.id);
+          if (!upstream.has(ref)) err("template-reference-unresolved", `"${entry.id}" references stepResults.${ref}, which is not upstream`, path27, entry.id);
         }
         declared.push(entry.id);
         break;
       case "sleep":
-        checkId(entry.id, path26);
-        if (!Number.isFinite(entry.duration) || entry.duration < 0) err("invalid-envelope", "sleep.duration must be a non-negative number", `${path26}.duration`, entry.id);
+        checkId(entry.id, path27);
+        if (!Number.isFinite(entry.duration) || entry.duration < 0) err("invalid-envelope", "sleep.duration must be a non-negative number", `${path27}.duration`, entry.id);
         declared.push(entry.id);
         break;
       case "sleepUntil": {
         const s = entry;
-        checkId(s.id, path26);
-        err("node-type-unsupported-by-engine", sleepUntilUnsupportedMessage(s.id), path26, s.id);
+        checkId(s.id, path27);
+        err("node-type-unsupported-by-engine", sleepUntilUnsupportedMessage(s.id), path27, s.id);
         if (s.date === void 0 === (s.dateFrom === void 0)) {
-          err("invalid-envelope", "sleepUntil needs exactly one of `date` | `dateFrom`", path26, s.id);
+          err("invalid-envelope", "sleepUntil needs exactly one of `date` | `dateFrom`", path27, s.id);
         }
         if (s.dateFrom && !upstream.has(s.dateFrom.step)) {
-          err("sleep-until-source-missing", `sleepUntil "${s.id}" reads dateFrom.step "${s.dateFrom.step}", which is not upstream`, `${path26}.dateFrom`, s.id);
+          err("sleep-until-source-missing", `sleepUntil "${s.id}" reads dateFrom.step "${s.dateFrom.step}", which is not upstream`, `${path27}.dateFrom`, s.id);
         }
         declared.push(s.id);
         break;
@@ -7899,10 +8032,10 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       case "parallel": {
         const p = entry;
         if (p.steps.length < 2 || p.steps.length > caps.maxParallelArms) {
-          err("cap-exceeded", `parallel needs 2..${caps.maxParallelArms} arms (got ${p.steps.length})`, path26);
+          err("cap-exceeded", `parallel needs 2..${caps.maxParallelArms} arms (got ${p.steps.length})`, path27);
         }
         p.steps.forEach((arm, j) => {
-          const armPath = `${path26}.steps.${j}`;
+          const armPath = `${path27}.steps.${j}`;
           if (arm.type === "mapping") {
             err("mapping-placement", "a bare mapping cannot be a parallel arm \u2014 chain it as [map, step]", armPath);
             return;
@@ -7912,31 +8045,31 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         });
         const executableArms = p.steps.filter(isSingleStep);
         const worktreeArms = executableArms.filter((a) => a.workspace?.isolation === "worktree");
-        if (worktreeArms.length > 0 && !p.merge) err("worktree-arms-require-merge", "worktree arms need a `merge` policy", path26);
-        if (worktreeArms.length === 0 && p.merge) err("merge-requires-worktree-arms", "`merge` needs at least one worktree arm", path26);
-        if (worktreeArms.length > WORKFLOW_JOB_MAX_WORKTREE_ARMS) err("worktree-arms-exceed-cap", `at most ${WORKFLOW_JOB_MAX_WORKTREE_ARMS} worktree arms per parallel`, path26);
+        if (worktreeArms.length > 0 && !p.merge) err("worktree-arms-require-merge", "worktree arms need a `merge` policy", path27);
+        if (worktreeArms.length === 0 && p.merge) err("merge-requires-worktree-arms", "`merge` needs at least one worktree arm", path27);
+        if (worktreeArms.length > WORKFLOW_JOB_MAX_WORKTREE_ARMS) err("worktree-arms-exceed-cap", `at most ${WORKFLOW_JOB_MAX_WORKTREE_ARMS} worktree arms per parallel`, path27);
         const sharedArms = executableArms.filter((a) => {
           const w = workspaceOf(a);
           if (!w || w === "inherit" || w.isolation === "worktree") return false;
           return !(envelopeWorkspace?.backend === "efs" && w.mount === "ro");
         });
-        if (sharedArms.length > 1) err("workspace-parallel-requires-worktree", `${sharedArms.length} arms mount the shared workspace inside one parallel \u2014 give each arm isolation:'worktree' (+ merge) or run them sequentially`, `${path26}.steps`);
+        if (sharedArms.length > 1) err("workspace-parallel-requires-worktree", `${sharedArms.length} arms mount the shared workspace inside one parallel \u2014 give each arm isolation:'worktree' (+ merge) or run them sequentially`, `${path27}.steps`);
         break;
       }
       case "conditional": {
         const c = entry;
         if (!Array.isArray(c.predicates) || c.predicates.length !== c.steps.length) {
-          err("invalid-envelope", "conditional.predicates must match conditional.steps one-to-one", path26);
+          err("invalid-envelope", "conditional.predicates must match conditional.steps one-to-one", path27);
         }
         (c.predicates ?? []).forEach((p, j) => {
-          if (!isWellFormedPredicate(p)) err("closure-predicate", "a conditional predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path26}.predicates.${j}`);
+          if (!isWellFormedPredicate(p)) err("closure-predicate", "a conditional predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path27}.predicates.${j}`);
         });
         c.steps.forEach((arm, j) => {
-          checkArm(arm, `${path26}.steps.${j}`, 1, "conditional");
+          checkArm(arm, `${path27}.steps.${j}`, 1, "conditional");
           declared.push(armId(arm));
         });
         if (c.otherwise) {
-          checkArm(c.otherwise, `${path26}.otherwise`, 1, "conditional");
+          checkArm(c.otherwise, `${path27}.otherwise`, 1, "conditional");
           declared.push(armId(c.otherwise));
         }
         break;
@@ -7945,34 +8078,34 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         const f = entry;
         const o = f.opts ?? {};
         if (o.concurrency !== void 0 && (o.concurrency < 1 || o.concurrency > caps.maxForeachConcurrency)) {
-          err("cap-exceeded", `foreach.concurrency must be 1..${caps.maxForeachConcurrency}`, `${path26}.opts.concurrency`);
+          err("cap-exceeded", `foreach.concurrency must be 1..${caps.maxForeachConcurrency}`, `${path27}.opts.concurrency`);
         }
         if (o.maxItems !== void 0 && (o.maxItems < 1 || o.maxItems > caps.maxForeachItems)) {
-          err("cap-exceeded", `foreach.maxItems must be 1..${caps.maxForeachItems} (the platform ceiling of maxForeachItems)`, `${path26}.opts.maxItems`);
+          err("cap-exceeded", `foreach.maxItems must be 1..${caps.maxForeachItems} (the platform ceiling of maxForeachItems)`, `${path27}.opts.maxItems`);
         }
         {
           const itemsCap = o.maxItems ?? WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS;
           const literal = o.items;
           if (Array.isArray(literal) && literal.length > itemsCap) {
-            err("foreach-items-exceed-cap", `foreach({items}) carries ${literal.length} items \u2014 above maxItems ${itemsCap}`, `${path26}.opts.items`);
+            err("foreach-items-exceed-cap", `foreach({items}) carries ${literal.length} items \u2014 above maxItems ${itemsCap}`, `${path27}.opts.items`);
           }
         }
         if (o.chunk !== void 0) {
           const max = o.maxItems ?? WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS;
           const size = typeof o.chunk === "number" ? o.chunk : o.chunk.size;
           if (!Number.isInteger(size) || size < 1 || size > max) {
-            err("chunk-size-invalid", `foreach.chunk.size must be an integer in [1, ${max}]`, typeof o.chunk === "number" ? `${path26}.opts.chunk` : `${path26}.opts.chunk.size`);
+            err("chunk-size-invalid", `foreach.chunk.size must be an integer in [1, ${max}]`, typeof o.chunk === "number" ? `${path27}.opts.chunk` : `${path27}.opts.chunk.size`);
           }
         }
         if (o.rateLimit !== void 0) {
           const hasS = o.rateLimit.perSecond !== void 0;
           const hasM = o.rateLimit.perMinute !== void 0;
           if (hasS === hasM) {
-            err("rate-limit-invalid", "foreach.rateLimit needs exactly one of perSecond | perMinute", `${path26}.opts.rateLimit`);
+            err("rate-limit-invalid", "foreach.rateLimit needs exactly one of perSecond | perMinute", `${path27}.opts.rateLimit`);
           } else if (hasS && (o.rateLimit.perSecond <= 0 || o.rateLimit.perSecond > caps.maxForeachRatePerSecond)) {
-            err("rate-limit-invalid", `rateLimit.perSecond must be in (0, ${caps.maxForeachRatePerSecond}]`, `${path26}.opts.rateLimit.perSecond`);
+            err("rate-limit-invalid", `rateLimit.perSecond must be in (0, ${caps.maxForeachRatePerSecond}]`, `${path27}.opts.rateLimit.perSecond`);
           } else if (hasM && (o.rateLimit.perMinute <= 0 || o.rateLimit.perMinute > caps.maxForeachRatePerSecond * 60)) {
-            err("rate-limit-invalid", `rateLimit.perMinute must be in (0, ${caps.maxForeachRatePerSecond * 60}]`, `${path26}.opts.rateLimit.perMinute`);
+            err("rate-limit-invalid", `rateLimit.perMinute must be in (0, ${caps.maxForeachRatePerSecond * 60}]`, `${path27}.opts.rateLimit.perMinute`);
           }
         }
         const bodyType = f.step.type;
@@ -7987,18 +8120,18 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
             const src = outputSchemas.get(d.step);
             arrayLike = src === void 0 ? void 0 : schemaIsArray(schemaAtPath(src, d.path ?? ""));
           }
-          if (arrayLike === false) err("foreach-items-not-array", `foreach({items}) for "${singleId(f.step)}" binds a value that is not an array`, `${path26}.step`, singleId(f.step));
+          if (arrayLike === false) err("foreach-items-not-array", `foreach({items}) for "${singleId(f.step)}" binds a value that is not an array`, `${path27}.step`, singleId(f.step));
         }
-        if (bodyType === "mapping") err("container-arm-empty", "a foreach body needs a step, not a bare mapping", `${path26}.step`);
+        if (bodyType === "mapping") err("container-arm-empty", "a foreach body needs a step, not a bare mapping", `${path27}.step`);
         else if (isHitlNode(f.step)) {
           if (o.chunk !== void 0) {
-            checkId(f.step.id, `${path26}.step`);
-            err("node-type-unsupported-in-container", workflowHitlArmShapeMessage(f.step.type, f.step.id, "chunked-foreach"), `${path26}.step`, f.step.id);
-          } else checkHitlArm(f.step, `${path26}.step`, "foreach");
+            checkId(f.step.id, `${path27}.step`);
+            err("node-type-unsupported-in-container", workflowHitlArmShapeMessage(f.step.type, f.step.id, "chunked-foreach"), `${path27}.step`, f.step.id);
+          } else checkHitlArm(f.step, `${path27}.step`, "foreach");
           declared.push(f.step.id);
         } else {
-          checkBodyInput(f.step, `${path26}.step`, "foreach");
-          checkSingle(f.step, `${path26}.step`, o.chunk ? 2 : 1);
+          checkBodyInput(f.step, `${path27}.step`, "foreach");
+          checkSingle(f.step, `${path27}.step`, o.chunk ? 2 : 1);
           declared.push(singleId(f.step));
         }
         break;
@@ -8006,31 +8139,31 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       case "loop": {
         const l = entry;
         if (l.maxIterations !== void 0 && (!Number.isInteger(l.maxIterations) || l.maxIterations < 1)) {
-          err("invalid-envelope", "loop.maxIterations must be a positive integer", `${path26}.maxIterations`);
+          err("invalid-envelope", "loop.maxIterations must be a positive integer", `${path27}.maxIterations`);
         }
         if (l.intervalSeconds !== void 0 && (!Number.isInteger(l.intervalSeconds) || l.intervalSeconds < 1 || l.intervalSeconds > caps.maxLoopIntervalSeconds)) {
-          err("loop-interval-out-of-range", `loop.intervalSeconds must be an integer in 1..${caps.maxLoopIntervalSeconds}`, `${path26}.intervalSeconds`);
+          err("loop-interval-out-of-range", `loop.intervalSeconds must be an integer in 1..${caps.maxLoopIntervalSeconds}`, `${path27}.intervalSeconds`);
         }
-        if (!isWellFormedPredicate(l.predicate)) err("closure-predicate", "a loop predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path26}.predicate`);
+        if (!isWellFormedPredicate(l.predicate)) err("closure-predicate", "a loop predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path27}.predicate`);
         const bodyType = l.step.type;
-        if (bodyType === "mapping") err("container-arm-empty", "a loop body needs a step, not a bare mapping", `${path26}.step`);
+        if (bodyType === "mapping") err("container-arm-empty", "a loop body needs a step, not a bare mapping", `${path27}.step`);
         else if (isHitlNode(l.step)) {
-          checkHitlArm(l.step, `${path26}.step`, "loop");
+          checkHitlArm(l.step, `${path27}.step`, "loop");
