lua-cli 3.41.0 → 3.42.0-beta.1

package/dist/index.js

@@ -1752,24 +1752,24 @@ function composePresetEndpoint(type, endpoint) {
     reason: "invalid_url"
   };
   const origin = url.origin;
-  const path27 = url.pathname.replace(/\/+$/, "");
+  const path30 = url.pathname.replace(/\/+$/, "");
   if (!rule.segment) {
-    const base2 = path27.endsWith(rule.path) ? path27.slice(0, path27.length - rule.path.length) : path27;
+    const base2 = path30.endsWith(rule.path) ? path30.slice(0, path30.length - rule.path.length) : path30;
     return {
       ok: true,
       endpoint: `${origin}${base2}${rule.path}`
     };
   }
   const marker = `${rule.path}/`;
-  const at = path27.indexOf(marker);
+  const at = path30.indexOf(marker);
   if (at < 0) {
     return {
       ok: false,
       reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
     };
   }
-  const base = path27.slice(0, at);
-  const afterMarker = path27.slice(at + marker.length);
+  const base = path30.slice(0, at);
+  const afterMarker = path30.slice(at + marker.length);
   const rest = rule.suffix && afterMarker.endsWith(rule.suffix) ? afterMarker.slice(0, afterMarker.length - rule.suffix.length) : afterMarker;
   if (!rest || rest.includes("/")) {
     return {
@@ -2467,7 +2467,7 @@ function scheduledWorkflowRunId(jobId, scheduledTime) {
 }
 function renderWorkflowScheduleKeyTemplate(template3, ctx) {
   if (!template3) return void 0;
-  const read = /* @__PURE__ */ __name2((path27) => path27.split(".").reduce((o, k) => o && typeof o === "object" ? o[k] : void 0, ctx.input), "read");
+  const read = /* @__PURE__ */ __name2((path30) => path30.split(".").reduce((o, k) => o && typeof o === "object" ? o[k] : void 0, ctx.input), "read");
   let unresolved = false;
   const out = template3.replace(/\$\{\s*([a-zA-Z0-9_.]+)\s*\}/g, (_m, expr) => {
     let v = "";
@@ -3345,7 +3345,7 @@ function envTemplatePlaceholder(key) {
     __envRef: key
   };
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, PLATFORM_INVOCATION_CALLERS, SUPERVISION_OPS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE;
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, PLATFORM_INVOCATION_CALLERS, SUPERVISION_OPS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_WALL_MS, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSETS, WEB_APP_ASSET_PATH_PATTERN, WEB_APP_ASSET_PATH_MAX_CHARS, WEB_APP_MAX_ROUTES, WEB_APP_MAX_ASSET_BYTES, WEB_APP_CSP_NONCE_PLACEHOLDER, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -3428,7 +3428,8 @@ var init_dist = __esm({
       "sendWebchatMessage",
       "sendTeamsMessage",
       "sendInstagramMessage",
-      "sendMessengerMessage"
+      "sendMessengerMessage",
+      "sendSlackMessage"
     ];
     __name(isAllowedReviewableExecuteTool, "isAllowedReviewableExecuteTool");
     __name2(isAllowedReviewableExecuteTool, "isAllowedReviewableExecuteTool");
@@ -5765,6 +5766,24 @@ listed here; never invent a target.`;
       label: copy(100),
       body: onboardingRichTextSchema
     }).strict();
+    onboardingInstallScreenSchema = z4.object({
+      title: onboardingHeadingSchema,
+      subtitle: copy(240),
+      ctaLabel: copy(80),
+      ctaHelperText: onboardingRichTextSchema
+    }).strict();
+    onboardingResultScreenSchema = z4.object({
+      title: onboardingHeadingSchema,
+      subheader: copy(240),
+      inputPlaceholder: copy(120)
+    }).strict();
+    onboardingConnectScreenSchema = z4.object({
+      title: onboardingHeadingSchema,
+      description: onboardingRichTextSchema,
+      ctaLabel: copy(80),
+      neverLine: copy(120),
+      footnote: copy(240)
+    }).strict();
     onboardingTemplateContentSchema = z4.object({
       id,
       templateId: copy(160),
@@ -5777,7 +5796,10 @@ listed here; never invent a target.`;
       artwork: onboardingArtworkSchema,
       hireButtonLabel: copy(80),
       changeRoleButtonLabel: copy(80),
-      nextStepText: onboardingRichTextSchema
+      nextStepText: onboardingRichTextSchema,
+      install: onboardingInstallScreenSchema.optional(),
+      result: onboardingResultScreenSchema.optional(),
+      connect: onboardingConnectScreenSchema.optional()
     }).strict();
     onboardingUnavailableOutcomeSchema = z4.object({
       id,
@@ -5937,6 +5959,7 @@ listed here; never invent a target.`;
     __name2(isForwardableWebRouteRequestHeader, "isForwardableWebRouteRequestHeader");
     __name(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
     __name2(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
+    WEB_ROUTE_MAX_WALL_MS = 6e4;
     WEB_ROUTE_MAX_REQUEST_BODY_BYTES = 1 * 1024 * 1024;
     WEB_ROUTE_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
     __name(isWebRouteBody, "isWebRouteBody");
@@ -5947,6 +5970,14 @@ listed here; never invent a target.`;
     __name2(isQueryRecord, "isQueryRecord");
     __name(isWebRouteInput, "isWebRouteInput");
     __name2(isWebRouteInput, "isWebRouteInput");
+    WEB_APP_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+    WEB_APP_ENTRY_HTML_MAX_CHARS = 256 * 1024;
+    WEB_APP_MAX_ASSETS = 1e3;
+    WEB_APP_ASSET_PATH_PATTERN = /^assets\/(?!.*\.\.)[A-Za-z0-9._\-/]+$/;
+    WEB_APP_ASSET_PATH_MAX_CHARS = 512;
+    WEB_APP_MAX_ROUTES = 200;
+    WEB_APP_MAX_ASSET_BYTES = 8 * 1024 * 1024;
+    WEB_APP_CSP_NONCE_PLACEHOLDER = "__LUA_CSP_NONCE__";
     EVIDENCE_SESSION_IDLE_MS = 30 * 6e4;
     EVIDENCE_MIN_CONVERSATIONS = 20;
     EVIDENCE_LOW_CONFIDENCE_N = 5;
@@ -6125,8 +6156,8 @@ function uidFromFirebaseIdToken(idToken) {
   if (parsed.success) return parsed.data.sub;
   throw new Error(INVALID_FIREBASE_SESSION);
 }
-function parseFirebaseSession(json, now = Date.now()) {
-  const customTokenResponse = customTokenResponseSchema.safeParse(json);
+function parseFirebaseSession(json2, now = Date.now()) {
+  const customTokenResponse = customTokenResponseSchema.safeParse(json2);
   if (customTokenResponse.success) {
     const { idToken: idToken2, refreshToken: refreshToken2, expiresIn: expiresIn2, localId } = customTokenResponse.data;
     return {
@@ -6136,7 +6167,7 @@ function parseFirebaseSession(json, now = Date.now()) {
       uid: localId ?? uidFromFirebaseIdToken(idToken2)
     };
   }
-  const refreshResponse = refreshResponseSchema.safeParse(json);
+  const refreshResponse = refreshResponseSchema.safeParse(json2);
   if (!refreshResponse.success) throw new Error(INVALID_FIREBASE_SESSION);
   const { id_token: idToken, refresh_token: refreshToken, expires_in: expiresIn, user_id: uid } = refreshResponse.data;
   return {
@@ -6727,9 +6758,9 @@ function workflowJobTargetProblem(target, plugins, luaApi) {
   if (!hasPlugins && luaApi !== true) return "`target` is legal only beside `plugins` or `luaApi: true`";
   return null;
 }
-function readInitDataPath(root, path27) {
+function readInitDataPath(root, path30) {
   let cur = root;
-  for (const seg of path27.split(".")) {
+  for (const seg of path30.split(".")) {
     const name = seg.replace(/\[(?:0|[1-9]\d*)\]/g, "");
     const indexes = [
       ...seg.matchAll(/\[(0|[1-9]\d*)\]/g)
@@ -6762,25 +6793,25 @@ function renderWorkflowJobTarget(target, initData) {
       templated: false
     };
   }
-  const path27 = workflowJobTargetTemplatePath(agentId);
-  if (path27 === null) return {
+  const path30 = workflowJobTargetTemplatePath(agentId);
+  if (path30 === null) return {
     ok: false,
     reason: "invalid",
     message: "target.agentId is not a valid initData template"
   };
-  const value3 = readInitDataPath(initData, path27);
+  const value3 = readInitDataPath(initData, path30);
   if (value3 === void 0 || value3 === null) {
     return {
       ok: false,
       reason: "unbound",
-      message: `target_unresolved: the run input has no initData.${path27}`
+      message: `target_unresolved: the run input has no initData.${path30}`
     };
   }
   if (typeof value3 !== "string" || !value3.trim() || value3.length > 256 || /\s/.test(value3.trim())) {
     return {
       ok: false,
       reason: "empty",
-      message: `target_unresolved: initData.${path27} is not a non-empty agent id`
+      message: `target_unresolved: initData.${path30} is not a non-empty agent id`
     };
   }
   return {
@@ -6888,13 +6919,13 @@ function parseTemplatePlaceholder(rawExpr) {
     rest: dot === -1 ? "" : rawExpr.slice(dot + 1)
   };
 }
-function traverseMappingPath(root, path27, errorLabel2) {
-  if (path27 === "" || path27 === ".") return root;
-  const parts = path27.split(".");
+function traverseMappingPath(root, path30, errorLabel2) {
+  if (path30 === "" || path30 === ".") return root;
+  const parts = path30.split(".");
   let value22 = root;
   for (const part of parts) {
     if (typeof value22 === "object" && value22 !== null) value22 = value22[part];
-    else throw new WorkflowTemplateError(`Invalid path ${path27} in ${errorLabel2}`, path27);
+    else throw new WorkflowTemplateError(`Invalid path ${path30} in ${errorLabel2}`, path30);
   }
   return value22;
 }
@@ -7079,11 +7110,11 @@ function parseModelTemplate(model) {
       message: modelTemplateInvalidMessage(model, why)
     };
   }
-  const path27 = m[1];
-  if (!path27.split(".").every((seg) => PATH_SEGMENT_RE.test(seg))) {
+  const path30 = m[1];
+  if (!path30.split(".").every((seg) => PATH_SEGMENT_RE.test(seg))) {
     return {
       kind: "invalid",
-      message: modelTemplateInvalidMessage(model, `the path \`${path27}\` is not a dotted path of names and canonical [n] indexes`)
+      message: modelTemplateInvalidMessage(model, `the path \`${path30}\` is not a dotted path of names and canonical [n] indexes`)
     };
   }
   if (m[2] !== void 0) {
@@ -7102,7 +7133,7 @@ function parseModelTemplate(model) {
       kind: "template",
       template: {
         placeholder: trimmed2,
-        path: path27,
+        path: path30,
         default: dflt
       }
     };
@@ -7111,7 +7142,7 @@ function parseModelTemplate(model) {
     kind: "template",
     template: {
       placeholder: trimmed2,
-      path: path27
+      path: path30
     }
   };
 }
@@ -7128,9 +7159,9 @@ function staticModelPin(model) {
   if (parsed.kind === "template") return parsed.template.default;
   return void 0;
 }
-function readPath(root, path27) {
+function readPath(root, path30) {
   let cur = root;
-  for (const seg of path27.split(".")) {
+  for (const seg of path30.split(".")) {
     const name = seg.replace(/\[(?:0|[1-9]\d*)\]/g, "");
     const indexes = [
       ...seg.matchAll(/\[(0|[1-9]\d*)\]/g)
@@ -7165,17 +7196,17 @@ function renderModelTemplate(model, initData) {
     model,
     source: "static"
   };
-  const { placeholder, path: path27 } = parsed.template;
+  const { placeholder, path: path30 } = parsed.template;
   if (initData !== void 0 && initData !== null && (typeof initData !== "object" || Array.isArray(initData))) {
     return {
       ok: false,
       placeholder,
-      path: path27,
+      path: path30,
       reason: "input-not-object",
       message: modelTemplateInputNotObjectMessage(placeholder, initData)
     };
   }
-  const value22 = readPath(initData, path27);
+  const value22 = readPath(initData, path30);
   const reason = value22 === void 0 || value22 === null ? "unbound" : typeof value22 !== "string" ? "not-a-string" : value22.trim() ? null : "empty";
   if (reason === null) return {
     ok: true,
@@ -7190,14 +7221,14 @@ function renderModelTemplate(model, initData) {
   return {
     ok: false,
     placeholder,
-    path: path27,
+    path: path30,
     reason,
-    message: modelTemplateUnboundMessage(placeholder, path27, reason)
+    message: modelTemplateUnboundMessage(placeholder, path30, reason)
   };
 }
-function modelTemplateUnboundMessage(placeholder, path27, reason) {
-  const what = reason === "unbound" ? `the run input has no ${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path27}` : reason === "empty" ? `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path27} is empty on the run input` : `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path27} on the run input is not a string`;
-  return `model placeholder "${placeholder}" is unbound \u2014 ${what} and the placeholder declares no default; pass one in the run input or write \${${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path27}|<provider/model>}`;
+function modelTemplateUnboundMessage(placeholder, path30, reason) {
+  const what = reason === "unbound" ? `the run input has no ${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path30}` : reason === "empty" ? `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path30} is empty on the run input` : `${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path30} on the run input is not a string`;
+  return `model placeholder "${placeholder}" is unbound \u2014 ${what} and the placeholder declares no default; pass one in the run input or write \${${WORKFLOW_MODEL_TEMPLATE_ROOT}.${path30}|<provider/model>}`;
 }
 function modelTemplateInputNotObjectMessage(placeholder, initData) {
   const type = Array.isArray(initData) ? "an array" : `a ${typeof initData}`;
@@ -7237,22 +7268,22 @@ function validateApproverBlock(node, opts = {
   path: "approval"
 }) {
   const issues = [];
-  const push = /* @__PURE__ */ __name4((code, path27, message, severity = "error") => issues.push({
+  const push = /* @__PURE__ */ __name4((code, path30, message, severity = "error") => issues.push({
     code,
-    path: path27,
+    path: path30,
     severity,
     message
   }), "push");
-  const checkSpec = /* @__PURE__ */ __name4((spec, path27) => {
+  const checkSpec = /* @__PURE__ */ __name4((spec, path30) => {
     const r = ApproverSpecSchema.safeParse(spec);
     if (!r.success) {
       const users = spec?.users;
-      if (Array.isArray(users) && users.length > APPROVER_SPEC_MAX_USERS) push("cap-exceeded", path27, `at most ${APPROVER_SPEC_MAX_USERS} users`);
+      if (Array.isArray(users) && users.length > APPROVER_SPEC_MAX_USERS) push("cap-exceeded", path30, `at most ${APPROVER_SPEC_MAX_USERS} users`);
       else {
         const refusal2 = describeApproverSpecRefusal(spec);
         issues.push({
           code: "approver-invalid",
-          path: path27,
+          path: path30,
           severity: "error",
           message: refusal2.message,
           repair: {
@@ -7265,12 +7296,12 @@ function validateApproverBlock(node, opts = {
     }
     const s = r.data;
     if (typeof s === "object") {
-      if ("governance" in s && !opts.governanceEnabled) push("approver-governance-unavailable", path27, "governance reviewer routing is not enabled for this deployment");
-      if ("group" in s && typeof s.group === "string" && !opts.scimEnabled && opts.idpGroups?.includes(s.group)) push("approver-idp-group-unavailable", path27, "IdP-group approvers are not enabled for this deployment");
+      if ("governance" in s && !opts.governanceEnabled) push("approver-governance-unavailable", path30, "governance reviewer routing is not enabled for this deployment");
+      if ("group" in s && typeof s.group === "string" && !opts.scimEnabled && opts.idpGroups?.includes(s.group)) push("approver-idp-group-unavailable", path30, "IdP-group approvers are not enabled for this deployment");
       const binding = "users" in s ? s.users : "role" in s ? s.role : "group" in s ? s.group : void 0;
       if (isTemplateBinding(binding)) {
-        if (!bindingRootsOk(binding.template)) push("approver-binding-invalid", `${path27}.template`, "binding root must be initData / stepResults / requestContext / state");
-        if ("users" in s && opts.customerReachable) push("approver-binding-customer-reachable", `${path27}.users`, "a customer-reachable workflow may not bind its approver list");
+        if (!bindingRootsOk(binding.template)) push("approver-binding-invalid", `${path30}.template`, "binding root must be initData / stepResults / requestContext / state");
+        if ("users" in s && opts.customerReachable) push("approver-binding-customer-reachable", `${path30}.users`, "a customer-reachable workflow may not bind its approver list");
       }
     }
   }, "checkSpec");
@@ -7455,8 +7486,8 @@ function withDefaultsFilled(g) {
 function isConnectionKeyShaped(value22) {
   return WORKFLOW_CONNECTION_KEY_RE.test(value22) && !CONNECTION_ID_HEX_RE.test(value22);
 }
-function connectionKeyUndeclaredMessage(path27, key) {
-  return `${path27} '${key}' is neither a connection id nor a declared connections[].key \u2014 declare it: connections: [{ key: '${key}', integrationType: '<catalog slug, e.g. github>' }] and it resolves on any agent`;
+function connectionKeyUndeclaredMessage(path30, key) {
+  return `${path30} '${key}' is neither a connection id nor a declared connections[].key \u2014 declare it: connections: [{ key: '${key}', integrationType: '<catalog slug, e.g. github>' }] and it resolves on any agent`;
 }
 function classifyModelProvider(model) {
   const m = (model ?? "").trim().toLowerCase();
@@ -7466,10 +7497,10 @@ function classifyModelProvider(model) {
   if (/^(google\/|gemini)/.test(m)) return "google";
   return null;
 }
-function schemaAtPath(schema, path27) {
+function schemaAtPath(schema, path30) {
   let cur = schema;
   if (!cur || typeof cur !== "object") return void 0;
-  for (const seg of path27.split(".").filter(Boolean)) {
+  for (const seg of path30.split(".").filter(Boolean)) {
     const props = cur.properties;
     const next = props?.[seg];
     if (!next || typeof next !== "object") return void 0;
@@ -7536,21 +7567,21 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   static: true
 }) {
   const issues = [];
-  const err = /* @__PURE__ */ __name4((code, message, path27, stepId) => {
+  const err = /* @__PURE__ */ __name4((code, message, path30, stepId) => {
     issues.push({
       code,
       message,
       severity: "error",
-      path: path27,
+      path: path30,
       stepId
     });
   }, "err");
-  const warn = /* @__PURE__ */ __name4((code, message, path27, stepId) => {
+  const warn = /* @__PURE__ */ __name4((code, message, path30, stepId) => {
     issues.push({
       code,
       message,
       severity: "warning",
-      path: path27,
+      path: path30,
       stepId
     });
   }, "warn");
@@ -7586,19 +7617,19 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     err("connection-declaration-invalid", "`connections` must be an array of { key, integrationType }", "connections");
   }
   (Array.isArray(g.connections) ? g.connections : []).forEach((c, i) => {
-    const path27 = `connections.${i}`;
+    const path30 = `connections.${i}`;
     const key = c?.key;
     const integrationType = c?.integrationType;
     if (typeof key !== "string" || !WORKFLOW_CONNECTION_KEY_RE.test(key)) {
-      err("connection-declaration-invalid", `connections[${i}].key must match ${WORKFLOW_CONNECTION_KEY_RE}`, `${path27}.key`);
+      err("connection-declaration-invalid", `connections[${i}].key must match ${WORKFLOW_CONNECTION_KEY_RE}`, `${path30}.key`);
       return;
     }
     if (ownKeys.has(key)) {
-      err("connection-declaration-invalid", `connections[${i}].key "${key}" is declared twice`, `${path27}.key`);
+      err("connection-declaration-invalid", `connections[${i}].key "${key}" is declared twice`, `${path30}.key`);
       return;
     }
     if (typeof integrationType !== "string" || !integrationType.trim()) {
-      err("connection-declaration-invalid", `connections[${i}] ("${key}") needs an integrationType (the catalog slug, e.g. 'github')`, `${path27}.integrationType`);
+      err("connection-declaration-invalid", `connections[${i}] ("${key}") needs an integrationType (the catalog slug, e.g. 'github')`, `${path30}.integrationType`);
       return;
     }
     ownKeys.add(key);
@@ -7612,112 +7643,112 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
-  const checkId = /* @__PURE__ */ __name4((id2, path27) => {
+  const checkId = /* @__PURE__ */ __name4((id2, path30) => {
     nodeCount += 1;
     if (seen.has(id2)) {
-      err("duplicate-step-id", `step id "${id2}" is declared twice (first at ${seen.get(id2)})`, path27, id2);
+      err("duplicate-step-id", `step id "${id2}" is declared twice (first at ${seen.get(id2)})`, path30, id2);
     } else {
-      seen.set(id2, path27);
+      seen.set(id2, path30);
     }
   }, "checkId");
-  const checkPolicyEnums = /* @__PURE__ */ __name4((node, path27) => {
+  const checkPolicyEnums = /* @__PURE__ */ __name4((node, path30) => {
     const id2 = singleId(node);
     const check = /* @__PURE__ */ __name4((member, allowed) => {
       const value22 = node[member];
       if (value22 === void 0 || typeof value22 === "string" && allowed.includes(value22)) return;
-      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path27}.${member}`, id2);
+      err("invalid-envelope", `\`${member}\` must be ${allowed.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path30}.${member}`, id2);
     }, "check");
     check("sideEffects", WORKFLOW_SIDE_EFFECTS);
     check("jobResources", WORKFLOW_JOB_RESOURCES);
   }, "checkPolicyEnums");
-  const checkRetry = /* @__PURE__ */ __name4((node, path27) => {
+  const checkRetry = /* @__PURE__ */ __name4((node, path30) => {
     const r = node.retry;
     if (!r) return;
     const id2 = singleId(node);
     const unknown = unknownWorkflowRetryMembers(r);
-    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path27}.retry`, id2);
+    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path30}.retry`, id2);
     if (!isWithinWorkflowRetryAttempts(r.maxAttempts)) {
       const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
-      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path27}.retry.maxAttempts`, id2);
+      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path30}.retry.maxAttempts`, id2);
     }
     const backoffs = retryBackoffs();
     if (r.backoff !== void 0 && !backoffs.includes(r.backoff)) {
       const list = backoffs.map((b) => `'${b}'`).join(" | ");
-      err("backoff-invalid", `retry.backoff must be ${list}`, `${path27}.retry.backoff`, id2);
+      err("backoff-invalid", `retry.backoff must be ${list}`, `${path30}.retry.backoff`, id2);
     }
     if (r.backoffSeconds !== void 0 && r.backoffSeconds < 0) {
-      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path27}.retry.backoffSeconds`, id2);
+      err("backoff-invalid", "retry.backoffSeconds must be \u2265 0", `${path30}.retry.backoffSeconds`, id2);
     }
     if (r.maxBackoffSeconds !== void 0) {
       if (r.backoff !== "exponential") {
-        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path27}.retry`, id2);
+        err("backoff-invalid", "retry.maxBackoffSeconds is only meaningful with backoff:'exponential'", `${path30}.retry`, id2);
       } else if (r.maxBackoffSeconds <= 0 || r.backoffSeconds !== void 0 && r.maxBackoffSeconds < r.backoffSeconds) {
-        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path27}.retry.maxBackoffSeconds`, id2);
+        err("backoff-invalid", "retry.maxBackoffSeconds must be > 0 and \u2265 backoffSeconds", `${path30}.retry.maxBackoffSeconds`, id2);
       }
     }
   }, "checkRetry");
-  const checkTimeout = /* @__PURE__ */ __name4((node, path27) => {
+  const checkTimeout = /* @__PURE__ */ __name4((node, path30) => {
     const t = node.timeoutSeconds;
     if (t === void 0) return;
     const id2 = singleId(node);
     if (!Number.isInteger(t) || t < 1) {
-      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path27}.timeoutSeconds`, id2);
+      err("timeout-out-of-range", `timeoutSeconds must be an integer \u2265 1 (got ${t})`, `${path30}.timeoutSeconds`, id2);
       return;
     }
     if (node.tier === "job") {
       const cap = node.type === "agent" ? caps.maxJobTimeoutSeconds : caps.maxJobSegmentSeconds;
       if (t > cap) {
-        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path27}.timeoutSeconds`, id2);
+        err("job-timeout-exceeds-cap", `timeoutSeconds ${t} exceeds the Job-tier cap of ${cap} s`, `${path30}.timeoutSeconds`, id2);
       } else if (node.type === "agent" && t > caps.maxJobSegmentSeconds && !node.workspace) {
-        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path27}.timeoutSeconds`, id2);
+        err("long-job-requires-workspace", `steps longer than 4 h checkpoint to the run workspace \u2014 add workspace:{mount:'rw'} (and workspace on createWorkflow) or split the step`, `${path30}.timeoutSeconds`, id2);
       }
     } else if (t > caps.maxWorkerTimeoutSeconds) {
-      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path27}.timeoutSeconds`, id2);
+      err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path30}.timeoutSeconds`, id2);
     }
   }, "checkTimeout");
-  const checkSpecialistRole = /* @__PURE__ */ __name4((node, path27) => {
+  const checkSpecialistRole = /* @__PURE__ */ __name4((node, path30) => {
     const role = node.role;
     const hasRef = typeof role.ref === "string";
     const hasInline = role.name !== void 0 || role.instructions !== void 0 || Array.isArray(role.tools) && role.tools.length > 0;
     if (hasRef && hasInline) {
-      err("role-ref-and-inline", "a role is either `{ref}` or inline `{name, instructions, tools}`, never both", `${path27}.role`, node.id);
+      err("role-ref-and-inline", "a role is either `{ref}` or inline `{name, instructions, tools}`, never both", `${path30}.role`, node.id);
     }
     if (node.agentId !== "$self") {
-      err("ephemeral-base-not-self", "a role runs on the owner only: use '$self'", `${path27}.agentId`, node.id);
+      err("ephemeral-base-not-self", "a role runs on the owner only: use '$self'", `${path30}.agentId`, node.id);
     }
     if (opts.policy && opts.policy.ephemeralSpecialists !== true) {
-      err("ephemeral-specialists-disabled", "ephemeral specialists are off for this org/agent (workflowPolicy.ephemeralSpecialists)", `${path27}.role`, node.id);
+      err("ephemeral-specialists-disabled", "ephemeral specialists are off for this org/agent (workflowPolicy.ephemeralSpecialists)", `${path30}.role`, node.id);
     }
     let tools = Array.isArray(role.tools) ? role.tools.filter((t) => typeof t === "string") : [];
     if (hasRef && opts.roleLibrary) {
       const saved = opts.roleLibrary.get(role.ref);
       if (!saved) {
-        err("role-ref-unknown", `no saved role \`${role.ref}\` in the owner's library`, `${path27}.role.ref`, node.id);
+        err("role-ref-unknown", `no saved role \`${role.ref}\` in the owner's library`, `${path30}.role.ref`, node.id);
       } else {
         tools = saved.tools ?? [];
         if (typeof role.roleHash === "string" && saved.roleHash && role.roleHash !== saved.roleHash) {
-          warn("role-ref-stale", `saved role \`${role.ref}\` changed since this version was frozen`, `${path27}.role.ref`, node.id);
+          warn("role-ref-stale", `saved role \`${role.ref}\` changed since this version was frozen`, `${path30}.role.ref`, node.id);
         }
       }
     }
     if (tools.length && opts.toolCatalog) {
       const missing = tools.filter((t) => !opts.toolCatalog.has(t));
       if (missing.length) {
-        err("ephemeral-tools-not-subset", `role tools not in the owner's catalog: ${missing.join(", ")}`, `${path27}.role.tools`, node.id);
+        err("ephemeral-tools-not-subset", `role tools not in the owner's catalog: ${missing.join(", ")}`, `${path30}.role.tools`, node.id);
       }
     }
   }, "checkSpecialistRole");
-  const checkRequiredConnections = /* @__PURE__ */ __name4((node, path27) => {
+  const checkRequiredConnections = /* @__PURE__ */ __name4((node, path30) => {
     const required = node.requiredConnections;
     if (!Array.isArray(required)) return;
     const undeclared = required.filter(undeclaredKey);
     if (undeclared.length) {
-      err("connection-key-undeclared", connectionKeyUndeclaredMessage(`${path27}.requiredConnections`, undeclared[0]) + (undeclared.length > 1 ? ` (also undeclared: ${JSON.stringify(undeclared.slice(1))})` : ""), `${path27}.requiredConnections`, singleId(node));
+      err("connection-key-undeclared", connectionKeyUndeclaredMessage(`${path30}.requiredConnections`, undeclared[0]) + (undeclared.length > 1 ? ` (also undeclared: ${JSON.stringify(undeclared.slice(1))})` : ""), `${path30}.requiredConnections`, singleId(node));
     }
     if (!opts.connectionIds) return;
     const unknown = required.filter((c) => typeof c !== "string" || !declaredKeys.has(c) && !opts.connectionIds.has(c));
     if (unknown.length) {
-      err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are neither declared connections[].key values nor connections the owner can mount`, `${path27}.requiredConnections`, singleId(node));
+      err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are neither declared connections[].key values nor connections the owner can mount`, `${path30}.requiredConnections`, singleId(node));
     }
   }, "checkRequiredConnections");
   const jobClassifiablePin = /* @__PURE__ */ __name4((model) => {
@@ -7735,33 +7766,33 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     return void 0;
   }, "jobClassifiablePin");
-  const checkTier = /* @__PURE__ */ __name4((node, path27) => {
+  const checkTier = /* @__PURE__ */ __name4((node, path30) => {
     const id2 = singleId(node);
     if (node.workspace && node.workspace !== "inherit" && node.tier !== void 0 && node.tier !== "job") {
