lua-cli 3.43.0 → 3.45.0

package/dist/index.js

@@ -986,6 +986,106 @@ function supervisionSubjectId(agentId) {
 function isSupervisionOp(op) {
   return typeof op === "string" && Object.prototype.hasOwnProperty.call(SUPERVISION_OPS, op);
 }
+function isSupervisionWatchdogOp(op) {
+  return typeof op === "string" && Object.prototype.hasOwnProperty.call(SUPERVISION_WATCHDOG_OPS, op);
+}
+function isSupervisionRollbackRefusalReason(v) {
+  return typeof v === "string" && Object.prototype.hasOwnProperty.call(SUPERVISION_ROLLBACK_REFUSAL_CODES, v);
+}
+function supervisionRollbackTargetRefusal(target, expectActive, window) {
+  if (target.status !== "superseded" || !target.promotedAt || target.compensationFailed === true) {
+    return {
+      reason: "never_active",
+      message: `Version ${target.version} was never fully the active version (status ${target.status ?? "unknown"})`
+    };
+  }
+  if (typeof expectActive !== "number" || !(target.version < expectActive)) {
+    return {
+      reason: "not_older",
+      message: `Version ${target.version} is not older than the active version ${expectActive ?? "none"}`
+    };
+  }
+  if (window) {
+    if (target.supersededVia === "rollback" || target.promotedVia === "rollback") {
+      return {
+        reason: "after_rollback",
+        message: `Version ${target.version} was retired or restored by a rollback`
+      };
+    }
+    if (target.supersededVia !== "promote" && target.supersededVia !== "scoped") {
+      return {
+        reason: "not_in_lineage",
+        message: `Version ${target.version} has no forward-promote history`
+      };
+    }
+    const ended = target.supersededAt ? new Date(target.supersededAt).getTime() : NaN;
+    if (!Number.isFinite(ended) || ended < window.now - window.windowMs) {
+      return {
+        reason: "too_old",
+        message: `Version ${target.version} was last active outside the ${Math.round(window.windowMs / 864e5)}-day window`
+      };
+    }
+  }
+  return null;
+}
+function supervisionRollbackRefusal(input) {
+  const { target, active, lineage, expectActive, windowMs, now } = input;
+  const pre = supervisionRollbackTargetRefusal(target, expectActive);
+  if (pre) return pre;
+  if (!active || active.version !== expectActive) {
+    return {
+      reason: "not_older",
+      message: `Version ${expectActive ?? "none"} is not the active version`
+    };
+  }
+  if (active.promotedVia === "rollback") {
+    return {
+      reason: "after_rollback",
+      message: `The active version ${active.version} was restored by a rollback; a watchdog does not roll back twice in a row`
+    };
+  }
+  let previous = active;
+  for (const step3 of lineage.slice(0, SUPERVISION_ROLLBACK_LINEAGE_MAX)) {
+    const label2 = `version ${step3.version}`;
+    if (step3.supersededVia === "rollback" || step3.promotedVia === "rollback") {
+      return {
+        reason: "after_rollback",
+        message: `The rollback lineage crosses ${label2}, which a rollback retired or restored`
+      };
+    }
+    if (step3.supersededVia !== "promote" && step3.supersededVia !== "scoped") {
+      return {
+        reason: "not_in_lineage",
+        message: `The rollback lineage stops at ${label2} (no forward-promote history)`
+      };
+    }
+    if (step3.compensationFailed === true || step3.status !== "superseded" || !step3.promotedAt) {
+      return {
+        reason: "not_in_lineage",
+        message: `The rollback lineage stops at ${label2} (not fully served)`
+      };
+    }
+    if (!(step3.version < previous.version)) {
+      return {
+        reason: "after_backward_promote",
+        message: `Version ${previous.version} was promoted BACK over ${label2}; a watchdog never reaches behind that`
+      };
+    }
+    const ended = step3.supersededAt ? new Date(step3.supersededAt).getTime() : NaN;
+    if (!Number.isFinite(ended) || ended < now - windowMs) {
+      return {
+        reason: "too_old",
+        message: `The rollback lineage reaches ${label2}, last active outside the ${Math.round(windowMs / 864e5)}-day window`
+      };
+    }
+    if (step3.version === target.version && (!target.id || !step3.id || step3.id === target.id)) return null;
+    previous = step3;
+  }
+  return {
+    reason: "not_in_lineage",
+    message: `Version ${target.version} is not in the active version's recent forward-promote lineage`
+  };
+}
 function isUntargetedSupervisionOp(op) {
   return typeof op === "string" && SUPERVISION_UNTARGETED_OPS.includes(op);
 }
@@ -3286,6 +3386,19 @@ function resolveSlackReactionName(value3) {
   }
   return slackEmojiName(trimmed2);
 }
+function threadScopingSetting(type) {
+  const noun = THREAD_SCOPING_NOUN[type];
+  return {
+    key: `${type}.threadScoping`,
+    group: "conversations",
+    label: `One conversation per ${noun}`,
+    help: `Each ${noun} is its own conversation with its own history.`,
+    effect: "Off: every message from the same person shares one conversation.",
+    type: "boolean",
+    default: false,
+    confirm: "Changing this starts fresh conversations for ones that are already open. Earlier history isn't carried over."
+  };
+}
 function takeoverSettings(type) {
   const variants = type === "email" ? [
     "ses"
@@ -3641,13 +3754,13 @@ function channelSettingsGroups(channel, config) {
   const groups = [];
   for (const def of channelSettingDefinitions(channel, config)) {
     const { tunableDefault: _tunable, ...shown } = def;
-    const unavailable3 = channelSettingUnavailable(channel, def);
+    const unavailable2 = channelSettingUnavailable(channel, def);
     const view = {
       ...shown,
       ...effectiveChannelSetting(channel, def),
       resettable: channelSettingResettable(def),
-      ...unavailable3 && {
-        unavailable: unavailable3
+      ...unavailable2 && {
+        unavailable: unavailable2
       }
     };
     const group = groups.find((candidate) => candidate.key === def.group);
@@ -5259,6 +5372,9 @@ function workflowOccurrenceId(lineageId, stepId) {
 function workflowOrgSlotKey(orgId, kind) {
   return `wf:org:${orgId}:${kind}`;
 }
+function isWorkflowAgentAppConnectionId(id2) {
+  return typeof id2 === "string" && id2.startsWith(WORKFLOW_AGENT_APP_CONNECTION_PREFIX) && /^[A-Za-z0-9_-]{1,128}$/.test(id2);
+}
 function workflowJobModelSourceLabel(source) {
   return WORKFLOW_JOB_MODEL_SOURCE_LABELS[source];
 }
@@ -6814,7 +6930,7 @@ function isPaymentRequiredChatErrorEnvelope(data) {
   if (d.type !== "error") return false;
   return d.textDelta === BILLING_REJECTION_TEXT_CREDITS || d.textDelta === BILLING_REJECTION_TEXT_SEAT || d.textDelta === BILLING_REJECTION_TEXT_USER_QUOTA;
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_WALL_MS, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSETS, WEB_APP_ASSET_PATH_PATTERN, WEB_APP_ASSET_PATH_MAX_CHARS, WEB_APP_MAX_ROUTES, WEB_APP_MAX_ASSET_BYTES, WEB_APP_CSP_NONCE_PLACEHOLDER, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA;
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_WALL_MS, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSETS, WEB_APP_ASSET_PATH_PATTERN, WEB_APP_ASSET_PATH_MAX_CHARS, WEB_APP_MAX_ROUTES, WEB_APP_MAX_ASSET_BYTES, WEB_APP_CSP_NONCE_PLACEHOLDER, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -7030,7 +7146,20 @@ var init_dist = __esm({
       * agentId }`) to its env. `act`, on a turn whose platform-picked user is the target's owner, never overwriting a
       * key (`LUA_SECRET_ATTACH_EXISTING_ENABLED`).