           declared.push(l.step.id);
         } else {
-          checkBodyInput(l.step, `${path26}.step`, "loop");
-          checkSingle(l.step, `${path26}.step`, 1);
+          checkBodyInput(l.step, `${path27}.step`, "loop");
+          checkSingle(l.step, `${path27}.step`, 1);
           declared.push(singleId(l.step));
         }
         break;
       }
       case "approval":
       case "waitForSignal":
-        checkHitl(entry, path26);
+        checkHitl(entry, path27);
         declared.push(entry.id);
         break;
       default:
-        err("invalid-envelope", `unknown entry type "${entry.type}"`, path26);
+        err("invalid-envelope", `unknown entry type "${entry.type}"`, path27);
     }
     for (const id2 of declared) upstream.add(id2);
   });
@@ -8279,11 +8412,11 @@ function compilePlan(g) {
 }
 function resolvePath(rawPath, ctx) {
   const templateMatch = PATH_PLACEHOLDER.exec(rawPath.trim());
-  const path26 = templateMatch ? templateMatch[1].trim() : rawPath.trim();
-  if (path26 === "") return MISSING;
-  const dot = path26.indexOf(".");
-  const scope = dot === -1 ? path26 : path26.slice(0, dot);
-  const rest = dot === -1 ? "" : path26.slice(dot + 1);
+  const path27 = templateMatch ? templateMatch[1].trim() : rawPath.trim();
+  if (path27 === "") return MISSING;
+  const dot = path27.indexOf(".");
+  const scope = dot === -1 ? path27 : path27.slice(0, dot);
+  const rest = dot === -1 ? "" : path27.slice(dot + 1);
   let root;
   switch (scope) {
     case "initData":
@@ -8317,9 +8450,9 @@ function resolvePath(rawPath, ctx) {
   }
   return walk(root, rest);
 }
-function walk(root, path26) {
-  if (path26 === "") return root;
-  const parts = path26.split(".");
+function walk(root, path27) {
+  if (path27 === "") return root;
+  const parts = path27.split(".");
   let value22 = root;
   for (const part of parts) {
     if (value22 === null || value22 === void 0) return MISSING;
@@ -8445,14 +8578,14 @@ function step(s) {
 function stepOf(id2) {
   return step(id2);
 }
-function init(path26) {
+function init(path27) {
   return {
-    path: path26 === "" ? "initData" : `initData.${path26}`
+    path: path27 === "" ? "initData" : `initData.${path27}`
   };
 }
-function state(path26) {
+function state(path27) {
   return {
-    path: path26 === "" ? "state" : `state.${path26}`
+    path: path27 === "" ? "state" : `state.${path27}`
   };
 }
 function lit(v) {
@@ -9382,7 +9515,7 @@ function timeZoneSupported(tz) {
     return false;
   }
 }
-function validateBusinessHours(cal, path26 = "businessHours") {
+function validateBusinessHours(cal, path27 = "businessHours") {
   const issues = [];
   const issue = /* @__PURE__ */ __name4((p, message) => issues.push({
     code: "business-hours-invalid",
@@ -9392,32 +9525,32 @@ function validateBusinessHours(cal, path26 = "businessHours") {
   if (typeof cal !== "object" || cal === null) return [
     {
       code: "business-hours-invalid",
-      path: path26,
+      path: path27,
       message: "not an object"
     }
   ];
   const c = cal;
-  if (!timeZoneSupported(c.tz)) issue(`${path26}.tz`, "unknown IANA time zone");
+  if (!timeZoneSupported(c.tz)) issue(`${path27}.tz`, "unknown IANA time zone");
   if (c.calendar === void 0 || c.calendar === "mon-fri") return issues;
   if (typeof c.calendar !== "object" || c.calendar === null) {
-    issue(`${path26}.calendar`, "expected 'mon-fri' or { days, start, end, holidays? }");
+    issue(`${path27}.calendar`, "expected 'mon-fri' or { days, start, end, holidays? }");
     return issues;
   }
   const k = c.calendar;
   if (!Array.isArray(k.days) || k.days.length === 0 || k.days.some((d) => !Number.isInteger(d) || d < 0 || d > 6)) {
-    issue(`${path26}.calendar.days`, "days must be a non-empty array of 0\u20136");
+    issue(`${path27}.calendar.days`, "days must be a non-empty array of 0\u20136");
   }
   const startOk = typeof k.start === "string" && HHMM.test(k.start);
   const endOk = typeof k.end === "string" && HHMM.test(k.end);
-  if (!startOk) issue(`${path26}.calendar.start`, "expected 'HH:MM'");
-  if (!endOk) issue(`${path26}.calendar.end`, "expected 'HH:MM'");
-  if (startOk && endOk && toMinutes(k.start) >= toMinutes(k.end)) issue(`${path26}.calendar`, "start must be before end");
+  if (!startOk) issue(`${path27}.calendar.start`, "expected 'HH:MM'");
+  if (!endOk) issue(`${path27}.calendar.end`, "expected 'HH:MM'");
+  if (startOk && endOk && toMinutes(k.start) >= toMinutes(k.end)) issue(`${path27}.calendar`, "start must be before end");
   if (k.holidays !== void 0) {
-    if (!Array.isArray(k.holidays)) issue(`${path26}.calendar.holidays`, "expected an array of YYYY-MM-DD");
+    if (!Array.isArray(k.holidays)) issue(`${path27}.calendar.holidays`, "expected an array of YYYY-MM-DD");
     else {
-      if (k.holidays.length > MAX_HOLIDAYS) issue(`${path26}.calendar.holidays`, `at most ${MAX_HOLIDAYS} holidays`);
+      if (k.holidays.length > MAX_HOLIDAYS) issue(`${path27}.calendar.holidays`, `at most ${MAX_HOLIDAYS} holidays`);
       k.holidays.forEach((h, i) => {
-        if (typeof h !== "string" || !YMD.test(h)) issue(`${path26}.calendar.holidays[${i}]`, "expected 'YYYY-MM-DD'");
+        if (typeof h !== "string" || !YMD.test(h)) issue(`${path27}.calendar.holidays[${i}]`, "expected 'YYYY-MM-DD'");
       });
     }
   }
@@ -9829,7 +9962,7 @@ function rebaseItemPointer(pointer, itemsPath, index) {
   const base = `/${itemsPath.split(".").map(escapePointer).join("/")}/${index}`;
   return pointer === "/" || pointer === "" ? base : `${base}${pointer}`;
 }
-function validateWorkflowSchedule(schedule, path26 = "/schedule") {
+function validateWorkflowSchedule(schedule, path27 = "/schedule") {
   if (schedule === void 0 || schedule === null) return [];
   const issue = /* @__PURE__ */ __name4((at, detail) => [
     {
@@ -9840,40 +9973,40 @@ function validateWorkflowSchedule(schedule, path26 = "/schedule") {
     }
   ], "issue");
   if (!isObject(schedule)) {
-    return issue(path26, `\`schedule\` is ${Array.isArray(schedule) ? "an array" : `a ${typeof schedule}`}, not a typed schedule object`);
+    return issue(path27, `\`schedule\` is ${Array.isArray(schedule) ? "an array" : `a ${typeof schedule}`}, not a typed schedule object`);
   }
   const type = schedule.type;
   if (type === void 0) {
     const keys = Object.keys(schedule);
     const seen = keys.length ? ` (got { ${keys.join(", ")} })` : " (got {})";
-    return issue(path26, `\`schedule\` carries no \`type\` discriminator${seen}`);
+    return issue(path27, `\`schedule\` carries no \`type\` discriminator${seen}`);
   }
   if (typeof type !== "string" || !WORKFLOW_SCHEDULE_TYPES.includes(type)) {
-    return issue(path26, `\`schedule.type\` ${JSON.stringify(type)} is not one of ${WORKFLOW_SCHEDULE_TYPES.map((t) => `'${t}'`).join(" | ")}`);
+    return issue(path27, `\`schedule.type\` ${JSON.stringify(type)} is not one of ${WORKFLOW_SCHEDULE_TYPES.map((t) => `'${t}'`).join(" | ")}`);
   }
   if (schedule.runAs !== void 0 && !WORKFLOW_SCHEDULE_RUN_AS.includes(schedule.runAs)) {
-    return issue(`${path26}/runAs`, `\`schedule.runAs\` ${JSON.stringify(schedule.runAs)} is not one of ${WORKFLOW_SCHEDULE_RUN_AS.map((v) => `'${v}'`).join(" | ")}`);
+    return issue(`${path27}/runAs`, `\`schedule.runAs\` ${JSON.stringify(schedule.runAs)} is not one of ${WORKFLOW_SCHEDULE_RUN_AS.map((v) => `'${v}'`).join(" | ")}`);
   }
   switch (type) {
     case "cron": {
       if (typeof schedule.expression !== "string" || schedule.expression.trim().length === 0) {
-        return issue(`${path26}/expression`, "a { type: 'cron' } schedule needs a non-empty string `expression`");
+        return issue(`${path27}/expression`, "a { type: 'cron' } schedule needs a non-empty string `expression`");
       }
       if (schedule.timezone !== void 0 && (typeof schedule.timezone !== "string" || schedule.timezone.length === 0)) {
-        return issue(`${path26}/timezone`, "a { type: 'cron' } schedule's `timezone`, when given, is a non-empty IANA string");
+        return issue(`${path27}/timezone`, "a { type: 'cron' } schedule's `timezone`, when given, is a non-empty IANA string");
       }
       return [];
     }
     case "interval": {
       const s = schedule.seconds;
       if (typeof s !== "number" || !Number.isFinite(s) || s <= 0) {
-        return issue(`${path26}/seconds`, "a { type: 'interval' } schedule needs a positive number `seconds`");
+        return issue(`${path27}/seconds`, "a { type: 'interval' } schedule needs a positive number `seconds`");
       }
       return [];
     }
     case "once": {
       if (typeof schedule.executeAt !== "string" || Number.isNaN(Date.parse(schedule.executeAt))) {
-        return issue(`${path26}/executeAt`, "a { type: 'once' } schedule needs an ISO-8601 string `executeAt`");
+        return issue(`${path27}/executeAt`, "a { type: 'once' } schedule needs an ISO-8601 string `executeAt`");
       }
       return [];
     }
@@ -10316,15 +10449,15 @@ var init_dist2 = __esm({
     __name4(resolveDescriptor, "resolveDescriptor");
     __name(resolveMapping, "resolveMapping");
     __name4(resolveMapping, "resolveMapping");
-    fromInit = /* @__PURE__ */ __name4((path26) => ({
+    fromInit = /* @__PURE__ */ __name4((path27) => ({
       initData: true,
-      path: path26
+      path: path27
     }), "fromInit");
-    fromStep = /* @__PURE__ */ __name4((s, path26 = "") => {
+    fromStep = /* @__PURE__ */ __name4((s, path27 = "") => {
       const idOf = /* @__PURE__ */ __name4((x) => typeof x === "string" ? x : x.id, "idOf");
       return {
         step: Array.isArray(s) ? s.map(idOf) : idOf(s),
-        path: path26
+        path: path27
       };
     }, "fromStep");
     value = /* @__PURE__ */ __name4((v) => ({
@@ -10333,12 +10466,12 @@ var init_dist2 = __esm({
     template = /* @__PURE__ */ __name4((s) => ({
       template: s
     }), "template");
-    fromRequest = /* @__PURE__ */ __name4((path26) => ({
-      requestContextPath: path26
+    fromRequest = /* @__PURE__ */ __name4((path27) => ({
+      requestContextPath: path27
     }), "fromRequest");
-    rows = /* @__PURE__ */ __name4((s, path26, page) => ({
+    rows = /* @__PURE__ */ __name4((s, path27, page) => ({
       step: typeof s === "string" ? s : s.id,
-      path: path26,
+      path: path27,
       rows: page
     }), "rows");
     fromKnowledge = /* @__PURE__ */ __name4((k) => ({
@@ -10449,6 +10582,8 @@ var init_dist2 = __esm({
     __name4(validateApproverBlock, "validateApproverBlock");
     __name(liftRenderedApprover, "liftRenderedApprover");
     __name4(liftRenderedApprover, "liftRenderedApprover");
+    __name(approverUsersOf, "approverUsersOf");
+    __name4(approverUsersOf, "approverUsersOf");
     WORKSPACE_TEMPLATE_EXPR_RE = /^\$\{\s*(?:initData|input)\.([^}]+?)\s*\}$/;
     __name(workspaceTemplatePath, "workspaceTemplatePath");
     __name4(workspaceTemplatePath, "workspaceTemplatePath");
@@ -11105,7 +11240,9 @@ function stepNodeOf(s) {
     tier,
     workspace: s.workspace,
     jobResources: s.jobResources,
-    jobTools: s.jobTools
+    jobTools: s.jobTools,
+    luaApi: s.luaApi,
+    target: s.target
   });
 }
 function materializeEntry(entry, steps) {
@@ -11337,13 +11474,13 @@ var init_workflow = __esm({
       }
       if ("step" in items && Array.isArray(items.step)) throw foreachItemsNotLowered("a fan-in fromStep([\u2026])");
       if (typeof items.path !== "string") throw foreachItemsNotLowered("value(\u2026) / template(\u2026) / fromRequest(\u2026) / fromKnowledge(\u2026)");
-      const path26 = items.path;
-      if (path26.startsWith("initData")) return {
+      const path27 = items.path;
+      if (path27.startsWith("initData")) return {
         initData: true,
-        path: path26 === "initData" ? "" : path26.slice("initData.".length)
+        path: path27 === "initData" ? "" : path27.slice("initData.".length)
       };
-      if (path26.startsWith("stepResults.")) {
-        const rest = path26.slice("stepResults.".length);
+      if (path27.startsWith("stepResults.")) {
+        const rest = path27.slice("stepResults.".length);
         const dot = rest.indexOf(".");
         return dot === -1 ? {
           step: rest,
@@ -11353,7 +11490,7 @@ var init_workflow = __esm({
           path: rest.slice(dot + 1)
         };
       }
-      throw new LuaWorkflowBuildError("invalid-envelope", `foreach.items ref "${path26}" must point at initData.* or stepResults.*`);
+      throw new LuaWorkflowBuildError("invalid-envelope", `foreach.items ref "${path27}" must point at initData.* or stepResults.*`);
     }, "refToDescriptor");
     __workflowCommitHook = {};
     LuaWorkflow = class {
@@ -11453,6 +11590,14 @@ var init_workflow = __esm({
         const tier = s.tier ?? (s.workspace ? "job" : void 0);