-      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path27}.workspace`, id2);
+      err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path30}.workspace`, id2);
     }
     if (node.harness !== void 0 && node.tier !== "job") {
-      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path27}.harness`, id2);
+      err("harness-requires-job-tier", "`harness` is only legal on a tier:'job' agent step", `${path30}.harness`, id2);
     }
     const provider = node.type === "agent" ? classifyModelProvider(jobClassifiablePin(node.model)) : null;
     if (node.harness === "claude-code" && provider !== null && provider !== "anthropic") {
-      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path27}.harness`, id2);
+      err("harness-provider-mismatch", `harness:'claude-code' needs an Anthropic model (model "${node.type === "agent" ? node.model : ""}" is ${provider})`, `${path30}.harness`, id2);
     }
     if (isJobTier(node) && provider !== null && opts.policy?.jobProviders && !opts.policy.jobProviders.includes(provider)) {
-      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path27}.model`, id2);
+      err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path30}.model`, id2);
     }
   }, "checkTier");
-  const checkModel = /* @__PURE__ */ __name4((node, path27) => {
+  const checkModel = /* @__PURE__ */ __name4((node, path30) => {
     if (node.type !== "agent" || typeof node.model !== "string") return;
     const id2 = singleId(node);
     const parsed = parseModelTemplate(node.model);
     if (parsed.kind === "invalid") {
-      err("model-template-invalid", parsed.message, `${path27}.model`, id2);
+      err("model-template-invalid", parsed.message, `${path30}.model`, id2);
       return;
     }
     if (parsed.kind === "template" && parsed.template.default === void 0) {
       if (isJobTier(node)) {
-        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path27}.model`, id2);
+        err("model-template-default-required", modelTemplateDefaultRequiredMessage(node.model), `${path30}.model`, id2);
       }
       return;
     }
@@ -7774,40 +7805,40 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     if (registry === "unavailable") {
       const trimmed2 = pin.trim();
       if (trimmed2 && !normalizeModelId(trimmed2, []).ok) {
-        warn("model-unresolved", inContext(`model "${trimmed2}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path27}.model`, id2);
+        warn("model-unresolved", inContext(`model "${trimmed2}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path30}.model`, id2);
       }
       return;
     }
     const resolved = normalizeModelId(pin, registry);
-    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path27}.model`, id2);
+    if (!resolved.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved)), `${path30}.model`, id2);
   }, "checkModel");
-  const checkTaskClass = /* @__PURE__ */ __name4((node, path27) => {
+  const checkTaskClass = /* @__PURE__ */ __name4((node, path30) => {
     if (node.type !== "agent" || node.taskClass === void 0) return;
     if (!opts.static) return;
     if (typeof node.model === "string" && node.model.trim()) return;
-    err("task-class-without-model", `taskClass '${String(node.taskClass)}' needs a \`model\` on a pushed definition \u2014 write a class (model: 'class/fast' | 'class/balanced' | 'class/strong') or an approved provider/model code; nothing maps a task class to a model at dispatch, so a step with neither would run on the agent\u2019s own model`, `${path27}.taskClass`, singleId(node));
+    err("task-class-without-model", `taskClass '${String(node.taskClass)}' needs a \`model\` on a pushed definition \u2014 write a class (model: 'class/fast' | 'class/balanced' | 'class/strong') or an approved provider/model code; nothing maps a task class to a model at dispatch, so a step with neither would run on the agent\u2019s own model`, `${path30}.taskClass`, singleId(node));
   }, "checkTaskClass");
-  const checkWorkspace = /* @__PURE__ */ __name4((node, path27) => {
+  const checkWorkspace = /* @__PURE__ */ __name4((node, path30) => {
     const id2 = singleId(node);
     const ws = workspaceOf(node);
     if (isJobTier(node) && opts.policy && opts.policy.jobTier !== true) {
-      err("job-tier-disabled", `"${id2}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path27}.tier`, id2);
+      err("job-tier-disabled", `"${id2}" runs on the Job tier but the org's workflowPolicy.jobTier is off \u2014 an org admin enables it (lua features workflows.caps.jobTier true)`, `${path30}.tier`, id2);
     }
     const tools = jobToolsOf(node);
     if (tools !== void 0) {
       if (!isJobTier(node)) {
-        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path27}.jobTools`, id2);
+        err("job-tools-require-job-tier", "`jobTools` needs tier:'job'", `${path30}.jobTools`, id2);
       }
       const unknown = (Array.isArray(tools) ? tools : [
         tools
       ]).filter((t) => !WORKFLOW_JOB_TOOLS.includes(t));
       if (unknown.length > 0) {
-        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path27}.jobTools`, id2);
+        err("job-tools-unknown", `jobTools ${JSON.stringify(unknown)} outside WORKFLOW_JOB_TOOLS [${WORKFLOW_JOB_TOOLS.join(", ")}]`, `${path30}.jobTools`, id2);
       }
       if (node.type === "agent" && (Array.isArray(tools) ? tools : [
         tools
       ]).includes("gh")) {
-        warn("gh-on-coding-turn", `"${id2}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path27}.jobTools`, id2);
+        warn("gh-on-coding-turn", `"${id2}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path30}.jobTools`, id2);
       }
     }
     const plugins = node.plugins;
@@ -7815,44 +7846,44 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const luaApi = node.luaApi;
     if (luaApi !== void 0) {
       const problem = workflowJobLuaApiProblem(luaApi, node.type === "step" ? "code" : node.type, isJobTier(node) ? "job" : node.tier);
-      if (problem) err("lua-api-invalid", problem, `${path27}.luaApi`, id2);
+      if (problem) err("lua-api-invalid", problem, `${path30}.luaApi`, id2);
     }
     if (target !== void 0) {
       const problem = workflowJobTargetProblem(target, plugins, luaApi);
-      if (problem) err("target-invalid", problem, `${path27}.target`, id2);
+      if (problem) err("target-invalid", problem, `${path30}.target`, id2);
     }
     if (plugins !== void 0) {
       const problem = workflowJobPluginsProblem(plugins);
-      if (problem) err("plugins-invalid", problem, `${path27}.plugins`, id2);
-      if (node.type !== "agent") err("plugins-invalid", "`plugins` is legal on agent steps only", `${path27}.plugins`, id2);
+      if (problem) err("plugins-invalid", problem, `${path30}.plugins`, id2);
+      if (node.type !== "agent") err("plugins-invalid", "`plugins` is legal on agent steps only", `${path30}.plugins`, id2);
       else {
-        if (!isJobTier(node)) err("plugins-invalid", "`plugins` needs tier:'job'", `${path27}.plugins`, id2);
+        if (!isJobTier(node)) err("plugins-invalid", "`plugins` needs tier:'job'", `${path30}.plugins`, id2);
         const provider = classifyModelProvider(jobClassifiablePin(node.model));
-        if (node.harness === "generic" || provider !== null && provider !== "anthropic") err("plugins-invalid", "`plugins` run on the claude-code harness only (an Anthropic model, no `harness:'generic'`)", `${path27}.plugins`, id2);
+        if (node.harness === "generic" || provider !== null && provider !== "anthropic") err("plugins-invalid", "`plugins` run on the claude-code harness only (an Anthropic model, no `harness:'generic'`)", `${path30}.plugins`, id2);
         const w = workspaceOf(node);
         const ro = w !== void 0 && w !== "inherit" && w.mount === "ro";
         const declared = Array.isArray(tools) ? tools : void 0;
-        if (!effectiveJobTools(declared, ro).includes("shell")) err("plugins-invalid", "`plugins` need the `shell` job tool (the plugin drives lua-cli) \u2014 keep it in jobTools and mount rw", `${path27}.plugins`, id2);
+        if (!effectiveJobTools(declared, ro).includes("shell")) err("plugins-invalid", "`plugins` need the `shell` job tool (the plugin drives lua-cli) \u2014 keep it in jobTools and mount rw", `${path30}.plugins`, id2);
       }
     }
     if (node.type === "agent" && ws && ws !== "inherit" && ws.mount === "ro" && Array.isArray(tools) && effectiveJobTools(tools, true).length === 0) {
-      warn("ro-step-has-no-tools", `"${id2}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path27}.jobTools`, id2);
+      warn("ro-step-has-no-tools", `"${id2}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path30}.jobTools`, id2);
     }
     if (ws && ws !== "inherit") {
       if (!envelopeWorkspace && !opts.mayInherit) {
-        err("workspace-not-declared", `"${id2}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path27}.workspace`, id2);
+        err("workspace-not-declared", `"${id2}" mounts a workspace but the workflow declares none \u2014 add workspace:{kind, \u2026} on createWorkflow`, `${path30}.workspace`, id2);
       }
       if (ws.isolation === "worktree" && envelopeWorkspace?.kind === "empty") {
-        err("worktree-requires-git-workspace", `"${id2}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path27}.workspace.isolation`, id2);
+        err("worktree-requires-git-workspace", `"${id2}": isolation:'worktree' needs a kind:'git' workspace (the envelope declares kind:'empty')`, `${path30}.workspace.isolation`, id2);
       }
     }
     if (node.type === "workflow" && ws === "inherit") {
       if (!envelopeWorkspace) {
-        err("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path27}.workspace`, id2);
+        err("workspace-inherit-without-parent-workspace", `"${id2}": workspace:'inherit' but the parent workflow declares no workspace \u2014 there is nothing to inherit`, `${path30}.workspace`, id2);
       }
       const child = opts.resolveWorkflow?.(node.workflowId);
       if (child?.workspace) {
-        err("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path27}.workspace`, id2);
+        err("workspace-inherit-conflict", `"${id2}": workspace:'inherit' on "${node.workflowId}", which declares its own workspace`, `${path30}.workspace`, id2);
       }
     }
   }, "checkWorkspace");
@@ -7866,165 +7897,165 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id2, m), `${basePath}.${m.member}`, id2);
     }
   }, "checkMapMembers");
-  const checkInputShape = /* @__PURE__ */ __name4((node, path27) => {
+  const checkInputShape = /* @__PURE__ */ __name4((node, path30) => {
     const input = node.input;
     if (input === void 0) return;
     const id2 = singleId(node);
     if (input !== null && typeof input === "object" && !Array.isArray(input)) {
-      checkMapMembers(input, `${path27}.input`, id2);
+      checkMapMembers(input, `${path30}.input`, id2);
       return;
     }
-    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path27}.input`, id2);
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path30}.input`, id2);
   }, "checkInputShape");
-  const checkBodyInput = /* @__PURE__ */ __name4((body, path27, container) => {
+  const checkBodyInput = /* @__PURE__ */ __name4((body, path30, container) => {
     if (body.type === "workflow" || body.input === void 0) return;
-    err("arm-input-unsupported", container === "foreach" ? `a foreach body receives each item as its input \u2014 drop \`input\` on "${singleId(body)}" and map the items before the foreach instead` : `a loop body receives the previous output as its input \u2014 drop \`input\` on "${singleId(body)}" and put the map before the loop instead`, `${path27}.input`, singleId(body));
+    err("arm-input-unsupported", container === "foreach" ? `a foreach body receives each item as its input \u2014 drop \`input\` on "${singleId(body)}" and map the items before the foreach instead` : `a loop body receives the previous output as its input \u2014 drop \`input\` on "${singleId(body)}" and put the map before the loop instead`, `${path30}.input`, singleId(body));
   }, "checkBodyInput");
-  const checkSingle = /* @__PURE__ */ __name4((node, path27, depth) => {
+  const checkSingle = /* @__PURE__ */ __name4((node, path30, depth) => {
     recordOutputSchema(node);
     if (node.type === "workflow" && (typeof node.workflowId !== "string" || node.workflowId.length === 0)) {
-      checkId(node.id, path27);
-      err("invalid-envelope", `\`workflowId\` must be a non-empty string naming the workflow to start (got ${JSON.stringify(node.workflowId)})`, `${path27}.workflowId`, node.id);
+      checkId(node.id, path30);
+      err("invalid-envelope", `\`workflowId\` must be a non-empty string naming the workflow to start (got ${JSON.stringify(node.workflowId)})`, `${path30}.workflowId`, node.id);
       return;
     }
     if (node.type === "workflow" && (node.workflowId.startsWith("$") || Array.isArray(node.graph))) {
-      checkId(node.id, path27);
-      err("node-type-unsupported-by-engine", armSubrunUnsupportedMessage(node.id, node.workflowId), path27, node.id);
+      checkId(node.id, path30);
+      err("node-type-unsupported-by-engine", armSubrunUnsupportedMessage(node.id, node.workflowId), path30, node.id);
       return;
     }
-    checkId(singleId(node), path27);
-    checkPolicyEnums(node, path27);
-    checkInputShape(node, path27);
-    checkTimeout(node, path27);
-    checkTier(node, path27);
-    checkModel(node, path27);
-    checkTaskClass(node, path27);
-    checkRetry(node, path27);
-    checkWorkspace(node, path27);
+    checkId(singleId(node), path30);
+    checkPolicyEnums(node, path30);
+    checkInputShape(node, path30);
+    checkTimeout(node, path30);
+    checkTier(node, path30);
+    checkModel(node, path30);
+    checkTaskClass(node, path30);
+    checkRetry(node, path30);
+    checkWorkspace(node, path30);
     if (!opts.static) {
-      if (node.type === "step") err("code-step-not-allowed", "code steps are static-only (03 \xA73.4.2)", path27, node.step.id);
+      if (node.type === "step") err("code-step-not-allowed", "code steps are static-only (03 \xA73.4.2)", path30, node.step.id);
       if (node.type === "agent" && node.systemPrompt !== void 0) {
-        err("persona-override-not-allowed", "`systemPrompt` is static-only (03 \xA73.4.2)", `${path27}.systemPrompt`, node.id);
+        err("persona-override-not-allowed", "`systemPrompt` is static-only (03 \xA73.4.2)", `${path30}.systemPrompt`, node.id);
       }
     }
     if (node.type === "agent" && node.role && node.systemPrompt !== void 0) {
-      err("ephemeral-persona-not-overridable", "a specialist role and systemPrompt cannot coexist", `${path27}.systemPrompt`, node.id);
+      err("ephemeral-persona-not-overridable", "a specialist role and systemPrompt cannot coexist", `${path30}.systemPrompt`, node.id);
     }
     if (node.type === "agent" && node.role && typeof node.role.instructions === "string" && node.role.instructions.length > 4e3) {
-      err("ephemeral-role-too-long", "role.instructions exceeds 4000 chars", `${path27}.role.instructions`, node.id);
+      err("ephemeral-role-too-long", "role.instructions exceeds 4000 chars", `${path30}.role.instructions`, node.id);
     }
     if (node.type === "agent" && node.role && (node.role.tools?.length ?? 0) > 64) {
-      err("cap-exceeded", "role.tools exceeds 64 entries", `${path27}.role.tools`, node.id);
+      err("cap-exceeded", "role.tools exceeds 64 entries", `${path30}.role.tools`, node.id);
     }
-    if (node.type === "agent" && node.role) checkSpecialistRole(node, path27);
-    checkRequiredConnections(node, path27);
+    if (node.type === "agent" && node.role) checkSpecialistRole(node, path30);
+    checkRequiredConnections(node, path30);
     if (node.type === "workflow" && node.kind === "subrun" && depth > caps.maxNestingDepth) {
-      err("cap-exceeded", `nesting depth ${depth} exceeds ${caps.maxNestingDepth}`, path27, node.id);
+      err("cap-exceeded", `nesting depth ${depth} exceeds ${caps.maxNestingDepth}`, path30, node.id);
     }
     if (node.type === "workflow" && typeof g.definition?.id === "string" && node.workflowId === g.definition.id) {
-      err("subrun-cycle", `"${node.id}" starts "${node.workflowId}", which is this workflow itself`, path27, node.id);
+      err("subrun-cycle", `"${node.id}" starts "${node.workflowId}", which is this workflow itself`, path30, node.id);
     }
     for (const ref of nodeStepRefs(node)) {
       if (!upstream.has(ref)) {
-        err("template-reference-unresolved", `"${singleId(node)}" references stepResults.${ref}, which is not upstream`, path27, singleId(node));
+        err("template-reference-unresolved", `"${singleId(node)}" references stepResults.${ref}, which is not upstream`, path30, singleId(node));
       }
     }
   }, "checkSingle");
-  const checkHitl = /* @__PURE__ */ __name4((node, path27) => {
+  const checkHitl = /* @__PURE__ */ __name4((node, path30) => {
     if (node.type === "waitForSignal") {
       const w = node;
-      checkId(w.id, path27);
-      if (typeof w.signal !== "string" || w.signal.length === 0) err("invalid-envelope", "waitForSignal.signal is required", `${path27}.signal`, w.id);
+      checkId(w.id, path30);
+      if (typeof w.signal !== "string" || w.signal.length === 0) err("invalid-envelope", "waitForSignal.signal is required", `${path30}.signal`, w.id);
       return;
     }
     const a = node;
-    checkId(a.id, path27);
+    checkId(a.id, path30);
     if ((a.approver ?? "creator") === "creator" && a.excludeInitiator === true) {
-      err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path27, a.id);
+      err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path30, a.id);
     }
     const editable = approvalEditable(a);
     if (a.fourEyes !== void 0 && !editable) {
-      err("four-eyes-requires-editable", "`fourEyes` requires editable:true", `${path27}.fourEyes`, a.id);
+      err("four-eyes-requires-editable", "`fourEyes` requires editable:true", `${path30}.fourEyes`, a.id);
     }
     if (a.editable === false && Array.isArray(a.editablePaths) && a.editablePaths.length > 0) {
-      err("editable-path-invalid", "`editablePaths` beside editable:false is contradictory \u2014 drop the paths or set editable:true", `${path27}.editablePaths`, a.id);
+      err("editable-path-invalid", "`editablePaths` beside editable:false is contradictory \u2014 drop the paths or set editable:true", `${path30}.editablePaths`, a.id);
     } else if ((a.editablePaths !== void 0 || a.editedPayloadSchema !== void 0) && !editable) {
-      err("editable-path-invalid", "`editablePaths` / `editedPayloadSchema` require editable:true (a non-empty editablePaths implies it)", `${path27}.editablePaths`, a.id);
+      err("editable-path-invalid", "`editablePaths` / `editedPayloadSchema` require editable:true (a non-empty editablePaths implies it)", `${path30}.editablePaths`, a.id);
     }
     for (const p of a.editablePaths ?? []) {
-      if (!EDITABLE_PATH_RE.test(p)) err("editable-path-invalid", `editablePaths entry "${p}" is outside the seg(.seg)*[*]/[n] grammar`, `${path27}.editablePaths`, a.id);
+      if (!EDITABLE_PATH_RE.test(p)) err("editable-path-invalid", `editablePaths entry "${p}" is outside the seg(.seg)*[*]/[n] grammar`, `${path30}.editablePaths`, a.id);
     }
     if (Array.isArray(a.onTimeout)) {
       const chain = a.onTimeout;
       const hops = chain.filter((h) => typeof h === "object" && h !== null && "escalateTo" in h);
-      if (hops.length > 3) err("escalation-chain-too-long", "an onTimeout chain carries at most 3 escalation hops", `${path27}.onTimeout`, a.id);
+      if (hops.length > 3) err("escalation-chain-too-long", "an onTimeout chain carries at most 3 escalation hops", `${path30}.onTimeout`, a.id);
       const last = chain[chain.length - 1];
       if (last === void 0 || typeof last === "object" && last !== null && "escalateTo" in last) {
-        err("escalation-chain-not-terminal", "an onTimeout chain must end in a terminal member", `${path27}.onTimeout`, a.id);
+        err("escalation-chain-not-terminal", "an onTimeout chain must end in a terminal member", `${path30}.onTimeout`, a.id);
       }
     }
     if (typeof a.details === "string") {
       for (const ref of templateStepRefs(a.details)) {
-        if (!upstream.has(ref)) err("template-reference-unresolved", `"${a.id}" references stepResults.${ref}, which is not upstream`, path27, a.id);
+        if (!upstream.has(ref)) err("template-reference-unresolved", `"${a.id}" references stepResults.${ref}, which is not upstream`, path30, a.id);
       }
     }
   }, "checkHitl");
-  const checkHitlArm = /* @__PURE__ */ __name4((node, path27, container) => {
+  const checkHitlArm = /* @__PURE__ */ __name4((node, path30, container) => {
     if (!workflowContainerRunsHitlArm(container)) {
-      checkId(node.id, path27);
-      err("node-type-unsupported-in-container", workflowHitlArmUnsupportedMessage(node.type, node.id, container), path27, node.id);
+      checkId(node.id, path30);
+      err("node-type-unsupported-in-container", workflowHitlArmUnsupportedMessage(node.type, node.id, container), path30, node.id);
       return;
     }
-    checkHitl(node, path27);
+    checkHitl(node, path30);
   }, "checkHitlArm");
-  const checkArm = /* @__PURE__ */ __name4((arm, path27, depth, container) => {
+  const checkArm = /* @__PURE__ */ __name4((arm, path30, depth, container) => {
     if (arm.type === "mapping") {
-      checkId(arm.id, path27);
-      checkMapMembers(readMapConfig(arm.mapConfig), `${path27}.mapConfig`, arm.id);
+      checkId(arm.id, path30);
+      checkMapMembers(readMapConfig(arm.mapConfig), `${path30}.mapConfig`, arm.id);
       for (const ref of nodeStepRefs(arm)) {
-        if (!upstream.has(ref)) err("template-reference-unresolved", `"${arm.id}" references stepResults.${ref}, which is not upstream`, path27, arm.id);
+        if (!upstream.has(ref)) err("template-reference-unresolved", `"${arm.id}" references stepResults.${ref}, which is not upstream`, path30, arm.id);
       }
       return;
     }
     if (isHitlNode(arm)) {
-      checkHitlArm(arm, path27, container);
+      checkHitlArm(arm, path30, container);
       return;
     }
-    checkSingle(arm, path27, depth);
+    checkSingle(arm, path30, depth);
   }, "checkArm");
   graph.forEach((entry, i) => {
-    const path27 = `graph.${i}`;
+    const path30 = `graph.${i}`;
     const declared = [];
     switch (entry.type) {
       case "step":
       case "agent":
       case "tool":
       case "workflow":
-        checkSingle(entry, path27, 1);
+        checkSingle(entry, path30, 1);
         declared.push(singleId(entry));
         break;
       case "mapping":
-        checkId(entry.id, path27);
-        checkMapMembers(readMapConfig(entry.mapConfig), `${path27}.mapConfig`, entry.id);
+        checkId(entry.id, path30);
+        checkMapMembers(readMapConfig(entry.mapConfig), `${path30}.mapConfig`, entry.id);
         for (const ref of nodeStepRefs(entry)) {
-          if (!upstream.has(ref)) err("template-reference-unresolved", `"${entry.id}" references stepResults.${ref}, which is not upstream`, path27, entry.id);
+          if (!upstream.has(ref)) err("template-reference-unresolved", `"${entry.id}" references stepResults.${ref}, which is not upstream`, path30, entry.id);
         }
         declared.push(entry.id);
         break;
       case "sleep":
-        checkId(entry.id, path27);
-        if (!Number.isFinite(entry.duration) || entry.duration < 0) err("invalid-envelope", "sleep.duration must be a non-negative number", `${path27}.duration`, entry.id);
+        checkId(entry.id, path30);
+        if (!Number.isFinite(entry.duration) || entry.duration < 0) err("invalid-envelope", "sleep.duration must be a non-negative number", `${path30}.duration`, entry.id);
         declared.push(entry.id);
         break;
       case "sleepUntil": {
         const s = entry;
-        checkId(s.id, path27);
-        err("node-type-unsupported-by-engine", sleepUntilUnsupportedMessage(s.id), path27, s.id);
+        checkId(s.id, path30);
+        err("node-type-unsupported-by-engine", sleepUntilUnsupportedMessage(s.id), path30, s.id);
         if (s.date === void 0 === (s.dateFrom === void 0)) {
-          err("invalid-envelope", "sleepUntil needs exactly one of `date` | `dateFrom`", path27, s.id);
+          err("invalid-envelope", "sleepUntil needs exactly one of `date` | `dateFrom`", path30, s.id);
         }
         if (s.dateFrom && !upstream.has(s.dateFrom.step)) {
-          err("sleep-until-source-missing", `sleepUntil "${s.id}" reads dateFrom.step "${s.dateFrom.step}", which is not upstream`, `${path27}.dateFrom`, s.id);
+          err("sleep-until-source-missing", `sleepUntil "${s.id}" reads dateFrom.step "${s.dateFrom.step}", which is not upstream`, `${path30}.dateFrom`, s.id);
         }
         declared.push(s.id);
         break;
@@ -8032,10 +8063,10 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       case "parallel": {
         const p = entry;
         if (p.steps.length < 2 || p.steps.length > caps.maxParallelArms) {
-          err("cap-exceeded", `parallel needs 2..${caps.maxParallelArms} arms (got ${p.steps.length})`, path27);
+          err("cap-exceeded", `parallel needs 2..${caps.maxParallelArms} arms (got ${p.steps.length})`, path30);
         }
         p.steps.forEach((arm, j) => {
-          const armPath = `${path27}.steps.${j}`;
+          const armPath = `${path30}.steps.${j}`;
           if (arm.type === "mapping") {
             err("mapping-placement", "a bare mapping cannot be a parallel arm \u2014 chain it as [map, step]", armPath);
             return;
@@ -8045,31 +8076,31 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         });
         const executableArms = p.steps.filter(isSingleStep);
         const worktreeArms = executableArms.filter((a) => a.workspace?.isolation === "worktree");
-        if (worktreeArms.length > 0 && !p.merge) err("worktree-arms-require-merge", "worktree arms need a `merge` policy", path27);
-        if (worktreeArms.length === 0 && p.merge) err("merge-requires-worktree-arms", "`merge` needs at least one worktree arm", path27);
-        if (worktreeArms.length > WORKFLOW_JOB_MAX_WORKTREE_ARMS) err("worktree-arms-exceed-cap", `at most ${WORKFLOW_JOB_MAX_WORKTREE_ARMS} worktree arms per parallel`, path27);
+        if (worktreeArms.length > 0 && !p.merge) err("worktree-arms-require-merge", "worktree arms need a `merge` policy", path30);
+        if (worktreeArms.length === 0 && p.merge) err("merge-requires-worktree-arms", "`merge` needs at least one worktree arm", path30);
+        if (worktreeArms.length > WORKFLOW_JOB_MAX_WORKTREE_ARMS) err("worktree-arms-exceed-cap", `at most ${WORKFLOW_JOB_MAX_WORKTREE_ARMS} worktree arms per parallel`, path30);
         const sharedArms = executableArms.filter((a) => {
           const w = workspaceOf(a);
           if (!w || w === "inherit" || w.isolation === "worktree") return false;
           return !(envelopeWorkspace?.backend === "efs" && w.mount === "ro");
         });
-        if (sharedArms.length > 1) err("workspace-parallel-requires-worktree", `${sharedArms.length} arms mount the shared workspace inside one parallel \u2014 give each arm isolation:'worktree' (+ merge) or run them sequentially`, `${path27}.steps`);
+        if (sharedArms.length > 1) err("workspace-parallel-requires-worktree", `${sharedArms.length} arms mount the shared workspace inside one parallel \u2014 give each arm isolation:'worktree' (+ merge) or run them sequentially`, `${path30}.steps`);
         break;
       }
       case "conditional": {
         const c = entry;
         if (!Array.isArray(c.predicates) || c.predicates.length !== c.steps.length) {
-          err("invalid-envelope", "conditional.predicates must match conditional.steps one-to-one", path27);
+          err("invalid-envelope", "conditional.predicates must match conditional.steps one-to-one", path30);
         }
         (c.predicates ?? []).forEach((p, j) => {
-          if (!isWellFormedPredicate(p)) err("closure-predicate", "a conditional predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path27}.predicates.${j}`);
+          if (!isWellFormedPredicate(p)) err("closure-predicate", "a conditional predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path30}.predicates.${j}`);
         });
         c.steps.forEach((arm, j) => {
-          checkArm(arm, `${path27}.steps.${j}`, 1, "conditional");
+          checkArm(arm, `${path30}.steps.${j}`, 1, "conditional");
           declared.push(armId(arm));
         });
         if (c.otherwise) {
-          checkArm(c.otherwise, `${path27}.otherwise`, 1, "conditional");
+          checkArm(c.otherwise, `${path30}.otherwise`, 1, "conditional");
           declared.push(armId(c.otherwise));
         }
         break;
@@ -8078,34 +8109,34 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         const f = entry;
         const o = f.opts ?? {};
         if (o.concurrency !== void 0 && (o.concurrency < 1 || o.concurrency > caps.maxForeachConcurrency)) {
-          err("cap-exceeded", `foreach.concurrency must be 1..${caps.maxForeachConcurrency}`, `${path27}.opts.concurrency`);