       */
-      "secrets.attach": "act"
+      "secrets.attach": "act",
+      /**
+      * SV (LUA-1080) — `Agents.deployed(id)`: what the target serves RIGHT NOW, read from each primitive's live pointer
+      * (skills with their tools, the published persona, pre/postprocessors), with version ids comparable to an agent
+      * version snapshot. Works whether or not the target has a promoted agent version. Metadata and hashes only.
+      */
+      "primitives.deployed": "observe",
+      // [WD]
+      /**
+      * WD (watchdog grant) — `Agents.versions(id).rollback(version, { expectActive })`: restore a version of the target
+      * that was ACTIVE before, is OLDER than the active one and was active within the last 7 days. CAS on the active
+      * version; only from a workflow step the watchdog grant names. Held only by a watchdog grant.
+      */
+      "versions.rollback": "rollback"
     };
     __name(isSupervisionOp, "isSupervisionOp");
     __name2(isSupervisionOp, "isSupervisionOp");
@@ -7208,8 +7337,65 @@ var init_dist = __esm({
         gate: "act",
         targeted: true,
         item: "SV"
+      },
+      /** SV (LUA-1080) — `Agents.deployed(id)`: the target's deployed primitives (live pointers, no agent version needed). */
+      "primitives.deployed": {
+        gate: "observe",
+        targeted: true,
+        item: "SV"
+      },
+      /** WD — `Agents.versions(id).rollback(version, { expectActive })` (watchdog grant only). */
+      "versions.rollback": {
+        gate: "rollback",
+        targeted: true,
+        item: "WD"
       }
     };
+    SUPERVISION_WATCHDOG_OPS = {
+      logs: "observe",
+      "runs.list": "observe",
+      "runs.get": "observe",
+      "data.get": "observe",
+      "data.query": "observe",
+      "versions.list": "observe",
+      "versions.get": "observe",
+      "versions.diff": "observe",
+      "versions.rollback": "rollback"
+    };
+    __name(isSupervisionWatchdogOp, "isSupervisionWatchdogOp");
+    __name2(isSupervisionWatchdogOp, "isSupervisionWatchdogOp");
+    SUPERVISION_WATCHDOG_ERRORS = {
+      /** A watchdog holder called an op outside {@link SUPERVISION_WATCHDOG_OPS}. */
+      OP_REFUSED: "supervision_watchdog_op_refused",
+      /** See {@link SupervisionRollbackRefusalReason}. */
+      ROLLBACK_NEVER_ACTIVE: "supervision_rollback_never_active",
+      ROLLBACK_NOT_OLDER: "supervision_rollback_not_older",
+      ROLLBACK_NOT_IN_LINEAGE: "supervision_rollback_not_in_lineage",
+      ROLLBACK_AFTER_ROLLBACK: "supervision_rollback_after_rollback",
+      ROLLBACK_AFTER_BACKWARD_PROMOTE: "supervision_rollback_after_backward_promote",
+      ROLLBACK_TOO_OLD: "supervision_rollback_too_old",
+      /** `expectActive` is not the active version (CAS). */
+      ROLLBACK_CONFLICT: "supervision_rollback_conflict",
+      /** The promote failed part-way and its compensation restored the previous active version. */
+      ROLLBACK_INCOMPLETE: "supervision_rollback_incomplete",
+      /** The promote failed part-way AND its compensation failed: the Agents DB may have moved (manual triage). */
+      ROLLBACK_INCOMPLETE_UNCOMPENSATED: "supervision_rollback_incomplete_uncompensated"
+    };
+    SUPERVISION_ROLLBACK_REFUSAL_CODES = {
+      never_active: SUPERVISION_WATCHDOG_ERRORS.ROLLBACK_NEVER_ACTIVE,
+      not_older: SUPERVISION_WATCHDOG_ERRORS.ROLLBACK_NOT_OLDER,
+      not_in_lineage: SUPERVISION_WATCHDOG_ERRORS.ROLLBACK_NOT_IN_LINEAGE,
+      after_rollback: SUPERVISION_WATCHDOG_ERRORS.ROLLBACK_AFTER_ROLLBACK,
+      after_backward_promote: SUPERVISION_WATCHDOG_ERRORS.ROLLBACK_AFTER_BACKWARD_PROMOTE,
+      too_old: SUPERVISION_WATCHDOG_ERRORS.ROLLBACK_TOO_OLD
+    };
+    __name(isSupervisionRollbackRefusalReason, "isSupervisionRollbackRefusalReason");
+    __name2(isSupervisionRollbackRefusalReason, "isSupervisionRollbackRefusalReason");
+    SUPERVISION_ROLLBACK_LINEAGE_MAX = 25;
+    __name(supervisionRollbackTargetRefusal, "supervisionRollbackTargetRefusal");
+    __name2(supervisionRollbackTargetRefusal, "supervisionRollbackTargetRefusal");
+    __name(supervisionRollbackRefusal, "supervisionRollbackRefusal");
+    __name2(supervisionRollbackRefusal, "supervisionRollbackRefusal");
     SUPERVISION_UNTARGETED_OPS = [
       "agents.list",
       ...Object.entries(SUPERVISION_OPS_WAVE2).filter(([, contract]) => !contract.targeted).map(([op]) => op)
@@ -7645,7 +7831,9 @@ var init_dist = __esm({
       /** `secrets.attach` would set an env key the agent already has: never overwritten (remove or rotate it first). */
       KEY_EXISTS: "secret_key_exists",
       /** A request held for an existing agent submitted on the public token page: its owner submits it signed in. */
-      OWNER_SUBMIT_REQUIRED: "secret_submit_requires_owner"
+      OWNER_SUBMIT_REQUIRED: "secret_submit_requires_owner",
+      /** LUA-1079 — `requestSecret` with `pendingFor` on a client that did not declare the pending card capability. */
+      PENDING_CARD_UNSUPPORTED: "secret_pending_card_unsupported"
     };
     SECRET_OUTCOME_STATUSES = [
       ...SECRET_TEST_RESULTS,
@@ -8360,6 +8548,13 @@ var init_dist = __esm({
       welcome: "Welcome and Home page",
       takeover: "Human takeover"
     };
+    THREAD_SCOPING_NOUN = {
+      front: "Front conversation",
+      messagebird: "MessageBird conversation",
+      imessage: "iMessage chat"
+    };
+    __name(threadScopingSetting, "threadScopingSetting");
+    __name2(threadScopingSetting, "threadScopingSetting");
     TAKEOVER_CHANNEL_TYPES = [
       "whatsapp",
       "instagram",
@@ -8633,7 +8828,10 @@ var init_dist = __esm({
     CHANNEL_SETTINGS = {
       ...Object.fromEntries(TAKEOVER_CHANNEL_TYPES.map((type) => [
         type,
-        type === "email" ? EMAIL_SETTINGS : takeoverSettings(type)
+        type === "email" ? EMAIL_SETTINGS : type === "front" || type === "messagebird" || type === "imessage" ? [
+          ...takeoverSettings(type),
+          threadScopingSetting(type)
+        ] : takeoverSettings(type)
       ])),