         if (s.workspace && s.tier !== void 0 && s.tier !== "job") throw new LuaWorkflowBuildError("workspace-requires-job-tier", `"${s.id}": a step mounting a workspace must be tier:'job'`);
         if (s.jobTools && tier !== "job") throw new LuaWorkflowBuildError("cap-exceeded", `"${s.id}": jobTools require tier:'job' (job-tools-require-job-tier)`);
+        if (s.luaApi !== void 0) {
+          const problem = workflowJobLuaApiProblem(s.luaApi, "code", tier);
+          if (problem) throw new LuaWorkflowBuildError("lua-api-invalid", `"${s.id}": ${problem}`);
+        }
+        if (s.target !== void 0) {
+          const problem = workflowJobTargetProblem(s.target, void 0, s.luaApi);
+          if (problem) throw new LuaWorkflowBuildError("target-invalid", `"${s.id}": ${problem}`);
+        }
         assertTimeout({
           id: s.id,
           timeoutSeconds: s.timeoutSeconds,
@@ -11709,7 +11854,7 @@ var init_workflow = __esm({
         }
         if (opts.target !== void 0) {
           const problem = workflowJobTargetProblem(opts.target, opts.plugins);
-          if (problem) throw new LuaWorkflowBuildError("plugins-invalid", `"${id2}": ${problem}`);
+          if (problem) throw new LuaWorkflowBuildError("target-invalid", `"${id2}": ${problem}`);
         }
         assertTimeout({
           id: id2,
@@ -12165,6 +12310,7 @@ var init_types = __esm({
       PrimitiveKind2["DEVICE_TRIGGER"] = "device-trigger";
       PrimitiveKind2["VOICE"] = "voice";
       PrimitiveKind2["WORKFLOW"] = "workflow";
+      PrimitiveKind2["WEB_APP"] = "web-app";
       return PrimitiveKind2;
     })({});
   }
@@ -13304,12 +13450,12 @@ var init_dist3 = __esm({
         this.options = options;
         this.fetchFn = options.fetch ?? fetch;
       }
-      url(path26) {
+      url(path27) {
         const base = this.options.baseUrl.replace(/\/$/, "");
-        return `${base}/developer/agents/${encodeURIComponent(this.options.agentId)}${path26}`;
+        return `${base}/developer/agents/${encodeURIComponent(this.options.agentId)}${path27}`;
       }
-      async json(method, path26, body) {
-        const endpoint = this.url(path26);
+      async json(method, path27, body) {
+        const endpoint = this.url(path27);
         const res = await this.fetchFn(endpoint, {
           method,
           headers: {
@@ -13328,7 +13474,7 @@ var init_dist3 = __esm({
           } catch {
             text2 = void 0;
           }
-          throw new BackupHttpError(`Backup request failed: ${method} ${path26} \u2192 ${res.status} ${res.statusText}`, res.status, endpoint, text2);
+          throw new BackupHttpError(`Backup request failed: ${method} ${path27} \u2192 ${res.status} ${res.statusText}`, res.status, endpoint, text2);
         }
         const text = await res.text();
         if (!text) return void 0;
@@ -13475,12 +13621,12 @@ var init_backup_api_service = __esm({
       * @returns Promise resolving to missing/existing hash lists
       */
       async checkBlobsExist(hashes) {
-        const path26 = `/developer/agents/${this.agentId}/backup/check-blobs`;
+        const path27 = `/developer/agents/${this.agentId}/backup/check-blobs`;
         if (hashes.length <= CHECK_BLOBS_MAX_HASHES) {
           const data = {
             hashes
           };
-          return this.httpPost(path26, data, {});
+          return this.httpPost(path27, data, {});
         }
         const merged = {
           missing: [],
@@ -13492,7 +13638,7 @@ var init_backup_api_service = __esm({
           const data = {
             hashes: hashes.slice(i, i + CHECK_BLOBS_MAX_HASHES)
           };
-          const part = await this.httpPost(path26, data, {});
+          const part = await this.httpPost(path27, data, {});
           if (!part.success || !part.data) return part;
           merged.missing.push(...part.data.missing);
           merged.existing.push(...part.data.existing);
@@ -20563,8 +20709,8 @@ var init_voice_plugin = __esm({
             }, "isMissingTopLevelRequired");
             for (const issue of parsed.error.issues) {
               if (isMissingTopLevelRequired(issue)) continue;
-              const path26 = issue.path.length > 0 ? issue.path.join(".") : "<root>";
-              errors.push(validationError(`Voice config invalid at \`${path26}\`: ${issue.message}`, {
+              const path27 = issue.path.length > 0 ? issue.path.join(".") : "<root>";
+              errors.push(validationError(`Voice config invalid at \`${path27}\`: ${issue.message}`, {
                 line
               }));
             }
@@ -23045,8 +23191,9 @@ function metaOf(node, sources) {
     const jobTools = n2.toolScope?.jobTools;
     pick("jobTools", jobTools);
     pick("plugins", n2.plugins);
-    pick("target", n2.target);
   }
+  if (n2.type === "agent" || n2.type === "step") pick("target", n2.target);
+  if (n2.type === "step") pick("luaApi", n2.luaApi);
   if (n2.type === "approval") {
     pick("editedPayloadSchema", n2.editedPayloadSchema);
     pick("itemsPath", n2.itemsPath);
@@ -23948,6 +24095,402 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
   }
 });
 
+// src/compiler/plugins/web-app.plugin.ts
+import path9 from "path";
+import { Node as Node19 } from "ts-morph";
+function resolveValue2(node) {
+  let cur = unwrapExpression(node);
+  if (cur && Node19.isIdentifier(cur)) cur = unwrapExpression(resolveIdentifier(cur));
+  return cur;
+}
+function propertyValue(obj, name) {
+  const prop = obj.getProperty(name);
+  if (!prop) return void 0;
+  if (Node19.isShorthandPropertyAssignment(prop)) return resolveValue2(prop.getNameNode());
+  if (Node19.isPropertyAssignment(prop)) return resolveValue2(prop.getInitializer());
+  return void 0;
+}
+function literalKey(prop) {
+  if (!Node19.isPropertyAssignment(prop) && !Node19.isShorthandPropertyAssignment(prop)) return void 0;
+  const nameNode = prop.getNameNode();
+  if (Node19.isStringLiteral(nameNode) || Node19.isNoSubstitutionTemplateLiteral(nameNode)) {
+    return nameNode.getLiteralValue();
+  }
+  if (Node19.isIdentifier(nameNode) || Node19.isNumericLiteral(nameNode)) return nameNode.getText();
+  return void 0;
+}
+function isLuaCliRouteCall(call) {
+  if (!Node19.isCallExpression(call)) return false;
+  const callee = call.getExpression();
+  if (!Node19.isIdentifier(callee) || callee.getText() !== "route") return false;
+  return call.getSourceFile().getImportDeclarations().some((decl) => LUA_CLI_SPECIFIERS.has(decl.getModuleSpecifierValue()) && decl.getNamedImports().some((n2) => n2.getName() === "route" && !n2.getAliasNode()));
+}
+function aliasedHelpers(files) {
+  const out = [];
+  for (const sf of files) {
+    for (const decl of sf.getImportDeclarations()) {
+      if (!LUA_CLI_SPECIFIERS.has(decl.getModuleSpecifierValue())) continue;
+      for (const n2 of decl.getNamedImports()) {
+        const alias = n2.getAliasNode()?.getText();
+        if (alias && INJECTED_HELPERS.has(n2.getName())) {
+          out.push(`${n2.getName()} as ${alias} (${path9.basename(sf.getFilePath())})`);
+        }
+      }
+    }
+  }
+  return out;
+}
+function readRoutes(config) {
+  const routes = [];
+  const unreadable = [];
+  const duplicates = [];
+  const files = /* @__PURE__ */ new Set([
+    config.getSourceFile()
+  ]);
+  const seen = /* @__PURE__ */ new Set();
+  const routesNode = propertyValue(config, "routes");
+  if (!routesNode) return {
+    routes,
+    unreadable,
+    duplicates,
+    files
+  };
+  if (!Node19.isObjectLiteralExpression(routesNode)) {
+    return {
+      routes,
+      unreadable: [
+        routesNode.getText().slice(0, 60)
+      ],
+      duplicates,
+      files
+    };
+  }
+  files.add(routesNode.getSourceFile());
+  for (const prop of routesNode.getProperties()) {
+    const key = literalKey(prop);
+    if (key === void 0) {
+      unreadable.push(prop.getText().slice(0, 60));
+      continue;
+    }
+    if (seen.has(key)) {
+      duplicates.push(key);
+      continue;
+    }
+    seen.add(key);
+    const value3 = Node19.isShorthandPropertyAssignment(prop) ? resolveValue2(prop.getNameNode()) : Node19.isPropertyAssignment(prop) ? resolveValue2(prop.getInitializer()) : void 0;
+    if (value3) files.add(value3.getSourceFile());
+    if (value3 && isLuaCliRouteCall(value3) && Node19.isCallExpression(value3)) {
+      const arg = resolveValue2(value3.getArguments()[0]);
+      if (arg && Node19.isObjectLiteralExpression(arg)) {
+        routes.push({
+          key,
+          description: extractStringProperty(arg, "description"),
+          definition: arg
+        });
+        continue;
+      }
+    }
+    if (value3 && (Node19.isArrowFunction(value3) || Node19.isFunctionExpression(value3) || Node19.isFunctionDeclaration(value3))) {
+      routes.push({
+        key
+      });
+      continue;
+    }
+    unreadable.push(key);
+  }
+  return {
+    routes,
+    unreadable,
+    duplicates,
+    files
+  };
+}
+function responseStatuses(definition) {
+  const responses = definition ? propertyValue(definition, "responses") : void 0;
+  if (!responses || !Node19.isObjectLiteralExpression(responses)) return [];
+  const out = [];
+  for (const prop of responses.getProperties()) {
+    const status = Number(literalKey(prop));
+    const node = Node19.isPropertyAssignment(prop) ? prop.getInitializer() : void 0;
+    if (Number.isInteger(status) && node) out.push({
+      status,
+      node
+    });
+  }
+  return out;
+}
+function pageImportsOf(definitionFile, files, pagesRoot) {
+  if (!pagesRoot) return [];
+  const pagesDir = path9.resolve(path9.dirname(definitionFile.getFilePath()), pagesRoot) + path9.sep;
+  const out = [];
+  for (const sourceFile of files) {
+    out.push(...valueImportsInto(sourceFile, pagesDir));
+  }
+  return out;
+}
+function valueImportsInto(sourceFile, pagesDir) {
+  const out = [];
+  for (const decl of sourceFile.getImportDeclarations()) {
+    if (decl.isTypeOnly()) continue;
+    const named = decl.getNamedImports();
+    const valueBinding = !!decl.getDefaultImport() || !!decl.getNamespaceImport() || named.some((n2) => !n2.isTypeOnly()) || !decl.getImportClause();
+    if (!valueBinding) continue;
+    const specifier = decl.getModuleSpecifierValue();
+    const target = decl.getModuleSpecifierSourceFile()?.getFilePath() ?? (specifier.startsWith(".") ? path9.resolve(path9.dirname(sourceFile.getFilePath()), specifier) : void 0);
+    if (target && (target + path9.sep).startsWith(pagesDir)) out.push(specifier);
+  }
+  return out;
+}
+function isOutsideProject(sourceFile, pagesRoot) {
+  if (path9.isAbsolute(pagesRoot)) return true;
+  const configFile = sourceFile.getProject().getCompilerOptions().configFilePath;
+  const projectRoot = typeof configFile === "string" ? path9.dirname(configFile) : void 0;
+  if (!projectRoot) return false;
+  const rel = path9.relative(projectRoot, path9.resolve(path9.dirname(sourceFile.getFilePath()), pagesRoot));
+  return rel === ".." || rel.startsWith(`..${path9.sep}`) || path9.isAbsolute(rel);
+}
+function findConfig(sourceFile, exportName) {
+  const argOf = /* @__PURE__ */ __name((expr) => {
+    const e = unwrapExpression(expr);
+    if (!e || !(Node19.isCallExpression(e) || Node19.isNewExpression(e))) return void 0;
+    const arg = e.getArguments()[0];
+    return arg && Node19.isObjectLiteralExpression(arg) ? arg : void 0;
+  }, "argOf");
+  if (exportName === "default") {
+    for (const assignment of sourceFile.getExportAssignments()) {
+      const arg = argOf(assignment.getExpression());
+      if (arg) return arg;
+    }
+    return void 0;
+  }
+  return argOf(sourceFile.getVariableDeclaration(exportName)?.getInitializer());
+}
+var WEB_APP_NAME_PATTERN, ROUTE_KEY_PATTERN, MAX_ROUTES, SCHEMA_PARTS, LUA_CLI_SPECIFIERS, INJECTED_HELPERS, schemaKey, WebAppPlugin;
+var init_web_app_plugin = __esm({
+  "src/compiler/plugins/web-app.plugin.ts"() {
+    "use strict";
+    init_dist();
+    init_base();
+    init_ast_helpers();
+    init_schema_converter();
+    WEB_APP_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+    ROUTE_KEY_PATTERN = new RegExp(`^(${WEB_ROUTE_METHODS.join("|")}) (/\\S*)$`);
+    MAX_ROUTES = 200;
+    SCHEMA_PARTS = [
+      "params",
+      "query",
+      "body"
+    ];
+    LUA_CLI_SPECIFIERS = /* @__PURE__ */ new Set([
+      "lua-cli",
+      "lua-cli/skill",
+      "lua-cli/voice"
+    ]);
+    INJECTED_HELPERS = /* @__PURE__ */ new Set([
+      "route",
+      "json"
+    ]);
+    __name(resolveValue2, "resolveValue");
+    __name(propertyValue, "propertyValue");
+    __name(literalKey, "literalKey");
+    __name(isLuaCliRouteCall, "isLuaCliRouteCall");
+    __name(aliasedHelpers, "aliasedHelpers");
+    __name(readRoutes, "readRoutes");
+    __name(responseStatuses, "responseStatuses");