+          err("cap-exceeded", `foreach.concurrency must be 1..${caps.maxForeachConcurrency}`, `${path30}.opts.concurrency`);
         }
         if (o.maxItems !== void 0 && (o.maxItems < 1 || o.maxItems > caps.maxForeachItems)) {
-          err("cap-exceeded", `foreach.maxItems must be 1..${caps.maxForeachItems} (the platform ceiling of maxForeachItems)`, `${path27}.opts.maxItems`);
+          err("cap-exceeded", `foreach.maxItems must be 1..${caps.maxForeachItems} (the platform ceiling of maxForeachItems)`, `${path30}.opts.maxItems`);
         }
         {
           const itemsCap = o.maxItems ?? WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS;
           const literal = o.items;
           if (Array.isArray(literal) && literal.length > itemsCap) {
-            err("foreach-items-exceed-cap", `foreach({items}) carries ${literal.length} items \u2014 above maxItems ${itemsCap}`, `${path27}.opts.items`);
+            err("foreach-items-exceed-cap", `foreach({items}) carries ${literal.length} items \u2014 above maxItems ${itemsCap}`, `${path30}.opts.items`);
           }
         }
         if (o.chunk !== void 0) {
           const max = o.maxItems ?? WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS;
           const size = typeof o.chunk === "number" ? o.chunk : o.chunk.size;
           if (!Number.isInteger(size) || size < 1 || size > max) {
-            err("chunk-size-invalid", `foreach.chunk.size must be an integer in [1, ${max}]`, typeof o.chunk === "number" ? `${path27}.opts.chunk` : `${path27}.opts.chunk.size`);
+            err("chunk-size-invalid", `foreach.chunk.size must be an integer in [1, ${max}]`, typeof o.chunk === "number" ? `${path30}.opts.chunk` : `${path30}.opts.chunk.size`);
           }
         }
         if (o.rateLimit !== void 0) {
           const hasS = o.rateLimit.perSecond !== void 0;
           const hasM = o.rateLimit.perMinute !== void 0;
           if (hasS === hasM) {
-            err("rate-limit-invalid", "foreach.rateLimit needs exactly one of perSecond | perMinute", `${path27}.opts.rateLimit`);
+            err("rate-limit-invalid", "foreach.rateLimit needs exactly one of perSecond | perMinute", `${path30}.opts.rateLimit`);
           } else if (hasS && (o.rateLimit.perSecond <= 0 || o.rateLimit.perSecond > caps.maxForeachRatePerSecond)) {
-            err("rate-limit-invalid", `rateLimit.perSecond must be in (0, ${caps.maxForeachRatePerSecond}]`, `${path27}.opts.rateLimit.perSecond`);
+            err("rate-limit-invalid", `rateLimit.perSecond must be in (0, ${caps.maxForeachRatePerSecond}]`, `${path30}.opts.rateLimit.perSecond`);
           } else if (hasM && (o.rateLimit.perMinute <= 0 || o.rateLimit.perMinute > caps.maxForeachRatePerSecond * 60)) {
-            err("rate-limit-invalid", `rateLimit.perMinute must be in (0, ${caps.maxForeachRatePerSecond * 60}]`, `${path27}.opts.rateLimit.perMinute`);
+            err("rate-limit-invalid", `rateLimit.perMinute must be in (0, ${caps.maxForeachRatePerSecond * 60}]`, `${path30}.opts.rateLimit.perMinute`);
           }
         }
         const bodyType = f.step.type;
@@ -8120,18 +8151,18 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
             const src = outputSchemas.get(d.step);
             arrayLike = src === void 0 ? void 0 : schemaIsArray(schemaAtPath(src, d.path ?? ""));
           }
-          if (arrayLike === false) err("foreach-items-not-array", `foreach({items}) for "${singleId(f.step)}" binds a value that is not an array`, `${path27}.step`, singleId(f.step));
+          if (arrayLike === false) err("foreach-items-not-array", `foreach({items}) for "${singleId(f.step)}" binds a value that is not an array`, `${path30}.step`, singleId(f.step));
         }
-        if (bodyType === "mapping") err("container-arm-empty", "a foreach body needs a step, not a bare mapping", `${path27}.step`);
+        if (bodyType === "mapping") err("container-arm-empty", "a foreach body needs a step, not a bare mapping", `${path30}.step`);
         else if (isHitlNode(f.step)) {
           if (o.chunk !== void 0) {
-            checkId(f.step.id, `${path27}.step`);
-            err("node-type-unsupported-in-container", workflowHitlArmShapeMessage(f.step.type, f.step.id, "chunked-foreach"), `${path27}.step`, f.step.id);
-          } else checkHitlArm(f.step, `${path27}.step`, "foreach");
+            checkId(f.step.id, `${path30}.step`);
+            err("node-type-unsupported-in-container", workflowHitlArmShapeMessage(f.step.type, f.step.id, "chunked-foreach"), `${path30}.step`, f.step.id);
+          } else checkHitlArm(f.step, `${path30}.step`, "foreach");
           declared.push(f.step.id);
         } else {
-          checkBodyInput(f.step, `${path27}.step`, "foreach");
-          checkSingle(f.step, `${path27}.step`, o.chunk ? 2 : 1);
+          checkBodyInput(f.step, `${path30}.step`, "foreach");
+          checkSingle(f.step, `${path30}.step`, o.chunk ? 2 : 1);
           declared.push(singleId(f.step));
         }
         break;
@@ -8139,31 +8170,31 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       case "loop": {
         const l = entry;
         if (l.maxIterations !== void 0 && (!Number.isInteger(l.maxIterations) || l.maxIterations < 1)) {
-          err("invalid-envelope", "loop.maxIterations must be a positive integer", `${path27}.maxIterations`);
+          err("invalid-envelope", "loop.maxIterations must be a positive integer", `${path30}.maxIterations`);
         }
         if (l.intervalSeconds !== void 0 && (!Number.isInteger(l.intervalSeconds) || l.intervalSeconds < 1 || l.intervalSeconds > caps.maxLoopIntervalSeconds)) {
-          err("loop-interval-out-of-range", `loop.intervalSeconds must be an integer in 1..${caps.maxLoopIntervalSeconds}`, `${path27}.intervalSeconds`);
+          err("loop-interval-out-of-range", `loop.intervalSeconds must be an integer in 1..${caps.maxLoopIntervalSeconds}`, `${path30}.intervalSeconds`);
         }
-        if (!isWellFormedPredicate(l.predicate)) err("closure-predicate", "a loop predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path27}.predicate`);
+        if (!isWellFormedPredicate(l.predicate)) err("closure-predicate", "a loop predicate must be a well-formed LuaPredicate object ({op, left/right | value | path | args | arg}), not a function or an expression string", `${path30}.predicate`);
         const bodyType = l.step.type;
-        if (bodyType === "mapping") err("container-arm-empty", "a loop body needs a step, not a bare mapping", `${path27}.step`);
+        if (bodyType === "mapping") err("container-arm-empty", "a loop body needs a step, not a bare mapping", `${path30}.step`);
         else if (isHitlNode(l.step)) {
-          checkHitlArm(l.step, `${path27}.step`, "loop");
+          checkHitlArm(l.step, `${path30}.step`, "loop");
           declared.push(l.step.id);
         } else {
-          checkBodyInput(l.step, `${path27}.step`, "loop");
-          checkSingle(l.step, `${path27}.step`, 1);
+          checkBodyInput(l.step, `${path30}.step`, "loop");
+          checkSingle(l.step, `${path30}.step`, 1);
           declared.push(singleId(l.step));
         }
         break;
       }
       case "approval":
       case "waitForSignal":
-        checkHitl(entry, path27);
+        checkHitl(entry, path30);
         declared.push(entry.id);
         break;
       default:
-        err("invalid-envelope", `unknown entry type "${entry.type}"`, path27);
+        err("invalid-envelope", `unknown entry type "${entry.type}"`, path30);
     }
     for (const id2 of declared) upstream.add(id2);
   });
@@ -8412,11 +8443,11 @@ function compilePlan(g) {
 }
 function resolvePath(rawPath, ctx) {
   const templateMatch = PATH_PLACEHOLDER.exec(rawPath.trim());
-  const path27 = templateMatch ? templateMatch[1].trim() : rawPath.trim();
-  if (path27 === "") return MISSING;
-  const dot = path27.indexOf(".");
-  const scope = dot === -1 ? path27 : path27.slice(0, dot);
-  const rest = dot === -1 ? "" : path27.slice(dot + 1);
+  const path30 = templateMatch ? templateMatch[1].trim() : rawPath.trim();
+  if (path30 === "") return MISSING;
+  const dot = path30.indexOf(".");
+  const scope = dot === -1 ? path30 : path30.slice(0, dot);
+  const rest = dot === -1 ? "" : path30.slice(dot + 1);
   let root;
   switch (scope) {
     case "initData":
@@ -8450,9 +8481,9 @@ function resolvePath(rawPath, ctx) {
   }
   return walk(root, rest);
 }
-function walk(root, path27) {
-  if (path27 === "") return root;
-  const parts = path27.split(".");
+function walk(root, path30) {
+  if (path30 === "") return root;
+  const parts = path30.split(".");
   let value22 = root;
   for (const part of parts) {
     if (value22 === null || value22 === void 0) return MISSING;
@@ -8578,14 +8609,14 @@ function step(s) {
 function stepOf(id2) {
   return step(id2);
 }
-function init(path27) {
+function init(path30) {
   return {
-    path: path27 === "" ? "initData" : `initData.${path27}`
+    path: path30 === "" ? "initData" : `initData.${path30}`
   };
 }
-function state(path27) {
+function state(path30) {
   return {
-    path: path27 === "" ? "state" : `state.${path27}`
+    path: path30 === "" ? "state" : `state.${path30}`
   };
 }
 function lit(v) {
@@ -9515,7 +9546,7 @@ function timeZoneSupported(tz) {
     return false;
   }
 }
-function validateBusinessHours(cal, path27 = "businessHours") {
+function validateBusinessHours(cal, path30 = "businessHours") {
   const issues = [];
   const issue = /* @__PURE__ */ __name4((p, message) => issues.push({
     code: "business-hours-invalid",
@@ -9525,32 +9556,32 @@ function validateBusinessHours(cal, path27 = "businessHours") {
   if (typeof cal !== "object" || cal === null) return [
     {
       code: "business-hours-invalid",
-      path: path27,
+      path: path30,
       message: "not an object"
     }
   ];
   const c = cal;
-  if (!timeZoneSupported(c.tz)) issue(`${path27}.tz`, "unknown IANA time zone");
+  if (!timeZoneSupported(c.tz)) issue(`${path30}.tz`, "unknown IANA time zone");
   if (c.calendar === void 0 || c.calendar === "mon-fri") return issues;
   if (typeof c.calendar !== "object" || c.calendar === null) {
-    issue(`${path27}.calendar`, "expected 'mon-fri' or { days, start, end, holidays? }");
+    issue(`${path30}.calendar`, "expected 'mon-fri' or { days, start, end, holidays? }");
     return issues;
   }
   const k = c.calendar;
   if (!Array.isArray(k.days) || k.days.length === 0 || k.days.some((d) => !Number.isInteger(d) || d < 0 || d > 6)) {
-    issue(`${path27}.calendar.days`, "days must be a non-empty array of 0\u20136");
+    issue(`${path30}.calendar.days`, "days must be a non-empty array of 0\u20136");
   }
   const startOk = typeof k.start === "string" && HHMM.test(k.start);
   const endOk = typeof k.end === "string" && HHMM.test(k.end);
-  if (!startOk) issue(`${path27}.calendar.start`, "expected 'HH:MM'");
-  if (!endOk) issue(`${path27}.calendar.end`, "expected 'HH:MM'");
-  if (startOk && endOk && toMinutes(k.start) >= toMinutes(k.end)) issue(`${path27}.calendar`, "start must be before end");
+  if (!startOk) issue(`${path30}.calendar.start`, "expected 'HH:MM'");
+  if (!endOk) issue(`${path30}.calendar.end`, "expected 'HH:MM'");
+  if (startOk && endOk && toMinutes(k.start) >= toMinutes(k.end)) issue(`${path30}.calendar`, "start must be before end");
   if (k.holidays !== void 0) {
-    if (!Array.isArray(k.holidays)) issue(`${path27}.calendar.holidays`, "expected an array of YYYY-MM-DD");
+    if (!Array.isArray(k.holidays)) issue(`${path30}.calendar.holidays`, "expected an array of YYYY-MM-DD");
     else {
-      if (k.holidays.length > MAX_HOLIDAYS) issue(`${path27}.calendar.holidays`, `at most ${MAX_HOLIDAYS} holidays`);
+      if (k.holidays.length > MAX_HOLIDAYS) issue(`${path30}.calendar.holidays`, `at most ${MAX_HOLIDAYS} holidays`);
       k.holidays.forEach((h, i) => {
-        if (typeof h !== "string" || !YMD.test(h)) issue(`${path27}.calendar.holidays[${i}]`, "expected 'YYYY-MM-DD'");
+        if (typeof h !== "string" || !YMD.test(h)) issue(`${path30}.calendar.holidays[${i}]`, "expected 'YYYY-MM-DD'");
       });
     }
   }
@@ -9962,7 +9993,7 @@ function rebaseItemPointer(pointer, itemsPath, index) {
   const base = `/${itemsPath.split(".").map(escapePointer).join("/")}/${index}`;
   return pointer === "/" || pointer === "" ? base : `${base}${pointer}`;
 }
-function validateWorkflowSchedule(schedule, path27 = "/schedule") {
+function validateWorkflowSchedule(schedule, path30 = "/schedule") {
   if (schedule === void 0 || schedule === null) return [];
   const issue = /* @__PURE__ */ __name4((at, detail) => [
     {
@@ -9973,40 +10004,40 @@ function validateWorkflowSchedule(schedule, path27 = "/schedule") {
     }
   ], "issue");
   if (!isObject(schedule)) {
-    return issue(path27, `\`schedule\` is ${Array.isArray(schedule) ? "an array" : `a ${typeof schedule}`}, not a typed schedule object`);
+    return issue(path30, `\`schedule\` is ${Array.isArray(schedule) ? "an array" : `a ${typeof schedule}`}, not a typed schedule object`);
   }
   const type = schedule.type;
   if (type === void 0) {
     const keys = Object.keys(schedule);
     const seen = keys.length ? ` (got { ${keys.join(", ")} })` : " (got {})";
-    return issue(path27, `\`schedule\` carries no \`type\` discriminator${seen}`);
+    return issue(path30, `\`schedule\` carries no \`type\` discriminator${seen}`);
   }
   if (typeof type !== "string" || !WORKFLOW_SCHEDULE_TYPES.includes(type)) {
-    return issue(path27, `\`schedule.type\` ${JSON.stringify(type)} is not one of ${WORKFLOW_SCHEDULE_TYPES.map((t) => `'${t}'`).join(" | ")}`);
+    return issue(path30, `\`schedule.type\` ${JSON.stringify(type)} is not one of ${WORKFLOW_SCHEDULE_TYPES.map((t) => `'${t}'`).join(" | ")}`);
   }
   if (schedule.runAs !== void 0 && !WORKFLOW_SCHEDULE_RUN_AS.includes(schedule.runAs)) {
-    return issue(`${path27}/runAs`, `\`schedule.runAs\` ${JSON.stringify(schedule.runAs)} is not one of ${WORKFLOW_SCHEDULE_RUN_AS.map((v) => `'${v}'`).join(" | ")}`);
+    return issue(`${path30}/runAs`, `\`schedule.runAs\` ${JSON.stringify(schedule.runAs)} is not one of ${WORKFLOW_SCHEDULE_RUN_AS.map((v) => `'${v}'`).join(" | ")}`);
   }
   switch (type) {
     case "cron": {
       if (typeof schedule.expression !== "string" || schedule.expression.trim().length === 0) {
-        return issue(`${path27}/expression`, "a { type: 'cron' } schedule needs a non-empty string `expression`");
+        return issue(`${path30}/expression`, "a { type: 'cron' } schedule needs a non-empty string `expression`");
       }
       if (schedule.timezone !== void 0 && (typeof schedule.timezone !== "string" || schedule.timezone.length === 0)) {
-        return issue(`${path27}/timezone`, "a { type: 'cron' } schedule's `timezone`, when given, is a non-empty IANA string");
+        return issue(`${path30}/timezone`, "a { type: 'cron' } schedule's `timezone`, when given, is a non-empty IANA string");
       }
       return [];
     }
     case "interval": {
       const s = schedule.seconds;
       if (typeof s !== "number" || !Number.isFinite(s) || s <= 0) {
-        return issue(`${path27}/seconds`, "a { type: 'interval' } schedule needs a positive number `seconds`");
+        return issue(`${path30}/seconds`, "a { type: 'interval' } schedule needs a positive number `seconds`");
       }
       return [];
     }
     case "once": {
       if (typeof schedule.executeAt !== "string" || Number.isNaN(Date.parse(schedule.executeAt))) {
-        return issue(`${path27}/executeAt`, "a { type: 'once' } schedule needs an ISO-8601 string `executeAt`");
+        return issue(`${path30}/executeAt`, "a { type: 'once' } schedule needs an ISO-8601 string `executeAt`");
       }
       return [];
     }
@@ -10449,15 +10480,15 @@ var init_dist2 = __esm({
     __name4(resolveDescriptor, "resolveDescriptor");
     __name(resolveMapping, "resolveMapping");
     __name4(resolveMapping, "resolveMapping");
-    fromInit = /* @__PURE__ */ __name4((path27) => ({
+    fromInit = /* @__PURE__ */ __name4((path30) => ({
       initData: true,
-      path: path27
+      path: path30
     }), "fromInit");
-    fromStep = /* @__PURE__ */ __name4((s, path27 = "") => {
+    fromStep = /* @__PURE__ */ __name4((s, path30 = "") => {
       const idOf = /* @__PURE__ */ __name4((x) => typeof x === "string" ? x : x.id, "idOf");
       return {
         step: Array.isArray(s) ? s.map(idOf) : idOf(s),
-        path: path27
+        path: path30
       };
     }, "fromStep");
     value = /* @__PURE__ */ __name4((v) => ({
@@ -10466,12 +10497,12 @@ var init_dist2 = __esm({
     template = /* @__PURE__ */ __name4((s) => ({
       template: s
     }), "template");
-    fromRequest = /* @__PURE__ */ __name4((path27) => ({
-      requestContextPath: path27
+    fromRequest = /* @__PURE__ */ __name4((path30) => ({
+      requestContextPath: path30
     }), "fromRequest");
-    rows = /* @__PURE__ */ __name4((s, path27, page) => ({
+    rows = /* @__PURE__ */ __name4((s, path30, page) => ({
       step: typeof s === "string" ? s : s.id,
-      path: path27,
+      path: path30,
       rows: page
     }), "rows");
     fromKnowledge = /* @__PURE__ */ __name4((k) => ({
@@ -11474,13 +11505,13 @@ var init_workflow = __esm({
       }
       if ("step" in items && Array.isArray(items.step)) throw foreachItemsNotLowered("a fan-in fromStep([\u2026])");
       if (typeof items.path !== "string") throw foreachItemsNotLowered("value(\u2026) / template(\u2026) / fromRequest(\u2026) / fromKnowledge(\u2026)");
-      const path27 = items.path;
-      if (path27.startsWith("initData")) return {
+      const path30 = items.path;
+      if (path30.startsWith("initData")) return {
         initData: true,
-        path: path27 === "initData" ? "" : path27.slice("initData.".length)
+        path: path30 === "initData" ? "" : path30.slice("initData.".length)
       };
-      if (path27.startsWith("stepResults.")) {
-        const rest = path27.slice("stepResults.".length);
+      if (path30.startsWith("stepResults.")) {
+        const rest = path30.slice("stepResults.".length);
         const dot = rest.indexOf(".");
         return dot === -1 ? {
           step: rest,
@@ -11490,7 +11521,7 @@ var init_workflow = __esm({
           path: rest.slice(dot + 1)
         };
       }
-      throw new LuaWorkflowBuildError("invalid-envelope", `foreach.items ref "${path27}" must point at initData.* or stepResults.*`);
+      throw new LuaWorkflowBuildError("invalid-envelope", `foreach.items ref "${path30}" must point at initData.* or stepResults.*`);
     }, "refToDescriptor");
     __workflowCommitHook = {};
     LuaWorkflow = class {
@@ -12980,8 +13011,8 @@ function buildSourceArchive(files) {
     map[entryFile] = source;
   }
   if (Object.keys(map).length === 0) return null;
-  const json = JSON.stringify(map);
-  const gz = zlib.gzipSync(Buffer.from(json, "utf-8"));
+  const json2 = JSON.stringify(map);
+  const gz = zlib.gzipSync(Buffer.from(json2, "utf-8"));
   return gz.toString("base64");
 }
 function getPrimitivesByKind(manifest, kind) {
@@ -13450,12 +13481,12 @@ var init_dist3 = __esm({
         this.options = options;
         this.fetchFn = options.fetch ?? fetch;
       }
-      url(path27) {
+      url(path30) {
         const base = this.options.baseUrl.replace(/\/$/, "");
-        return `${base}/developer/agents/${encodeURIComponent(this.options.agentId)}${path27}`;
+        return `${base}/developer/agents/${encodeURIComponent(this.options.agentId)}${path30}`;
       }
-      async json(method, path27, body) {
-        const endpoint = this.url(path27);
+      async json(method, path30, body) {
+        const endpoint = this.url(path30);
         const res = await this.fetchFn(endpoint, {
           method,
           headers: {
@@ -13474,7 +13505,7 @@ var init_dist3 = __esm({
           } catch {
             text2 = void 0;
           }
-          throw new BackupHttpError(`Backup request failed: ${method} ${path27} \u2192 ${res.status} ${res.statusText}`, res.status, endpoint, text2);
+          throw new BackupHttpError(`Backup request failed: ${method} ${path30} \u2192 ${res.status} ${res.statusText}`, res.status, endpoint, text2);
         }
         const text = await res.text();
         if (!text) return void 0;
@@ -13621,12 +13652,12 @@ var init_backup_api_service = __esm({
       * @returns Promise resolving to missing/existing hash lists
       */
       async checkBlobsExist(hashes) {
-        const path27 = `/developer/agents/${this.agentId}/backup/check-blobs`;
+        const path30 = `/developer/agents/${this.agentId}/backup/check-blobs`;
         if (hashes.length <= CHECK_BLOBS_MAX_HASHES) {
           const data = {
             hashes
           };
-          return this.httpPost(path27, data, {});
+          return this.httpPost(path30, data, {});
         }
         const merged = {
           missing: [],
@@ -13638,7 +13669,7 @@ var init_backup_api_service = __esm({
           const data = {
             hashes: hashes.slice(i, i + CHECK_BLOBS_MAX_HASHES)
           };
-          const part = await this.httpPost(path27, data, {});
+          const part = await this.httpPost(path30, data, {});
           if (!part.success || !part.data) return part;
           merged.missing.push(...part.data.missing);
           merged.existing.push(...part.data.existing);
@@ -14704,7 +14735,8 @@ var init_skill_handler = __esm({
         }
         return {
           name: skill.name,
-          description: skill.description,
+          // Same fallback as createOnServer — the server's version row requires a description.
+          description: skill.description || `A Lua skill for ${skill.name}`,
           // Same gate as createOnServer — server validator rejects empty content.
           ...hasPersonaTextContent(skill.context) ? {
             context: skill.context
@@ -15236,14 +15268,14 @@ async function withErrorHandling(commandFn, commandName, opts) {
       } catch {
       }
     }
-    let json = false;
+    let json2 = false;
     try {
-      json = typeof opts?.json === "function" ? !!opts.json() : !!opts?.json;
+      json2 = typeof opts?.json === "function" ? !!opts.json() : !!opts?.json;
     } catch {
     }
     const reported = reportCliError(error, {
       extraHint,
-      json
+      json: json2
     });
     process.exitCode = reported.exitCode;
     await showUpdateWarningIfNeeded(versionCheckPromise);
@@ -20709,8 +20741,8 @@ var init_voice_plugin = __esm({
             }, "isMissingTopLevelRequired");
             for (const issue of parsed.error.issues) {
               if (isMissingTopLevelRequired(issue)) continue;
-              const path27 = issue.path.length > 0 ? issue.path.join(".") : "<root>";
-              errors.push(validationError(`Voice config invalid at \`${path27}\`: ${issue.message}`, {
+              const path30 = issue.path.length > 0 ? issue.path.join(".") : "<root>";
+              errors.push(validationError(`Voice config invalid at \`${path30}\`: ${issue.message}`, {
                 line
               }));
             }
@@ -22527,7 +22559,7 @@ function parseWorkflowScript(script, fileName) {
       status: "deferred"
     });
   }, "collectRole");
-  const walk3 = /* @__PURE__ */ __name((node) => {
+  const walk4 = /* @__PURE__ */ __name((node) => {
     if (node === metaStatement) return;
     if (ts4.isIdentifier(node)) {
       const parent = node.parent;
@@ -22593,15 +22625,15 @@ function parseWorkflowScript(script, fileName) {
               issues.push(errorAt(sf, file, t, "SCRIPT_META_INVALID", `step() timeoutSeconds must be a literal 1..${WORKFLOW_SCRIPT_STEP_MAX_TIMEOUT_SECONDS}`, "step-timeout-invalid"));
             }
           }
-          if (label2) walk3(label2);
-          if (stepOpts) walk3(stepOpts);
+          if (label2) walk4(label2);
+          if (stepOpts) walk4(stepOpts);
           return;
         }
       }
     }
-    ts4.forEachChild(node, walk3);
+    ts4.forEachChild(node, walk4);
   }, "walk");
-  for (const st of sf.statements) walk3(st);
+  for (const st of sf.statements) walk4(st);
   return {
     meta,
     issues,
@@ -24265,7 +24297,7 @@ function findConfig(sourceFile, exportName) {
   }
   return argOf(sourceFile.getVariableDeclaration(exportName)?.getInitializer());
 }
-var WEB_APP_NAME_PATTERN, ROUTE_KEY_PATTERN, MAX_ROUTES, SCHEMA_PARTS, LUA_CLI_SPECIFIERS, INJECTED_HELPERS, schemaKey, WebAppPlugin;
+var ROUTE_KEY_PATTERN, SCHEMA_PARTS, LUA_CLI_SPECIFIERS, INJECTED_HELPERS, schemaKey, WebAppPlugin;
 var init_web_app_plugin = __esm({
   "src/compiler/plugins/web-app.plugin.ts"() {
     "use strict";
@@ -24273,9 +24305,7 @@ var init_web_app_plugin = __esm({
     init_base();
     init_ast_helpers();
     init_schema_converter();
-    WEB_APP_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
     ROUTE_KEY_PATTERN = new RegExp(`^(${WEB_ROUTE_METHODS.join("|")}) (/\\S*)$`);
-    MAX_ROUTES = 200;
     SCHEMA_PARTS = [
       "params",
       "query",
@@ -24388,8 +24418,8 @@ var init_web_app_plugin = __esm({
             errors.push(validationError(`Web app route key ${JSON.stringify(r.key)} must look like 'GET /path' (${WEB_ROUTE_METHODS.join(", ")})`, at));
           }
         }
-        if (meta.routes.length > MAX_ROUTES) {
-          errors.push(validationError(`Web app declares ${meta.routes.length} routes; the limit is ${MAX_ROUTES}`, at));
+        if (meta.routes.length > WEB_APP_MAX_ROUTES) {
+          errors.push(validationError(`Web app declares ${meta.routes.length} routes; the limit is ${WEB_APP_MAX_ROUTES}`, at));
         }
         if (meta.routes.length === 0 && !meta.hasFetch && meta.unreadableRoutes.length === 0) {
           errors.push(validationError("Web app must declare at least one route or a `fetch` handler", at));
@@ -25390,9 +25420,9 @@ function packageJsonHasWorkspaces(pkgPath) {
   if (!fileExists(pkgPath)) return false;
   try {
     const raw = fs9.readFileSync(pkgPath, "utf-8");
-    const json = JSON.parse(raw);
-    if (!json.workspaces) return false;
-    return Array.isArray(json.workspaces) || typeof json.workspaces === "object";
+    const json2 = JSON.parse(raw);
+    if (!json2.workspaces) return false;
+    return Array.isArray(json2.workspaces) || typeof json2.workspaces === "object";
   } catch {
     return false;
   }
@@ -29023,8 +29053,8 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse containing the profile, or null if not found
       */
       async getUserProfileByEmail(email, agentId) {
-        const path27 = `/developer/user/profile/email/${encodeURIComponent(email)}`;
-        const scopedPath = agentId ? `${path27}?agentId=${encodeURIComponent(agentId)}` : path27;
+        const path30 = `/developer/user/profile/email/${encodeURIComponent(email)}`;
+        const scopedPath = agentId ? `${path30}?agentId=${encodeURIComponent(agentId)}` : path30;
         return this.httpGet(scopedPath, {});
       }
       /**
@@ -29034,8 +29064,8 @@ var init_developer_api_service = __esm({
       */
       async getUserProfileByPhone(phone, agentId) {
         const normalizedPhone = phone.replace(/^\+/, "");
-        const path27 = `/developer/user/profile/phone/${normalizedPhone}`;
-        const scopedPath = agentId ? `${path27}?agentId=${encodeURIComponent(agentId)}` : path27;
+        const path30 = `/developer/user/profile/phone/${normalizedPhone}`;
+        const scopedPath = agentId ? `${path30}?agentId=${encodeURIComponent(agentId)}` : path30;
         return this.httpGet(scopedPath, {});
       }
     };
@@ -31753,6 +31783,29 @@ var AgentApi = class extends HttpClient {
   async createSlackChannel(agentId, channelData) {
     return this.httpPost(`/admin/agents/${agentId}/channels`, channelData, {});
   }
+  /** The Slack manifest for this agent: a new app's create link, or with `channelId` the update for that app. */
+  async getSlackManifest(agentId, channelId) {
+    const query = channelId ? `?channelId=${encodeURIComponent(channelId)}` : "";
+    return this.httpGet(`/admin/agents/${agentId}/channels/slack/manifest${query}`, {});
+  }
+  /** A signed install link for a public Slack connection; the installer lands on Lua's result page. */
+  async getSlackInstallUrl(agentId, channelId) {
+    return this.httpPost(`/admin/agents/${agentId}/channels/${channelId}/slack/install-url`, {
+      origin: "cli"
+    }, {});
+  }
+  /** Asks Slack what the connection's token may do now; a dead token marks it uninstalled. */
+  async checkSlackConnection(agentId, channelId) {
+    return this.httpPost(`/admin/agents/${agentId}/channels/${channelId}/slack/check`, {}, {});
+  }
+  /** Saves the app's signing secret on every connection of this agent to the app. */
+  async saveSlackSigningSecret(agentId, channelIdentifier, signingSecret) {
+    return this.httpPut(`/admin/agents/${agentId}/channels/${encodeURIComponent(channelIdentifier)}`, {
+      slack: {
+        signingSecret
+      }
+    }, {});
+  }
   /**
   * Creates a new Email channel for a specific agent
   * @param agentId - The unique identifier of the agent
@@ -34666,7 +34719,7 @@ __name(apiKeyCommand, "apiKeyCommand");
 init_cli();
 init_files();
 init_request_credential();
-import path23 from "path";
+import path25 from "path";
 