       slack: SLACK_SETTINGS
     };
@@ -10495,6 +10693,9 @@ This text is who you are for this person. As you learn them, their name, their w
     __name2(workflowOrgSlotKey, "workflowOrgSlotKey");
     WORKFLOW_JOURNAL_PROTOCOL_VERSION = 1;
     WORKFLOW_CONNECTION_KEY_RE = /^[a-z][a-z0-9_-]{0,63}$/;
+    WORKFLOW_AGENT_APP_CONNECTION_PREFIX = "agentapp_";
+    __name(isWorkflowAgentAppConnectionId, "isWorkflowAgentAppConnectionId");
+    __name2(isWorkflowAgentAppConnectionId, "isWorkflowAgentAppConnectionId");
     WORKFLOW_JOB_MODEL_SOURCE_LABELS = {
       stamp: "lease stamp",
       initData: "run input",
@@ -10520,6 +10721,7 @@ This text is who you are for this person. As you learn them, their name, their w
       ...WORKFLOW_RUN_GATE_KINDS
     ];
     WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES = 64 * 1024;
+    WORKFLOW_SIGNAL_NAME_RE = /^[a-zA-Z0-9_.-]{1,64}$/;
     WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS = 168;
     WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES = 256 * 1024;
     SCHEDULE_HEALTH_NOTIFY_CHANNELS = [
@@ -12739,6 +12941,19 @@ function validateApprovalReminder(node, path31) {
   }
   return [];
 }
+function validateHitlTimeoutHours(node, path31) {
+  const h = node.timeoutHours;
+  if (typeof h !== "number") return [];
+  if (Number.isFinite(h) && h >= APPROVAL_TIMEOUT_HOURS_MIN && h <= APPROVAL_TIMEOUT_HOURS_MAX) return [];
+  return [
+    {
+      code: "timeout-hours-out-of-range",
+      path: `${path31}.timeoutHours`,
+      severity: "error",
+      message: `timeoutHours must be a number of hours in [${APPROVAL_TIMEOUT_HOURS_MIN}, ${APPROVAL_TIMEOUT_HOURS_MAX}] (got ${h})`
+    }
+  ];
+}
 function firstAskDeadline(node) {
   const head = Array.isArray(node.onTimeout) ? node.onTimeout[0] : node.onTimeout;
   if (typeof head === "object" && head !== null && "escalateTo" in head) {
@@ -12810,6 +13025,9 @@ function retryBackoffs() {
 function sleepUntilUnsupportedMessage(id2) {
   return `the engine does not execute \`sleepUntil\` yet (node "${id2}") \u2014 replace it with a \`sleep\` node with a \`duration\` in ms, e.g. { type: 'sleep', id: '${id2}', duration: ${SLEEP_UNTIL_REPLACEMENT.duration} }`;
 }
+function signalNameInvalidMessage(id2, name) {
+  return `waitForSignal "${id2}" signal "${name}" must match /${WORKFLOW_SIGNAL_NAME_RE.source}/ (the names a delivery accepts)`;
+}
 function armSubrunUnsupportedMessage(id2, workflowId) {
   return `the engine does not execute the implicit \`${workflowId}\` arm subrun (node "${id2}") \u2014 a [map, step] container arm is the step itself with the map as its \`input\` since lua-cli 3.32.4; re-run \`lua compile\` with the current CLI (a hand-written artifact: put the map on the arm node's \`input\` and drop the \`workflow\` wrapper)`;
 }
@@ -13402,10 +13620,13 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       const w = node;
       checkId(w.id, path31);
       if (typeof w.signal !== "string" || w.signal.length === 0) err("invalid-envelope", "waitForSignal.signal is required", `${path31}.signal`, w.id);
+      else if (!WORKFLOW_SIGNAL_NAME_RE.test(w.signal)) err("signal-name-invalid", signalNameInvalidMessage(w.id, w.signal), `${path31}.signal`, w.id);
+      for (const r of validateHitlTimeoutHours(w, path31)) err(r.code, r.message, r.path, w.id);
       return;
     }
     const a = node;
     checkId(a.id, path31);
+    for (const r of validateHitlTimeoutHours(a, path31)) err(r.code, r.message, r.path, a.id);
     if ((a.approver ?? "creator") === "creator" && a.excludeInitiator === true) {
       err("approver-excludes-only-candidate", "approver:'creator' with excludeInitiator:true always excludes the only candidate", path31, a.id);
     }
@@ -15873,7 +16094,7 @@ function collectJobTierSteps(entry, out) {
       return;
   }
 }
-var __defProp4, __name4, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_MODEL_TEMPLATE_ROOT, WORKFLOW_MODEL_TEMPLATE_RE, PATH_SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, APPROVAL_REMIND_AFTER_HOURS_MIN, APPROVAL_REMIND_AFTER_HOURS_MAX, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_WORKSPACE_TTL_MAX_HOURS_DEFAULT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS2, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, SUSPENDED_FOR_DIMENSIONS, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_SCHEDULE_TYPES, WORKFLOW_SCHEDULE_SHAPE_ISSUE, WORKFLOW_SCHEDULE_SHAPES_HINT, WORKFLOW_SCHEDULE_RUN_AS, isObject, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
+var __defProp4, __name4, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_MODEL_TEMPLATE_ROOT, WORKFLOW_MODEL_TEMPLATE_RE, PATH_SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, APPROVAL_REMIND_AFTER_HOURS_MIN, APPROVAL_REMIND_AFTER_HOURS_MAX, APPROVAL_TIMEOUT_HOURS_MIN, APPROVAL_TIMEOUT_HOURS_MAX, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_WORKSPACE_TTL_MAX_HOURS_DEFAULT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS2, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, SUSPENDED_FOR_DIMENSIONS, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_SCHEDULE_TYPES, WORKFLOW_SCHEDULE_SHAPE_ISSUE, WORKFLOW_SCHEDULE_SHAPES_HINT, WORKFLOW_SCHEDULE_RUN_AS, isObject, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
@@ -16082,8 +16303,12 @@ var init_dist2 = __esm({
     __name4(validateApproverBlock, "validateApproverBlock");
     APPROVAL_REMIND_AFTER_HOURS_MIN = 1;
     APPROVAL_REMIND_AFTER_HOURS_MAX = 720;
+    APPROVAL_TIMEOUT_HOURS_MIN = 1;
+    APPROVAL_TIMEOUT_HOURS_MAX = 720;
     __name(validateApprovalReminder, "validateApprovalReminder");
     __name4(validateApprovalReminder, "validateApprovalReminder");
+    __name(validateHitlTimeoutHours, "validateHitlTimeoutHours");
+    __name4(validateHitlTimeoutHours, "validateHitlTimeoutHours");
     __name(firstAskDeadline, "firstAskDeadline");
     __name4(firstAskDeadline, "firstAskDeadline");
     __name(liftRenderedApprover, "liftRenderedApprover");
@@ -16101,6 +16326,8 @@ var init_dist2 = __esm({
     });