+    __name(pageImportsOf, "pageImportsOf");
+    __name(valueImportsInto, "valueImportsInto");
+    __name(isOutsideProject, "isOutsideProject");
+    __name(findConfig, "findConfig");
+    schemaKey = /* @__PURE__ */ __name((routeKey, part) => `route:${routeKey}:${part}`, "schemaKey");
+    WebAppPlugin = class extends BasePlugin {
+      static {
+        __name(this, "WebAppPlugin");
+      }
+      kind = "web-app";
+      displayName = "Web app";
+      defineFunction = "defineWebApp";
+      legacyClassNames = [
+        "LuaWebApp"
+      ];
+      crossFileRewrite = {
+        copyAllFields: true
+      };
+      extractFromConfig(config, exportName, sourcePath, position, pattern) {
+        const common = this.extractCommonFields(config, exportName, sourcePath, position);
+        if (!common) return null;
+        const pages = extractObjectProperty(config, "pages");
+        const pagesNode = propertyValue(config, "pages");
+        const pagesRoot = typeof pages?.root === "string" ? pages.root : pagesNode && Node19.isObjectLiteralExpression(pagesNode) ? extractStringProperty(pagesNode, "root") : void 0;
+        const { routes, unreadable, duplicates, files } = readRoutes(config);
+        const sourceFile = config.getSourceFile();
+        return {
+          kind: this.kind,
+          ...common,
+          metadata: {
+            pattern,
+            pagesRoot,
+            spa: typeof pages?.spa === "boolean" ? pages.spa : void 0,
+            nav: Array.isArray(pages?.nav) ? pages.nav : void 0,
+            csp: pages?.csp && typeof pages.csp === "object" ? pages.csp : void 0,
+            branding: extractObjectProperty(config, "branding"),
+            routes: routes.map((r) => {
+              const match = ROUTE_KEY_PATTERN.exec(r.key);
+              return {
+                key: r.key,
+                method: match ? match[1] : "",
+                path: match ? match[2] : "",
+                ...r.description ? {
+                  description: r.description
+                } : {},
+                has: {
+                  params: !!r.definition && hasProperty(r.definition, "params"),
+                  query: !!r.definition && hasProperty(r.definition, "query"),
+                  body: !!r.definition && hasProperty(r.definition, "body"),
+                  responses: responseStatuses(r.definition).map((x) => x.status)
+                }
+              };
+            }),
+            hasFetch: hasProperty(config, "fetch"),
+            unreadableRoutes: unreadable,
+            duplicateRoutes: duplicates,
+            aliasedHelpers: aliasedHelpers(files),
+            pagesRootOutsideProject: !!pagesRoot && isOutsideProject(sourceFile, pagesRoot),
+            pageImports: pageImportsOf(sourceFile, files, pagesRoot)
+          }
+        };
+      }
+      validate(metadata) {
+        const { errors, warnings } = this.baseValidation(metadata);
+        const meta = metadata.metadata;
+        const at = {
+          line: metadata.line
+        };
+        if (metadata.name && !WEB_APP_NAME_PATTERN.test(metadata.name)) {
+          errors.push(validationError(`Web app name must match ${WEB_APP_NAME_PATTERN} (lower-case letters, digits, dashes)`, at));
+        }
+        if (!meta.pagesRoot) {
+          errors.push(validationError("Web app `pages.root` must be a string literal naming the Vite project directory", at));
+        }
+        for (const entry of meta.unreadableRoutes) {
+          errors.push(validationError(`Web app route ${JSON.stringify(entry)} cannot be read at compile time: use a literal key with \`route({...})\` or a handler function`, at));
+        }
+        for (const key of meta.duplicateRoutes) {
+          errors.push(validationError(`Web app route ${JSON.stringify(key)} is declared more than once; only the last would run`, at));
+        }
+        for (const entry of meta.aliasedHelpers) {
+          errors.push(validationError(`Web app imports \`${entry}\` from lua-cli: import \`route\` and \`json\` under their own names (the bundle provides them only as such)`, at));
+        }
+        if (meta.pagesRootOutsideProject) {
+          errors.push(validationError(`Web app \`pages.root\` ${JSON.stringify(meta.pagesRoot)} must be a relative path to a directory inside the project`, at));
+        }
+        for (const r of meta.routes) {
+          if (!r.method) {
+            errors.push(validationError(`Web app route key ${JSON.stringify(r.key)} must look like 'GET /path' (${WEB_ROUTE_METHODS.join(", ")})`, at));
+          }
+        }
+        if (meta.routes.length > MAX_ROUTES) {
+          errors.push(validationError(`Web app declares ${meta.routes.length} routes; the limit is ${MAX_ROUTES}`, at));
+        }
+        if (meta.routes.length === 0 && !meta.hasFetch && meta.unreadableRoutes.length === 0) {
+          errors.push(validationError("Web app must declare at least one route or a `fetch` handler", at));
+        }
+        for (const specifier of meta.pageImports) {
+          errors.push(validationError(`Web app definition imports ${JSON.stringify(specifier)} from its pages directory: route code runs in the sandbox, pages in the browser. Use \`import type\` for shared types.`, at));
+        }
+        return {
+          valid: errors.length === 0,
+          errors,
+          warnings
+        };
+      }
+      getRuntimeValidation() {
+        return `
+  const app = primitive.primitive;
+  if (!app || (typeof app.fetch !== 'function' && (!app.routes || typeof app.routes !== 'object'))) {
+    throw new Error('[Lua] Invalid web-app artifact: missing routes or fetch');
+  }`;
+      }
+      /** JSON Schema per route part, keyed by `schemaKey`. A schema that cannot be converted is left out, not fatal. */
+      async extractSchemas(metadata, project) {
+        const sourceFile = project.getSourceFile(metadata.sourcePath);
+        const config = sourceFile && findConfig(sourceFile, metadata.exportName);
+        if (!config) return void 0;
+        const schemas = {};
+        const convert = /* @__PURE__ */ __name(async (key, node, label2) => {
+          if (!node) return;
+          try {
+            schemas[key] = await zodToJsonSchema2(node);
+          } catch (error) {
+            console.warn(`Warning: Could not convert ${label2} for web app ${metadata.name}:`, error);
+          }
+        }, "convert");
+        for (const r of readRoutes(config).routes) {
+          if (!r.definition) continue;
+          for (const part of SCHEMA_PARTS) {
+            await convert(schemaKey(r.key, part), propertyValue(r.definition, part), `${r.key} ${part}`);
+          }
+          for (const { status, node } of responseStatuses(r.definition)) {
+            await convert(schemaKey(r.key, `responses:${status}`), node, `${r.key} response ${status}`);
+          }
+        }
+        return Object.keys(schemas).length > 0 ? schemas : void 0;
+      }
+      toManifestEntry(compiled) {
+        const meta = compiled.metadata;
+        const schemas = compiled.schemas ?? {};
+        const routes = meta.routes.map((r) => {
+          const part = /* @__PURE__ */ __name((p) => schemas[schemaKey(r.key, p)], "part");
+          const responses = {};
+          for (const status of r.has.responses) {
+            const s = part(`responses:${status}`);
+            if (s) responses[String(status)] = s;
+          }
+          const routeSchemas = {
+            ...part("params") ? {
+              params: part("params")
+            } : {},
+            ...part("query") ? {
+              query: part("query")
+            } : {},
+            ...part("body") ? {
+              body: part("body")
+            } : {},
+            ...Object.keys(responses).length ? {
+              responses
+            } : {}
+          };
+          return {
+            key: r.key,
+            method: r.method,
+            path: r.path,
+            ...r.description ? {
+              description: r.description
+            } : {},
+            ...Object.keys(routeSchemas).length ? {
+              schemas: routeSchemas
+            } : {}
+          };
+        });
+        return {
+          ...this.baseManifestFields(compiled),
+          kind: "web-app",
+          pagesRoot: meta.pagesRoot ?? ".",
+          spa: meta.spa !== false,
+          nav: meta.nav ?? [],
+          ...meta.csp ? {
+            csp: meta.csp
+          } : {},
+          ...meta.branding ? {
+            branding: meta.branding
+          } : {},
+          routes,
+          hasFetch: meta.hasFetch
+        };
+      }
+    };
+  }
+});
+
 // src/compiler/plugins/registry.ts
 function getAllDefineFunctions() {
   return pluginRegistry.getAll().map((p) => p.defineFunction);
@@ -23972,6 +24515,7 @@ var init_registry = __esm({
     init_device_trigger_plugin();
     init_voice_plugin();
     init_workflow_plugin();
+    init_web_app_plugin();
     PluginRegistry = class {
       static {
         __name(this, "PluginRegistry");
@@ -23991,6 +24535,7 @@ var init_registry = __esm({
         this.register(new DeviceTriggerPlugin());
         this.register(new VoicePlugin());
         this.register(new WorkflowPlugin());
+        this.register(new WebAppPlugin());
       }
       /**
       * Register a plugin.
@@ -24041,13 +24586,13 @@ var init_registry = __esm({
 
 // src/compiler/bundler.ts
 import fs7 from "fs/promises";
-import path9 from "path";
+import path10 from "path";
 import crypto4 from "crypto";
 import { build } from "esbuild";
 function nodeCapabilityUnavailableMessage(specifier) {
   return `${NODE_CAPABILITY_UNAVAILABLE}: \`${specifier}\` is not available to a workflow code step \u2014 on the Job tier run a command through \`ctx.exec(['git', 'status'])\` or \`ctx.$\`git status\`\` (allow-listed binaries, argv only, no shell; see docs/workflows/workspaces-and-long-steps.md); a worker-tier step has no process access at all`;
 }
-var WORKFLOW_BUILDER_SUBPATH, WORKFLOW_BUILDER_INJECT_FILE, NODE_CAPABILITY_UNAVAILABLE, NODE_CAPABILITY_GUARDED, Bundler;
+var WORKFLOW_BUILDER_SUBPATH, WORKFLOW_BUILDER_INJECT_FILE, WEB_APP_RUNTIME_INJECT_FILE, WEB_APP_RUNTIME_INJECT_SOURCE, NODE_CAPABILITY_UNAVAILABLE, NODE_CAPABILITY_GUARDED, Bundler;
 var init_bundler = __esm({
   "src/compiler/bundler.ts"() {
     "use strict";
@@ -24058,6 +24603,23 @@ var init_bundler = __esm({
     init_package_root();
     WORKFLOW_BUILDER_SUBPATH = "lua-cli/workflow-builder";
     WORKFLOW_BUILDER_INJECT_FILE = "workflow-builder.inject.mjs";
+    WEB_APP_RUNTIME_INJECT_FILE = "web-app-runtime.inject.mjs";
+    WEB_APP_RUNTIME_INJECT_SOURCE = `// AUTO-GENERATED by lua-cli (compiler/bundler.ts) \u2014 esbuild inject shim for web-app bundles.
+export function route(def) {
+  if (!def || typeof def.handler !== 'function') throw new Error('route() requires a \`handler\` function.');
+  return def;
+}
+export function json(data, status = 200, headers = {}) {
+  const hasBody = data !== undefined && status !== 204 && status !== 304;
+  return new Response(hasBody ? JSON.stringify(data) : null, {
+    status,
+    headers: hasBody ? { 'content-type': 'application/json', ...headers } : headers,
+  });
+}
+export function defineWebApp(config) {
+  return config;
+}
+`;
     NODE_CAPABILITY_UNAVAILABLE = "node-capability-unavailable";
     NODE_CAPABILITY_GUARDED = /^(node:)?(child_process|worker_threads|cluster)$/;
     __name(nodeCapabilityUnavailableMessage, "nodeCapabilityUnavailableMessage");
@@ -24126,9 +24688,9 @@ var init_bundler = __esm({
       * Bundle a primitive's entry point using esbuild.
       */
       async bundle(metadata, entryPointCode) {
-        const tempDir = path9.join(this.options.outDir, ".temp");
-        const outfile = path9.join(tempDir, `${metadata.kind}-${metadata.name}.bundle.js`);
-        const sourceDir = path9.dirname(metadata.sourcePath);
+        const tempDir = path10.join(this.options.outDir, ".temp");
+        const outfile = path10.join(tempDir, `${metadata.kind}-${metadata.name}.bundle.js`);
+        const sourceDir = path10.dirname(metadata.sourcePath);
         if (this.options.debug) {
           this.verbose(`      Source: ${metadata.sourcePath}`);
           this.verbose(`      Output: ${outfile}`);
@@ -24138,6 +24700,8 @@ var init_bundler = __esm({
         const selfContainedWorkflow = metadata.kind === "workflow";
         const inject = selfContainedWorkflow ? [
           await this.writeWorkflowBuilderInject(tempDir)
+        ] : metadata.kind === "web-app" ? [
+          await this.writeWebAppRuntimeInject(tempDir)
         ] : [];
         const plugins = selfContainedWorkflow ? [
           this.createNodeCapabilityGuardPlugin(),
@@ -24205,7 +24769,7 @@ var init_bundler = __esm({
       * untouched — the same scoping rules as the stripped import would have had.