 // src/commands/sync.ts
 init_dist();
@@ -36749,8 +36802,8 @@ function buildSupervisionAgentsApi(call) {
     }), "persona"),
     source: /* @__PURE__ */ __name7((agentId) => ({
       list: /* @__PURE__ */ __name7(() => call("source.list", agentId), "list"),
-      get: /* @__PURE__ */ __name7((path27) => call("source.get", agentId, {
-        path: path27
+      get: /* @__PURE__ */ __name7((path30) => call("source.get", agentId, {
+        path: path30
       }), "get")
     }), "source"),
     /** Environment variable NAMES only — values are never returned. */
@@ -36762,6 +36815,211 @@ function buildSupervisionAgentsApi(call) {
 __name(buildSupervisionAgentsApi, "buildSupervisionAgentsApi");
 __name7(buildSupervisionAgentsApi, "buildSupervisionAgentsApi");
 
+// ../sandbox-runtime/dist/web-route-wrapper.mjs
+init_dist();
+var __defProp8 = Object.defineProperty;
+var __name8 = /* @__PURE__ */ __name((target, value3) => __defProp8(target, "name", { value: value3, configurable: true }), "__name");
+var WEB_ROUTE_WRAPPER_FUNCTION_SOURCE = `async function (input, primitive, logTiming, console) {
+  const RESPONSE_HEADER_ALLOWLIST = ${JSON.stringify(WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST)};
+  const MAX_RESPONSE_BYTES = ${WEB_ROUTE_MAX_RESPONSE_BYTES};
+  const startTime = Date.now();
+  const timing = typeof logTiming === 'function' ? logTiming : async () => {};
+  const req = input.request;
+
+  // Buffer and URLSearchParams are sandbox contract globals (shared-sandbox contract.ts).
+  const encodeBase64 = (bytes) => Buffer.from(bytes).toString('base64');
+  const decodeBase64 = (text) => new Uint8Array(Buffer.from(text, 'base64'));
+  const jsonResult = (status, value) => ({ status, headers: { 'content-type': 'application/json' }, body: { kind: 'json', value } });
+
+  const bodyValue = req.body ? req.body.value : undefined;
+  const rawBodyForRequest = () => {
+    if (!req.body || req.method === 'GET') return undefined;
+    if (req.body.kind === 'json') return JSON.stringify(req.body.value);
+    if (req.body.kind === 'text') return req.body.value;
+    return decodeBase64(req.body.value);
+  };
+
+  // Built on first use: typed handlers get the parsed body and rarely read ctx.request,
+  // so the body is not re-serialized (or base64-decoded) for them.
+  let webRequest;
+  const getRequest = () => {
+    if (webRequest === undefined && typeof Request === 'function' && typeof URL === 'function') {
+      const url = new URL(req.path, input.app.origin);
+      for (const key of Object.keys(req.query || {})) {
+        const v = req.query[key];
+        for (const one of Array.isArray(v) ? v : [v]) url.searchParams.append(key, String(one));
+      }
+      webRequest = new Request(url, { method: req.method, headers: req.headers || {}, body: rawBodyForRequest() });
+    }
+    return webRequest;
+  };
+
+  // The contract's response cap, enforced here so an oversized body is refused before it
+  // is materialized (and base64-inflated) in the sandbox; the gateway re-checks the bytes.
+  const tooLarge = () => jsonResult(500, { code: 'RESPONSE_TOO_LARGE', message: 'Response exceeds ' + MAX_RESPONSE_BYTES + ' bytes' });
+
+  // Reads a Response body up to the cap: a stream is cancelled as soon as it passes it.
+  const readCapped = async (response) => {
+    if (response.body && typeof response.body.getReader === 'function') {
+      const reader = response.body.getReader();
+      const chunks = [];
+      let total = 0;
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        total += value.byteLength;
+        if (total > MAX_RESPONSE_BYTES) {
+          try { await reader.cancel(); } catch (e) {}
+          return null;
+        }
+        chunks.push(value);
+      }
+      const out = new Uint8Array(total);
+      let offset = 0;
+      for (const c of chunks) { out.set(c, offset); offset += c.byteLength; }
+      return out;
+    }
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    return bytes.length > MAX_RESPONSE_BYTES ? null : bytes;
+  };
+
+  // type/subtype without parameters, lower-cased.
+  const mediaTypeOf = (contentType) => String(contentType || '').split(';')[0].trim().toLowerCase();
+  const isJsonType = (t) => t === 'application/json' || t.endsWith('+json');
+  const isTextType = (t) =>
+    t.startsWith('text/') || t.endsWith('+xml') || t === 'application/xml' || t === 'application/javascript' || t === 'application/ecmascript';
+
+  const normalize = async (result) => {
+    if (result === undefined || result === null) return { status: 204, headers: {} };
+    const looksLikeResponse =
+      typeof result === 'object' && typeof result.status === 'number' && result.headers && typeof result.headers.get === 'function' && typeof result.arrayBuffer === 'function';
+    if (!looksLikeResponse) {
+      // UTF-16 length never exceeds the UTF-8 byte length, so this under-counts at worst;
+      // the gateway applies the exact byte cap.
+      const serialized = JSON.stringify(result);
+      if (serialized !== undefined && serialized.length > MAX_RESPONSE_BYTES) return tooLarge();
+      return jsonResult(200, result);
+    }
+    const headers = {};
+    result.headers.forEach((value, name) => {
+      const n = String(name).toLowerCase();
+      if (n === 'set-cookie') return;
+      if (RESPONSE_HEADER_ALLOWLIST.includes(n) || n.startsWith('x-lua-')) headers[n] = value;
+    });
+    const out = { status: result.status, headers };
+    if (result.status === 204 || result.status === 304) return out;
+    const mediaType = mediaTypeOf(headers['content-type']);
+    const bytes = await readCapped(result);
+    if (bytes === null) return tooLarge();
+    if (bytes.length === 0) return out;
+    if (isJsonType(mediaType)) {
+      const text = new TextDecoder().decode(bytes);
+      try { out.body = { kind: 'json', value: JSON.parse(text) }; } catch (e) { out.body = { kind: 'text', value: text }; }
+      return out;
+    }
+    if (isTextType(mediaType)) {
+      out.body = { kind: 'text', value: new TextDecoder().decode(bytes) };
+      return out;
+    }
+    out.body = { kind: 'base64', value: encodeBase64(bytes) };
+    return out;
+  };
+
+  const validationFailure = (part, issues) => jsonResult(400, { code: 'VALIDATION', message: 'Invalid ' + part, issues });
+
+  await timing('start', 'Web route started');
+  try {
+    const def = req.route && primitive.routes && typeof primitive.routes === 'object' ? primitive.routes[req.route] : undefined;
+    const handler = typeof def === 'function' ? def : def && typeof def.handler === 'function' ? def.handler : undefined;
+    let result;
+    if (!handler) {
+      const request = typeof primitive.fetch === 'function' ? getRequest() : undefined;
+      if (request) {
+        result = await normalize(await primitive.fetch(request));
+      } else {
+        result = jsonResult(404, { code: 'NOT_FOUND', message: 'No route handler for ' + (req.route || req.method + ' ' + req.path) });
+      }
+    } else {
+      const parsed = { params: req.params || {}, query: req.query || {}, body: bodyValue };
+      const schemas = typeof def === 'object' && def ? def : {};
+      for (const part of ['params', 'query', 'body']) {
+        const schema = schemas[part];
+        if (schema && typeof schema.safeParse === 'function') {
+          const r = schema.safeParse(parsed[part]);
+          if (!r.success) {
+            const issues = r.error && Array.isArray(r.error.issues) ? r.error.issues : r.error;
+            result = validationFailure(part, issues);
+            break;
+          }
+          parsed[part] = r.data;
+        }
+      }
+      if (!result) {
+        const ctx = {
+          params: parsed.params,
+          query: parsed.query,
+          body: parsed.body,
+          headers: req.headers || {},
+          method: req.method,
+          path: req.path,
+          route: req.route,
+          auth: input.auth,
+          app: input.app,
+          get request() {
+            return getRequest();
+          },
+        };
+        result = await normalize(await handler(ctx));
+      }
+    }
+    const duration = Date.now() - startTime;
+    timing('complete', 'Web route completed', duration).catch((err) => console.error('Error logging timing', err));
+    console.log('Web route', req.route || req.method + ' ' + req.path, 'answered', result.status, 'in', duration, 'ms');
+    return result;
+  } catch (error) {
+    const duration = Date.now() - startTime;
+    timing('error', 'Web route failed', duration, error).catch((err) => console.error('Error logging timing', err));
+    console.error('Web route failed after', duration, 'ms:', error);
+    throw error;
+  }
+}`;
+function buildWebRouteWrapper(decompressedCode, input) {
+  const code = `
+// Run the bundled module
+${decompressedCode}
+
+// Extract primitive from module exports
+const __exports = module.exports.default || module.exports;
+const __primitive = __exports?.primitive;
+
+if (
+  !__primitive ||
+  (typeof __primitive.fetch !== 'function' && (!__primitive.routes || typeof __primitive.routes !== 'object'))
+) {
+  const __platformErr = new Error('[Lua] Invalid web-app artifact: missing primitive.routes or primitive.fetch');
+  __platformErr.code = 'PLATFORM_VM_ERROR';
+  throw __platformErr;
+}
+
+// Wrapper function
+const wrapperFunction = ${WEB_ROUTE_WRAPPER_FUNCTION_SOURCE};
+
+// Execute immediately and return result
+(async () => {
+  return await wrapperFunction(${JSON.stringify(input)}, __primitive, typeof logTiming === 'function' ? logTiming : undefined, console);
+})();
+`;
+  return {
+    code,
+    contextName: "WebRouteExecutionContext",
+    contextOrigin: "web-route-execution",
+    source: "web-route",
+    timeoutMs: WEB_ROUTE_MAX_WALL_MS
+  };
+}
+__name(buildWebRouteWrapper, "buildWebRouteWrapper");
+__name8(buildWebRouteWrapper, "buildWebRouteWrapper");
+
 // src/utils/sandbox.ts
 init_dist4();
 import vm4 from "vm";
@@ -36882,8 +37140,8 @@ import path20 from "path";
 import { spawn as nodeSpawn } from "child_process";
 import { accessSync, constants as fsConstants, realpathSync, statSync as statSync5 } from "fs";
 import path19 from "path";
-var __defProp8 = Object.defineProperty;
-var __name8 = /* @__PURE__ */ __name((target, value3) => __defProp8(target, "name", { value: value3, configurable: true }), "__name");
+var __defProp9 = Object.defineProperty;
+var __name9 = /* @__PURE__ */ __name((target, value3) => __defProp9(target, "name", { value: value3, configurable: true }), "__name");
 var WORKFLOW_EXEC_BINARIES = Object.freeze([
   "git",
   "gh",
@@ -36910,7 +37168,7 @@ var WorkflowExecError = class extends Error {
     __name(this, "WorkflowExecError");
   }
   static {
-    __name8(this, "WorkflowExecError");
+    __name9(this, "WorkflowExecError");
   }
   code;
   reason;
@@ -36944,7 +37202,7 @@ function isWorkflowExecError(err) {
   return !!e && typeof e === "object" && e.name === "ExecError" && typeof e.code === "string";
 }
 __name(isWorkflowExecError, "isWorkflowExecError");
-__name8(isWorkflowExecError, "isWorkflowExecError");
+__name9(isWorkflowExecError, "isWorkflowExecError");
 function workflowExecRefusal(reason, detail, argv) {
   return new WorkflowExecError("EXEC_REFUSED", `[Lua] exec refused: ${detail} (EXEC_REFUSED/${reason})`, {
     reason,
@@ -36954,7 +37212,7 @@ function workflowExecRefusal(reason, detail, argv) {
   });
 }
 __name(workflowExecRefusal, "workflowExecRefusal");
-__name8(workflowExecRefusal, "workflowExecRefusal");
+__name9(workflowExecRefusal, "workflowExecRefusal");
 var refused = workflowExecRefusal;
 var ALLOWLIST_TEXT = WORKFLOW_EXEC_BINARIES.join(", ");
 function parseCommandTemplate(template3, values) {
@@ -36965,13 +37223,13 @@ function parseCommandTemplate(template3, values) {
   const argv = [];
   let current = null;
   let quote = null;
-  const flush = /* @__PURE__ */ __name8(() => {
+  const flush = /* @__PURE__ */ __name9(() => {
     if (current !== null) {
       argv.push(current);
       current = null;
     }
   }, "flush");
-  const scalar = /* @__PURE__ */ __name8((v, at) => {
+  const scalar = /* @__PURE__ */ __name9((v, at) => {
     if (typeof v === "string") return v;
     if (typeof v === "number" && Number.isFinite(v)) return String(v);
     if (typeof v === "boolean") return String(v);
@@ -37032,7 +37290,7 @@ function parseCommandTemplate(template3, values) {
   return argv;
 }
 __name(parseCommandTemplate, "parseCommandTemplate");
-__name8(parseCommandTemplate, "parseCommandTemplate");
+__name9(parseCommandTemplate, "parseCommandTemplate");
 function validateWorkflowExecArgv(argv) {
   if (!Array.isArray(argv)) throw refused("argv_invalid", 'argv must be an array of strings \u2014 exec(["git", "status"])');
   if (argv.length === 0) throw refused("argv_empty", "the command is empty");
@@ -37054,7 +37312,7 @@ function validateWorkflowExecArgv(argv) {
   ];
 }
 __name(validateWorkflowExecArgv, "validateWorkflowExecArgv");
-__name8(validateWorkflowExecArgv, "validateWorkflowExecArgv");
+__name9(validateWorkflowExecArgv, "validateWorkflowExecArgv");
 function resolveWorkflowExecBinary(name, pathDirs) {
   if (typeof name !== "string" || name.length === 0) throw refused("argv_invalid", "argv[0] must name a binary");
   if (name.includes("/") || name.includes("\\") || name.startsWith(".")) {
@@ -37083,12 +37341,12 @@ function resolveWorkflowExecBinary(name, pathDirs) {
   ]);
 }
 __name(resolveWorkflowExecBinary, "resolveWorkflowExecBinary");
-__name8(resolveWorkflowExecBinary, "resolveWorkflowExecBinary");
+__name9(resolveWorkflowExecBinary, "resolveWorkflowExecBinary");
 function within(root, p) {
   return p === root || p.startsWith(root.endsWith(path19.sep) ? root : root + path19.sep);
 }
 __name(within, "within");
-__name8(within, "within");
+__name9(within, "within");
 function confineWorkflowExecCwd(root, cwd) {
   if (typeof root !== "string" || root.length === 0) throw refused("workspace_unavailable", "the step has no workspace");
   let rootReal;
@@ -37122,7 +37380,7 @@ function confineWorkflowExecCwd(root, cwd) {
   return abs;
 }
 __name(confineWorkflowExecCwd, "confineWorkflowExecCwd");
-__name8(confineWorkflowExecCwd, "confineWorkflowExecCwd");
+__name9(confineWorkflowExecCwd, "confineWorkflowExecCwd");
 var RESERVED_ENV_KEY = /^(LUA_|LD_|DYLD_|GIT_|GH_|GITHUB_)|^(PATH|HOME|NODE_OPTIONS|BASH_ENV|ENV|TZ)$|_PROXY$/i;
 function checkWorkflowExecEnv(env) {
   if (env === void 0) return {};
@@ -37140,7 +37398,7 @@ function checkWorkflowExecEnv(env) {
   return out;
 }
 __name(checkWorkflowExecEnv, "checkWorkflowExecEnv");
-__name8(checkWorkflowExecEnv, "checkWorkflowExecEnv");
+__name9(checkWorkflowExecEnv, "checkWorkflowExecEnv");
 var WORKFLOW_EXEC_GIT_DENIED_SUBCOMMANDS = Object.freeze([
   "push-mirror",
   "daemon",
@@ -37170,7 +37428,7 @@ function gitOptionMatches(arg, opt) {
   return opt.length === 2 && arg.length > 2 && arg.startsWith(opt);
 }
 __name(gitOptionMatches, "gitOptionMatches");
-__name8(gitOptionMatches, "gitOptionMatches");
+__name9(gitOptionMatches, "gitOptionMatches");
 var GIT_PUSH_FORBIDDEN_FLAG = /^(--mirror|--delete|-d|-f|--force|--force-with-lease(=.*)?|--force-if-includes|--prune|--all|--tags)$/;
 function checkWorkflowExecGitArgv(argv, opts = {}) {
   if (argv[0] !== "git") return {};
@@ -37213,9 +37471,9 @@ function checkWorkflowExecGitArgv(argv, opts = {}) {
   };
 }
 __name(checkWorkflowExecGitArgv, "checkWorkflowExecGitArgv");
-__name8(checkWorkflowExecGitArgv, "checkWorkflowExecGitArgv");
+__name9(checkWorkflowExecGitArgv, "checkWorkflowExecGitArgv");
 function formatWorkflowExecArgv(argv, max = WORKFLOW_EXEC_LOG_ARGV_MAX) {
-  const q = /* @__PURE__ */ __name8((a) => {
+  const q = /* @__PURE__ */ __name9((a) => {
     const s = String(a);
     return s.length > 0 && /^[A-Za-z0-9_@%+=:,./-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
   }, "q");
@@ -37223,7 +37481,7 @@ function formatWorkflowExecArgv(argv, max = WORKFLOW_EXEC_LOG_ARGV_MAX) {
   return line.length > max ? `${line.slice(0, max)}\u2026` : line;
 }
 __name(formatWorkflowExecArgv, "formatWorkflowExecArgv");
-__name8(formatWorkflowExecArgv, "formatWorkflowExecArgv");
+__name9(formatWorkflowExecArgv, "formatWorkflowExecArgv");
 function spawnWorkflowExec(o) {
   const spawnFn = o.spawnImpl ?? nodeSpawn;
   const max = o.outputMaxBytes ?? WORKFLOW_EXEC_OUTPUT_MAX_BYTES;
@@ -37258,7 +37516,7 @@ function spawnWorkflowExec(o) {
     let settled = false;
     let killTimer;
     let wallTimer;
-    const collect2 = /* @__PURE__ */ __name8((stream) => {
+    const collect2 = /* @__PURE__ */ __name9((stream) => {
       const chunks = [];
       let bytes = 0;
       stream?.on("data", (c) => {
@@ -37281,7 +37539,7 @@ function spawnWorkflowExec(o) {
     }, "collect");
     const stdout = collect2(child.stdout);
     const stderr = collect2(child.stderr);
-    const killTree = /* @__PURE__ */ __name8((sig) => {
+    const killTree = /* @__PURE__ */ __name9((sig) => {
       const pid = child.pid;
       if (!pid) return;
       try {
@@ -37290,7 +37548,7 @@ function spawnWorkflowExec(o) {
       } catch {
       }
     }, "killTree");
-    const end = /* @__PURE__ */ __name8(() => {
+    const end = /* @__PURE__ */ __name9(() => {
       if (settled || timedOut) return;
       timedOut = true;
       killTree("SIGTERM");
@@ -37301,7 +37559,7 @@ function spawnWorkflowExec(o) {
       }, grace);
       killTimer.unref?.();
     }, "end");
-    const cleanup = /* @__PURE__ */ __name8(() => {
+    const cleanup = /* @__PURE__ */ __name9(() => {
       if (wallTimer) clearTimeout(wallTimer);
       if (killTimer) clearTimeout(killTimer);
       o.signal?.removeEventListener("abort", end);
@@ -37335,7 +37593,7 @@ function spawnWorkflowExec(o) {
   });
 }
 __name(spawnWorkflowExec, "spawnWorkflowExec");
-__name8(spawnWorkflowExec, "spawnWorkflowExec");
+__name9(spawnWorkflowExec, "spawnWorkflowExec");
 async function runWorkflowExec(o) {
   const argv = validateWorkflowExecArgv(o.request.argv);
   const file = resolveWorkflowExecBinary(argv[0], o.pathDirs);
@@ -37381,7 +37639,7 @@ async function runWorkflowExec(o) {
   });
 }
 __name(runWorkflowExec, "runWorkflowExec");
-__name8(runWorkflowExec, "runWorkflowExec");
+__name9(runWorkflowExec, "runWorkflowExec");
 function createWorkflowExecQueue() {
   let tail = Promise.resolve();
   return (task) => {
@@ -37391,7 +37649,7 @@ function createWorkflowExecQueue() {
   };
 }
 __name(createWorkflowExecQueue, "createWorkflowExecQueue");
-__name8(createWorkflowExecQueue, "createWorkflowExecQueue");
+__name9(createWorkflowExecQueue, "createWorkflowExecQueue");
 function stderrTail(s) {
   const t = s.trim();
   if (!t) return "";
@@ -37399,9 +37657,9 @@ function stderrTail(s) {
   return `: ${tail.replace(/\s+/g, " ")}`;
 }
 __name(stderrTail, "stderrTail");
-__name8(stderrTail, "stderrTail");
+__name9(stderrTail, "stderrTail");
 function buildWorkflowExecApi(run) {
-  const call = /* @__PURE__ */ __name8(async (req, strict) => {
+  const call = /* @__PURE__ */ __name9(async (req, strict) => {
     const out = await run(req);
     if (out.timedOut) {
       throw new WorkflowExecError("EXEC_TIMEOUT", `[Lua] ${formatWorkflowExecArgv(out.argv)} did not finish within its wall (${out.durationMs} ms) and was killed (EXEC_TIMEOUT)`, out);
@@ -37411,7 +37669,7 @@ function buildWorkflowExecApi(run) {
     }
     return out;
   }, "call");
-  const request2 = /* @__PURE__ */ __name8((argv, opts) => {
+  const request2 = /* @__PURE__ */ __name9((argv, opts) => {
     const o = opts && typeof opts === "object" ? opts : {};
     return {
       argv,
@@ -37420,9 +37678,9 @@ function buildWorkflowExecApi(run) {
       env: o.env
     };
   }, "request");
-  const exec = /* @__PURE__ */ __name8((argv, opts) => call(request2(argv, opts), false), "exec");
+  const exec = /* @__PURE__ */ __name9((argv, opts) => call(request2(argv, opts), false), "exec");
   exec.strict = (argv, opts) => call(request2(argv, opts), true);
-  const $ = /* @__PURE__ */ __name8(async (strings, ...values) => call({
+  const $ = /* @__PURE__ */ __name9(async (strings, ...values) => call({
     argv: parseCommandTemplate(strings, values)
   }, false), "$");
   $.strict = async (strings, ...values) => call({
@@ -37434,16 +37692,16 @@ function buildWorkflowExecApi(run) {
   };
 }
 __name(buildWorkflowExecApi, "buildWorkflowExecApi");
-__name8(buildWorkflowExecApi, "buildWorkflowExecApi");
+__name9(buildWorkflowExecApi, "buildWorkflowExecApi");
 function unavailableWorkflowExecApi(why) {
-  const reject = /* @__PURE__ */ __name8(async () => {
+  const reject = /* @__PURE__ */ __name9(async () => {
     throw new WorkflowExecError("EXEC_UNAVAILABLE", `[Lua] ctx.exec is not available here: ${why} (EXEC_UNAVAILABLE)`);
   }, "reject");
   const exec = Object.assign(() => reject(), {
-    strict: /* @__PURE__ */ __name8(() => reject(), "strict")
+    strict: /* @__PURE__ */ __name9(() => reject(), "strict")
   });
   const $ = Object.assign(() => reject(), {
-    strict: /* @__PURE__ */ __name8(() => reject(), "strict")
+    strict: /* @__PURE__ */ __name9(() => reject(), "strict")
   });
   return {
     exec,
@@ -37451,7 +37709,7 @@ function unavailableWorkflowExecApi(why) {
   };
 }
 __name(unavailableWorkflowExecApi, "unavailableWorkflowExecApi");
-__name8(unavailableWorkflowExecApi, "unavailableWorkflowExecApi");
+__name9(unavailableWorkflowExecApi, "unavailableWorkflowExecApi");
 