     __name(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
     __name4(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
+    __name(signalNameInvalidMessage, "signalNameInvalidMessage");
+    __name4(signalNameInvalidMessage, "signalNameInvalidMessage");
     __name(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
     __name4(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
     WORKFLOW_WORKSPACE_TTL_MAX_HOURS_DEFAULT = 168;
@@ -17513,6 +17740,9 @@ var init_workflow = __esm({
         for (const r of validateApprovalReminder(opts, `approval("${id2}")`)) {
           if (r.severity === "error") throw new LuaWorkflowBuildError("remind-after-invalid", `"${id2}": ${r.message}`);
         }
+        for (const r of validateHitlTimeoutHours(opts, `approval("${id2}")`)) {
+          throw new LuaWorkflowBuildError("timeout-hours-out-of-range", `"${id2}": ${r.message}`);
+        }
         if (typeof opts.details === "function") throw new LuaWorkflowBuildError("closure-binding", `approval("${id2}").details must be template(...)`);
         this.recordEnvRefs(opts.details, opts.timeoutHours, opts.approver);
         const node = defined({
@@ -17543,6 +17773,10 @@ var init_workflow = __esm({
       waitForSignal(id2, opts) {
         this.assertId(id2, "waitForSignal()");
         if (!opts || typeof opts.signal !== "string" || opts.signal.length === 0) throw new LuaWorkflowBuildError("invalid-envelope", `waitForSignal("${id2}") needs a signal name`);
+        if (!WORKFLOW_SIGNAL_NAME_RE.test(opts.signal)) throw new LuaWorkflowBuildError("signal-name-invalid", signalNameInvalidMessage(id2, opts.signal));
+        for (const r of validateHitlTimeoutHours(opts, `waitForSignal("${id2}")`)) {
+          throw new LuaWorkflowBuildError("timeout-hours-out-of-range", `"${id2}": ${r.message}`);
+        }
         this.recordEnvRefs(opts.timeoutHours);
         const node = defined({
           type: "waitForSignal",
@@ -17605,7 +17839,7 @@ var init_workflow = __esm({
         if (this.mapCount >= 2 && this.unnamedMaps > 0) {
           this.warnings.push({
             code: "map-id-required",
-            message: `${this.unnamedMaps} of ${this.mapCount} map() calls have no explicit id \u2014 positional ids renumber on insert; pass { id } (error at push)`
+            message: `${this.unnamedMaps} of ${this.mapCount} map() calls have no explicit id \u2014 positional ids renumber on insert; pass { id } to every map() to keep step ids stable`
           });
         }
         if (graphHasHitl(graph, this.steps) && this.config.budget?.maxDurationSeconds === void 0) {
@@ -17839,6 +18073,19 @@ var init_types = __esm({
 
 // src/api/http.client.ts
 import { randomUUID as randomUUID3 } from "crypto";
+function abortedResponse() {
+  return {
+    success: false,
+    error: {
+      message: "Request aborted",
+      code: REQUEST_ABORTED_CODE,
+      statusCode: 0
+    }
+  };
+}
+function isAborted(signal) {
+  return !!signal && signal.aborted === true;
+}
 async function classifyErrorResponse(response) {
   let errorData;
   try {
@@ -17994,7 +18241,7 @@ function coreDrainApiRetryDelayMs(error) {
   const delayMs = retryAfterSeconds * 1e3;
   return Math.min(Math.max(0, delayMs), CORE_DRAINING_MAX_RETRY_MS);
 }
-var DEFAULT_REQUEST_TIMEOUT_MS, HttpClient;
+var DEFAULT_REQUEST_TIMEOUT_MS, REQUEST_ABORTED_CODE, HttpClient;
 var init_http_client = __esm({
   "src/api/http.client.ts"() {
     "use strict";
@@ -18005,6 +18252,9 @@ var init_http_client = __esm({
     init_lua_fetch();
     init_request_credential();
     DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+    REQUEST_ABORTED_CODE = "REQUEST_ABORTED";
+    __name(abortedResponse, "abortedResponse");
+    __name(isAborted, "isAborted");
     HttpClient = class {
       static {
         __name(this, "HttpClient");
@@ -18027,9 +18277,17 @@ var init_http_client = __esm({
       * @private
       */
       async request(url, options = {}, overrides) {
+        const callerSignal = overrides?.signal;
+        if (isAborted(callerSignal)) return abortedResponse();
         const controller = new AbortController();
         const timeoutMs = overrides?.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
         const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+        const onCallerAbort = /* @__PURE__ */ __name(() => controller.abort(), "onCallerAbort");
+        if (typeof callerSignal?.addEventListener === "function") {
+          callerSignal.addEventListener("abort", onCallerAbort, {
+            once: true
+          });
+        }
         try {
           const authorization = this.requestCredential ? `Bearer ${await bearerFor(this.requestCredential)}` : void 0;
           const response = await luaFetch(url, {
@@ -18051,6 +18309,7 @@ var init_http_client = __esm({
           try {
             data = await response.json();
           } catch (jsonError) {
+            if (isAborted(callerSignal)) throw jsonError;
             data = {};
           }
           if (typeof data === "object" && data !== null && "success" in data) {
@@ -18068,6 +18327,9 @@ var init_http_client = __esm({
           if (isAccessDeniedError(error)) {
             throw error;
           }
+          if (isAborted(callerSignal)) {
+            return abortedResponse();
+          }
           if (error instanceof DOMException && error.name === "AbortError") {
             return {
               success: false,
@@ -18084,9 +18346,36 @@ var init_http_client = __esm({
               statusCode: 0
             }
           };
+        } finally {
+          clearTimeout(timeoutId);
+          if (typeof callerSignal?.removeEventListener === "function") {
+            callerSignal.removeEventListener("abort", onCallerAbort);
+          }
         }
       }
       /**
+      * A backoff wait the caller's signal can cut short (BAC-1097): resolves at `ms` or on abort, whichever is
+      * first, and never leaves the timer or the listener behind. The caller re-checks `signal.aborted` afterwards.