       */
       async writeWorkflowBuilderInject(tempDir) {
-        const injectPath = path9.join(tempDir, WORKFLOW_BUILDER_INJECT_FILE);
+        const injectPath = path10.join(tempDir, WORKFLOW_BUILDER_INJECT_FILE);
         const contents = `// AUTO-GENERATED by lua-cli (compiler/bundler.ts) \u2014 esbuild inject shim for graph-form workflow bundles (F5).
 export { ${WORKFLOW_SHIM_NAMES.join(", ")} } from ${JSON.stringify(this.workflowBuilderModule)};
 `;
@@ -24215,6 +24779,15 @@ export { ${WORKFLOW_SHIM_NAMES.join(", ")} } from ${JSON.stringify(this.workflow
         await fs7.writeFile(injectPath, contents, "utf-8");
         return injectPath;
       }
+      /** Write the esbuild `inject` module for a web-app bundle (see `WEB_APP_RUNTIME_INJECT_SOURCE`). */
+      async writeWebAppRuntimeInject(tempDir) {
+        const injectPath = path10.join(tempDir, WEB_APP_RUNTIME_INJECT_FILE);
+        await fs7.mkdir(tempDir, {
+          recursive: true
+        });
+        await fs7.writeFile(injectPath, WEB_APP_RUNTIME_INJECT_SOURCE, "utf-8");
+        return injectPath;
+      }
       /**
       * F5 companion plugin for workflow bundles. The bundled builder pulls in
       * `zod-to-json-schema`, whose own `import … from 'zod/v3'` would otherwise
@@ -24248,8 +24821,8 @@ export { ${WORKFLOW_SHIM_NAMES.join(", ")} } from ${JSON.stringify(this.workflow
       */
       isWorkflowBuilderSource(filePath) {
         if (filePath === this.workflowBuilderModule) return true;
-        if (filePath.endsWith(path9.join("dist", "workflow-builder.js"))) return true;
-        const srcDir = path9.join(getPackageRoot(), "src") + path9.sep;
+        if (filePath.endsWith(path10.join("dist", "workflow-builder.js"))) return true;
+        const srcDir = path10.join(getPackageRoot(), "src") + path10.sep;
         return this.workflowBuilderModule.startsWith(srcDir) && filePath.startsWith(srcDir);
       }
       /**
@@ -24290,14 +24863,14 @@ export { ${WORKFLOW_SHIM_NAMES.join(", ")} } from ${JSON.stringify(this.workflow
         const bundler = this;
         const sourcePath = metadata.sourcePath;
         const exportName = metadata.exportName;
-        const sourceDir = path9.dirname(sourcePath);
+        const sourceDir = path10.dirname(sourcePath);
         return {
           name: "lua-virtual-source",
           setup(build2) {
             build2.onResolve({
               filter: /.*/
             }, (args2) => {
-              const resolved = args2.path.startsWith(".") ? path9.resolve(args2.resolveDir, args2.path) : args2.path;
+              const resolved = args2.path.startsWith(".") ? path10.resolve(args2.resolveDir, args2.path) : args2.path;
               const normalizedResolved = resolved.replace(/\.(ts|tsx|js|jsx)$/, "");
               const normalizedSource = sourcePath.replace(/\.(ts|tsx|js|jsx)$/, "");
               if (normalizedResolved === normalizedSource) {
@@ -24314,7 +24887,7 @@ export { ${WORKFLOW_SHIM_NAMES.join(", ")} } from ${JSON.stringify(this.workflow
             }, async () => {
               const sourceFile = bundler.project.getSourceFile(sourcePath);
               let content = sourceFile?.getText() ?? await fs7.readFile(sourcePath, "utf-8");
-              content = bundler.stripLuaCliImportsAST(content, path9.basename(sourcePath));
+              content = bundler.stripLuaCliImportsAST(content, path10.basename(sourcePath));
               const virtualContent = metadata.isDefaultExport ? content : `${content}
 export { ${exportName} as __lua_target__ };
 `;
@@ -24349,12 +24922,12 @@ export { ${exportName} as __lua_target__ };
                 return null;
               }
               try {
-                const modifiedContents = stripImports(contents, path9.basename(args2.path));
+                const modifiedContents = stripImports(contents, path10.basename(args2.path));
                 if (modifiedContents !== contents) {
                   return {
                     contents: modifiedContents,
                     loader: args2.path.endsWith(".ts") || args2.path.endsWith(".tsx") ? "ts" : "js",
-                    resolveDir: path9.dirname(args2.path)
+                    resolveDir: path10.dirname(args2.path)
                   };
                 }
                 return null;
@@ -24410,8 +24983,8 @@ var init_bundle_hazards = __esm({
 });
 
 // src/compiler/agent-traverser.ts
-import { Project as Project2, Node as Node19 } from "ts-morph";
-import path10 from "path";
+import { Project as Project2, Node as Node20 } from "ts-morph";
+import path11 from "path";
 import fs8 from "fs";
 var PRIMITIVE_TYPES, AgentTraverser;
 var init_agent_traverser = __esm({
@@ -24474,6 +25047,11 @@ var init_agent_traverser = __esm({
         kind: "workflow",
         configProperty: "workflows",
         resolveNested: true
+      },
+      // Lua Apps (PRD 7.1): `webApps: [opsDashboard]`. Inert for any agent without a `webApps` config.
+      {
+        kind: "web-app",
+        configProperty: "webApps"
       }
     ];
     AgentTraverser = class {
@@ -24496,7 +25074,7 @@ var init_agent_traverser = __esm({
         this.rootDir = rootDir;
         this.debug = debug;
         this.project = new Project2({
-          tsConfigFilePath: path10.join(rootDir, "tsconfig.json"),
+          tsConfigFilePath: path11.join(rootDir, "tsconfig.json"),
           skipAddingFilesFromTsConfig: true
         });
         registerProjectRootDir(this.project, this.rootDir);
@@ -24587,12 +25165,12 @@ var init_agent_traverser = __esm({
       */
       detectAgent() {
         const priorityFiles = [
-          path10.join(this.rootDir, "index.ts"),
-          path10.join(this.rootDir, "src", "index.ts"),
-          path10.join(this.rootDir, "agent.ts"),
-          path10.join(this.rootDir, "src", "agent.ts"),
-          path10.join(this.rootDir, "main.ts"),
-          path10.join(this.rootDir, "src", "main.ts")
+          path11.join(this.rootDir, "index.ts"),
+          path11.join(this.rootDir, "src", "index.ts"),
+          path11.join(this.rootDir, "agent.ts"),
+          path11.join(this.rootDir, "src", "agent.ts"),
+          path11.join(this.rootDir, "main.ts"),
+          path11.join(this.rootDir, "src", "main.ts")
         ];
         for (const filePath of priorityFiles) {
           if (fs8.existsSync(filePath)) {
@@ -24651,7 +25229,7 @@ var init_agent_traverser = __esm({
       */
       extractArrayRefs(config, propName) {
         const prop = config.getProperty(propName);
-        if (!prop || !Node19.isPropertyAssignment(prop)) return [];
+        if (!prop || !Node20.isPropertyAssignment(prop)) return [];
         const value3 = prop.getInitializer();
         if (!value3) return [];
         const ctx = {
@@ -24736,7 +25314,7 @@ var init_agent_traverser = __esm({
             for (const assign of file.getExportAssignments()) {
               if (assign.isExportEquals()) continue;
               const expr = assign.getExpression();
-              if (!Node19.isIdentifier(expr)) continue;
+              if (!Node20.isIdentifier(expr)) continue;
               const targetName = expr.getText();
               defaultMatch = detected.find((d) => d.exportName === targetName);
               if (defaultMatch) break;
@@ -24747,7 +25325,7 @@ var init_agent_traverser = __esm({
             console.warn(formatSarifWarning({
               ruleId: "lua/missing-primitive-declaration",
               filePath: sourcePath,
-              message: `agent references ${kind} "${refName}" but ${path10.basename(sourcePath)} does not define a matching primitive`,
+              message: `agent references ${kind} "${refName}" but ${path11.basename(sourcePath)} does not define a matching primitive`,
               hint: `export a named ${plugin.displayName.toLowerCase()} declaration as "${refName}", or adjust the import so it points to the file that does`
             }));
             return null;
@@ -24768,19 +25346,19 @@ var init_agent_traverser = __esm({
 
 // src/compiler/utils/workspace.ts
 import fs9 from "fs";
-import path11 from "path";
+import path12 from "path";
 function findWorkspaceRoot(rootDir) {
-  const resolvedInput = path11.resolve(rootDir);
+  const resolvedInput = path12.resolve(rootDir);
   const cached = workspaceRootCache.get(resolvedInput);
   if (cached !== void 0) return cached;
   let current = resolvedInput;
-  const { root } = path11.parse(current);
+  const { root } = path12.parse(current);
   while (true) {
     if (isWorkspaceRoot(current)) {
       workspaceRootCache.set(resolvedInput, current);
       return current;
     }
-    const parent = path11.dirname(current);
+    const parent = path12.dirname(current);
     if (parent === current || current === root) break;
     current = parent;
   }
@@ -24788,10 +25366,10 @@ function findWorkspaceRoot(rootDir) {
   return resolvedInput;
 }
 function isWorkspaceRoot(dir) {
-  if (fileExists(path11.join(dir, "pnpm-workspace.yaml"))) return true;
-  if (fileExists(path11.join(dir, "lerna.json"))) return true;
-  if (packageJsonHasWorkspaces(path11.join(dir, "package.json"))) return true;
-  if (dirExists(path11.join(dir, ".git"))) return true;
+  if (fileExists(path12.join(dir, "pnpm-workspace.yaml"))) return true;
+  if (fileExists(path12.join(dir, "lerna.json"))) return true;
+  if (packageJsonHasWorkspaces(path12.join(dir, "package.json"))) return true;
+  if (dirExists(path12.join(dir, ".git"))) return true;
   return false;
 }
 function fileExists(p) {
@@ -24834,7 +25412,7 @@ var init_workspace = __esm({
 
 // src/compiler/compiler.ts
 import fs10 from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 import { Project as Project3 } from "ts-morph";
 async function compile2(options) {
   const compiler = new Compiler(options);
@@ -24891,7 +25469,7 @@ var init_compiler = __esm({
           ...options
         };
         this.project = new Project3({
-          tsConfigFilePath: path12.join(options.rootDir, "tsconfig.json")
+          tsConfigFilePath: path13.join(options.rootDir, "tsconfig.json")
         });
         registerProjectRootDir(this.project, this.options.rootDir);
         this.bundler = new Bundler({
@@ -24972,7 +25550,7 @@ var init_compiler = __esm({
           await fs10.mkdir(this.options.outDir, {
             recursive: true
           });
-          await fs10.mkdir(path12.join(this.options.outDir, ".temp"), {
+          await fs10.mkdir(path13.join(this.options.outDir, ".temp"), {
             recursive: true
           });
           const CONCURRENCY = 4;
@@ -25024,7 +25602,7 @@ var init_compiler = __esm({
           this.verbose("\u{1F4BE} Writing artifacts...");
           await this.writeArtifacts(compiledPrimitives);
           if (!this.options.debug) {
-            await fs10.rm(path12.join(this.options.outDir, ".temp"), {
+            await fs10.rm(path13.join(this.options.outDir, ".temp"), {
               recursive: true,
               force: true
             });
@@ -25076,7 +25654,7 @@ var init_compiler = __esm({
       */
       getWorkspaceRoot() {
         if (this._workspaceRoot === void 0) {
-          this._workspaceRoot = findWorkspaceRoot(path12.resolve(this.options.rootDir));
+          this._workspaceRoot = findWorkspaceRoot(path13.resolve(this.options.rootDir));
         }
         return this._workspaceRoot;
       }
@@ -25090,18 +25668,18 @@ var init_compiler = __esm({
       *  - Files outside the detected workspace root (not our code)
       */
       collectExternalWorkspaceFiles(traverser) {
-        const rootDir = path12.resolve(this.options.rootDir);
+        const rootDir = path13.resolve(this.options.rootDir);
         const workspaceRoot = this.getWorkspaceRoot();
         if (workspaceRoot === rootDir) return [];
         const loaded = traverser.getAllLoadedSourceFilePaths();
         const result = [];
         const seen = /* @__PURE__ */ new Set();
         for (const raw of loaded) {
-          const abs = path12.resolve(raw);
+          const abs = path13.resolve(raw);
           if (seen.has(abs)) continue;
           seen.add(abs);
           if (isInside(abs, rootDir)) continue;
-          if (abs.includes(`${path12.sep}node_modules${path12.sep}`)) continue;
+          if (abs.includes(`${path13.sep}node_modules${path13.sep}`)) continue;
           if (!isInside(abs, workspaceRoot)) continue;
           result.push(abs);
         }
@@ -25244,8 +25822,8 @@ var init_compiler = __esm({
       * @param primitives - All compiled primitives to write
       */
       async writeArtifacts(primitives) {
-        const artifactsDir = path12.join(this.options.outDir, "artifacts");
-        const sourcesDir = path12.join(this.options.outDir, "sources");
+        const artifactsDir = path13.join(this.options.outDir, "artifacts");
+        const sourcesDir = path13.join(this.options.outDir, "sources");
         await fs10.mkdir(sourcesDir, {
           recursive: true
         });
@@ -25254,7 +25832,7 @@ var init_compiler = __esm({
         this.verbose("   \u{1F4C2} Collecting project files...");
         const projectFiles = await this.storeProjectFiles(sourcesDir, writtenSources);
         const manifest = await this.createManifest(primitives, projectFiles);
-        await fs10.writeFile(path12.join(this.options.outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+        await fs10.writeFile(path13.join(this.options.outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
         this.verbose(`   \u{1F4E6} Total files stored: ${writtenSources.size} (deduplicated)`);
         this.verbose(`   \u{1F4C1} Project files: ${projectFiles.length}`);
         if (this.options.verbose || this.options.debug) {
@@ -25266,25 +25844,25 @@ var init_compiler = __esm({
       */
       async writePrimitiveArtifacts(primitives, artifactsDir, sourcesDir, writtenSources) {
         for (const primitive of primitives) {
-          const primitiveDir = path12.join(artifactsDir, primitive.kind);
+          const primitiveDir = path13.join(artifactsDir, primitive.kind);
           await fs10.mkdir(primitiveDir, {
             recursive: true
           });
           const baseName = primitive.name;
-          await fs10.writeFile(path12.join(primitiveDir, `${baseName}.js`), primitive.artifact.code);
+          await fs10.writeFile(path13.join(primitiveDir, `${baseName}.js`), primitive.artifact.code);
           if (primitive.artifact.sourceMap) {
-            await fs10.writeFile(path12.join(primitiveDir, `${baseName}.js.map`), primitive.artifact.sourceMap);
+            await fs10.writeFile(path13.join(primitiveDir, `${baseName}.js.map`), primitive.artifact.sourceMap);
           }
           const sourceHash = hashContent(primitive.artifact.originalSource);
           if (!writtenSources.has(sourceHash)) {
             const ext = primitive.sourcePath.endsWith(".tsx") ? ".tsx" : primitive.sourcePath.endsWith(".js") ? ".js" : ".ts";
-            await fs10.writeFile(path12.join(sourcesDir, `${sourceHash}${ext}`), primitive.artifact.originalSource);
-            const relativePath = path12.relative(this.options.rootDir, primitive.sourcePath);
+            await fs10.writeFile(path13.join(sourcesDir, `${sourceHash}${ext}`), primitive.artifact.originalSource);
+            const relativePath = path13.relative(this.options.rootDir, primitive.sourcePath);