 // src/utils/workflow-exec.ts
 var WORKFLOW_LOCAL_EXEC_ENV_KEYS = [
@@ -39441,6 +39699,28 @@ module.exports = async (event) => {
   }
 }
 __name(executeWebhook, "executeWebhook");
+async function executeWebRoute(options) {
+  const context = vm4.createContext(createSandbox(options));
+  applyGlobalSelfReference(context);
+  const wrapper = buildWebRouteWrapper(options.appCode, options.input);
+  const pending = vm4.runInContext(wrapper.code, context, {
+    filename: "web-app.bundle.js",
+    timeout: wrapper.timeoutMs
+  });
+  let timer;
+  const wall = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`The route did not answer within ${wrapper.timeoutMs} ms (the wall-clock cap)`)), wrapper.timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      pending,
+      wall
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+__name(executeWebRoute, "executeWebRoute");
 async function executeJob(options) {
   const { jobCode, jobData, apiKey, agentId } = options;
   const sandbox = createSandbox(options);
@@ -39718,12 +39998,12 @@ function isWrittenAsModelClassRef(model) {
 }
 __name(isWrittenAsModelClassRef, "isWrittenAsModelClassRef");
 var oneOf = /* @__PURE__ */ __name((tuple) => tuple.map((v) => `\`${v}\``).join(", "), "oneOf");
-function validateAgentNodeModelMembers(node, path27) {
+function validateAgentNodeModelMembers(node, path30) {
   const issues = [];
   if (typeof node.model === "string" && isWrittenAsModelClassRef(node.model)) {
     if (!modelClassOf(node.model)) {
       issues.push({
-        path: `${path27}.model`,
+        path: `${path30}.model`,
         code: "model-class-unknown",
         message: `"${node.model}" is not a model class \u2014 use one of ${oneOf(WORKFLOW_MODEL_CLASSES.map((c) => modelClassRef(c)))}, or pin an approved model code`
       });
@@ -39732,7 +40012,7 @@ function validateAgentNodeModelMembers(node, path27) {
   if (node.taskClass !== void 0) {
     if (typeof node.taskClass !== "string" || !isWorkflowTaskClass(node.taskClass)) {
       issues.push({
-        path: `${path27}.taskClass`,
+        path: `${path30}.taskClass`,
         code: "task-class-unknown",
         message: `"${String(node.taskClass)}" is not a task class \u2014 use one of ${oneOf(WORKFLOW_TASK_CLASSES)}`
       });
@@ -39741,7 +40021,7 @@ function validateAgentNodeModelMembers(node, path27) {
   if (node.requires !== void 0) {
     if (!Array.isArray(node.requires)) {
       issues.push({
-        path: `${path27}.requires`,
+        path: `${path30}.requires`,
         code: "requires-invalid",
         message: `\`requires\` must be an array of ${oneOf(WORKFLOW_MODEL_TRAITS)}`
       });
@@ -39749,7 +40029,7 @@ function validateAgentNodeModelMembers(node, path27) {
       node.requires.forEach((trait, i) => {
         if (typeof trait !== "string" || !isWorkflowModelTrait(trait)) {
           issues.push({
-            path: `${path27}.requires.${i}`,
+            path: `${path30}.requires.${i}`,
             code: "model-trait-unknown",
             message: `"${String(trait)}" is not a model trait \u2014 use one of ${oneOf(WORKFLOW_MODEL_TRAITS)}`
           });
@@ -39760,7 +40040,7 @@ function validateAgentNodeModelMembers(node, path27) {
   if (node.effort !== void 0) {
     if (typeof node.effort !== "string" || !isWorkflowEffort(node.effort)) {
       issues.push({
-        path: `${path27}.effort`,
+        path: `${path30}.effort`,
         code: "effort-unknown",
         message: `"${String(node.effort)}" is not a workflow effort \u2014 use one of ${oneOf(WORKFLOW_AGENT_EFFORTS)}. (\`off\`, \`minimal\` and \`max\` are the agent-level \`modelSettings.reasoning.effort\` scale, not this one.)`
       });
@@ -39769,13 +40049,13 @@ function validateAgentNodeModelMembers(node, path27) {
   if (node.modelReason !== void 0) {
     if (typeof node.modelReason !== "string") {
       issues.push({
-        path: `${path27}.modelReason`,
+        path: `${path30}.modelReason`,
         code: "model-reason-invalid",
         message: "`modelReason` must be a string"
       });
     } else if (node.modelReason.length > WORKFLOW_MODEL_REASON_MAX_LENGTH) {
       issues.push({
-        path: `${path27}.modelReason`,
+        path: `${path30}.modelReason`,
         code: "model-reason-too-long",
         message: `\`modelReason\` is ${node.modelReason.length} characters \u2014 the cap is ${WORKFLOW_MODEL_REASON_MAX_LENGTH}`
       });
@@ -39795,22 +40075,22 @@ var MEMBERS = [
 function validateGraphModelMembers(graph) {
   const issues = [];
   const seen = /* @__PURE__ */ new Set();
-  const walk3 = /* @__PURE__ */ __name((value3, path27, depth) => {
+  const walk4 = /* @__PURE__ */ __name((value3, path30, depth) => {
     if (depth > WORKFLOW_MODEL_WALK_MAX_DEPTH || value3 === null || typeof value3 !== "object") return;
     if (seen.has(value3)) return;
     seen.add(value3);
     if (Array.isArray(value3)) {
-      value3.forEach((v, i) => walk3(v, `${path27}.${i}`, depth + 1));
+      value3.forEach((v, i) => walk4(v, `${path30}.${i}`, depth + 1));
       return;
     }
     const node = value3;
     if (MEMBERS.some((m) => node[m] !== void 0)) {
-      const label2 = typeof node.id === "string" && node.id ? node.id : path27;
+      const label2 = typeof node.id === "string" && node.id ? node.id : path30;
       issues.push(...validateAgentNodeModelMembers(node, label2));
     }
-    for (const [k, v] of Object.entries(node)) walk3(v, path27 ? `${path27}.${k}` : k, depth + 1);
+    for (const [k, v] of Object.entries(node)) walk4(v, path30 ? `${path30}.${k}` : k, depth + 1);
   }, "walk");
-  walk3(graph, "", 0);
+  walk4(graph, "", 0);
   return issues;
 }
 __name(validateGraphModelMembers, "validateGraphModelMembers");
@@ -40064,6 +40344,325 @@ function workflowModelMemberError(workflowName, issues) {
 }
 __name(workflowModelMemberError, "workflowModelMemberError");
 
+// src/primitives/web-app.handler.ts
+init_types();
+init_constants();
+import path24 from "path";
+
+// src/api/web-app.api.service.ts
+init_http_client();
+var WebAppApi = class extends HttpClient {
+  static {
+    __name(this, "WebAppApi");
+  }
+  agentId;
+  constructor(baseUrl, credential, agentId) {
+    super(baseUrl, credential);
+    this.agentId = agentId;
+  }
+  /** Every web app of the agent, each with its versions (newest first). */
+  async getWebApps() {
+    return this.httpGet(`/developer/web-apps/${this.agentId}`, {});
+  }
+  /** Register the app; the server assigns its slug (the app origin's host label). */
+  async createWebApp(data) {
+    return this.httpPost(`/developer/web-apps/${this.agentId}`, data, {});
+  }
+  /** A new, inactive version; it goes live with the agent version that pins it. */
+  async pushWebAppVersion(webAppId, data) {
+    return this.httpPost(`/developer/web-apps/${this.agentId}/${webAppId}/version`, data, {});
+  }
+};
+
+// src/primitives/web-app.handler.ts
+init_artifact_loader();
+
+// src/utils/web-app-build.ts
+init_dist();
+import crypto5 from "crypto";
+import fs17 from "fs";
+import os from "os";
+import path23 from "path";
+import { createRequire as createRequire2 } from "module";
+import { pathToFileURL as pathToFileURL2 } from "url";
+var WebAppBuildError = class extends Error {
+  static {
+    __name(this, "WebAppBuildError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "WebAppBuildError";
+  }
+};
+var CONTENT_TYPES = {
+  ".js": "text/javascript",
+  ".mjs": "text/javascript",
+  ".css": "text/css",
+  ".html": "text/html; charset=utf-8",
+  ".json": "application/json",
+  ".map": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".wasm": "application/wasm",
+  ".txt": "text/plain; charset=utf-8",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg"
+};
+function contentTypeFor(file) {
+  return CONTENT_TYPES[path23.extname(file).toLowerCase()] ?? "application/octet-stream";
+}
+__name(contentTypeFor, "contentTypeFor");
+async function loadAppVite(pagesDir) {
+  const requireFromApp = createRequire2(path23.join(pagesDir, "package.json"));
+  let entry;
+  let version;
+  try {
+    entry = requireFromApp.resolve("vite");
+    version = requireFromApp("vite/package.json").version;
+  } catch {
+    throw new WebAppBuildError(`No Vite installation found for ${pagesDir}. Install the page dependencies first (npm install in that directory).`);
+  }
+  const mod = await import(pathToFileURL2(entry).href);
+  const build2 = mod.build ?? mod.default?.build;
+  if (typeof build2 !== "function") throw new WebAppBuildError(`The Vite at ${entry} exposes no build() function.`);
+  const createServer = mod.createServer ?? mod.default?.createServer;
+  return {
+    build: build2,
+    createServer: typeof createServer === "function" ? createServer : void 0,
+    version
+  };
+}
+__name(loadAppVite, "loadAppVite");
+function walk3(dir, base = dir) {
+  const out = [];
+  for (const entry of fs17.readdirSync(dir, {
+    withFileTypes: true
+  })) {
+    const full = path23.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...walk3(full, base));
+    else if (entry.isFile()) out.push(path23.relative(base, full).split(path23.sep).join("/"));
+  }
+  return out.sort();
+}
+__name(walk3, "walk");
+function collectBuildOutput(outDir) {
+  const files = walk3(outDir);
+  if (!files.includes("index.html")) {
+    throw new WebAppBuildError(`The page build produced no index.html in ${outDir}.`);
+  }
+  const entryHtml = fs17.readFileSync(path23.join(outDir, "index.html"), "utf8");
+  if (entryHtml.length > WEB_APP_ENTRY_HTML_MAX_CHARS) {
+    throw new WebAppBuildError(`index.html is ${entryHtml.length} characters; the limit is ${WEB_APP_ENTRY_HTML_MAX_CHARS}. Move inline content into assets.`);
+  }
+  const assets = [];
+  const skipped = [];
+  for (const rel of files) {
+    if (rel === "index.html") continue;
+    if (!rel.startsWith("assets/")) {
+      skipped.push(rel);
+      continue;
+    }
+    if (rel.length > WEB_APP_ASSET_PATH_MAX_CHARS || !WEB_APP_ASSET_PATH_PATTERN.test(rel)) {
+      throw new WebAppBuildError(`${rel} is not a servable asset path (letters, digits, . _ - / only, at most ${WEB_APP_ASSET_PATH_MAX_CHARS} characters). Rename the source file.`);
+    }
+    const bytes = fs17.readFileSync(path23.join(outDir, rel));
+    if (bytes.length > WEB_APP_MAX_ASSET_BYTES) {
+      throw new WebAppBuildError(`${rel} is ${bytes.length} bytes; a page asset may be at most ${WEB_APP_MAX_ASSET_BYTES} bytes.`);
+    }
+    assets.push({
+      path: rel,
+      hash: crypto5.createHash("sha256").update(bytes).digest("hex"),
+      size: bytes.length,
+      contentType: contentTypeFor(rel),
+      bytes
+    });
+  }
+  if (assets.length > WEB_APP_MAX_ASSETS) {
+    throw new WebAppBuildError(`The page build produced ${assets.length} assets; the limit is ${WEB_APP_MAX_ASSETS}.`);
+  }
+  return {
+    entryHtml,
+    assets,
+    skipped
+  };
+}
+__name(collectBuildOutput, "collectBuildOutput");
+async function buildWebAppPages(pagesDir, loadVite = loadAppVite) {
+  if (!fs17.existsSync(path23.join(pagesDir, "index.html"))) {
+    throw new WebAppBuildError(`${pagesDir} has no index.html: \`pages.root\` must name the Vite project directory.`);
+  }
+  const { build: build2, version } = await loadVite(pagesDir);
+  const outDir = fs17.mkdtempSync(path23.join(os.tmpdir(), "lua-web-app-"));
+  try {
+    await build2({
+      root: pagesDir,
+      base: "/",
+      logLevel: "warn",
+      html: {
+        cspNonce: WEB_APP_CSP_NONCE_PLACEHOLDER
+      },
+      build: {
+        outDir,
+        emptyOutDir: true,
+        assetsDir: "assets",
+        manifest: false
+      }
+    });
+    return {
+      ...collectBuildOutput(outDir),
+      viteVersion: version
+    };
+  } finally {
+    fs17.rmSync(outDir, {
+      recursive: true,
+      force: true
+    });
+  }
+}
+__name(buildWebAppPages, "buildWebAppPages");
+
+// src/primitives/web-app.handler.ts
+init_package_root();
+init_cli();
+init_write_info();
+init_base_handler();
+var WEB_APP_GOES_LIVE_WITH_AGENT_VERSION = "A web app version goes live with the agent version that pins it: create an agent version and promote it.";
+var WebAppHandler = class extends BaseVersionedHandler {
+  static {
+    __name(this, "WebAppHandler");
+  }
+  kind = PrimitiveKind.WEB_APP;
+  displayName = "webapp";
+  displayNamePlural = "web apps";
+  /** No CLI delete in the MVP; unused because server-only apps are never stubbed (see shouldConsiderForOrphan). */
+  deleteCommand = "";
+  yamlConfig = {
+    yamlKey: "webApps",
+    idField: "webAppId"
+  };
+  getApi(apiKey, agentId) {
+    return new WebAppApi(BASE_URLS.API, apiKey, agentId);
+  }
+  async fetchFromServer(api) {
+    const response = await api.getWebApps();
+    if (!response.success || !response.data?.webApps) return null;
+    return response.data.webApps;
+  }
+  async createOnServer(api, primitive) {
+    const response = await api.createWebApp({
+      name: primitive.name,
+      description: primitive.description || void 0
+    });
+    if (!response.success || !response.data?.id) return null;
+    return response.data.id;
+  }
+  getActiveVersion(serverItem) {
+    if (serverItem.activeVersionId) {
+      return serverItem.versions?.find((v) => v.id === serverItem.activeVersionId)?.version ?? null;
+    }
+    return serverItem.versions?.find((v) => v.active === true)?.version ?? null;
+  }
+  /** The CLI cannot delete a web app (MVP), so an app only on the server is left alone, not stubbed. */
+  shouldConsiderForOrphan(_item) {
+    return false;
+  }
+  /**
+  * Silent for an agent that has no web apps on either side, so every other
+  * push and compile prints exactly what it printed before this kind existed.
+  */
+  async applySyncToYaml(serverData, config, manifest, apiCredentials) {
+    const local = this.getFromYaml(config).length > 0;
+    const compiled = !!manifest?.primitives.some((p) => p.kind === this.kind);
+    const remote = (serverData.serverItems?.length ?? 0) > 0;
+    if (!local && !compiled && !remote) return {
+      messages: [],
+      yamlUpdated: false,
+      orphanedCount: 0
+    };
+    return super.applySyncToYaml(serverData, config, manifest, apiCredentials);
+  }
+  buildPushData(primitive, compressedCode, codeS3Hash) {
+    const app = primitive;
+    return {
+      name: app.name,
+      ...app.description ? {
+        description: app.description
+      } : {},
+      ...codeS3Hash ? {
+        codeS3Hash
+      } : {
+        code: compressedCode
+      },
+      routes: app.routes,
+      hasFetch: app.hasFetch,
+      nav: app.nav,
+      ...app.csp ? {
+        csp: app.csp
+      } : {},
+      ...app.branding ? {
+        branding: app.branding
+      } : {},
+      compiler: {
+        luaCli: getCliVersion()
+      }
+    };
+  }
+  /**
+  * The page build: runs the app's Vite, adds every asset to the blob upload
+  * (`bundleAccumulator`, keyed by the sha256 of the raw bytes) and the entry
+  * HTML plus the asset manifest to the version.
+  */
+  async completePushData(pushData, manifest, name, bundleAccumulator) {
+    const app = findPrimitive(manifest, name, this.kind);
+    if (!app) throw new Error(`Web app "${name}" not found in compiled output.`);
+    const pagesDir = path24.resolve(path24.dirname(app.sourcePath), app.pagesRoot);
+    writeProgress(`\u{1F9F1} Building the pages of ${name} (${path24.relative(process.cwd(), pagesDir) || "."})...`);
+    const pages = await buildWebAppPages(pagesDir);
+    for (const asset of pages.assets) bundleAccumulator.set(asset.hash, asset.bytes);
+    const bytes = pages.assets.reduce((n2, a) => n2 + a.size, 0);
+    writeSuccess(`\u2705 Pages built: ${pages.assets.length} asset(s), ${Math.round(bytes / 1024)} KiB (Vite ${pages.viteVersion})`);
+    if (pages.skipped.length > 0) {
+      writeInfo(`\u26A0\uFE0F  Not served (outside assets/): ${pages.skipped.slice(0, 10).join(", ")}${pages.skipped.length > 10 ? ", \u2026" : ""}. Import files from your source so Vite emits them under assets/.`);
+    }
+    const compiler = pushData.compiler ?? {};
+    return {
+      ...pushData,
+      entryHtml: pages.entryHtml,
+      assets: pages.assets.map(({ bytes: _bytes, ...entry }) => entry),
+      compiler: {
+        ...compiler,
+        vite: pages.viteVersion
+      }
+    };
+  }
+  async pushToServer(apiKey, agentId, entityId, pushData) {
+    const api = this.getApi(apiKey, agentId);
+    const response = await api.pushWebAppVersion(entityId, pushData);
+    return {
+      success: response.success,
+      error: response.error?.message
+    };
+  }
+  async publishVersion(_apiKey, _agentId, _entityId, _version) {
+    return {
+      success: false,
+      error: WEB_APP_GOES_LIVE_WITH_AGENT_VERSION
+    };
+  }
+};
+var webAppHandler = new WebAppHandler();
+
 // src/primitives/index.ts
 init_skill_handler();
 init_mcp_server_handler();
@@ -40081,7 +40680,9 @@ var primitiveHandlers = {
   [PrimitiveKind.DEVICE_TRIGGER]: deviceTriggerHandler,
   [PrimitiveKind.VOICE]: voiceHandler,
   // WB-09 (WF-543): dark — no `workflows:` rows in lua.skill.yaml ⇒ never selected.
-  [PrimitiveKind.WORKFLOW]: workflowHandler
+  [PrimitiveKind.WORKFLOW]: workflowHandler,
+  // Lua Apps: inert (and silent, see WebAppHandler.applySyncToYaml) for an agent without `webApps`.
+  [PrimitiveKind.WEB_APP]: webAppHandler
 };
 var versionedHandlers = Object.values(primitiveHandlers).filter((h) => isVersionedHandler(h));
 var syncableHandlers = Object.values(primitiveHandlers);
@@ -40122,7 +40723,7 @@ async function compileCommand(options) {
     }
     writeProgress("\u{1F528} Compiling...");
     const rootDir = process.cwd();
-    const outDir = path23.join(rootDir, "dist-v2");
+    const outDir = path25.join(rootDir, "dist-v2");
     const result = await compile2({
       rootDir,
       outDir,
@@ -40293,6 +40894,415 @@ __name(printToolOutput, "printToolOutput");
 // src/commands/test.ts
 init_cli();
 init_command_utils();
+
+// src/utils/web-app-route.ts
+init_dist();
+var WebRouteSpecError = class extends Error {
+  static {
+    __name(this, "WebRouteSpecError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "WebRouteSpecError";
+  }
+};
+function parseRouteSpec(spec) {
+  const match = /^\s*([A-Za-z]+)\s+(\/\S*)\s*$/.exec(spec);
+  const method = match?.[1].toUpperCase();
+  if (!match || !WEB_ROUTE_METHODS.includes(method)) {
+    throw new WebRouteSpecError(`--route must look like 'GET /path?query' (${WEB_ROUTE_METHODS.join(", ")}); got ${JSON.stringify(spec)}`);
+  }
+  const url = new URL(match[2], "http://local");
+  const query = {};
+  for (const [key, value3] of url.searchParams) {
+    const existing = query[key];
+    if (existing === void 0) query[key] = value3;
+    else if (Array.isArray(existing)) existing.push(value3);
+    else query[key] = [
+      existing,
+      value3
+    ];
+  }
+  return {
+    method,
+    path: url.pathname,
+    query
+  };
+}
+__name(parseRouteSpec, "parseRouteSpec");
+var segmentsOf = /* @__PURE__ */ __name((p) => p.split("/").filter(Boolean), "segmentsOf");
+function matchManifestRoute(routes, method, path30) {
+  const parts = segmentsOf(path30);
+  const candidates = routes.map((r, order) => ({
+    r,
+    order,
+    segs: segmentsOf(r.path)
+  })).filter(({ r, segs }) => r.method === method && segs.length === parts.length).sort((a, b) => b.segs.filter((s) => !s.startsWith(":")).length - a.segs.filter((s) => !s.startsWith(":")).length || a.order - b.order);
+  for (const { r, segs } of candidates) {
+    const params = {};
+    let ok = true;
+    for (let i = 0; i < segs.length && ok; i++) {
+      if (segs[i].startsWith(":")) {
+        try {
+          params[segs[i].slice(1)] = decodeURIComponent(parts[i]);
+        } catch {
+          ok = false;
+        }
+      } else if (segs[i] !== parts[i]) {
+        ok = false;
+      }
+    }
+    if (ok) return {
+      key: r.key,
+      params
+    };
+  }
+  return null;
+}
+__name(matchManifestRoute, "matchManifestRoute");
+function buildWebRouteInput(opts) {
+  const headers = {};
+  for (const [name, value3] of Object.entries(opts.headers ?? {})) {
+    if (typeof value3 === "string" && isForwardableWebRouteRequestHeader(name)) headers[name.toLowerCase()] = value3;
+  }
+  let body;
+  if (opts.body !== void 0 && opts.spec.method !== "GET") {
+    body = typeof opts.body === "string" ? {
+      kind: "text",
+      value: opts.body
+    } : {
+      kind: "json",
+      value: opts.body
+    };
+    headers["content-type"] ??= body.kind === "json" ? "application/json" : "text/plain";
+  }
+  return {
+    v: WEB_ROUTE_PROTOCOL_VERSION,
+    request: {
+      method: opts.spec.method,
+      path: opts.spec.path,
+      ...opts.route ? {
+        route: opts.route.key,
+        params: opts.route.params
+      } : {
+        params: {}
+      },
+      query: opts.spec.query,
+      headers,
+      ...body ? {
+        body
+      } : {}
+    },
+    auth: opts.auth,
+    app: {
+      id: opts.app.id,
+      name: opts.app.name,
+      version: opts.app.version,
+      deployment: 0,
+      origin: "http://localhost",
+      preview: false
+    }
+  };
+}
+__name(buildWebRouteInput, "buildWebRouteInput");
+
+// src/utils/web-app-dev.ts
+init_dist();
+init_credential_operational_context();
+init_cli_error();
+async function developerAuth(apiKey, agentId, config) {
+  const credential = await resolveCredentialOperationalContext(apiKey);
+  if (!credential.userId) {
+    throw CliError.usage("A web app route runs as a signed-in person; this credential has no user. Run `lua auth configure` and sign in.");
+  }
+  const orgId = config?.agent?.orgId || credential.authorization.orgs[0]?.orgId;
+  if (!orgId) {
+    throw CliError.usage("No organization for this project: lua.skill.yaml has no agent.orgId and the credential belongs to no organization. Run `lua init` in the project.");
+  }
+  return {
+    userId: credential.userId,
+    orgId,
+    agentId,
+    subjectType: "user",
+    credentialType: "firstPartySession",
+    roles: [],
+    scopes: [],
+    ...credential.identity?.fullName ? {
+      name: credential.identity.fullName
+    } : {},
+    ...credential.identity?.email ? {
+      email: credential.identity.email
+    } : {}
+  };
+}
+__name(developerAuth, "developerAuth");
+function devBootstrap(app, origin) {
+  return {
+    v: 1,
+    app: {
+      id: "local",
+      name: app.name,
+      version: "0.0.0-dev",
+      deployment: 0,
+      origin
+    },
+    apiBase: "/_lua/api",
+    manifest: "/_lua/manifest",
+    auth: {
+      origin: "",
+      exchangePath: "",
+      audience: "web-app"
+    },
+    embedded: false,
+    hostOrigins: [],
+    theme: "dark",
+    density: "compact",
+    preview: false,
+    dev: true
+  };
+}
+__name(devBootstrap, "devBootstrap");
+function devBootstrapScript(app, origin) {
+  const json2 = JSON.stringify(devBootstrap(app, origin)).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+  return `<script>window.__LUA__=${json2};</script>`;
+}
+__name(devBootstrapScript, "devBootstrapScript");
+var json = /* @__PURE__ */ __name((status, value3) => ({
+  status,
+  headers: {
+    "content-type": "application/json",
+    "cache-control": "no-store"
+  },
+  body: Buffer.from(JSON.stringify(value3), "utf8")
+}), "json");
+function shapeBody(raw, contentType) {
+  if (!raw || raw.length === 0) return void 0;
+  const ct = (contentType || "").toLowerCase();
+  if (ct.includes("json")) return {
+    kind: "json",
+    value: JSON.parse(raw.toString("utf8"))
+  };
+  if (ct.startsWith("text/") || ct.includes("xml") || ct.includes("x-www-form-urlencoded")) {
+    return {
+      kind: "text",
+      value: raw.toString("utf8")
+    };
+  }
+  return {
+    kind: "base64",
+    value: raw.toString("base64")
+  };
+}
+__name(shapeBody, "shapeBody");
+function materialize(result) {
+  const headers = {
+    "cache-control": "no-store",
+    ...result.headers
+  };
+  const body = result.body;
+  if (!body) return {
+    status: result.status,
+    headers
+  };
+  if (body.kind === "json") {
+    headers["content-type"] ??= "application/json";
+    return {
+      status: result.status,
+      headers,
+      body: Buffer.from(JSON.stringify(body.value ?? null), "utf8")
+    };
+  }
+  if (body.kind === "text") {
+    headers["content-type"] ??= "text/plain; charset=utf-8";
+    return {
+      status: result.status,
+      headers,
+      body: Buffer.from(body.value ?? "", "utf8")
+    };
+  }
+  return {
+    status: result.status,
+    headers,
+    body: Buffer.from(body.value ?? "", "base64")
+  };
+}
+__name(materialize, "materialize");
+async function handleDevRequest(req, ctx) {
+  const url = new URL(req.url, "http://local");
+  if (url.pathname === "/_lua/manifest") {
+    return json(200, {
+      v: 1,
+      app: {
+        id: "local",
+        name: ctx.app.name,
+        description: ctx.app.description,
+        version: "0.0.0-dev",
+        deployment: 0
+      },
+      nav: ctx.app.nav,
+      user: {
+        id: ctx.auth.userId,
+        name: ctx.auth.name,
+        email: ctx.auth.email
+      },
+      org: {
+        id: ctx.auth.orgId
+      },
+      agent: {
+        id: ctx.auth.agentId
+      },
+      auth: {
+        roles: ctx.auth.roles,
+        scopes: ctx.auth.scopes
+      }
+    });
+  }
+  if (url.pathname !== "/_lua/api" && !url.pathname.startsWith("/_lua/api/")) return null;
+  const method = req.method.toUpperCase();
+  if (!WEB_ROUTE_METHODS.includes(method)) {
+    return json(405, {
+      code: "METHOD_NOT_ALLOWED",
+      message: `Method ${method} is not supported`
+    });
+  }
+  if (req.bodyTooLarge || req.body && req.body.length > WEB_ROUTE_MAX_REQUEST_BODY_BYTES) {
+    return json(413, {
+      code: "VALIDATION",
+      message: `Request body exceeds ${WEB_ROUTE_MAX_REQUEST_BODY_BYTES} bytes`
+    });
+  }
+  const routePath = url.pathname.slice("/_lua/api".length) || "/";
+  const spec = parseRouteSpec(`${method} ${routePath}${url.search}`);
+  const route = matchManifestRoute(ctx.app.routes, spec.method, spec.path);
+  if (!route && !ctx.app.hasFetch) {
+    return json(404, {
+      code: "NOT_FOUND",
+      message: `No route for ${spec.method} ${spec.path}`
+    });
+  }
+  let body;
+  try {
+    const ct = req.headers["content-type"];
+    body = shapeBody(req.body, Array.isArray(ct) ? ct[0] : ct);
+  } catch {
+    return json(400, {
+      code: "VALIDATION",
+      message: "Request body is not valid JSON"
+    });
+  }
+  const headers = {};
+  for (const [name, value3] of Object.entries(req.headers)) if (typeof value3 === "string") headers[name] = value3;
+  const input = buildWebRouteInput({
+    spec,
+    route,
+    headers,
+    auth: ctx.auth,
+    app: {
+      id: "local",
+      name: ctx.app.name,
+      version: "0.0.0-dev"
+    }
+  });
+  if (body && spec.method !== "GET") input.request.body = body;
+  try {
+    const execute = ctx.execute ?? executeWebRoute;
+    return materialize(await execute({
+      appCode: ctx.appCode(),
+      input,
+      apiKey: ctx.apiKey,
+      agentId: ctx.agentId
+    }));
+  } catch (error) {
+    console.error(error);
+    return json(500, {
+      code: "HANDLER_ERROR",
+      message: error?.message || "The route handler failed"
+    });
+  }
+}
+__name(handleDevRequest, "handleDevRequest");
+function readBody(req) {
+  return new Promise((resolve7, reject) => {
+    const chunks = [];
+    let total = 0;
+    let settled = false;
+    const onData = /* @__PURE__ */ __name((chunk) => {
+      total += chunk.length;
+      if (total > WEB_ROUTE_MAX_REQUEST_BODY_BYTES) {
+        settled = true;
+        req.off("data", onData);
+        req.pause();
+        resolve7({
+          body: Buffer.alloc(0),
+          tooLarge: true
+        });
+        return;
+      }
+      chunks.push(chunk);
+    }, "onData");
+    req.on("data", onData);
+    req.on("end", () => settled || resolve7({
+      body: Buffer.concat(chunks),
+      tooLarge: false
+    }));
+    req.on("error", (error) => settled || reject(error));
+  });
+}
+__name(readBody, "readBody");
+function isRouteSource(file, appDir, pagesDir) {
+  const inApp = file.startsWith(appDir + "/") || file.startsWith(appDir + "\\");
+  const inPages = file === pagesDir || file.startsWith(pagesDir + "/") || file.startsWith(pagesDir + "\\");
+  return inApp && !inPages && /\.[cm]?[jt]sx?$/.test(file);
+}
+__name(isRouteSource, "isRouteSource");
+function luaAppsDevPlugin(opts) {
+  return {
+    name: "lua-apps-dev",
+    configureServer(dev) {
+      dev.middlewares.use(async (req, res, next) => {
+        if (!String(req.url ?? "").startsWith("/_lua/")) return next();
+        try {
+          const read = await readBody(req);
+          const answer = await handleDevRequest({
+            method: req.method ?? "GET",
+            url: req.url ?? "/",
+            headers: req.headers,
+            body: read.body,
+            bodyTooLarge: read.tooLarge
+          }, opts.context());
+          if (!answer) return next();
+          res.statusCode = answer.status;
+          for (const [k, v] of Object.entries(answer.headers)) res.setHeader(k, v);
+          res.end(answer.body);
+          if (read.tooLarge) req.resume();
+          opts.log?.(`${req.method} ${req.url} \u2192 ${answer.status}`, answer.status);
+        } catch (error) {
+          res.statusCode = 500;
+          res.setHeader("content-type", "application/json");
+          res.end(JSON.stringify({
+            code: "PLATFORM_ERROR",
+            message: String(error?.message ?? error)
+          }));
+        }
+      });
+      if (opts.onRouteChange) {
+        dev.watcher.add(opts.appDir);
+        dev.watcher.on("change", (file) => {
+          if (isRouteSource(file, opts.appDir, opts.pagesDir)) void opts.onRouteChange(file);
+        });
+      }
+    },
+    transformIndexHtml(html) {
+      const script = devBootstrapScript(opts.context().app, opts.origin() || "http://localhost");
+      return html.includes("</head>") ? html.replace("</head>", `${script}
+</head>`) : `${script}
+${html}`;
+    }
+  };
+}
+__name(luaAppsDevPlugin, "luaAppsDevPlugin");
+
+// src/commands/test.ts
 init_files();
 init_artifact_loader();
 init_types();
@@ -40397,9 +41407,13 @@ var ALIAS_MAP = {
       "device-trigger",
       "voice",
       "workflow",
+      "webapp",
       "backup"
     ],
     aliases: lowerKeys({
+      webapps: "webapp",
+      "web-app": "webapp",
+      "web-apps": "webapp",
       skills: "skill",
       sk: "skill",
       voices: "voice",
@@ -40526,9 +41540,13 @@ var ALIAS_MAP = {
       "job",
       "preprocessor",
       "postprocessor",
-      "workflow"
+      "workflow",
+      "webapp"
     ],
     aliases: lowerKeys({
+      webapps: "webapp",
+      "web-app": "webapp",
+      "web-apps": "webapp",
       workflows: "workflow",
       wf: "workflow",
       skills: "skill",
@@ -41236,8 +42254,8 @@ function validateOrSuggest(group, input, opts) {
 __name(validateOrSuggest, "validateOrSuggest");
 