+      * @private
+      */
+      sleep(ms, signal) {
+        if (isAborted(signal)) return Promise.resolve();
+        const listenable = typeof signal?.addEventListener === "function";
+        return new Promise((resolve7) => {
+          const onAbort = /* @__PURE__ */ __name(() => {
+            clearTimeout(timer);
+            resolve7();
+          }, "onAbort");
+          const timer = setTimeout(() => {
+            if (listenable) signal.removeEventListener("abort", onAbort);
+            resolve7();
+          }, ms);
+          if (listenable) signal.addEventListener("abort", onAbort, {
+            once: true
+          });
+        });
+      }
+      /**
       * Non-2xx classification shared by `request` and `httpStream` (WF-204): 401s become
       * `AuthenticationError` (ownership vs credential), 403s throw, everything else returns the
       * `{ success:false, error }` envelope with the server body spread in.
@@ -18154,19 +18443,22 @@ var init_http_client = __esm({
           }
         }
         let lastResult = null;
+        const signal = overrides?.signal;
         for (let attempt = 0; attempt <= maxRetries; attempt++) {
+          if (isAborted(signal)) return abortedResponse();
           try {
             const result = await this.request(url, options, overrides);
             if (result.success || !result.error || !this.isRetryableStatus(result.error.statusCode || 0)) {
               return result;
             }
+            if (isAborted(signal)) return result;
             lastResult = result;
           } catch (error) {
             throw error;
           }
           if (attempt < maxRetries) {
             const backoff = this.retryDelayMs(attempt, lastResult?.error, options.method);
-            await new Promise((resolve7) => setTimeout(resolve7, backoff));
+            await this.sleep(backoff, signal);
           }
         }
         return lastResult;
@@ -18215,7 +18507,8 @@ var init_http_client = __esm({
       async httpPostCoreDrainRetry(url, data, headers, overrides) {
         const first = await this.httpPostOnce(url, data, headers, overrides);
         if (!isCoreDrainApiError(first.error)) return first;
-        await new Promise((resolve7) => setTimeout(resolve7, coreDrainApiRetryDelayMs(first.error)));
+        await this.sleep(coreDrainApiRetryDelayMs(first.error), overrides?.signal);
+        if (isAborted(overrides?.signal)) return abortedResponse();
         return this.httpPostOnce(url, data, headers, overrides);
       }
       /**
@@ -20702,6 +20995,23 @@ function setCiMode(enabled) {
 function isCiModeEnabled() {
   return isCiMode;
 }
+function setJsonOutputRequested(enabled) {
+  jsonOutputRequested = enabled;
+}
+function isJsonOutputRequested() {
+  return jsonOutputRequested;
+}
+function commandRequestedJson(command) {
+  for (let current = command; current; current = current.parent) {
+    if (current.getOptionValueSource("json") === "cli" && current.getOptionValue("json")) return true;
+  }
+  return false;
+}
+function registerJsonErrorEnvelope(program2) {
+  program2.hook("preAction", (_thisCommand, actionCommand) => {
+    setJsonOutputRequested(commandRequestedJson(actionCommand));
+  });
+}
 async function showUpdateWarningIfNeeded(versionCheckPromise) {
   try {
     const result = await versionCheckPromise;
@@ -20777,7 +21087,8 @@ async function withErrorHandling(commandFn, commandName, opts) {
     }
     let json2 = false;
     try {
-      json2 = typeof opts?.json === "function" ? !!opts.json() : !!opts?.json;
+      if (opts?.json === void 0) json2 = isJsonOutputRequested();
+      else json2 = typeof opts.json === "function" ? !!opts.json() : !!opts.json;
     } catch {
     }
     const reported = reportCliError(error, {
@@ -20801,7 +21112,7 @@ function writeSuccess(message) {
 function writeError(message) {
   process.stderr.write("\r\x1B[K" + message + "\n");
 }
-var isCiMode;
+var isCiMode, jsonOutputRequested;
 var init_cli = __esm({
   "src/utils/cli.ts"() {
     "use strict";
@@ -20815,6 +21126,11 @@ var init_cli = __esm({
     isCiMode = false;
     __name(setCiMode, "setCiMode");
     __name(isCiModeEnabled, "isCiModeEnabled");
+    jsonOutputRequested = false;
+    __name(setJsonOutputRequested, "setJsonOutputRequested");
+    __name(isJsonOutputRequested, "isJsonOutputRequested");
+    __name(commandRequestedJson, "commandRequestedJson");
+    __name(registerJsonErrorEnvelope, "registerJsonErrorEnvelope");
     __name(showUpdateWarningIfNeeded, "showUpdateWarningIfNeeded");
     __name(withErrorHandling, "withErrorHandling");
     __name(clearPromptLines, "clearPromptLines");
@@ -20932,6 +21248,10 @@ var init_cli_credentials_api_service = __esm({
       async createCliCredential(firebaseIdToken, request2) {
         return this.httpPostOnce("/admin/users/me/credentials/cli", request2, bearerHeaders(firebaseIdToken));
       }
+      /** Issue a credential bound to one agent and one device name. Needs a first-party session bearer. */
+      async issueDeviceCredential(firebaseIdToken, request2) {
+        return this.httpPostOnce("/admin/users/me/credentials/device", request2, bearerHeaders(firebaseIdToken));
+      }
     };
   }
 });
@@ -29005,15 +29325,15 @@ function parseWorkflowScript(script, fileName) {
     if (ts4.isNewExpression(node)) {
       const callee = node.expression;
       if (ts4.isIdentifier(callee) && callee.text === "Function") nondeterminism(node, "Function", "`new Function` is forbidden");
-      if (ts4.isIdentifier(callee) && callee.text === "Date" && (node.arguments?.length ?? 0) === 0) nondeterminism(node, "Date", "`new Date()` with no argument \u2014 use env.now()");
+      if (ts4.isIdentifier(callee) && callee.text === "Date" && (node.arguments?.length ?? 0) === 0) nondeterminism(node, "Date", "`new Date()` with no argument \u2014 use now()");
     }
     if (ts4.isCallExpression(node)) {
       const callee = node.expression;
       if (ts4.isPropertyAccessExpression(callee) && ts4.isIdentifier(callee.expression)) {
         const root = callee.expression.text;
         const member = callee.name.text;
-        if (root === "Date" && member === "now") nondeterminism(node, "Date.now", "`Date.now()` \u2014 use env.now()");
-        if (root === "Math" && member === "random") nondeterminism(node, "Math.random", "`Math.random()` \u2014 use env.random()");
+        if (root === "Date" && member === "now") nondeterminism(node, "Date.now", "`Date.now()` \u2014 use now()");