             writtenSources.set(sourceHash, relativePath);
           }
           const sidecarPlugin = pluginRegistry.get(primitive.kind);
           const sidecarMetadata = sidecarPlugin?.sanitizeForPersistence ? sidecarPlugin.sanitizeForPersistence(primitive.metadata) : primitive.metadata;
-          await fs10.writeFile(path12.join(primitiveDir, `${baseName}.json`), JSON.stringify({
+          await fs10.writeFile(path13.join(primitiveDir, `${baseName}.json`), JSON.stringify({
             kind: primitive.kind,
             name: primitive.name,
             description: primitive.description,
@@ -25306,12 +25884,12 @@ var init_compiler = __esm({
         const allFiles = await this.collectProjectFiles();
         const workspaceRoot = this.getWorkspaceRoot();
         for (const file of allFiles) {
-          const absPath = file.external ? path12.join(workspaceRoot, file.relativePath) : path12.join(this.options.rootDir, file.relativePath);
+          const absPath = file.external ? path13.join(workspaceRoot, file.relativePath) : path13.join(this.options.rootDir, file.relativePath);
           const content = await fs10.readFile(absPath, "utf-8");
           const hash = hashContent(content);
           if (!writtenSources.has(hash)) {
-            const ext = path12.extname(file.relativePath) || ".txt";
-            await fs10.writeFile(path12.join(sourcesDir, `${hash}${ext}`), content);
+            const ext = path13.extname(file.relativePath) || ".txt";
+            await fs10.writeFile(path13.join(sourcesDir, `${hash}${ext}`), content);
             writtenSources.set(hash, file.relativePath);
           }
           projectFiles.push({
@@ -25392,7 +25970,7 @@ var init_compiler = __esm({
           });
           for (const entry of entries) {
             const relativePath = relativeBase ? `${relativeBase}/${entry.name}` : entry.name;
-            const fullPath = path12.join(dir, entry.name);
+            const fullPath = path13.join(dir, entry.name);
             if (entry.isDirectory()) {
               if (shouldSkipDirectory(entry.name)) continue;
               await scanDir(fullPath, relativePath);
@@ -25409,10 +25987,10 @@ var init_compiler = __esm({
         const workspaceRoot = this.getWorkspaceRoot();
         const externalSeen = /* @__PURE__ */ new Set();
         for (const abs of this.externalWorkspaceFiles) {
-          const rel = path12.relative(workspaceRoot, abs).split(path12.sep).join("/");
+          const rel = path13.relative(workspaceRoot, abs).split(path13.sep).join("/");
           if (!rel || rel.startsWith("..")) continue;
           if (externalSeen.has(rel)) continue;
-          const name = path12.basename(abs);
+          const name = path13.basename(abs);
           if (shouldSkipFile(rel) || shouldSkipFile(name)) continue;
           externalSeen.add(rel);
           files.push({
@@ -25513,12 +26091,12 @@ var init_compiler = __esm({
 });
 
 // src/compiler/utils/file-discovery.ts
-import path13 from "path";
+import path14 from "path";
 import fs11 from "fs";
 function findEntryPoint(projectDir) {
   const baseDir = projectDir || process.cwd();
   for (const relativePath of ENTRY_POINT_PRIORITY) {
-    const fullPath = path13.join(baseDir, relativePath);
+    const fullPath = path14.join(baseDir, relativePath);
     if (fs11.existsSync(fullPath)) {
       return fullPath;
     }
@@ -25555,9 +26133,9 @@ var init_file_discovery = __esm({
 });
 
 // src/compiler/source-writer.ts
-import { Project as Project4, Node as Node20 } from "ts-morph";
+import { Project as Project4, Node as Node21 } from "ts-morph";
 import fs12 from "fs";
-import path14 from "path";
+import path15 from "path";
 function resolveEntryPath(options) {
   let indexPath;
   try {
@@ -25569,12 +26147,12 @@ function resolveEntryPath(options) {
         indexPath = entryPoint;
       } else {
         const baseDir = options?.projectDir || process.cwd();
-        indexPath = path14.join(baseDir, "src", "index.ts");
+        indexPath = path15.join(baseDir, "src", "index.ts");
       }
     }
   } catch {
     const baseDir = options?.projectDir || process.cwd();
-    indexPath = path14.join(baseDir, "src", "index.ts");
+    indexPath = path15.join(baseDir, "src", "index.ts");
   }
   if (!fs12.existsSync(indexPath)) {
     console.warn(`Warning: Entry file not found at ${indexPath}`);
@@ -25604,14 +26182,14 @@ function updateAgentConfig(updates, options) {
     const sourceFile = project.addSourceFileAtPath(indexPath);
     let updated = false;
     sourceFile.forEachDescendant((node) => {
-      if (Node20.isNewExpression(node) && node.getExpression().getText() === "LuaAgent") {
+      if (Node21.isNewExpression(node) && node.getExpression().getText() === "LuaAgent") {
         const args2 = node.getArguments();
-        if (args2.length > 0 && Node20.isObjectLiteralExpression(args2[0])) {
+        if (args2.length > 0 && Node21.isObjectLiteralExpression(args2[0])) {
           const configObj = args2[0];
           const replacedKeys = /* @__PURE__ */ new Set();
           let lastReplacedIndex = -1;
           configObj.getProperties().forEach((prop, index) => {
-            if (Node20.isPropertyAssignment(prop)) {
+            if (Node21.isPropertyAssignment(prop)) {
               const propName = prop.getName();
               if (Object.prototype.hasOwnProperty.call(filteredUpdates, propName)) {
                 const newValue = filteredUpdates[propName];
@@ -25674,14 +26252,14 @@ function removeAgentConfigProperty(propertyName, options) {
     let foundConstructor = false;
     let removed = false;
     sourceFile.forEachDescendant((node) => {
-      if (Node20.isNewExpression(node) && node.getExpression().getText() === "LuaAgent") {
+      if (Node21.isNewExpression(node) && node.getExpression().getText() === "LuaAgent") {
         const args2 = node.getArguments();
-        if (args2.length > 0 && Node20.isObjectLiteralExpression(args2[0])) {
+        if (args2.length > 0 && Node21.isObjectLiteralExpression(args2[0])) {
           foundConstructor = true;
           const configObj = args2[0];
           const props = configObj.getProperties();
           for (const prop of props) {
-            if (Node20.isPropertyAssignment(prop) && prop.getName() === propertyName) {
+            if (Node21.isPropertyAssignment(prop) && prop.getName() === propertyName) {
               prop.remove();
               removed = true;
               break;
@@ -28445,8 +29023,8 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse containing the profile, or null if not found
       */
       async getUserProfileByEmail(email, agentId) {
-        const path26 = `/developer/user/profile/email/${encodeURIComponent(email)}`;
-        const scopedPath = agentId ? `${path26}?agentId=${encodeURIComponent(agentId)}` : path26;
+        const path27 = `/developer/user/profile/email/${encodeURIComponent(email)}`;
+        const scopedPath = agentId ? `${path27}?agentId=${encodeURIComponent(agentId)}` : path27;
         return this.httpGet(scopedPath, {});
       }
       /**
@@ -28456,8 +29034,8 @@ var init_developer_api_service = __esm({
       */
       async getUserProfileByPhone(phone, agentId) {
         const normalizedPhone = phone.replace(/^\+/, "");
-        const path26 = `/developer/user/profile/phone/${normalizedPhone}`;
-        const scopedPath = agentId ? `${path26}?agentId=${encodeURIComponent(agentId)}` : path26;
+        const path27 = `/developer/user/profile/phone/${normalizedPhone}`;
+        const scopedPath = agentId ? `${path27}?agentId=${encodeURIComponent(agentId)}` : path27;
         return this.httpGet(scopedPath, {});
       }
     };
@@ -31477,7 +32055,7 @@ init_artifact_loader();
 init_backup_api_service();
 init_constants();
 import fs13 from "fs";
-import path15 from "path";
+import path16 from "path";
 var BACKUP_CACHE_FILENAME = "backup-manifest.json";
 function calculateProjectHash(projectFiles) {
   return combineFileHashes(projectFiles);
@@ -31490,9 +32068,9 @@ function getCurrentProjectHash(projectPath = process.cwd()) {
 }
 __name(getCurrentProjectHash, "getCurrentProjectHash");
 function loadSourceByHash(hash, relativePath, projectPath = process.cwd()) {
-  const sourcesDir = path15.join(projectPath, COMPILE_DIRS.DIST_V2, "sources");
-  const ext = path15.extname(relativePath) || ".txt";
-  const sourcePath = path15.join(sourcesDir, `${hash}${ext}`);
+  const sourcesDir = path16.join(projectPath, COMPILE_DIRS.DIST_V2, "sources");
+  const ext = path16.extname(relativePath) || ".txt";
+  const sourcePath = path16.join(sourcesDir, `${hash}${ext}`);
   if (fs13.existsSync(sourcePath)) {
     return fs13.readFileSync(sourcePath, "utf-8");
   }
@@ -31513,17 +32091,17 @@ function prepareFileRefs(projectPath = process.cwd()) {
 }
 __name(prepareFileRefs, "prepareFileRefs");
 function reconcileManifestWithDisk(projectPath = process.cwd()) {
-  const manifestPath = path15.join(projectPath, COMPILE_DIRS.DIST_V2, "manifest.json");
+  const manifestPath = path16.join(projectPath, COMPILE_DIRS.DIST_V2, "manifest.json");
   if (!fs13.existsSync(manifestPath)) return;
   const manifest = loadManifest(projectPath);
-  const sourcesDir = path15.join(projectPath, COMPILE_DIRS.DIST_V2, "sources");
+  const sourcesDir = path16.join(projectPath, COMPILE_DIRS.DIST_V2, "sources");
   fs13.mkdirSync(sourcesDir, {
     recursive: true
   });
   let changed = false;
   for (const file of manifest.projectFiles) {
     if (file.external) continue;
-    const absPath = path15.join(projectPath, file.relativePath);
+    const absPath = path16.join(projectPath, file.relativePath);
     if (!fs13.existsSync(absPath)) continue;
     let content;
     try {
@@ -31533,8 +32111,8 @@ function reconcileManifestWithDisk(projectPath = process.cwd()) {
     }
     const freshHash = hashContent(content);
     if (freshHash === file.hash) continue;
-    const ext = path15.extname(file.relativePath) || ".txt";
-    const sourceTargetPath = path15.join(sourcesDir, `${freshHash}${ext}`);
+    const ext = path16.extname(file.relativePath) || ".txt";
+    const sourceTargetPath = path16.join(sourcesDir, `${freshHash}${ext}`);
     try {
       fs13.writeFileSync(sourceTargetPath, content, "utf-8");
     } catch {
@@ -31681,13 +32259,13 @@ function createBackupTracking(projectHash) {
 }
 __name(createBackupTracking, "createBackupTracking");
 function getBackupCachePath(projectPath = process.cwd()) {
-  return path15.join(projectPath, ".lua", BACKUP_CACHE_FILENAME);
+  return path16.join(projectPath, ".lua", BACKUP_CACHE_FILENAME);
 }
 __name(getBackupCachePath, "getBackupCachePath");
 function writeBackupManifestCache(cache, projectPath = process.cwd()) {
   const cachePath = getBackupCachePath(projectPath);
   try {
-    fs13.mkdirSync(path15.dirname(cachePath), {
+    fs13.mkdirSync(path16.dirname(cachePath), {
       recursive: true
     });
     fs13.writeFileSync(cachePath, JSON.stringify(cache, null, 2), "utf-8");
@@ -31728,12 +32306,12 @@ function detectLocalConflictsForPull(incomingFiles, projectPath = process.cwd())
     f.hash
   ]));
   const conflicts = /* @__PURE__ */ new Set();
-  const projectRoot = path15.resolve(projectPath);
+  const projectRoot = path16.resolve(projectPath);
   for (const incoming of incomingFiles) {
     if (COMPILE_MANAGED_FILES.has(incoming.relativePath)) continue;
     if (incoming.external) continue;
-    const absPath = path15.resolve(projectRoot, incoming.relativePath);
-    if (absPath !== projectRoot && !absPath.startsWith(projectRoot + path15.sep)) {
+    const absPath = path16.resolve(projectRoot, incoming.relativePath);
+    if (absPath !== projectRoot && !absPath.startsWith(projectRoot + path16.sep)) {
       continue;
     }
     if (!fs13.existsSync(absPath)) continue;
@@ -31925,7 +32503,7 @@ function writeBackupFilesWithByteCompare(manifest, blobs, targetDir) {
         continue;
       }
     }
-    fs13.mkdirSync(path15.dirname(filePath), {
+    fs13.mkdirSync(path16.dirname(filePath), {
       recursive: true
     });
     fs13.writeFileSync(filePath, content);
@@ -34088,13 +34666,13 @@ __name(apiKeyCommand, "apiKeyCommand");
 init_cli();
 init_files();
 init_request_credential();
-import path22 from "path";
+import path23 from "path";
 
 // src/commands/sync.ts
 init_dist();
 init_cli();
 import fs14 from "fs";
-import path16 from "path";
+import path17 from "path";
 init_command_utils();
 
 // src/commands/log-tip.ts
@@ -34297,7 +34875,7 @@ init_mcp_server_handler();
 async function syncCommand(options) {
   return withErrorHandling(async () => {
     const preCompileYaml = readYamlConfig();
-    const yamlPath = path16.resolve(process.cwd(), "lua.skill.yaml");
+    const yamlPath = path17.resolve(process.cwd(), "lua.skill.yaml");
     const preCompileYamlBytes = fs14.existsSync(yamlPath) ? fs14.readFileSync(yamlPath, "utf-8") : null;
     let syncCompletedSuccessfully = false;
     try {
@@ -36171,8 +36749,8 @@ function buildSupervisionAgentsApi(call) {
     }), "persona"),
     source: /* @__PURE__ */ __name7((agentId) => ({
       list: /* @__PURE__ */ __name7(() => call("source.list", agentId), "list"),
-      get: /* @__PURE__ */ __name7((path26) => call("source.get", agentId, {
-        path: path26
+      get: /* @__PURE__ */ __name7((path27) => call("source.get", agentId, {
+        path: path27
       }), "get")
     }), "source"),
     /** Environment variable NAMES only — values are never returned. */
@@ -36187,10 +36765,10 @@ __name7(buildSupervisionAgentsApi, "buildSupervisionAgentsApi");
 // src/utils/sandbox.ts
 init_dist4();
 import vm4 from "vm";
-import path21 from "path";
+import path22 from "path";
 
 // src/utils/env-loader.utils.ts
-import path17 from "path";
+import path18 from "path";
 import fs15 from "fs";
 function parseEnvFile(filePath) {
   if (!fs15.existsSync(filePath)) {
@@ -36223,7 +36801,7 @@ async function loadEnvironmentVariables(context) {
 }
 __name(loadEnvironmentVariables, "loadEnvironmentVariables");
 function loadSandboxEnvVariables() {
-  const envFilePath = path17.join(process.cwd(), ".env");
+  const envFilePath = path18.join(process.cwd(), ".env");
   const envMap = parseEnvFile(envFilePath);
   return Object.entries(envMap).map(([key, value3]) => ({
     key,
@@ -36295,15 +36873,15 @@ init_compile_constants();
 init_dist2();
 init_dist();
 import fs16 from "fs";
-import path20 from "path";
+import path21 from "path";
 
 // src/utils/workflow-exec.ts
-import path19 from "path";
+import path20 from "path";
 
 // ../shared-types/dist/workflow-exec.mjs
 import { spawn as nodeSpawn } from "child_process";
 import { accessSync, constants as fsConstants, realpathSync, statSync as statSync5 } from "fs";
-import path18 from "path";
+import path19 from "path";
 var __defProp8 = Object.defineProperty;
 var __name8 = /* @__PURE__ */ __name((target, value3) => __defProp8(target, "name", { value: value3, configurable: true }), "__name");
 var WORKFLOW_EXEC_BINARIES = Object.freeze([
@@ -36316,7 +36894,10 @@ var WORKFLOW_EXEC_BINARIES = Object.freeze([
   "yarn",
   "python3",
   "pytest",
-  "make"
+  "make",
+  // EM-WS3 × EM-WS2: lua-cli. On the Job tier the host refuses it unless the claim declared `luaApi: true`, and then it
+  // runs against the sidecar's `:8092` staging-only proxy with a placeholder key (the real key is the sidecar's).