 // src/commands/workflow-local-run.ts
-import fs17 from "fs";
-import path24 from "path";
+import fs18 from "fs";
+import path26 from "path";
 init_cli();
 
 // src/utils/stdout-redirect.ts
@@ -41455,13 +42473,13 @@ __name(runScriptWorkflowLocally, "runScriptWorkflowLocally");
 
 // src/utils/workflow-script-replay.ts
 init_dist4();
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 import vm5 from "vm";
 import { createHash as createHash7, randomUUID as randomUUID4 } from "crypto";
 
 // ../sandbox-runtime/dist/workflow-script-wrapper.mjs
-var __defProp9 = Object.defineProperty;
-var __name9 = /* @__PURE__ */ __name((target, value3) => __defProp9(target, "name", { value: value3, configurable: true }), "__name");
+var __defProp10 = Object.defineProperty;
+var __name10 = /* @__PURE__ */ __name((target, value3) => __defProp10(target, "name", { value: value3, configurable: true }), "__name");
 var WORKFLOW_SCRIPT_RUNTIME_KEY = "__luaWorkflowScriptRuntime";
 var WORKFLOW_SCRIPT_PROTOCOL_VERSION = 1;
 var WORKFLOW_SCRIPT_DEFAULT_CAPS = {
@@ -41796,18 +42814,18 @@ function computeWorkflowProtocolShipWindow(input) {
   };
 }
 __name(computeWorkflowProtocolShipWindow, "computeWorkflowProtocolShipWindow");
-__name9(computeWorkflowProtocolShipWindow, "computeWorkflowProtocolShipWindow");
+__name10(computeWorkflowProtocolShipWindow, "computeWorkflowProtocolShipWindow");
 var WORKFLOW_SCRIPT_EFFORT_PROTOCOL_VERSION = 2;
 function scriptEffortForwardable(journalProtocolVersion) {
   return typeof journalProtocolVersion === "number" && journalProtocolVersion >= WORKFLOW_SCRIPT_EFFORT_PROTOCOL_VERSION;
 }
 __name(scriptEffortForwardable, "scriptEffortForwardable");
-__name9(scriptEffortForwardable, "scriptEffortForwardable");
+__name10(scriptEffortForwardable, "scriptEffortForwardable");
 function workflowScriptReplaySource(journalProtocolVersion) {
   return WORKFLOW_SCRIPT_PROTOCOL_VERSIONS.includes(journalProtocolVersion) ? WORKFLOW_SCRIPT_REPLAY_SOURCES[journalProtocolVersion] : void 0;
 }
 __name(workflowScriptReplaySource, "workflowScriptReplaySource");
-__name9(workflowScriptReplaySource, "workflowScriptReplaySource");
+__name10(workflowScriptReplaySource, "workflowScriptReplaySource");
 var HOST_BINDINGS = [
   "args",
   "agent",
@@ -41836,7 +42854,7 @@ function transformWorkflowScriptModule(script) {
   return script.replace(/^\s*export\s+const\s+meta\s*=/m, "const meta =");
 }
 __name(transformWorkflowScriptModule, "transformWorkflowScriptModule");
-__name9(transformWorkflowScriptModule, "transformWorkflowScriptModule");
+__name10(transformWorkflowScriptModule, "transformWorkflowScriptModule");
 function buildWorkflowScriptWrapper(script, input) {
   const tick = input ?? {};
   const version = tick.journalProtocolVersion ?? WORKFLOW_SCRIPT_PROTOCOL_VERSION;
@@ -41886,7 +42904,7 @@ ${transformWorkflowScriptModule(script)}
   };
 }
 __name(buildWorkflowScriptWrapper, "buildWorkflowScriptWrapper");
-__name9(buildWorkflowScriptWrapper, "buildWorkflowScriptWrapper");
+__name10(buildWorkflowScriptWrapper, "buildWorkflowScriptWrapper");
 
 // src/utils/workflow-script-replay.ts
 var ReplayRuntimeUnavailableError = class extends Error {
@@ -42010,7 +43028,7 @@ __name(bundledScriptRunner, "bundledScriptRunner");
 function projectScriptRunner(projectDir) {
   let runtime;
   try {
-    const req = createRequire2(`${projectDir.replace(/\/$/, "")}/package.json`);
+    const req = createRequire3(`${projectDir.replace(/\/$/, "")}/package.json`);
     runtime = req("@lua/sandbox-runtime");
   } catch (e) {
     throw new ReplayRuntimeUnavailableError(e.message);
@@ -42320,7 +43338,7 @@ async function runWorkflowLocalFromProject(name, flags) {
       fastRetries: !!flags.fastRetries,
       realTime: !!flags.realTime,
       artefactsDir: flags.artefactsDir,
-      workspaceDir: flags.workspace ? path24.resolve(flags.workspace) : void 0,
+      workspaceDir: flags.workspace ? path26.resolve(flags.workspace) : void 0,
       env: parseEnvFlags(flags.env),
       prompt: process.stdin.isTTY && !asJson && !isCiModeEnabled() ? promptForLocalDecision : void 0,
       log: asJson ? void 0 : (line) => console.log(line)
@@ -42471,10 +43489,10 @@ async function runScriptFormLocally(wf, flags, say) {
 }
 __name(runScriptFormLocally, "runScriptFormLocally");
 function writeLedgerFile(file, value3) {
-  fs17.mkdirSync(path24.dirname(path24.resolve(file)), {
+  fs18.mkdirSync(path26.dirname(path26.resolve(file)), {
     recursive: true
   });
-  fs17.writeFileSync(file, `${JSON.stringify(value3, null, 2)}
+  fs18.writeFileSync(file, `${JSON.stringify(value3, null, 2)}
 `);
 }
 __name(writeLedgerFile, "writeLedgerFile");
@@ -42668,6 +43686,10 @@ async function testCommand(type, cmdObj) {
             {
               name: "\u{1F4E4} PostProcessor",
               value: "postprocessor"
+            },
+            {
+              name: "\u{1F5A5}\uFE0F  Web app route",
+              value: "webapp"
             }
           ]
         }
@@ -42685,6 +43707,9 @@ async function testCommand(type, cmdObj) {
       case "webhook":
         await testWebhook(entityName, inputJson, asJson);
         break;
+      case "webapp":
+        await testWebApp(entityName, cmdObj?.route ?? null, inputJson, asJson);
+        break;
       case "job":
         await testJob(entityName, asJson);
         break;
@@ -42924,6 +43949,108 @@ async function testWebhook(entityName, inputJson, asJson = false) {
   });
 }
 __name(testWebhook, "testWebhook");
+async function testWebApp(entityName, routeSpec, inputJson, asJson = false) {
+  progress(asJson, "\u{1F5A5}\uFE0F  Testing web app route...");
+  progress(asJson, "\u{1F4E6} Compiling code first...");
+  await compileQuietly(asJson);
+  const { apiKey, agentId, config } = await loadAuthOrFail();
+  const manifest = loadManifest();
+  const apps = getPrimitivesByKind(manifest, PrimitiveKind.WEB_APP);
+  if (apps.length === 0) {
+    console.error("\u274C No web apps found in compiled output.");
+    console.log("\u{1F4A1} Define one with defineWebApp and list it under `webApps` on your LuaAgent.");
+    return;
+  }
+  const app = await selectEntityOrPrompt({
+    items: apps,
+    entityName,
+    entityType: "Web app",
+    idProperty: "name",
+    nameProperty: "name",
+    promptMessage: "Select a web app:",
+    formatChoice: /* @__PURE__ */ __name((a) => `${a.name} (${a.routes.length} route(s))`, "formatChoice"),
+    asJson
+  });
+  if (!app) {
+    console.log("Test cancelled.");
+    return;
+  }
+  let spec = routeSpec;
+  if (!spec) {
+    if (asJson) {
+      throw CliError.usage("--route is required with --json, e.g. --route 'GET /tickets?status=open'");
+    }
+    const answer = await safePrompt([
+      {
+        type: "input",
+        name: "route",
+        message: "Route to call (METHOD /path?query):",
+        default: app.routes[0] ? `${app.routes[0].method} ${app.routes[0].path}` : "GET /"
+      }
+    ]);
+    if (!answer) {
+      console.log("Test cancelled.");
+      return;
+    }
+    spec = answer.route;
+  }
+  let parsed;
+  try {
+    parsed = parseRouteSpec(spec);
+  } catch (error) {
+    throw CliError.usage(error.message);
+  }
+  const matched = matchManifestRoute(app.routes, parsed.method, parsed.path);
+  if (!matched && !app.hasFetch) {
+    throw CliError.usage(`No route of ${app.name} matches ${parsed.method} ${parsed.path}.`, [
+      "Routes:",
+      ...app.routes.map((r) => `  ${r.key}`)
+    ].join("\n"));
+  }
+  const input = inputJson ? parseJsonInputOrFail(inputJson, '{"body": {...}, "headers": {"x-custom": "..."}}') : {};
+  const auth = await developerAuth(apiKey, agentId, config);
+  const yamlApp = config?.webApps?.find((a) => a.name === app.name);
+  const webRouteInput = buildWebRouteInput({
+    spec: parsed,
+    route: matched,
+    body: input.body,
+    headers: input.headers,
+    auth,
+    app: {
+      id: yamlApp?.webAppId || "local",
+      name: app.name,
+      version: yamlApp?.version || "0.0.0"
+    }
+  });
+  progress(asJson, `
+\u{1F680} ${parsed.method} ${parsed.path}${matched ? `  \u2192  ${matched.key}` : "  \u2192  fetch"}`);
+  const appCode = loadArtifact(app, process.cwd());
+  await withSandboxEnv(async () => {
+    try {
+      const result = await executeWebRoute({
+        appCode,
+        input: webRouteInput,
+        apiKey,
+        agentId
+      });
+      if (asJson) {
+        console.log(JSON.stringify(result, null, 2));
+      } else {
+        const ok = result.status < 400;
+        (ok ? success : (_, m) => console.error(m))(asJson, `
+${ok ? "\u2705" : "\u26A0\uFE0F "} ${result.status}`);
+        for (const [name, value3] of Object.entries(result.headers ?? {})) console.log(`${name}: ${value3}`);
+        if (result.body) {
+          console.log(result.body.kind === "json" ? JSON.stringify(result.body.value, null, 2) : result.body.kind === "text" ? result.body.value : `<${Buffer.from(result.body.value, "base64").length} bytes, base64>`);
+        }
+      }
+      if (result.status >= 500) process.exitCode = 1;
+    } catch (error) {
+      handleExecutionError(error, "Web app route", asJson);
+    }
+  });
+}
+__name(testWebApp, "testWebApp");
 async function testJob(entityName, asJson = false) {
   progress(asJson, "\u23F0 Testing job...");
   progress(asJson, "\u{1F4E6} Compiling code first...");
@@ -44487,10 +45614,11 @@ async function pushVersionedPrimitive(handler, options = {}) {
     }
     const manifest = loadManifest();
     const bundleAccumulator = /* @__PURE__ */ new Map();
-    const pushData = handler.prepareForPush(manifest, selected.name, void 0, bundleAccumulator);
-    if (!pushData) {
+    const prepared = handler.prepareForPush(manifest, selected.name, void 0, bundleAccumulator);
+    if (!prepared) {
       throw new Error(`${handler.displayName} "${selected.name}" not found in compiled output.`);
     }
+    const pushData = handler.completePushData ? await handler.completePushData(prepared, manifest, selected.name, bundleAccumulator) : prepared;
     let bundleStats = {
       total: 0,
       alreadyExisted: 0,
@@ -44520,6 +45648,12 @@ async function pushVersionedPrimitive(handler, options = {}) {
     writeSuccess(`
 \u2705 Successfully pushed ${selected.name} v${confirmedVersion}
 `);
+    if (handler.kind === PrimitiveKind.WEB_APP) {
+      return {
+        productionDeploySucceeded: false,
+        bundleStats
+      };
+    }
     if (await shouldDeployAfterPush(options)) {
       const deployedOk = await genericDeployAfterPush(handler, apiKey, agentId, entityId, selected.name, confirmedVersion, options.autoDeploy || false);
       return {
@@ -44666,6 +45800,8 @@ async function pushCommand(type, cmdObj) {
       versionedPushDeployResult = await pushVersionedPrimitive(voiceHandler, options);
     } else if (selectedType === "workflow") {
       versionedPushDeployResult = await pushVersionedPrimitive(workflowHandler, options);
+    } else if (selectedType === "webapp") {
+      versionedPushDeployResult = await pushVersionedPrimitive(webAppHandler, options);
     } else if (selectedType === "mcp") {
       const mcpActivated = await pushMCPServer(options);
       versionedPushDeployResult = {
@@ -44785,6 +45921,21 @@ Until the backup catches up, \`lua init\` for this agent will restore an older s
         });
       } else if (selectedType === "backup") {
       } else if (selectedType === "agent") {
+      } else if (selectedType === "webapp") {
+        writeHintBlock({
+          headline: `Staged but NOT live yet. ${WEB_APP_GOES_LIVE_WITH_AGENT_VERSION}`,
+          lines: [
+            {
+              label: "Snapshot:",
+              command: "lua version create"
+            },
+            {
+              label: "Go live:",
+              command: "lua version promote"
+            }
+          ],
+          when: "success"
+        });
       } else if (deployHint) {
         writeHintBlock({
           headline: "Staged but NOT live yet. To make it active:",
@@ -45067,7 +46218,8 @@ async function pushAllCommand(options) {
     preprocessor: "\u{1F4E5}",
     postprocessor: "\u{1F4E4}",
     device: "\u{1F4E1}",
-    voice: "\u{1F399}\uFE0F"
+    voice: "\u{1F399}\uFE0F",
+    "web-app": "\u{1F5A5}\uFE0F"
   };
   const handlers = [
     skillHandler,
@@ -45083,7 +46235,10 @@ async function pushAllCommand(options) {
     postprocessorHandler,
     deviceHandler,
     deviceTriggerHandler,
-    voiceHandler
+    voiceHandler,
+    // Lua Apps: pushed (route bundle + page build) like any versioned kind, never deployed here —
+    // a web app version goes live with the agent version that pins it.
+    webAppHandler
   ];
   const handlerItems = handlers.map((handler) => ({
     handler,
@@ -45117,11 +46272,12 @@ ${icon} Pushing ${items.length} ${handler.displayName}(s)...`);
     for (const item of items) {
       try {
         const bundleAccumulator = /* @__PURE__ */ new Map();
-        const pushData = handler.prepareForPush(manifest, item.name, void 0, bundleAccumulator);
-        if (!pushData) {
+        const prepared = handler.prepareForPush(manifest, item.name, void 0, bundleAccumulator);
+        if (!prepared) {
           console.warn(`\u26A0\uFE0F  ${handler.displayName} "${item.name}" not found in compiled output, skipping`);
           continue;
         }
+        const pushData = handler.completePushData ? await handler.completePushData(prepared, manifest, item.name, bundleAccumulator) : prepared;
         if (bundleAccumulator.size > 0) {
           const stats = await ensureBundlesUploaded(apiKey, agentId, bundleAccumulator);
           bundleStatsAggregate.total += stats.total;
@@ -45179,7 +46335,8 @@ ${icon} Pushing ${items.length} ${handler.displayName}(s)...`);
           entityId
         });
         writeSuccess(`  \u2705 ${item.name} v${newVersion} pushed`);
-        if (options.autoDeploy) {
+        if (handler.kind === PrimitiveKind.WEB_APP) {
+        } else if (options.autoDeploy) {
           toDeploy.push({
             handler,
             name: item.name,
@@ -45318,7 +46475,8 @@ Until the backup catches up, \`lua init\` for this agent will restore an older s
     jobs: "\u23F0",
     preprocessors: "\u{1F4E5}",
     postprocessors: "\u{1F4E4}",
-    voices: "\u{1F399}\uFE0F"
+    voices: "\u{1F399}\uFE0F",
+    "web apps": "\u{1F5A5}\uFE0F"
   };
   for (const [kind, items] of byKind) {
     const icon = summaryIcons[kind] || "\u{1F4E6}";
@@ -47681,8 +48839,8 @@ init_cli();
 init_constants();
 init_command_utils();
 init_developer_api_service();
-import fs18 from "fs";
-import path25 from "path";
+import fs19 from "fs";
+import path27 from "path";
 import inquirer10 from "inquirer";
 init_analytics();
 init_cli_error();
@@ -48031,10 +49189,10 @@ function variablesToEnvContent(variables) {
 }
 __name(variablesToEnvContent, "variablesToEnvContent");
 function saveSandboxEnvVariables(variables) {
-  const envFilePath = path25.join(process.cwd(), ".env");
+  const envFilePath = path27.join(process.cwd(), ".env");
   try {
     const content = variablesToEnvContent(variables);
-    fs18.writeFileSync(envFilePath, content, "utf8");
+    fs19.writeFileSync(envFilePath, content, "utf8");
     return true;
   } catch (error) {
     console.error("\u274C Error saving .env file:", error);
@@ -50490,6 +51648,7 @@ async function listChannelsInteractive(agentApi, agentId, config) {
   clearPromptLines(2);
   const selectedChannel = channels[selectedIndex];
   displayChannelDetails(selectedChannel);
+  if (selectedChannel.type === "slack") await slackConnectionActions(agentApi, agentId, selectedChannel);
 }
 __name(listChannelsInteractive, "listChannelsInteractive");
 function displayChannelDetails(channel) {
@@ -50617,6 +51776,20 @@ function displaySlackDetails(channel) {
     if (channel.data.botId) {
       writeInfo(`Bot ID:         ${channel.data.botId}`);
     }
+    const status = channel.data.status;
+    if (status === "uninstalled") {
+      writeInfo("Status:         uninstalled in Slack \u2014 reinstall the app to reconnect");
+    } else if (status === "pending_setup" || status === "pending_oauth") {
+      writeInfo("Status:         not installed yet \u2014 get an install link below");
+    }
+    const setup = channel.data.setup;
+    if (setup) {
+      writeInfo(`Signing secret: ${SLACK_SIGNING_LABELS[setup.signing]}`);
+      if (setup.updateAvailable) {
+        const missing = setup.missingRequired.length ? ` (missing: ${setup.missingRequired.join(", ")})` : "";
+        writeInfo(`Update:         available${missing} \u2014 choose "Show the update steps" below`);
+      }
+    }
   }
 }
 __name(displaySlackDetails, "displaySlackDetails");
@@ -50888,8 +52061,97 @@ To complete the email channel setup, configure email forwarding:`);
   }
 }
 __name(createEmailChannel, "createEmailChannel");
+var SLACK_SIGNING_SECRET = /^[0-9A-Za-z]{32}$/;
+var SLACK_SIGNING_LABELS = {
+  none: "not saved \u2014 Slack events are not verified",
+  verifying: "saved, waiting for the first event to confirm it",
+  mismatch: "saved, but Slack's events don't match it \u2014 paste it again",
+  failing: "an event didn't match it and was rejected \u2014 if you regenerated it in Slack, paste the new one; otherwise this clears with the next real message",
+  verified: "verified \u2014 events that fail the check are rejected"
+};
+function slackSigningSecretPrompt() {
+  return {
+    type: "password",
+    name: "signingSecret",
+    message: "Enter the Slack app Signing Secret (Basic Information \u2192 App Credentials):",
+    mask: "*",
+    validate: /* @__PURE__ */ __name((input, answers) => {
+      const value3 = input.trim();
+      if (!SLACK_SIGNING_SECRET.test(value3)) return "The signing secret is 32 letters and digits";
+      if (answers?.clientSecret && value3 === answers.clientSecret.trim()) {
+        return "That's the Client Secret. Paste the Signing Secret, just below it";
+      }
+      return true;
+    }, "validate")
+  };
+}
+__name(slackSigningSecretPrompt, "slackSigningSecretPrompt");
+async function offerToOpen(url, question) {
+  const { openIt } = await inquirer12.prompt([
+    {
+      type: "confirm",
+      name: "openIt",
+      message: question,
+      default: true
+    }
+  ]);
+  if (openIt) await open5(url);
+}
+__name(offerToOpen, "offerToOpen");
+async function startSlackApp(agentApi, agentId, kind) {
+  const { source } = await inquirer12.prompt([
+    {
+      type: "list",
+      name: "source",
+      message: "Which Slack app?",
+      choices: [
+        {
+          name: "Create a new app from Lua\u2019s manifest (recommended)",
+          value: "new"
+        },
+        {
+          name: "I already have a Slack app",
+          value: "existing"
+        }
+      ]
+    }
+  ]);
+  if (source === "existing") return true;
+  const response = await agentApi.getSlackManifest(agentId);
+  const createAppUrl = response.success ? response.data?.createAppUrl : void 0;
+  if (!createAppUrl) {
+    throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Could not prepare the Slack app", response.error?.error);
+  }
+  writeInfo("\n1. Create the app. Slack opens with it named after your agent, with its permissions and events.");
+  writeInfo("   Pick the workspace, then click Next and Create and Install:");
+  console.log(`
+   ${createAppUrl}
+`);
+  await offerToOpen(createAppUrl, "Open it in your browser?");
+  writeInfo("   If Slack says the Request URL didn't respond, click Retry under Event Subscriptions.");
+  if (kind === "private") {
+    writeInfo("2. In the new app: Install App \u2192 Install to Workspace \u2192 Allow, then copy the Bot User OAuth Token.");
+    writeInfo("3. Basic Information \u2192 App Credentials: copy the Signing Secret.\n");
+  } else {
+    writeInfo("2. Basic Information \u2192 App Credentials: copy the App ID, Client ID, Client Secret and Signing Secret.\n");
+  }
+  return false;
+}
+__name(startSlackApp, "startSlackApp");
+var slackManifestEditorUrl = /* @__PURE__ */ __name((appId, teamId) => teamId ? `https://app.slack.com/app-settings/${teamId}/${appId}/app-manifest` : `https://api.slack.com/apps/${appId}`, "slackManifestEditorUrl");
+function printManifestUpdate(manifestUrl, manifest) {
+  writeInfo("\nUpdate the app with Lua\u2019s manifest:");
+  writeInfo(`  1. Open ${manifestUrl}`);
+  writeInfo("  2. Paste this on the JSON tab and click Save Changes");
+  writeInfo("  3. Reinstall the app when Slack asks");
+  writeInfo("  Saving replaces the app's settings in Slack: add anything you set up there yourself (slash commands, extra permissions) to the manifest first.\n");
+  console.log(JSON.stringify(manifest, null, 2));
+  console.log();
+}
+__name(printManifestUpdate, "printManifestUpdate");
 async function createSlackPrivateChannel(agentApi, agentId) {
   writeInfo("\u{1F512} Creating Private Slack Channel\n");
+  const existingApp = await startSlackApp(agentApi, agentId, "private");
   const answers = await inquirer12.prompt([
     {
       type: "password",
@@ -50905,13 +52167,15 @@ async function createSlackPrivateChannel(agentApi, agentId) {
         }
         return true;
       }, "validate")
-    }
+    },
+    slackSigningSecretPrompt()
   ]);
   const channelData = {
     type: "slack",
     slack: {
       type: "private",
-      accessToken: answers.accessToken.trim()
+      accessToken: answers.accessToken.trim(),
+      signingSecret: answers.signingSecret.trim()
     }
   };
   writeInfo("\n\u{1F4E1} Creating Slack private channel...");
@@ -50920,19 +52184,16 @@ async function createSlackPrivateChannel(agentApi, agentId) {
     throw channelCreateError(response.error, "This Slack workspace is already connected to this agent.");
   }
   const data = response.data;
-  if ("slack" in data && "botName" in data.slack) {
-    writeSuccess("\n\u2705 Slack private channel created successfully!\n");
-    writeInfo(`\u{1F916} Bot Name: ${data.slack.botName}`);
-    writeInfo(`\u{1F3E2} Workspace: ${data.slack.url}`);
-    writeInfo(`\u{1F194} Bot ID: ${data.slack.botId}`);
-    writeInfo(`Ensure your app Manifest is configured correctly. Below is an example:
-`);
-    writeInfo(JSON.stringify(data.slack.manifest, null, 2));
-  }
+  writeSuccess("\n\u2705 Slack private channel created successfully!\n");
+  writeInfo(`\u{1F916} Bot Name: ${data.botName}`);
+  writeInfo(`\u{1F3E2} Workspace: ${data.teamName || data.url}`);
+  if (existingApp) printManifestUpdate(slackManifestEditorUrl(data.appId, data.teamId), data.manifest);
+  writeInfo("\u{1F4AC} Send the bot a message in Slack: the first event confirms the signing secret.");
 }
 __name(createSlackPrivateChannel, "createSlackPrivateChannel");
 async function createSlackPublicChannel(agentApi, agentId) {
   writeInfo("\u{1F310} Creating Public Slack Channel\n");
+  const existingApp = await startSlackApp(agentApi, agentId, "public");
   const answers = await inquirer12.prompt([
     {
       type: "input",
@@ -50955,10 +52216,9 @@ async function createSlackPublicChannel(agentApi, agentId) {
       name: "clientSecret",
       message: "Enter Slack client secret:",
       mask: "*",
-      validate: /* @__PURE__ */ __name((input) => {
-        return input.trim().length > 0 || "Client secret is required";
-      }, "validate")
-    }
+      validate: /* @__PURE__ */ __name((input) => input.trim().length > 0 || "Client secret is required", "validate")
+    },
+    slackSigningSecretPrompt()
   ]);
   const channelData = {
     type: "slack",
@@ -50966,7 +52226,8 @@ async function createSlackPublicChannel(agentApi, agentId) {
       type: "public",
       appId: answers.appId.trim(),
       clientId: answers.clientId.trim(),
-      clientSecret: answers.clientSecret.trim()
+      clientSecret: answers.clientSecret.trim(),
+      signingSecret: answers.signingSecret.trim()
     }
   };
   writeInfo("\n\u{1F4E1} Creating Slack public channel...");
@@ -50975,19 +52236,84 @@ async function createSlackPublicChannel(agentApi, agentId) {
     throw channelCreateError(response.error, "This Slack app is already connected to this agent.");
   }
   const data = response.data;
-  if ("redirectUri" in data) {
-    writeSuccess("\n\u2705 Slack public channel created successfully!\n");
-    writeInfo(`\u{1F194} App ID: ${data.appId}`);
-    writeInfo(`\u{1F517} Redirect URI: ${data.redirectUri}`);
-    writeInfo(`\u{1F517} Webhook URL: ${data.webhookUrl}
+  writeSuccess("\n\u2705 Slack public channel created successfully!\n");
+  writeInfo(`\u{1F194} App ID: ${data.appId}`);
+  if (existingApp) printManifestUpdate(slackManifestEditorUrl(data.appId), data.manifest);
+  writeInfo("Last step: install the app in your workspace (the link works for 30 minutes):");
+  console.log(`
+   ${data.installUrl}
 `);
-    writeInfo(`\u{1F517} Install URL: https://auth.heylua.ai/slack/install/${data.appId}`);
-    writeInfo(`Ensure your app Manifest is configured correctly. Below is an example:
+  await offerToOpen(data.installUrl, "Open it in your browser?");
+  writeInfo("After you allow it, Slack shows Lua's result page. For a new link later: lua channels \u2192 List \u2192 this connection.");
+}
+__name(createSlackPublicChannel, "createSlackPublicChannel");
+async function slackConnectionActions(agentApi, agentId, channel) {
+  if (!channel.id) return;
+  const choices = [
+    {
+      name: "Show the update steps and manifest",
+      value: "manifest"
+    },
+    {
+      name: "Add or replace the signing secret",
+      value: "secret"
+    },
+    {
+      name: "Re-check permissions with Slack",
+      value: "check"
+    }
+  ];
+  if (channel.data?.type === "public") choices.push({
+    name: "Get an install link",
+    value: "install"
+  });
+  choices.push({
+    name: "\u2190 Back",
+    value: "back"
+  });
+  const { action } = await inquirer12.prompt([
+    {
+      type: "list",
+      name: "action",
+      message: "What would you like to do?",
+      choices
+    }
+  ]);
+  if (action === "manifest") {
+    const response = await agentApi.getSlackManifest(agentId, channel.id);
+    if (!response.success || !response.data) throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Could not load the manifest");
+    printManifestUpdate(response.data.manifestUrl ?? slackManifestEditorUrl(channel.data.appId, channel.data.teamId), response.data.manifest);
+    writeInfo("Then save the signing secret here and check again.");
+  } else if (action === "secret") {
+    const { signingSecret } = await inquirer12.prompt([
+      slackSigningSecretPrompt()
+    ]);
+    const response = await agentApi.saveSlackSigningSecret(agentId, channel.identifier, signingSecret.trim());
+    if (!response.success) throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Could not save the signing secret");
+    writeSuccess("\u2705 Signing secret saved. The next message the bot receives confirms it.");
+  } else if (action === "check") {
+    const response = await agentApi.checkSlackConnection(agentId, channel.id);
+    if (!response.success || !response.data) throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Could not reach Slack");
+    const { status, setup } = response.data;
+    if (status === "uninstalled") {
+      writeInfo("\u26A0\uFE0F  Slack says this app is no longer installed. Reinstall it, then reconnect.");
+    } else if (setup.missingRequired.length) {
+      writeInfo(`\u26A0\uFE0F  Missing required permissions: ${setup.missingRequired.join(", ")}. Update the manifest and reinstall.`);
+    } else {
+      writeSuccess(`\u2705 Slack answered. Signing secret: ${SLACK_SIGNING_LABELS[setup.signing]}.`);
+    }
+    if (setup.missingOptional.length) writeInfo(`Optional permissions not granted: ${setup.missingOptional.join(", ")}.`);
+  } else if (action === "install") {
+    const response = await agentApi.getSlackInstallUrl(agentId, channel.id);
+    if (!response.success || !response.data) throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Could not get an install link");
+    writeInfo("Install link (works for 30 minutes):");
+    console.log(`
+   ${response.data.installUrl}
 `);
-    writeInfo(JSON.stringify(data.manifest, null, 2));
+    await offerToOpen(response.data.installUrl, "Open it in your browser?");
   }
 }
-__name(createSlackPublicChannel, "createSlackPublicChannel");
+__name(slackConnectionActions, "slackConnectionActions");
 