+        if (root === "Math" && member === "random") nondeterminism(node, "Math.random", "`Math.random()` \u2014 use random()");
         if (root === "Promise" && member === "race") issues.push(errorAt(sf, file, node, "SCRIPT_NONDETERMINISM", "`Promise.race` \u2014 completion order is journaled but flagged as a coverage risk", "Promise.race", "warning"));
       }
       if (ts4.isIdentifier(callee) && callee.text === "Function") nondeterminism(node, "Function", "`Function()` is forbidden");
@@ -32961,10 +33281,15 @@ var init_webhook_api_service = __esm({
 });
 
 // src/instances/user.instance.ts
+function omit(source, key) {
+  const { [key]: _dropped, ...rest } = source;
+  return rest;
+}
 var UserDataInstance;
 var init_user_instance = __esm({
   "src/instances/user.instance.ts"() {
     "use strict";
+    __name(omit, "omit");
     UserDataInstance = class {
       static {
         __name(this, "UserDataInstance");
@@ -32980,7 +33305,12 @@ var init_user_instance = __esm({
       * @returns Proxied instance that allows direct access to data properties
       */
       constructor(api, data, profile) {
-        this.data = data && typeof data === "object" ? data : {};
+        Object.defineProperty(this, "data", {
+          value: data && typeof data === "object" ? data : {},
+          writable: true,
+          enumerable: false,
+          configurable: true
+        });
         Object.defineProperty(this, "userAPI", {
           value: api,
           writable: true,
@@ -33092,7 +33422,8 @@ var init_user_instance = __esm({
       */
       async update(data) {
         try {
-          const response = await this.userAPI.update(data);
+          const payload = data && data.data === this.data ? omit(data, "data") : data;
+          const response = await this.userAPI.update(payload);
           this.data = response;
           return this.data;
         } catch (error) {
@@ -34993,6 +35324,29 @@ var init_ai_api_service = __esm({
         }
         return result.data;
       }
+      async image(body) {
+        return this.httpPost(`/developer/ai/${this.agentId}/image`, body, {});
+      }
+      /**
+      * Handles the simplified-vs-full-options branching for `AI.image`.
+      * Simplified (`AI.image(prompt, options?)`) returns the hosted CDN url string; the options overload
+      * (`AI.image({ prompt, ... })`) returns the full `{ url, model, provider }`.
+      */
+      async imageForSandbox(promptOrOptions, options) {
+        const simplified = typeof promptOrOptions === "string";
+        const body = simplified ? {
+          prompt: promptOrOptions,
+          ...options
+        } : promptOrOptions;
+        const result = await this.image(body);
+        if (!result.success) {
+          throw new Error(result.error?.message || "AI image generation failed");
+        }
+        if (!result.data) {
+          throw new Error("AI image generation failed: empty response");
+        }
+        return simplified ? result.data.url : result.data;
+      }
     };
   }
 });
@@ -35379,6 +35733,12 @@ var init_connection_requests_api_service = __esm({
 });
 
 // src/api/agents.api.service.ts
+function isAborted2(signal) {
+  return !!signal && signal.aborted === true;
+}
+function abortReason2(signal) {
+  return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
 function toInvocationOutput(data, callerThreadId) {
   const toolNames = /* @__PURE__ */ new Set();
   for (const step3 of Array.isArray(data.steps) ? data.steps : []) {
@@ -35464,9 +35824,15 @@ var init_agents_api_service = __esm({
         });
         if (body.identifier) query.set("identifier", body.identifier);
         const chatBody = this.toChatGenerateBody(body);
-        return this.httpPostCoreDrainRetry(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {}, typeof body.timeoutMs === "number" ? {
-          timeoutMs: body.timeoutMs
-        } : void 0);
+        const overrides = {
+          ...typeof body.timeoutMs === "number" ? {
+            timeoutMs: body.timeoutMs
+          } : {},
+          ...body.signal ? {
+            signal: body.signal
+          } : {}
+        };
+        return this.httpPostCoreDrainRetry(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {}, Object.keys(overrides).length > 0 ? overrides : void 0);
       }
       /**
       * Sandbox overload: mirrors the `AI.generate` pattern where the simplified
@@ -35477,15 +35843,29 @@ var init_agents_api_service = __esm({
         const input = typeof promptOrInput === "string" ? {
           prompt: promptOrInput
         } : promptOrInput;
+        if (isAborted2(input.signal)) throw abortReason2(input.signal);
         const result = await this.invoke(targetAgentId, input);
         if (!result.success) {
+          if (isAborted2(input.signal)) throw abortReason2(input.signal);
           throw new Error(result.error?.message || "Agent invocation failed");
         }
         if (!result.data) {
           throw new Error("Agent invocation failed: empty response");
         }
-        if (typeof promptOrInput === "string") return result.data.text ?? "";
         const data = result.data;
+        if (data?.type === "error") {
+          if (isPaymentRequiredChatErrorEnvelope(data)) {
+            throw Object.assign(new Error(data.error || "Payment required"), {
+              name: "AgentInvocationError",
+              code: "PAYMENT_REQUIRED",
+              statusCode: 402
+            });
+          }
+          throw Object.assign(new Error(data.error || "Agent invocation failed"), {
+            name: "AgentInvocationError",
+            code: "AGENT_ERROR"
+          });
+        }
         if (data?.type === "preprocessor_blocked") {
           throw Object.assign(new Error(data.text || "Agent invocation blocked by preprocessor"), {
             name: "AgentInvocationError",
@@ -35500,6 +35880,7 @@ var init_agents_api_service = __esm({
             stage: data.governanceBlock?.stage
           });
         }
+        if (typeof promptOrInput === "string") return data.text ?? "";
         return toInvocationOutput(data, input.threadId);
       }
       /**
@@ -35520,7 +35901,8 @@ var init_agents_api_service = __esm({
             code
           });
         }, "refuse");
-        if (op === "versions.promote" || op === "persona.activate" || op === "versions.delete" || op === "workflows.create" || op === "workflows.push" || op === "workflows.deploy") {
+        if (op === "versions.promote" || // WD — a watchdog rollback changes what a live agent serves, like a promote.