+  "lua"
 ]);
 var WORKFLOW_EXEC_DEFAULT_TIMEOUT_MS = 10 * 60 * 1e3;
 var WORKFLOW_EXEC_OUTPUT_MAX_BYTES = 1024 * 1024;
@@ -36489,7 +37070,7 @@ function resolveWorkflowExecBinary(name, pathDirs) {
   }
   for (const dir of pathDirs) {
     if (!dir) continue;
-    const file = path18.join(dir, name);
+    const file = path19.join(dir, name);
     try {
       if (!statSync5(file).isFile()) continue;
       accessSync(file, fsConstants.X_OK);
@@ -36504,7 +37085,7 @@ function resolveWorkflowExecBinary(name, pathDirs) {
 __name(resolveWorkflowExecBinary, "resolveWorkflowExecBinary");
 __name8(resolveWorkflowExecBinary, "resolveWorkflowExecBinary");
 function within(root, p) {
-  return p === root || p.startsWith(root.endsWith(path18.sep) ? root : root + path18.sep);
+  return p === root || p.startsWith(root.endsWith(path19.sep) ? root : root + path19.sep);
 }
 __name(within, "within");
 __name8(within, "within");
@@ -36519,7 +37100,7 @@ function confineWorkflowExecCwd(root, cwd) {
   if (cwd !== void 0 && typeof cwd !== "string") throw refused("cwd_outside_workspace", "cwd must be a string");
   const given = typeof cwd === "string" ? cwd : ".";
   if (given.includes("\0")) throw refused("cwd_outside_workspace", "cwd contains NUL");
-  const abs = path18.resolve(root, given);
+  const abs = path19.resolve(root, given);
   if (!within(root, abs) && !within(rootReal, abs)) {
     throw refused("cwd_outside_workspace", `cwd ${given} is outside the workspace (${root})`);
   }
@@ -36912,7 +37493,7 @@ var processSigint = {
 };
 function createLocalWorkflowExec(o) {
   const env = localWorkflowExecEnv(o.env);
-  const pathDirs = o.pathDirs ?? env.PATH.split(path19.delimiter).filter(Boolean);
+  const pathDirs = o.pathDirs ?? env.PATH.split(path20.delimiter).filter(Boolean);
   const queue = createWorkflowExecQueue();
   const sigint = o.sigint ?? processSigint;
   return buildWorkflowExecApi((req) => queue(async () => {
@@ -36937,7 +37518,13 @@ function createLocalWorkflowExec(o) {
         deadlineAt: o.deadlineAt?.(),
         mount: o.mount,
         signal: abort.signal,
-        spawnImpl: o.spawnImpl
+        spawnImpl: o.spawnImpl,
+        // EM-WS3 × EM-WS2: `lua` is on the shared allowlist for the Job pod, where it only ever reaches the
+        // platform's staging-only :8092 proxy. Offline there is no such proxy: it would run with YOUR credentials
+        // against the real API, so a local run refuses it.
+        beforeSpawn: /* @__PURE__ */ __name(async (argv) => {
+          if (argv[0] === "lua") throw workflowExecRefusal("lua_api_not_declared", "lua: runs only on the platform's Job tier (a luaApi: true step, through the staging-only proxy); refused offline", argv);
+        }, "beforeSpawn")
       });
       o.log?.(`exec \xB7 ${formatWorkflowExecArgv(out.argv)} \xB7 ${out.timedOut ? "timed out" : `exit ${out.code ?? out.signal}`} \xB7 ${out.durationMs} ms${out.truncated ? " \xB7 output truncated" : ""}`);
       return out;
@@ -37368,7 +37955,7 @@ async function runWorkflowLocallyInner(rawOpts) {
       skipReason: reason
     });
   }, "skipRow");
-  const fixturePath = /* @__PURE__ */ __name((stepId, attempt, dir) => path20.join(dir, `${stepId.replace(/[\\/]/g, "_")}.${attempt}.json`), "fixturePath");
+  const fixturePath = /* @__PURE__ */ __name((stepId, attempt, dir) => path21.join(dir, `${stepId.replace(/[\\/]/g, "_")}.${attempt}.json`), "fixturePath");
   const readFixture = /* @__PURE__ */ __name((stepId, attempt) => {
     if (!opts.fixturesDir) return void 0;
     const file = fixturePath(stepId, attempt, opts.fixturesDir);
@@ -37430,7 +38017,7 @@ async function runWorkflowLocallyInner(rawOpts) {
         artefactSeq += 1;
         const artefactId = `local-${artefactSeq}`;
         const bytes = typeof data === "string" || Buffer.isBuffer(data) ? data : JSON.stringify(data);
-        fs16.writeFileSync(path20.join(dir, artefactId), bytes);
+        fs16.writeFileSync(path21.join(dir, artefactId), bytes);
         const metaDoc = {
           artefactId,
           name,
@@ -37438,7 +38025,7 @@ async function runWorkflowLocallyInner(rawOpts) {
           size: Buffer.byteLength(bytes),
           ...meta
         };
-        fs16.writeFileSync(path20.join(dir, `${artefactId}.meta.json`), `${JSON.stringify(metaDoc, null, 2)}
+        fs16.writeFileSync(path21.join(dir, `${artefactId}.meta.json`), `${JSON.stringify(metaDoc, null, 2)}
 `);
         say(`[artefact:${stepId}] ${name} \u2192 ${artefactId}`);
         return {
@@ -37446,11 +38033,11 @@ async function runWorkflowLocallyInner(rawOpts) {
         };
       }, "put"),
       get: /* @__PURE__ */ __name(async (artefactId) => {
-        const file = path20.join(dir, artefactId);
+        const file = path21.join(dir, artefactId);
         if (!fs16.existsSync(file)) {
           throw new StepFailure("ARTEFACT_NOT_FOUND", `no artefact "${artefactId}" under --artefacts-dir`);
         }
-        const metaFile = path20.join(dir, `${artefactId}.meta.json`);
+        const metaFile = path21.join(dir, `${artefactId}.meta.json`);
         const meta = fs16.existsSync(metaFile) ? JSON.parse(fs16.readFileSync(metaFile, "utf8")) : {
           artefactId
         };
@@ -37461,10 +38048,10 @@ async function runWorkflowLocallyInner(rawOpts) {
           text: /* @__PURE__ */ __name(async () => text, "text")
         };
       }, "get"),
-      list: /* @__PURE__ */ __name(async () => fs16.readdirSync(dir).filter((f) => f.endsWith(".meta.json")).map((f) => JSON.parse(fs16.readFileSync(path20.join(dir, f), "utf8"))), "list")
+      list: /* @__PURE__ */ __name(async () => fs16.readdirSync(dir).filter((f) => f.endsWith(".meta.json")).map((f) => JSON.parse(fs16.readFileSync(path21.join(dir, f), "utf8"))), "list")
     };
   }, "artefactsApi");
-  const workspaceRoot = opts.workspaceDir ? path20.resolve(opts.workspaceDir) : void 0;
+  const workspaceRoot = opts.workspaceDir ? path21.resolve(opts.workspaceDir) : void 0;
   const jobTierCtx = /* @__PURE__ */ __name((single, stepId, signal) => {
     if (single.type !== "step" || single.tier !== "job" && single.workspace === void 0) return {};
     const declared = single.workspace && typeof single.workspace === "object" ? single.workspace : {};
@@ -38440,7 +39027,7 @@ function kindOfSingle(s) {
 }
 __name(kindOfSingle, "kindOfSingle");
 function writeLedger(file, ledger) {
-  fs16.mkdirSync(path20.dirname(path20.resolve(file)), {
+  fs16.mkdirSync(path21.dirname(path21.resolve(file)), {
     recursive: true
   });
   fs16.writeFileSync(file, `${JSON.stringify(ledger, null, 2)}
@@ -38534,7 +39121,7 @@ function loadEnvironmentVariables2() {
       envVars[key] = value3;
     }
   }
-  const envFilePath = path21.join(process.cwd(), ".env");
+  const envFilePath = path22.join(process.cwd(), ".env");
   const fileEnvVars = parseEnvFile(envFilePath);
   Object.assign(envVars, fileEnvVars);
   return envVars;
@@ -39131,12 +39718,12 @@ function isWrittenAsModelClassRef(model) {
 }
 __name(isWrittenAsModelClassRef, "isWrittenAsModelClassRef");
 var oneOf = /* @__PURE__ */ __name((tuple) => tuple.map((v) => `\`${v}\``).join(", "), "oneOf");
-function validateAgentNodeModelMembers(node, path26) {
+function validateAgentNodeModelMembers(node, path27) {
   const issues = [];
   if (typeof node.model === "string" && isWrittenAsModelClassRef(node.model)) {
     if (!modelClassOf(node.model)) {
       issues.push({
-        path: `${path26}.model`,
+        path: `${path27}.model`,
         code: "model-class-unknown",
         message: `"${node.model}" is not a model class \u2014 use one of ${oneOf(WORKFLOW_MODEL_CLASSES.map((c) => modelClassRef(c)))}, or pin an approved model code`
       });
@@ -39145,7 +39732,7 @@ function validateAgentNodeModelMembers(node, path26) {
   if (node.taskClass !== void 0) {
     if (typeof node.taskClass !== "string" || !isWorkflowTaskClass(node.taskClass)) {
       issues.push({
-        path: `${path26}.taskClass`,
+        path: `${path27}.taskClass`,
         code: "task-class-unknown",
         message: `"${String(node.taskClass)}" is not a task class \u2014 use one of ${oneOf(WORKFLOW_TASK_CLASSES)}`
       });
@@ -39154,7 +39741,7 @@ function validateAgentNodeModelMembers(node, path26) {
   if (node.requires !== void 0) {
     if (!Array.isArray(node.requires)) {
       issues.push({
-        path: `${path26}.requires`,
+        path: `${path27}.requires`,
         code: "requires-invalid",
         message: `\`requires\` must be an array of ${oneOf(WORKFLOW_MODEL_TRAITS)}`
       });
@@ -39162,7 +39749,7 @@ function validateAgentNodeModelMembers(node, path26) {
       node.requires.forEach((trait, i) => {
         if (typeof trait !== "string" || !isWorkflowModelTrait(trait)) {
           issues.push({
-            path: `${path26}.requires.${i}`,
+            path: `${path27}.requires.${i}`,
             code: "model-trait-unknown",
             message: `"${String(trait)}" is not a model trait \u2014 use one of ${oneOf(WORKFLOW_MODEL_TRAITS)}`
           });
@@ -39173,7 +39760,7 @@ function validateAgentNodeModelMembers(node, path26) {
   if (node.effort !== void 0) {
     if (typeof node.effort !== "string" || !isWorkflowEffort(node.effort)) {
       issues.push({
-        path: `${path26}.effort`,
+        path: `${path27}.effort`,
         code: "effort-unknown",
         message: `"${String(node.effort)}" is not a workflow effort \u2014 use one of ${oneOf(WORKFLOW_AGENT_EFFORTS)}. (\`off\`, \`minimal\` and \`max\` are the agent-level \`modelSettings.reasoning.effort\` scale, not this one.)`
       });
@@ -39182,13 +39769,13 @@ function validateAgentNodeModelMembers(node, path26) {
   if (node.modelReason !== void 0) {
     if (typeof node.modelReason !== "string") {
       issues.push({
-        path: `${path26}.modelReason`,
+        path: `${path27}.modelReason`,
         code: "model-reason-invalid",
         message: "`modelReason` must be a string"
       });
     } else if (node.modelReason.length > WORKFLOW_MODEL_REASON_MAX_LENGTH) {
       issues.push({
-        path: `${path26}.modelReason`,
+        path: `${path27}.modelReason`,
         code: "model-reason-too-long",
         message: `\`modelReason\` is ${node.modelReason.length} characters \u2014 the cap is ${WORKFLOW_MODEL_REASON_MAX_LENGTH}`
       });
@@ -39208,20 +39795,20 @@ var MEMBERS = [
 function validateGraphModelMembers(graph) {
   const issues = [];
   const seen = /* @__PURE__ */ new Set();
-  const walk3 = /* @__PURE__ */ __name((value3, path26, depth) => {
+  const walk3 = /* @__PURE__ */ __name((value3, path27, depth) => {