 // src/commands/logs.ts
 init_cli();
@@ -51922,8 +53248,8 @@ var DrainsApi = class extends HttpClient {
   * answer is a plain `LogDrainRead` and is safe to retry; minting is not.
   */
   async rotateSecret(drainId, finalize) {
-    const path27 = this.drainPath(drainId, `/rotate-secret${finalize ? "?finalize=true" : ""}`);
-    return finalize ? this.httpPost(path27, {}) : this.httpPostOnce(path27, {});
+    const path30 = this.drainPath(drainId, `/rotate-secret${finalize ? "?finalize=true" : ""}`);
+    return finalize ? this.httpPost(path30, {}) : this.httpPostOnce(path30, {});
   }
   /**
   * Re-enqueue one batch's records (PRO-2126).
@@ -52003,8 +53329,8 @@ function printJson(payload) {
   console.log(JSON.stringify(payload, null, 2));
 }
 __name(printJson, "printJson");
-function emitAside(line, json) {
-  if (json) process.stderr.write(`${line}
+function emitAside(line, json2) {
+  if (json2) process.stderr.write(`${line}
 `);
   else writeInfo(line);
 }
@@ -52429,48 +53755,48 @@ function verificationCurl(type, endpoint, headers) {
   ];
 }
 __name(verificationCurl, "verificationCurl");
-function bucketVerificationInstructions(drain, json) {
+function bucketVerificationInstructions(drain, json2) {
   const prefix = drain.bucket?.prefix;
   const where = prefix ? `${prefix}/_lua-verify-*` : "_lua-verify-*";
   const bucket = drain.bucket?.bucket ?? "<your bucket>";
   const endpointArg = drain.bucket?.endpoint ? ` --endpoint-url '${drain.bucket.endpoint}'` : "";
-  emitAside("Lua writes a challenge object into the bucket itself \u2014 nothing is POSTed to a URL.", json);
-  emitAside("Check the credentials can write under the prefix first:", json);
-  emitAside("", json);
-  emitAside(`  aws s3 cp - 's3://${bucket}/${prefix ? `${prefix}/` : ""}_lua-write-check'${endpointArg} </dev/null`, json);
-  emitAside("", json);
-  emitAside("  (a zero-byte object, yours to delete \u2014 a write-only role cannot remove it itself)", json);
-  emitAside("", json);
-  emitAside(`Then:  lua drains verify ${drain.id}`, json);
-  emitAside("", json);
-  emitAside("That is what mints the challenge, and how it settles depends on the role:", json);
-  emitAside("  \xB7 with s3:GetObject, Lua reads the object back and 'verify' finishes on its own;", json);
-  emitAside("  \xB7 write-only \u2014 the grant we recommend \u2014 leaves the claim open. List the prefix", json);
-  emitAside(`    for ${where}, take the <token> off the object name, and run:`, json);
-  emitAside("", json);
-  emitAside(`  lua drains confirm ${drain.id} --token <token>`, json);
+  emitAside("Lua writes a challenge object into the bucket itself \u2014 nothing is POSTed to a URL.", json2);
+  emitAside("Check the credentials can write under the prefix first:", json2);
+  emitAside("", json2);
+  emitAside(`  aws s3 cp - 's3://${bucket}/${prefix ? `${prefix}/` : ""}_lua-write-check'${endpointArg} </dev/null`, json2);
+  emitAside("", json2);
+  emitAside("  (a zero-byte object, yours to delete \u2014 a write-only role cannot remove it itself)", json2);
+  emitAside("", json2);
+  emitAside(`Then:  lua drains verify ${drain.id}`, json2);
+  emitAside("", json2);
+  emitAside("That is what mints the challenge, and how it settles depends on the role:", json2);
+  emitAside("  \xB7 with s3:GetObject, Lua reads the object back and 'verify' finishes on its own;", json2);
+  emitAside("  \xB7 write-only \u2014 the grant we recommend \u2014 leaves the claim open. List the prefix", json2);
+  emitAside(`    for ${where}, take the <token> off the object name, and run:`, json2);
+  emitAside("", json2);
+  emitAside(`  lua drains confirm ${drain.id} --token <token>`, json2);
 }
 __name(bucketVerificationInstructions, "bucketVerificationInstructions");
 function verificationInstructions(drain, headers, options) {
   const type = drain.type;
-  const json = options.json;
-  emitAside("", json);
-  emitAside("Before anything is delivered, Lua has to confirm you own this destination.", json);
+  const json2 = options.json;
+  emitAside("", json2);
+  emitAside("Before anything is delivered, Lua has to confirm you own this destination.", json2);
   if (type === "s3") {
-    bucketVerificationInstructions(drain, json);
+    bucketVerificationInstructions(drain, json2);
     return;
   }
   if (TOKEN_ECHO_TYPES.includes(type)) {
-    emitAside("Lua POSTs one record carrying an X-Lua-Verify header; your receiver must answer 2xx AND", json);
-    emitAside("repeat that header back on the response. Check yours first:", json);
+    emitAside("Lua POSTs one record carrying an X-Lua-Verify header; your receiver must answer 2xx AND", json2);
+    emitAside("repeat that header back on the response. Check yours first:", json2);
   } else {
-    emitAside("Lua POSTs one record to the intake; any 2xx from the vendor verifies the drain.", json);
-    emitAside("Check the credentials reach the intake first:", json);
+    emitAside("Lua POSTs one record to the intake; any 2xx from the vendor verifies the drain.", json2);
+    emitAside("Check the credentials reach the intake first:", json2);
   }
-  emitAside("", json);
-  for (const line of verificationCurl(type, drain.endpoint, headers)) emitAside(`  ${line}`, json);
-  emitAside("", json);
-  emitAside(`Then:  lua drains verify ${drain.id}`, json);
+  emitAside("", json2);
+  for (const line of verificationCurl(type, drain.endpoint, headers)) emitAside(`  ${line}`, json2);
+  emitAside("", json2);
+  emitAside(`Then:  lua drains verify ${drain.id}`, json2);
 }
 __name(verificationInstructions, "verificationInstructions");
 async function createDrainCore(context, options) {
@@ -54662,7 +55988,7 @@ import chalk3 from "chalk";
 import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
 import { join as join10 } from "path";
 import { performance } from "perf_hooks";
-import * as os from "os";
+import * as os2 from "os";
 init_semver();
 init_version_check();
 init_constants();
@@ -54702,9 +56028,9 @@ function gatherEnvironment(currentVersion) {
     cliVersion: currentVersion,
     channel: detectChannel(currentVersion),
     nodeVersion: process.version,
-    platform: os.platform(),
-    arch: os.arch(),
-    osRelease: os.release(),
+    platform: os2.platform(),
+    arch: os2.arch(),
+    osRelease: os2.release(),
     installMethod: detectInstallMethod(process.execPath),
     execPath: process.execPath,
     configDir: CLI_CONFIG_DIR,
@@ -56220,12 +57546,12 @@ function resolveTrigger(triggers, ref) {
   return trigger;
 }
 __name(resolveTrigger, "resolveTrigger");
-function displayTriggersCore(triggers, json) {
+function displayTriggersCore(triggers, json2) {
   trackEvent("cli_triggers_list", {
     triggers_count: triggers.length,
-    json_output: json
+    json_output: json2
   });
-  if (json) {
+  if (json2) {
     console.log(JSON.stringify(triggers.map((t) => ({
       id: t.id,
       name: t.name,
@@ -56373,7 +57699,7 @@ function snippet(value3, maxLength = 100) {
   return text.length > maxLength ? `${text.substring(0, maxLength)}...` : text;
 }
 __name(snippet, "snippet");
-async function fetchAndDisplayLogsCore(context, trigger, limit, json) {
+async function fetchAndDisplayLogsCore(context, trigger, limit, json2) {
   const triggerApi = triggerApiFor(context);
   const response = await triggerApi.getTriggerExecutions(trigger.id, {
     limit
@@ -56381,7 +57707,7 @@ async function fetchAndDisplayLogsCore(context, trigger, limit, json) {
   trackEvent("cli_triggers_logs", {
     trigger_name: trigger.name,
     limit,
-    json_output: json,
+    json_output: json2,
     success: !!response.success
   });
   if (!response.success || !response.data) {
@@ -56389,7 +57715,7 @@ async function fetchAndDisplayLogsCore(context, trigger, limit, json) {
     return false;
   }
   const { executions = [], total } = response.data;
-  if (json) {
+  if (json2) {
     console.log(JSON.stringify(response.data, null, 2));
     return true;
   }
@@ -57971,9 +59297,9 @@ init_lua_fetch();
 init_compiler();
 init_types();
 init_cli_error();
-import fs19 from "fs";
-import os2 from "os";
-import path26 from "path";
+import fs20 from "fs";
+import os3 from "os";
+import path28 from "path";
 var EXPORT_NOT_COMPILABLE = "export-not-compilable";
 var EXPORT_CHECK_TSCONFIG = {
   compilerOptions: {
@@ -57994,13 +59320,13 @@ var EXPORT_CHECK_TSCONFIG = {
   ]
 };
 async function dryCompileWorkflowExport(files) {
-  const root = fs19.mkdtempSync(path26.join(os2.tmpdir(), "lua-workflows-export-"));
+  const root = fs20.mkdtempSync(path28.join(os3.tmpdir(), "lua-workflows-export-"));
   const issues = [];
   const workflows = [];
   try {
-    fs19.writeFileSync(path26.join(root, "tsconfig.json"), `${JSON.stringify(EXPORT_CHECK_TSCONFIG, null, 2)}
+    fs20.writeFileSync(path28.join(root, "tsconfig.json"), `${JSON.stringify(EXPORT_CHECK_TSCONFIG, null, 2)}
 `);
-    fs19.writeFileSync(path26.join(root, "package.json"), `${JSON.stringify({
+    fs20.writeFileSync(path28.join(root, "package.json"), `${JSON.stringify({
       name: "lua-workflows-export-check",
       version: "0.0.0",
       private: true,
@@ -58008,23 +59334,23 @@ async function dryCompileWorkflowExport(files) {
     }, null, 2)}
 `);
     for (const f of files) {
-      const target = path26.resolve(root, f.path);
-      if (!target.startsWith(root + path26.sep)) continue;
-      fs19.mkdirSync(path26.dirname(target), {
+      const target = path28.resolve(root, f.path);
+      if (!target.startsWith(root + path28.sep)) continue;
+      fs20.mkdirSync(path28.dirname(target), {
         recursive: true
       });
-      fs19.writeFileSync(target, f.contents);
+      fs20.writeFileSync(target, f.contents);
     }
     const result = await new Compiler({
       rootDir: root,
-      outDir: path26.join(root, "dist-v2"),
+      outDir: path28.join(root, "dist-v2"),
       minify: false,
       sourceMaps: false,
       quietWarnings: true,
       runtimeValidation: false
     }).compile();
     for (const e of result.errors) {
-      const file = e.file ? path26.relative(root, e.file) : void 0;
+      const file = e.file ? path28.relative(root, e.file) : void 0;
       const where = file ? `${file}${e.line ? `:${e.line}` : ""}` : void 0;
       issues.push({
         code: EXPORT_NOT_COMPILABLE,
@@ -58059,7 +59385,7 @@ async function dryCompileWorkflowExport(files) {
     });
   } finally {
     if (debugEnabled()) console.error(`\u{1F41B} export check project kept at ${root}`);
-    else fs19.rmSync(root, {
+    else fs20.rmSync(root, {
       recursive: true,
       force: true
     });
@@ -58114,7 +59440,7 @@ async function workflowsCommand(action, target, extra, cmdObj) {
       const options = {
         ...cmdObj ?? {}
       };
-      const json = !!options.json;
+      const json2 = !!options.json;
       let resolved;
       if (action) {
         resolved = validateOrSuggest("workflows.action", action);
@@ -58157,14 +59483,14 @@ async function workflowsCommand(action, target, extra, cmdObj) {
         return;
       }
       const { agentId, orgId, apiKey } = await initializeCommand({
-        showProgress: !json
+        showProgress: !json2
       });
       const ctx = {
         agentId,
         orgId,
         apiKey,
         api: new WorkflowApi(BASE_URLS.API, apiKey, agentId),
-        json
+        json: json2
       };
       const code = await executeAction(ctx, resolved, target, extra, options);
       if (code !== void 0 && code !== 0) process.exitCode = code;
@@ -59914,15 +61240,15 @@ function actorLabel(by, now = Date.now()) {
   return Number.isFinite(at) ? `${who} (${agoFrom(at, now)})` : who;
 }
 __name(actorLabel, "actorLabel");
-function reservedSecretKeyPaths(value3, path27 = "", depth = 0, out = []) {
+function reservedSecretKeyPaths(value3, path30 = "", depth = 0, out = []) {
   if (depth > 64 || out.length >= 20 || value3 === null || typeof value3 !== "object") return out;
   if (Array.isArray(value3)) {
-    value3.forEach((v, i) => reservedSecretKeyPaths(v, `${path27}[${i}]`, depth + 1, out));
+    value3.forEach((v, i) => reservedSecretKeyPaths(v, `${path30}[${i}]`, depth + 1, out));
     return out;
   }
   for (const [k, v] of Object.entries(value3)) {
     if (out.length >= 20) break;
-    const child = path27 ? `${path27}.${k}` : k;
+    const child = path30 ? `${path30}.${k}` : k;
     if (isWorkflowSecretKey(k) && v !== null && v !== void 0 && typeof v !== "object") out.push(child);
     else reservedSecretKeyPaths(v, child, depth + 1, out);
   }
@@ -60382,11 +61708,11 @@ async function exportCore(ctx, name, o) {
     if (!ctx.json && res.error?.statusCode === 404 && code === "VERSION_NOT_FOUND") console.error(`\u274C "${wf.name}" has no active version to export \u2014 pass -v <version|latest>`);
     return apiFailure(ctx, res, "export");
   }
-  const fs20 = await import("fs");
-  const path27 = await import("path");
-  const outDir = path27.resolve(o.out ?? ".");
+  const fs22 = await import("fs");
+  const path30 = await import("path");
+  const outDir = path30.resolve(o.out ?? ".");
   const d = res.data;
-  const escaping = d.files.filter((f) => !path27.resolve(outDir, f.path).startsWith(outDir + path27.sep));
+  const escaping = d.files.filter((f) => !path30.resolve(outDir, f.path).startsWith(outDir + path30.sep));
   if (escaping.length > 0) {
     if (ctx.json) {
       emitJson(ctx, {
@@ -60445,17 +61771,17 @@ async function exportCore(ctx, name, o) {
     }, null, 2));
     return WORKFLOW_EXIT.OK;
   }
-  const clash = d.files.filter((f) => fs20.existsSync(path27.join(outDir, f.path)));
+  const clash = d.files.filter((f) => fs22.existsSync(path30.join(outDir, f.path)));
   if (clash.length > 0 && !o.force) {
     console.error(`\u274C export: ${clash.map((f) => f.path).join(", ")} already exist${clash.length === 1 ? "s" : ""} under ${outDir} \u2014 pass --force to overwrite, or --out <dir>`);
     return WORKFLOW_EXIT.API;
   }
   for (const f of d.files) {
-    const target = path27.join(outDir, f.path);
-    fs20.mkdirSync(path27.dirname(target), {
+    const target = path30.join(outDir, f.path);
+    fs22.mkdirSync(path30.dirname(target), {
       recursive: true
     });
-    fs20.writeFileSync(target, f.contents);
+    fs22.writeFileSync(target, f.contents);
     console.log(`   ${f.path}`);
   }
   const written = `exported "${wf.name}" v${d.version} (${d.form} form) \u2014 ${d.files.length} file(s) under ${outDir}`;
@@ -60495,9 +61821,9 @@ var archiveDownload = {
   }, "fetchBytes")
 };
 async function archiveRunsCore(ctx, o) {
-  const fs20 = await import("fs");
-  const path27 = await import("path");
-  const crypto5 = await import("crypto");
+  const fs22 = await import("fs");
+  const path30 = await import("path");
+  const crypto6 = await import("crypto");
   const now = Date.now();
   const since = parseSinceFlag(o.since, now);
   if (!Number.isFinite(since)) {
@@ -60527,13 +61853,13 @@ async function archiveRunsCore(ctx, o) {
     if (!wf) return WORKFLOW_EXIT.NOT_FOUND;
     workflowId = wf.id;
   }
-  fs20.mkdirSync(o.out, {
+  fs22.mkdirSync(o.out, {
     recursive: true
   });
-  const indexFile = path27.join(o.out, "archive-index.ndjson");
+  const indexFile = path30.join(o.out, "archive-index.ndjson");
   const indexed = /* @__PURE__ */ new Map();
-  if (fs20.existsSync(indexFile)) {
-    for (const line of fs20.readFileSync(indexFile, "utf8").split("\n")) {
+  if (fs22.existsSync(indexFile)) {
+    for (const line of fs22.readFileSync(indexFile, "utf8").split("\n")) {
       if (!line.trim()) continue;
       try {
         const row2 = JSON.parse(line);
@@ -60578,17 +61904,17 @@ async function archiveRunsCore(ctx, o) {
   const say = /* @__PURE__ */ __name((line) => {
     if (!ctx.json) console.log(line);
   }, "say");
-  const sha256 = /* @__PURE__ */ __name((buf) => crypto5.createHash("sha256").update(buf).digest("hex"), "sha256");
+  const sha256 = /* @__PURE__ */ __name((buf) => crypto6.createHash("sha256").update(buf).digest("hex"), "sha256");
   const sleep4 = /* @__PURE__ */ __name((ms) => new Promise((r) => setTimeout(r, ms)), "sleep");
   const archiveOne = /* @__PURE__ */ __name(async (apiRow) => {
     const run = {
       ...apiRow,
       id: runIdOf(apiRow)
     };
-    const zipFile = path27.join(o.out, `${run.id}.zip`);
+    const zipFile = path30.join(o.out, `${run.id}.zip`);
     const prior = indexed.get(run.id);
     const completedAt = run.completedAt ? Date.parse(run.completedAt) : NaN;
-    if (prior && run.exportedAt && Number.isFinite(completedAt) && Date.parse(run.exportedAt) >= completedAt && fs20.existsSync(zipFile) && sha256(fs20.readFileSync(zipFile)) === prior.sha256) {
+    if (prior && run.exportedAt && Number.isFinite(completedAt) && Date.parse(run.exportedAt) >= completedAt && fs22.existsSync(zipFile) && sha256(fs22.readFileSync(zipFile)) === prior.sha256) {
       report2.skipped.push(run.id);
       say(`   ${run.id} \xB7 skipped (archived ${prior.exportId}, sha256 matches)`);
       return;
@@ -60683,7 +62009,7 @@ async function archiveRunsCore(ctx, o) {
       say(`   ${run.id} \xB7 failed (sha256 mismatch)`);
       return;
     }
-    fs20.writeFileSync(zipFile, bytes);
+    fs22.writeFileSync(zipFile, bytes);
     const row2 = {
       runId: run.id,
       workflowId: run.workflowId,
@@ -60692,7 +62018,7 @@ async function archiveRunsCore(ctx, o) {
       sha256: digest,
       bytes: bytes.length
     };
-    fs20.appendFileSync(indexFile, `${JSON.stringify(row2)}
+    fs22.appendFileSync(indexFile, `${JSON.stringify(row2)}
 `);
     indexed.set(run.id, row2);
     report2.archived.push(run.id);
@@ -61453,10 +62779,10 @@ function parseJudgePredicateFlag(raw) {
       } : {}
     };
   }
-  const [path27, op, ...rest] = raw.trim().split(/\s+/);
-  if (!path27 || !op || !GOAL_PREDICATE_OPS.includes(op)) throw new WorkflowLocalUsageError("usage", `--judge-predicate: expected "<path> <op> [value]" with op ${opList} (got "${raw}")`);
+  const [path30, op, ...rest] = raw.trim().split(/\s+/);
+  if (!path30 || !op || !GOAL_PREDICATE_OPS.includes(op)) throw new WorkflowLocalUsageError("usage", `--judge-predicate: expected "<path> <op> [value]" with op ${opList} (got "${raw}")`);
   if (rest.length === 0) return {
-    path: path27,
+    path: path30,
     op
   };
   const text = rest.join(" ");
@@ -61466,7 +62792,7 @@ function parseJudgePredicateFlag(raw) {
   } catch {
   }
   return {
-    path: path27,
+    path: path30,
     op,
     value: value3
   };
@@ -64049,8 +65375,12 @@ var TemplateApiService = class {
       body: JSON.stringify(data)
     });
   }
-  async listTemplates() {
-    return this._fetch("/marketplace/templates");
+  /**
+  * PRO-2201 — the catalog hides never-published templates; `includeUnpublished`
+  * (the template picker only) also lists the caller's own-org unpublished ones.
+  */
+  async listTemplates(opts = {}) {
+    return this._fetch(`/marketplace/templates${opts.includeUnpublished ? "?includeUnpublished=true" : ""}`);
   }
   async getTemplate(templateId) {
     return this._fetch(`/marketplace/templates/${templateId}`);
@@ -64251,10 +65581,12 @@ function missingVersionOrRethrow(error) {
   throw error;
 }
 __name(missingVersionOrRethrow, "missingVersionOrRethrow");
-async function resolveTemplateId(templateApi, options, message) {
+async function resolveTemplateId(templateApi, options, message, includeUnpublished) {
   if (options.templateId) return options.templateId;
   writeProgress("\u{1F504} Loading your templates...");
-  const { templates } = await templateApi.listTemplates();
+  const { templates } = await templateApi.listTemplates({
+    includeUnpublished
+  });
   if (!templates.length) {
     throw new Error("You haven't created any templates yet. Run `lua marketplace template create` first.");
   }
@@ -64476,7 +65808,7 @@ __name(templateCreateAction, "templateCreateAction");
 async function templateDraftAction(templateApi, options) {
   const config = readYamlConfig();
   if (!config) throw new Error("No lua.skill.yaml found in this directory.");
-  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to draft for?");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to draft for?", true);
   const sourceAgentVersion = options.sourceVersion ? Number.parseInt(options.sourceVersion, 10) : void 0;
   if (options.sourceVersion && (!Number.isFinite(sourceAgentVersion) || sourceAgentVersion <= 0)) {
     throw new Error(`Invalid --source-version "${options.sourceVersion}": must be a positive integer.`);
@@ -64595,7 +65927,7 @@ async function confirmTemplateSectionConsequences(templateApi, templateId, local
 }
 __name(confirmTemplateSectionConsequences, "confirmTemplateSectionConsequences");
 async function templatePublishAction(templateApi, config, options) {
-  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to publish a version for?");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to publish a version for?", true);
   const sourceAgentVersion = options.sourceVersion ? Number.parseInt(options.sourceVersion, 10) : void 0;
   if (options.sourceVersion && (!Number.isFinite(sourceAgentVersion) || sourceAgentVersion <= 0)) {
     throw new Error(`Invalid --source-version "${options.sourceVersion}": must be a positive integer.`);
@@ -64637,19 +65969,27 @@ async function templatePublishAction(templateApi, config, options) {
       selfAudit: templateSection.selfAudit
     } : {}
   });
+  const personaWarning = personaWarningLine(version, templateId);
   if (options.json) {
     console.log(JSON.stringify(version, null, 2));
+    if (personaWarning) console.warn(personaWarning);
     return;
   }
   writeSuccess(`\u2705 Published v${version.version}`);
   writeInfo(`Frozen from agent version v${version.sourceAgentVersion}`);
   writeInfo(autoApplyLine(version, options.skipAutoApply === true));
+  if (personaWarning) writeInfo(personaWarning);
   console.log("\nManifest:");
   printManifestSummary(version.content);
   const envCount = version.envContract ? Object.keys(version.envContract).length : 0;
   console.log(`  Env contract:   ${envCount} var(s)`);
 }
 __name(templatePublishAction, "templatePublishAction");
+function personaWarningLine(version, templateId) {
+  if (version.personaTemplate) return void 0;
+  return `\u26A0\uFE0F  No persona template on v${version.version}: installs will run on the stock placeholder persona, not the source agent's. Compose one with \`lua marketplace template draft --template-id ${templateId}\`, then publish again.`;
+}
+__name(personaWarningLine, "personaWarningLine");
 function autoApplyLine(version, skipped) {
   if (skipped) return "Auto-update: skipped (--skip-auto-apply)";
   if (version.autoApplyRunId) {
@@ -64661,7 +66001,7 @@ function autoApplyLine(version, skipped) {
 }
 __name(autoApplyLine, "autoApplyLine");
 async function templateViewAction(templateApi, options) {
-  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to view?");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to view?", true);
   if (options.version) {
     const versionNum = Number.parseInt(options.version, 10);
     if (!Number.isFinite(versionNum) || versionNum <= 0) {
@@ -64706,7 +66046,7 @@ ${"=".repeat(60)}
 }
 __name(templateViewAction, "templateViewAction");
 async function templateVersionsAction(templateApi, options) {
-  const templateId = await resolveTemplateId(templateApi, options, "Which template\u2019s versions would you like to see?");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template\u2019s versions would you like to see?", true);
   const versions = await templateApi.getVersions(templateId);
   if (options.json) {
     console.log(JSON.stringify(versions, null, 2));
@@ -64728,7 +66068,7 @@ __name(templateVersionsAction, "templateVersionsAction");
 async function templateInstallAction(templateApi, config, options) {
   const agentId = config.agent?.agentId;
   if (!agentId) throw new Error("Agent ID not found in configuration.");
-  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to install?");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to install?", false);
   const version = options.version ? Number.parseInt(options.version, 10) : void 0;
   const envValues = options.envVars ? parseKeyValuePairs(options.envVars) : void 0;
   if (!options.force) {
@@ -64812,7 +66152,7 @@ function resolveApplyTargets(options) {
 }
 __name(resolveApplyTargets, "resolveApplyTargets");
 async function templateApplyAction(templateApi, options) {
-  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to apply?");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to apply?", false);
   let targets = resolveApplyTargets(options);
   if (!targets && options.allInstalled) {
     writeProgress("\u{1F504} Loading install ledger...");
@@ -64899,7 +66239,7 @@ Apply run ${run.status} (${run.id})`);
 }
 __name(templateApplyAction, "templateApplyAction");
 async function templateHealthAction(templateApi, options) {
-  const templateId = await resolveTemplateId(templateApi, options, "Which template\u2019s fleet health would you like?");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template\u2019s fleet health would you like?", true);
   const windowDays = options.windowDays !== void 0 ? parseInt(options.windowDays, 10) : void 0;
   if (windowDays !== void 0 && (!Number.isFinite(windowDays) || windowDays < 1)) {
     throw new Error("--window-days must be a positive integer");
@@ -64970,7 +66310,7 @@ async function templateHealthAction(templateApi, options) {
 }
 __name(templateHealthAction, "templateHealthAction");
 async function templateStatusAction(templateApi, options) {
-  const templateId = await resolveTemplateId(templateApi, options, "Which template\u2019s fleet status would you like to see?");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template\u2019s fleet status would you like to see?", true);
   const installs = await templateApi.getAllInstalls(templateId);
   if (options.json) {
     console.log(JSON.stringify(installs, null, 2));
@@ -65038,7 +66378,7 @@ __name(templateInstalledAction, "templateInstalledAction");
 async function templateUninstallAction(templateApi, config, options) {
   const agentId = config.agent?.agentId;
   if (!agentId) throw new Error("Agent ID not found in configuration.");
-  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to uninstall?");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to uninstall?", false);
   if (!options.force) {
     throw CliError.usage("This action requires --force to confirm", `Use --force to confirm uninstalling template ${templateId} from this agent`);
   }
@@ -71384,13 +72724,13 @@ function hasSox() {
 }
 __name(hasSox, "hasSox");
 function detectSoxInstaller() {
-  const os3 = platform3();
+  const os4 = platform3();
   const has3 = /* @__PURE__ */ __name((bin) => spawnSync(bin, [
     "--version"
   ], {
     stdio: "ignore"
   }).status === 0, "has");
-  if (os3 === "darwin") {
+  if (os4 === "darwin") {
     if (has3("brew")) return {
       manager: "Homebrew",
       argv: [
@@ -71401,7 +72741,7 @@ function detectSoxInstaller() {
     };
     return null;
   }
-  if (os3 === "linux") {
+  if (os4 === "linux") {
     if (has3("apt-get")) return {
       manager: "apt",
       argv: [
@@ -71469,7 +72809,7 @@ function detectSoxInstaller() {
     };
     return null;
   }
-  if (os3 === "win32") {
+  if (os4 === "win32") {
     if (has3("winget")) return {
       manager: "winget",
       argv: [
@@ -72246,7 +73586,7 @@ function findVoiceTestFiles(root) {
     ".lua",
     "coverage"
   ]);
-  const walk3 = /* @__PURE__ */ __name((dir) => {
+  const walk4 = /* @__PURE__ */ __name((dir) => {
     let entries;
     try {
       entries = readdirSync4(dir);
@@ -72263,13 +73603,13 @@ function findVoiceTestFiles(root) {
       }
       if (s.isDirectory()) {
         if (skipDirs.has(entry)) continue;
-        walk3(full);
+        walk4(full);
       } else if (s.isFile() && /\.voice\.test\.(t|j)sx?$/.test(entry)) {
         out.push(resolve6(full));
       }
     }
   }, "walk");
-  walk3(root);
+  walk4(root);
   return out;
 }
 __name(findVoiceTestFiles, "findVoiceTestFiles");
@@ -72531,7 +73871,8 @@ async function versionListCommand(options = {}) {
         createdByEmail: v.createdByEmail,
         createdAt: v.createdAt,
         commitHash: v.commitHash,
-        sourceManifestVersion: v.sourceManifestVersion
+        sourceManifestVersion: v.sourceManifestVersion,
+        sourceDigest: v.sourceDigest
       }));
       console.log(JSON.stringify(summary, null, 2));
     } else if (versions.length === 0) {
@@ -73290,6 +74631,284 @@ async function pullCommand(options = {}) {
 }
 __name(pullCommand, "pullCommand");
 