+        op === "versions.rollback" || op === "persona.activate" || op === "versions.delete" || op === "workflows.create" || op === "workflows.push" || op === "workflows.deploy") {
           refuse("supervision_release_offline_refused", `${op} is refused offline: a local test never changes a live agent`);
         }
         if (op === "versions.preview" || op === "agents.list" || op === "agents.get" || op === "source.get" || // U25 — a subscription is live platform state (it starts a deployed trigger): never from a local test.
@@ -35688,6 +36070,8 @@ var init_agents_api_service = __esm({
           case "evals.cancel":
           case "owner.notify":
           case "connections.assign":
+          // SV (LUA-1080) — the live pointers are not exposed on a developer route: platform only.
+          case "primitives.deployed":
             return refuse("supervision_offline_unsupported", `${op} is not available offline; run it on the platform`);
           default:
             return refuse("supervision_unknown_op", `Unknown supervision operation ${String(op)}`);
@@ -35724,6 +36108,8 @@ var init_agents_api_service = __esm({
         };
       }
     };
+    __name(isAborted2, "isAborted");
+    __name(abortReason2, "abortReason");
     __name(toInvocationOutput, "toInvocationOutput");
     __name(runSummary, "runSummary");
     __name(supervisedCheck, "supervisedCheck");
@@ -36363,9 +36749,22 @@ function createWorkflowsRuntime(getApi) {
     },
     async list(opts = {}) {
       const api = await getApi();
-      const ref = opts.workflow ? await resolveRef(api, opts.workflow) : {};
+      let workflowId;
+      if (opts.workflow) {
+        const v = opts.workflow.trim();
+        const defs = await api.getWorkflows({
+          includeDynamic: true
+        });
+        const hit = defs.success && defs.data ? defs.data.workflows.find((w) => w.name === v) ?? defs.data.workflows.find((w) => w.id === v) : void 0;
+        if (hit) workflowId = hit.id;
+        else if (isWorkflowIdShaped(v)) workflowId = v;
+        else {
+          unwrap(defs, "Workflows.list");
+          return [];
+        }
+      }
       const page = unwrap(await api.getRuns({
-        workflowId: ref.workflowId,
+        workflowId,
         status: opts.status,
         limit: opts.limit,
         correlationKey: opts.correlationKey,
@@ -36403,7 +36802,10 @@ function createWorkflowsRuntime(getApi) {
         ...opts
       }), "Workflows.signalByKey");
     },
-    raiseBudget: unavailable("raiseBudget", "R45"),
+    async raiseBudget(runId, patch) {
+      const api = await getApi();
+      return unwrap(await api.raiseBudget(runId, patch), "Workflows.raiseBudget");
+    },
     // Goals are scoped to the bound agent: the IF-21 `agentId` argument is parity with the HTTP twin
     // (`/workflows/:agentId/goals`), never a way to reach another agent's goals (403 otherwise).
     async setGoal(agentId, goal) {
@@ -36446,7 +36848,7 @@ function createWorkflowsRuntime(getApi) {
     }
   };
 }
-var WORKFLOW_START_MAX_WAIT_SECONDS, WORKFLOW_START_CLIENT_DEADLINE_SLACK_MS, CONTROL_UNAVAILABLE_HINT, WorkflowApiError, WORKFLOWS_RUNTIME_MEMBERS, unwrap, assertBoundAgent, pathId, unavailable, WorkflowApi;
+var WORKFLOW_START_MAX_WAIT_SECONDS, WORKFLOW_START_CLIENT_DEADLINE_SLACK_MS, CONTROL_UNAVAILABLE_HINT, WorkflowApiError, WORKFLOWS_RUNTIME_MEMBERS, unwrap, isWorkflowIdShaped, assertBoundAgent, pathId, WorkflowApi;
 var init_workflow_api_service = __esm({
   "src/api/workflow.api.service.ts"() {
     "use strict";
@@ -36492,15 +36894,13 @@ var init_workflow_api_service = __esm({
       }
       return res.data;
     }, "unwrap");
+    isWorkflowIdShaped = /* @__PURE__ */ __name((v) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v) || /^wfc?_[A-Za-z0-9]/.test(v), "isWorkflowIdShaped");
     assertBoundAgent = /* @__PURE__ */ __name((api, agentId, member) => {
       if (agentId && agentId !== api.agentId) {
         throw new WorkflowApiError("FORBIDDEN", `Workflows.${member}: goals are scoped to the bound agent ${api.agentId}`, 403);
       }
     }, "assertBoundAgent");
     pathId = /* @__PURE__ */ __name((id2) => encodeURIComponent(id2), "pathId");
-    unavailable = /* @__PURE__ */ __name((member, route) => async () => {
-      throw new WorkflowApiError("WORKFLOWS_API_UNAVAILABLE", `Workflows.${member} is not available in this runtime yet (${route} lands with a later wave)`, 501);
-    }, "unavailable");
     __name(createWorkflowsRuntime, "createWorkflowsRuntime");
     WorkflowApi = class extends HttpClient {
       static {
@@ -36940,20 +37340,35 @@ var init_device_api_service = __esm({
         return this.httpDelete(`/developer/devices/${this.agentId}/${deviceId}`, {});
       }
       async sendCommand(deviceName, command, payload, timeout) {
-        return this.httpPost(`/developer/devices/${this.agentId}/${deviceName}/command`, {
+        return this.httpPost(`/developer/devices/${this.agentId}/${encodeURIComponent(deviceName)}/command`, {
           command,
           payload,
           timeout: timeout || 3e4
         }, {});
       }
       async getDeviceStatus(deviceName) {
-        return this.httpGet(`/developer/devices/${this.agentId}/${deviceName}/status`, {});
+        return this.httpGet(`/developer/devices/${this.agentId}/${encodeURIComponent(deviceName)}/status`, {});
       }
       async enableDevice(deviceName) {
-        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/enable`, {}, {});
+        return this.httpPatch(`/developer/devices/${this.agentId}/${encodeURIComponent(deviceName)}/enable`, {}, {});
       }
       async disableDevice(deviceName) {
-        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/disable`, {}, {});