     if (depth > WORKFLOW_MODEL_WALK_MAX_DEPTH || value3 === null || typeof value3 !== "object") return;
     if (seen.has(value3)) return;
     seen.add(value3);
     if (Array.isArray(value3)) {
-      value3.forEach((v, i) => walk3(v, `${path26}.${i}`, depth + 1));
+      value3.forEach((v, i) => walk3(v, `${path27}.${i}`, depth + 1));
       return;
     }
     const node = value3;
     if (MEMBERS.some((m) => node[m] !== void 0)) {
-      const label2 = typeof node.id === "string" && node.id ? node.id : path26;
+      const label2 = typeof node.id === "string" && node.id ? node.id : path27;
       issues.push(...validateAgentNodeModelMembers(node, label2));
     }
-    for (const [k, v] of Object.entries(node)) walk3(v, path26 ? `${path26}.${k}` : k, depth + 1);
+    for (const [k, v] of Object.entries(node)) walk3(v, path27 ? `${path27}.${k}` : k, depth + 1);
   }, "walk");
   walk3(graph, "", 0);
   return issues;
@@ -39535,7 +40122,7 @@ async function compileCommand(options) {
     }
     writeProgress("\u{1F528} Compiling...");
     const rootDir = process.cwd();
-    const outDir = path22.join(rootDir, "dist-v2");
+    const outDir = path23.join(rootDir, "dist-v2");
     const result = await compile2({
       rootDir,
       outDir,
@@ -40650,7 +41237,7 @@ __name(validateOrSuggest, "validateOrSuggest");
 
 // src/commands/workflow-local-run.ts
 import fs17 from "fs";
-import path23 from "path";
+import path24 from "path";
 init_cli();
 
 // src/utils/stdout-redirect.ts
@@ -41733,7 +42320,7 @@ async function runWorkflowLocalFromProject(name, flags) {
       fastRetries: !!flags.fastRetries,
       realTime: !!flags.realTime,
       artefactsDir: flags.artefactsDir,
-      workspaceDir: flags.workspace ? path23.resolve(flags.workspace) : void 0,
+      workspaceDir: flags.workspace ? path24.resolve(flags.workspace) : void 0,
       env: parseEnvFlags(flags.env),
       prompt: process.stdin.isTTY && !asJson && !isCiModeEnabled() ? promptForLocalDecision : void 0,
       log: asJson ? void 0 : (line) => console.log(line)
@@ -41884,7 +42471,7 @@ async function runScriptFormLocally(wf, flags, say) {
 }
 __name(runScriptFormLocally, "runScriptFormLocally");
 function writeLedgerFile(file, value3) {
-  fs17.mkdirSync(path23.dirname(path23.resolve(file)), {
+  fs17.mkdirSync(path24.dirname(path24.resolve(file)), {
     recursive: true
   });
   fs17.writeFileSync(file, `${JSON.stringify(value3, null, 2)}
@@ -47095,7 +47682,7 @@ init_constants();
 init_command_utils();
 init_developer_api_service();
 import fs18 from "fs";
-import path24 from "path";
+import path25 from "path";
 import inquirer10 from "inquirer";
 init_analytics();
 init_cli_error();
@@ -47444,7 +48031,7 @@ function variablesToEnvContent(variables) {
 }
 __name(variablesToEnvContent, "variablesToEnvContent");
 function saveSandboxEnvVariables(variables) {
-  const envFilePath = path24.join(process.cwd(), ".env");
+  const envFilePath = path25.join(process.cwd(), ".env");
   try {
     const content = variablesToEnvContent(variables);
     fs18.writeFileSync(envFilePath, content, "utf8");
@@ -51335,8 +51922,8 @@ var DrainsApi = class extends HttpClient {
   * answer is a plain `LogDrainRead` and is safe to retry; minting is not.
   */
   async rotateSecret(drainId, finalize) {
-    const path26 = this.drainPath(drainId, `/rotate-secret${finalize ? "?finalize=true" : ""}`);
-    return finalize ? this.httpPost(path26, {}) : this.httpPostOnce(path26, {});
+    const path27 = this.drainPath(drainId, `/rotate-secret${finalize ? "?finalize=true" : ""}`);
+    return finalize ? this.httpPost(path27, {}) : this.httpPostOnce(path27, {});
   }
   /**
   * Re-enqueue one batch's records (PRO-2126).
@@ -57386,7 +57973,7 @@ init_types();
 init_cli_error();
 import fs19 from "fs";
 import os2 from "os";
-import path25 from "path";
+import path26 from "path";
 var EXPORT_NOT_COMPILABLE = "export-not-compilable";
 var EXPORT_CHECK_TSCONFIG = {
   compilerOptions: {
@@ -57407,13 +57994,13 @@ var EXPORT_CHECK_TSCONFIG = {
   ]
 };
 async function dryCompileWorkflowExport(files) {
-  const root = fs19.mkdtempSync(path25.join(os2.tmpdir(), "lua-workflows-export-"));
+  const root = fs19.mkdtempSync(path26.join(os2.tmpdir(), "lua-workflows-export-"));
   const issues = [];
   const workflows = [];
   try {
-    fs19.writeFileSync(path25.join(root, "tsconfig.json"), `${JSON.stringify(EXPORT_CHECK_TSCONFIG, null, 2)}
+    fs19.writeFileSync(path26.join(root, "tsconfig.json"), `${JSON.stringify(EXPORT_CHECK_TSCONFIG, null, 2)}
 `);
-    fs19.writeFileSync(path25.join(root, "package.json"), `${JSON.stringify({
+    fs19.writeFileSync(path26.join(root, "package.json"), `${JSON.stringify({
       name: "lua-workflows-export-check",
       version: "0.0.0",
       private: true,
@@ -57421,23 +58008,23 @@ async function dryCompileWorkflowExport(files) {
     }, null, 2)}
 `);
     for (const f of files) {
-      const target = path25.resolve(root, f.path);
-      if (!target.startsWith(root + path25.sep)) continue;
-      fs19.mkdirSync(path25.dirname(target), {
+      const target = path26.resolve(root, f.path);
+      if (!target.startsWith(root + path26.sep)) continue;
+      fs19.mkdirSync(path26.dirname(target), {
         recursive: true
       });
       fs19.writeFileSync(target, f.contents);
     }
     const result = await new Compiler({
       rootDir: root,
-      outDir: path25.join(root, "dist-v2"),
+      outDir: path26.join(root, "dist-v2"),
       minify: false,
       sourceMaps: false,
       quietWarnings: true,
       runtimeValidation: false
     }).compile();
     for (const e of result.errors) {
-      const file = e.file ? path25.relative(root, e.file) : void 0;
+      const file = e.file ? path26.relative(root, e.file) : void 0;
       const where = file ? `${file}${e.line ? `:${e.line}` : ""}` : void 0;
       issues.push({
         code: EXPORT_NOT_COMPILABLE,
@@ -59327,15 +59914,15 @@ function actorLabel(by, now = Date.now()) {
   return Number.isFinite(at) ? `${who} (${agoFrom(at, now)})` : who;
 }
 __name(actorLabel, "actorLabel");
-function reservedSecretKeyPaths(value3, path26 = "", depth = 0, out = []) {
+function reservedSecretKeyPaths(value3, path27 = "", depth = 0, out = []) {
   if (depth > 64 || out.length >= 20 || value3 === null || typeof value3 !== "object") return out;
   if (Array.isArray(value3)) {
-    value3.forEach((v, i) => reservedSecretKeyPaths(v, `${path26}[${i}]`, depth + 1, out));
+    value3.forEach((v, i) => reservedSecretKeyPaths(v, `${path27}[${i}]`, depth + 1, out));
     return out;
   }
   for (const [k, v] of Object.entries(value3)) {
     if (out.length >= 20) break;
-    const child = path26 ? `${path26}.${k}` : k;
+    const child = path27 ? `${path27}.${k}` : k;
     if (isWorkflowSecretKey(k) && v !== null && v !== void 0 && typeof v !== "object") out.push(child);
     else reservedSecretKeyPaths(v, child, depth + 1, out);
   }
@@ -59796,10 +60383,10 @@ async function exportCore(ctx, name, o) {
     return apiFailure(ctx, res, "export");
   }
   const fs20 = await import("fs");
-  const path26 = await import("path");
-  const outDir = path26.resolve(o.out ?? ".");
+  const path27 = await import("path");
+  const outDir = path27.resolve(o.out ?? ".");
   const d = res.data;
-  const escaping = d.files.filter((f) => !path26.resolve(outDir, f.path).startsWith(outDir + path26.sep));
+  const escaping = d.files.filter((f) => !path27.resolve(outDir, f.path).startsWith(outDir + path27.sep));
   if (escaping.length > 0) {
     if (ctx.json) {
       emitJson(ctx, {
@@ -59858,14 +60445,14 @@ async function exportCore(ctx, name, o) {
     }, null, 2));
     return WORKFLOW_EXIT.OK;
   }
-  const clash = d.files.filter((f) => fs20.existsSync(path26.join(outDir, f.path)));
+  const clash = d.files.filter((f) => fs20.existsSync(path27.join(outDir, f.path)));
   if (clash.length > 0 && !o.force) {
     console.error(`\u274C export: ${clash.map((f) => f.path).join(", ")} already exist${clash.length === 1 ? "s" : ""} under ${outDir} \u2014 pass --force to overwrite, or --out <dir>`);
     return WORKFLOW_EXIT.API;
   }
   for (const f of d.files) {
-    const target = path26.join(outDir, f.path);
-    fs20.mkdirSync(path26.dirname(target), {
+    const target = path27.join(outDir, f.path);
+    fs20.mkdirSync(path27.dirname(target), {
       recursive: true
     });
     fs20.writeFileSync(target, f.contents);
@@ -59909,7 +60496,7 @@ var archiveDownload = {
 };
 async function archiveRunsCore(ctx, o) {
   const fs20 = await import("fs");
-  const path26 = await import("path");
+  const path27 = await import("path");
   const crypto5 = await import("crypto");
   const now = Date.now();
   const since = parseSinceFlag(o.since, now);
@@ -59943,7 +60530,7 @@ async function archiveRunsCore(ctx, o) {
   fs20.mkdirSync(o.out, {
     recursive: true
   });
-  const indexFile = path26.join(o.out, "archive-index.ndjson");
+  const indexFile = path27.join(o.out, "archive-index.ndjson");
   const indexed = /* @__PURE__ */ new Map();
   if (fs20.existsSync(indexFile)) {
     for (const line of fs20.readFileSync(indexFile, "utf8").split("\n")) {
@@ -59998,7 +60585,7 @@ async function archiveRunsCore(ctx, o) {
       ...apiRow,
       id: runIdOf(apiRow)
     };
-    const zipFile = path26.join(o.out, `${run.id}.zip`);
+    const zipFile = path27.join(o.out, `${run.id}.zip`);
     const prior = indexed.get(run.id);
     const completedAt = run.completedAt ? Date.parse(run.completedAt) : NaN;
     if (prior && run.exportedAt && Number.isFinite(completedAt) && Date.parse(run.exportedAt) >= completedAt && fs20.existsSync(zipFile) && sha256(fs20.readFileSync(zipFile)) === prior.sha256) {
@@ -60866,10 +61453,10 @@ function parseJudgePredicateFlag(raw) {
       } : {}
     };
   }
-  const [path26, op, ...rest] = raw.trim().split(/\s+/);
-  if (!path26 || !op || !GOAL_PREDICATE_OPS.includes(op)) throw new WorkflowLocalUsageError("usage", `--judge-predicate: expected "<path> <op> [value]" with op ${opList} (got "${raw}")`);
+  const [path27, op, ...rest] = raw.trim().split(/\s+/);
+  if (!path27 || !op || !GOAL_PREDICATE_OPS.includes(op)) throw new WorkflowLocalUsageError("usage", `--judge-predicate: expected "<path> <op> [value]" with op ${opList} (got "${raw}")`);
   if (rest.length === 0) return {
-    path: path26,
+    path: path27,
     op
   };
   const text = rest.join(" ");
@@ -60879,7 +61466,7 @@ function parseJudgePredicateFlag(raw) {
   } catch {
   }
   return {
-    path: path26,
+    path: path27,
     op,
     value: value3
   };