+// src/commands/apps.ts
+init_dist();
+init_cli();
+init_write_info();
+init_package_root();
+init_cli_error();
+init_analytics();
+import fs21 from "fs";
+import path29 from "path";
+import { IndentationText, Node as Node22, Project as Project5, QuoteKind, SyntaxKind } from "ts-morph";
+init_command_utils();
+init_artifact_loader();
+init_types();
+var WEB_APP_TEMPLATE_DIR = "template-web-app";
+var PAGES_EXCLUDE_GLOB = "src/apps/*/web";
+var NAME_PLACEHOLDER = "__APP_NAME__";
+function appIdentifier(name) {
+  return name.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+__name(appIdentifier, "appIdentifier");
+function copyTemplate(from, to, name, written) {
+  fs21.mkdirSync(to, {
+    recursive: true
+  });
+  for (const entry of fs21.readdirSync(from, {
+    withFileTypes: true
+  })) {
+    if (entry.name === "node_modules" || entry.name === "dist") continue;
+    const src = path29.join(from, entry.name);
+    const dest = path29.join(to, entry.name);
+    if (entry.isDirectory()) {
+      copyTemplate(src, dest, name, written);
+    } else {
+      fs21.writeFileSync(dest, fs21.readFileSync(src, "utf8").split(NAME_PLACEHOLDER).join(name));
+      written.push(dest);
+    }
+  }
+}
+__name(copyTemplate, "copyTemplate");
+function excludePagesFromTsconfig(projectRoot) {
+  const file = path29.join(projectRoot, "tsconfig.json");
+  if (!fs21.existsSync(file)) return "missing";
+  let config;
+  try {
+    config = JSON.parse(fs21.readFileSync(file, "utf8"));
+  } catch {
+    return "unparsable";
+  }
+  const exclude = Array.isArray(config.exclude) ? config.exclude : [
+    "node_modules"
+  ];
+  if (exclude.includes(PAGES_EXCLUDE_GLOB)) return "present";
+  config.exclude = [
+    ...exclude,
+    PAGES_EXCLUDE_GLOB
+  ];
+  fs21.writeFileSync(file, JSON.stringify(config, null, 2) + "\n");
+  return "added";
+}
+__name(excludePagesFromTsconfig, "excludePagesFromTsconfig");
+function registerWebAppOnAgent(indexFile, name) {
+  if (!fs21.existsSync(indexFile)) return "missing-index";
+  const project = new Project5({
+    skipAddingFilesFromTsConfig: true,
+    // The style of the agent template (and of most agent code): single quotes, two spaces.
+    manipulationSettings: {
+      quoteKind: QuoteKind.Single,
+      indentationText: IndentationText.TwoSpaces
+    }
+  });
+  const sf = project.addSourceFileAtPath(indexFile);
+  const agentNew = sf.getDescendantsOfKind(SyntaxKind.NewExpression).find((n2) => n2.getExpression().getText() === "LuaAgent");
+  const config = agentNew?.getArguments()[0];
+  if (!config || !Node22.isObjectLiteralExpression(config)) return "no-agent";
+  const prop = config.getProperty("webApps");
+  const list = prop && Node22.isPropertyAssignment(prop) ? prop.getInitializer() : void 0;
+  if (prop && !(list && Node22.isArrayLiteralExpression(list))) return "webapps-not-array";
+  const binding = appIdentifier(name);
+  const specifier = `./apps/${name}/app`;
+  if (!sf.getImportDeclaration((d) => d.getModuleSpecifierValue() === specifier)) {
+    const last = sf.getImportDeclarations().at(-1);
+    sf.insertImportDeclaration(last ? last.getChildIndex() + 1 : 0, {
+      defaultImport: binding,
+      moduleSpecifier: specifier
+    });
+  }
+  if (list && Node22.isArrayLiteralExpression(list)) {
+    if (!list.getElements().some((e) => e.getText() === binding)) list.addElement(binding);
+  } else {
+    config.addPropertyAssignment({
+      name: "webApps",
+      initializer: `[${binding}]`
+    });
+  }
+  sf.saveSync();
+  return "registered";
+}
+__name(registerWebAppOnAgent, "registerWebAppOnAgent");
+function scaffoldWebApp(projectRoot, name, templateRoot = getPackageRoot()) {
+  if (!WEB_APP_NAME_PATTERN.test(name)) {
+    throw CliError.usage(`App name must match ${WEB_APP_NAME_PATTERN} (lower-case letters, digits and dashes, starting with a letter); got ${JSON.stringify(name)}.`);
+  }
+  if (!fs21.existsSync(path29.join(projectRoot, "lua.skill.yaml"))) {
+    throw CliError.usage("No lua.skill.yaml here: run `lua apps new` in the root of an agent project (`lua init` makes one).");
+  }
+  const appDir = path29.join(projectRoot, "src", "apps", name);
+  if (fs21.existsSync(appDir)) {
+    throw CliError.usage(`${path29.relative(projectRoot, appDir)} already exists; pick another name or delete it first.`);
+  }
+  const files = [];
+  copyTemplate(path29.join(templateRoot, WEB_APP_TEMPLATE_DIR), appDir, name, files);
+  return {
+    appDir,
+    files,
+    registered: registerWebAppOnAgent(path29.join(projectRoot, "src", "index.ts"), name),
+    tsconfig: excludePagesFromTsconfig(projectRoot)
+  };
+}
+__name(scaffoldWebApp, "scaffoldWebApp");
+async function appsNewCommand(name) {
+  return withErrorHandling(async () => {
+    const projectRoot = process.cwd();
+    const result = scaffoldWebApp(projectRoot, name);
+    const rel = /* @__PURE__ */ __name((p) => path29.relative(projectRoot, p), "rel");
+    for (const file of result.files) writeInfo(`  created ${rel(file)}`);
+    const binding = appIdentifier(name);
+    const addLines = `       import ${binding} from './apps/${name}/app';
+       webApps: [${binding}],   (on your LuaAgent)`;
+    switch (result.registered) {
+      case "registered":
+        writeInfo(`  updated src/index.ts                     webApps: [${binding}]`);
+        break;
+      case "missing-index":
+        writeInfo(`  \u26A0\uFE0F  No src/index.ts. Where your LuaAgent is defined, add:
+${addLines}`);
+        break;
+      case "no-agent":
+        writeInfo(`  \u26A0\uFE0F  No \`new LuaAgent({...})\` in src/index.ts. Where your LuaAgent is defined, add:
+${addLines}`);
+        break;
+      case "webapps-not-array":
+        writeInfo(`  \u26A0\uFE0F  \`webApps\` in src/index.ts is not an array literal, so it was left as is. Add ${binding} to it and:
+       import ${binding} from './apps/${name}/app';`);
+        break;
+    }
+    if (result.tsconfig === "added") writeInfo(`  updated tsconfig.json                    exclude: "${PAGES_EXCLUDE_GLOB}"`);
+    if (result.tsconfig === "unparsable" || result.tsconfig === "missing") {
+      writeInfo(`  \u26A0\uFE0F  Add "${PAGES_EXCLUDE_GLOB}" to "exclude" in tsconfig.json so the agent compiler never loads the pages.`);
+    }
+    writeSuccess(`
+\u2705 Web app ${name} created`);
+    writeHintBlock({
+      headline: "Next:",
+      lines: [
+        {
+          label: "Install pages:",
+          command: `cd ${rel(path29.join(result.appDir, "web"))} && npm install`
+        },
+        {
+          label: "Run locally:",
+          command: `lua apps dev ${name}`
+        },
+        {
+          label: "Ship:",
+          command: `lua push webapp --name ${name}`
+        }
+      ],
+      when: "success"
+    });
+    trackEvent("cli_apps_new", {
+      registered: result.registered,
+      tsconfig: result.tsconfig
+    });
+  }, "apps new");
+}
+__name(appsNewCommand, "appsNewCommand");
+async function appsDevCommand(name, opts = {}) {
+  return withErrorHandling(async () => {
+    await compileCommand();
+    const { apiKey, agentId, config } = await initializeCommand({
+      showProgress: false
+    });
+    const find = /* @__PURE__ */ __name(() => getPrimitivesByKind(loadManifest(), PrimitiveKind.WEB_APP).find((a) => a.name === name), "find");
+    const app = find();
+    if (!app) {
+      throw CliError.usage(`No web app named ${JSON.stringify(name)} in the compiled agent.`, `Create one with: lua apps new ${name}  (and list it under \`webApps\` on your LuaAgent)`);
+    }
+    const appDir = path29.dirname(app.sourcePath);
+    const pagesDir = path29.resolve(appDir, app.pagesRoot);
+    const vite = await loadAppVite(pagesDir);
+    if (!vite.createServer) throw new WebAppBuildError(`The Vite in ${pagesDir} exposes no createServer().`);
+    const auth = await developerAuth(apiKey, agentId, config);
+    const addedEnv = [];
+    for (const [key, value3] of Object.entries(loadEnvironmentVariables2())) {
+      if (process.env[key] === void 0) {
+        process.env[key] = value3;
+        addedEnv.push(key);
+      }
+    }
+    let code = loadArtifact(app, process.cwd());
+    let current = app;
+    const ctx = /* @__PURE__ */ __name(() => ({
+      app: current,
+      appCode: /* @__PURE__ */ __name(() => code, "appCode"),
+      auth,
+      apiKey,
+      agentId
+    }), "ctx");
+    let origin = "";
+    const server = await vite.createServer({
+      root: pagesDir,
+      server: {
+        port: opts.port ? Number(opts.port) : void 0
+      },
+      plugins: [
+        luaAppsDevPlugin({
+          context: ctx,
+          origin: /* @__PURE__ */ __name(() => origin, "origin"),
+          appDir,
+          pagesDir,
+          log: /* @__PURE__ */ __name((line, status) => (status >= 500 ? console.error : console.log)(`  ${line}`), "log"),
+          onRouteChange: /* @__PURE__ */ __name(async (file) => {
+            writeInfo(`
+\u267B\uFE0F  ${path29.relative(process.cwd(), file)} changed \u2014 recompiling routes...`);
+            try {
+              await compileCommand();
+              const next = find();
+              if (!next) throw new Error(`web app ${name} is gone from the compiled agent`);
+              current = next;
+              code = loadArtifact(next, process.cwd());
+              writeSuccess("\u2705 Routes reloaded");
+            } catch (error) {
+              console.error(`\u274C Recompile failed; still serving the previous routes: ${error?.message}`);
+            }
+          }, "onRouteChange")
+        })
+      ]
+    });
+    await server.listen();
+    origin = server.resolvedUrls?.local?.[0]?.replace(/\/$/, "") ?? "";
+    writeSuccess(`
+\u2705 ${name} is running`);
+    writeHintBlock({
+      headline: "Lua apps dev:",
+      lines: [
+        {
+          label: "Pages:",
+          command: `${origin || "http://localhost"}   (Vite, hot reload)`
+        },
+        {
+          label: "Routes:",
+          command: "/_lua/api/*  \u2192 local sandbox, auth = you (Data and env() are live)"
+        },
+        {
+          label: "Stop:",
+          command: "Ctrl+C"
+        }
+      ],
+      when: "success"
+    });
+    trackEvent("cli_apps_dev", {
+      routes: app.routes.length,
+      hasFetch: app.hasFetch
+    });
+    await new Promise((resolve7) => {
+      const stop = /* @__PURE__ */ __name(() => {
+        process.off("SIGINT", stop);
+        process.off("SIGTERM", stop);
+        for (const key of addedEnv) delete process.env[key];
+        void server.close().finally(resolve7);
+      }, "stop");
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+    });
+  }, "apps dev");
+}
+__name(appsDevCommand, "appsDevCommand");
+
 // src/cli/command-definitions.ts
 init_cli();
 function collect(value3, previous) {
@@ -73465,7 +75084,7 @@ Examples:
     ...opts,
     accept: opts.pull || opts.accept
   }));
-  program2.command("test [type]").description("\u{1F9EA} Test skills, webhooks, or jobs interactively").option("--name <name>", "Entity name to test").option("--input <json>", "JSON input string for testing").option("--json", "Output result as raw JSON (useful for scripting and piping)").option("--step-output <id=json>", "Workflow: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "Workflow: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "Workflow: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "Workflow: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "Workflow: seed completed steps from a real run").option("--force", "Workflow: seed from a run whose graph differs").option("--record <dir>", "Workflow: record agent/tool outputs as fixtures").option("--fixtures <dir>", "Workflow: replay recorded fixtures (exit 5 when one is missing)").option("--step-wall <s>", "Workflow: per-step wall in seconds (default 600)").option("--job-wall <s>", "Workflow: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--max-ticks <n>", "Workflow (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--ledger-out <file>", "Workflow: write the in-memory ledger as JSON").option("--agents <fake|live>", "Workflow: fake agent steps (default) or call the dev API").option("--now <iso>", "Workflow: virtual clock start").option("--park <id>", "Workflow: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "Workflow: collapse retry backoff waits to 0").option("--real-time", "Workflow: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "Workflow: back ctx.artefacts.* on disk").option("--workspace <dir>", "Workflow: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").addHelpText("after", `
+  program2.command("test [type]").description("\u{1F9EA} Test skills, webhooks, or jobs interactively").option("--name <name>", "Entity name to test").option("--input <json>", "JSON input string for testing").option("--json", "Output result as raw JSON (useful for scripting and piping)").option("--route <route>", "Web app: the route to call, e.g. 'GET /tickets?status=open'").option("--step-output <id=json>", "Workflow: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "Workflow: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "Workflow: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "Workflow: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "Workflow: seed completed steps from a real run").option("--force", "Workflow: seed from a run whose graph differs").option("--record <dir>", "Workflow: record agent/tool outputs as fixtures").option("--fixtures <dir>", "Workflow: replay recorded fixtures (exit 5 when one is missing)").option("--step-wall <s>", "Workflow: per-step wall in seconds (default 600)").option("--job-wall <s>", "Workflow: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--max-ticks <n>", "Workflow (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--ledger-out <file>", "Workflow: write the in-memory ledger as JSON").option("--agents <fake|live>", "Workflow: fake agent steps (default) or call the dev API").option("--now <iso>", "Workflow: virtual clock start").option("--park <id>", "Workflow: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "Workflow: collapse retry backoff waits to 0").option("--real-time", "Workflow: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "Workflow: back ctx.artefacts.* on disk").option("--workspace <dir>", "Workflow: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").addHelpText("after", `
 Arguments:
   type                   Optional: 'skill', 'webhook', 'job' or 'workflow' (prompts if not provided)
 
@@ -73487,7 +75106,7 @@ Examples:
 `).action(testCommand);
   program2.command("push [type]").description("\u2601\uFE0F  Push skill, agent, webhook, job, MCP server, or backup to server").option("--force", "Skip all confirmation prompts (auto-confirm)").option("--auto-deploy", "Automatically deploy to production after push").option("--name <name>", "Entity name to push").option("--set-version <version>", "Version to set (e.g., 1.0.5)").option("--fresh", "Build backup manifest from disk instead of compiled manifest.json (push backup only)").option("--apply-effort", "push workflow: send each agent step's effort to the model from this version on (a plain push never does)").option("--no-include-source", "Skip the per-skill source attach after push (default: attach, so admin Builder UI sees CLI edits)").addHelpText("after", `
 Arguments:
-  type                   Optional: 'skill', 'agent', 'persona', 'webhook', 'job', 'preprocessor', 'postprocessor', 'mcp', 'backup', or 'all' (prompts if not provided)
+  type                   Optional: 'skill', 'agent', 'persona', 'webhook', 'job', 'preprocessor', 'postprocessor', 'mcp', 'webapp', 'backup', or 'all' (prompts if not provided)
 
 Options:
   --force                Skip all confirmation prompts
@@ -73505,6 +75124,7 @@ Examples:
   $ lua push webhook                                        Push a webhook directly
   $ lua push job                                            Push a job directly
   $ lua push mcp                                            Push an MCP server directly
+  $ lua push webapp --name ops-dashboard                    Build and push a web app (routes + pages)
   $ lua push backup                                         Push project source backup
   $ lua push backup --fresh                                 Push backup, building manifest from disk
   $ lua push all --force                                    Push all components without prompts
@@ -74196,6 +75816,9 @@ Examples:
   $ lua version delete v3 --ci          Refused: needs --force (usage error, exit 2)
   $ lua version delete v3 --ci --force  Delete non-interactively
 `).action((version, opts) => versionDeleteCommand(version, opts));
+  const appsGroup = program2.command("apps").description("\u{1F5A5}\uFE0F  Create and develop web apps of this agent");
+  appsGroup.command("new <name>").description("Scaffold a web app in src/apps/<name> (routes + a Vite/React page) and list it on the agent").action((name) => appsNewCommand(name));
+  appsGroup.command("dev <name>").description("Run a web app locally: pages on Vite with hot reload, routes in the local sandbox as you").option("--port <port>", "Port for the dev server (default: Vite's)").action((name, opts) => appsDevCommand(name, opts));
   const gitGroup = program2.command("git").description("Manage opt-in git auto-commits for this project");
   gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").option("--auto-push", "Also enable post-commit auto-push (requires `lua git auth github` + a GitHub HTTPS origin remote)").action((opts) => gitConnectCommand({
     autoPush: opts.autoPush