+        return this.httpPatch(`/developer/devices/${this.agentId}/${encodeURIComponent(deviceName)}/disable`, {}, {});
+      }
+      /** Device instances the agent has seen, with live status; self-describing devices only appear here. */
+      async getConnectedDevices() {
+        return this.httpGet(`/developer/devices/${this.agentId}/connected`, {});
+      }
+      /** Fire a trigger as the named device would; the live handler runs. */
+      async fireTrigger(deviceName, triggerName, payload) {
+        return this.httpPost(`/developer/devices/${this.agentId}/${encodeURIComponent(deviceName)}/trigger`, {
+          triggerName,
+          payload
+        }, {});
+      }
+      /** Remove a connected device's instance record (not its definition). */
+      async deleteDeviceInstance(deviceName) {
+        return this.httpDelete(`/developer/devices/${this.agentId}/${encodeURIComponent(deviceName)}/instance`, {});
       }
     };
   }
@@ -38417,7 +38832,6 @@ init_credential_operational_context();
 init_command_utils();
 init_cli_error();
 init_cli();
-import inquirer3 from "inquirer";
 import { writeFileSync as writeFileSync7, existsSync as existsSync8 } from "fs";
 import { join as join8 } from "path";
 
@@ -38538,7 +38952,7 @@ __name(injectGovernanceIntoAgent, "injectGovernanceIntoAgent");
 import inquirer2 from "inquirer";
 import chalk from "chalk";
 async function promptAgentChoice() {
-  const { agentChoice } = await inquirer2.prompt([
+  const { agentChoice } = await safePrompt([
     {
       type: "list",
       name: "agentChoice",
@@ -38567,7 +38981,7 @@ async function promptOrganizationSelection(orgs) {
     name: org.registeredName || org.name || "Unknown Organization",
     value: org
   }));
-  const { selectedOrg } = await inquirer2.prompt([
+  const { selectedOrg } = await safePrompt([
     {
       type: "list",
       name: "selectedOrg",
@@ -38586,7 +39000,7 @@ async function promptAgentSelection(org) {
     name: agent.name,
     value: agent
   }));
-  const { selectedAgent } = await inquirer2.prompt([
+  const { selectedAgent } = await safePrompt([
     {
       type: "list",
       name: "selectedAgent",
@@ -38600,7 +39014,7 @@ __name(promptAgentSelection, "promptAgentSelection");
 async function promptMetadataCollection(requiredFields) {
   const metadata = {};
   for (const field of requiredFields) {
-    const { [field]: value3 } = await inquirer2.prompt([
+    const { [field]: value3 } = await safePrompt([
       {
         type: "input",
         name: field,
@@ -38614,7 +39028,7 @@ async function promptMetadataCollection(requiredFields) {
 }
 __name(promptMetadataCollection, "promptMetadataCollection");
 async function promptAgentName() {
-  const { agentName } = await inquirer2.prompt([
+  const { agentName } = await safePrompt([
     {
       type: "input",
       name: "agentName",
@@ -38650,7 +39064,7 @@ async function promptModelSelection(models) {
       });
     }
   }
-  const { selectedModel } = await inquirer2.prompt([
+  const { selectedModel } = await safePrompt([
     {
       type: "list",
       name: "selectedModel",
@@ -38683,7 +39097,7 @@ __name(displayPersonaInstructions, "displayPersonaInstructions");
 async function promptDuplicateOptions(sourceOrg, allOrgs, sourceAgentName) {
   let targetOrg = sourceOrg;
   if (allOrgs.length > 1) {
-    const { sameOrg } = await inquirer2.prompt([
+    const { sameOrg } = await safePrompt([
       {
         type: "list",
         name: "sameOrg",
@@ -38707,7 +39121,7 @@ async function promptDuplicateOptions(sourceOrg, allOrgs, sourceAgentName) {
     }
   }
   const defaultName = `${sourceAgentName} (Copy)`;
-  const { newName } = await inquirer2.prompt([
+  const { newName } = await safePrompt([
     {
       type: "input",
       name: "newName",
@@ -38716,7 +39130,7 @@ async function promptDuplicateOptions(sourceOrg, allOrgs, sourceAgentName) {
       validate: /* @__PURE__ */ __name((input) => input.trim().length > 0 || "Name is required", "validate")
     }
   ]);
-  const { includedBuckets } = await inquirer2.prompt([
+  const { includedBuckets } = await safePrompt([
     {
       type: "checkbox",
       name: "includedBuckets",
@@ -38760,7 +39174,7 @@ async function promptDuplicateOptions(sourceOrg, allOrgs, sourceAgentName) {
   console.log(chalk.white(`  Including:     ${includedBuckets.length > 0 ? includedBuckets.join(", ") : "core agent definition only"}`));
   console.log(chalk.cyan("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501"));
   console.log("");
-  const { confirmed } = await inquirer2.prompt([
+  const { confirmed } = await safePrompt([
     {
       type: "confirm",
       name: "confirmed",
@@ -41035,7 +41449,7 @@ async function initCommand(options = {}) {
             writeError("\n\u26A0\uFE0F  You don't have access to the agent in this project");
             writeInfo(`   Agent ID: ${existingAgentId}
 `);
-            const { action } = await inquirer3.prompt([
+            const { action } = await safePrompt([
               {
                 type: "list",
                 name: "action",
@@ -41072,7 +41486,7 @@ async function initCommand(options = {}) {
             writeInfo("\n\u{1F4CB} Found existing project configuration");
             writeInfo(`   Current Agent ID: ${existingAgentId}
 `);
-            const { wantSwitch } = await inquirer3.prompt([
+            const { wantSwitch } = await safePrompt([
               {
                 type: "list",
                 name: "wantSwitch",
@@ -41359,7 +41773,7 @@ __name(createNewAgentNonInteractive, "createNewAgentNonInteractive");
 async function createNewAgentFlow(apiKey, organizations, promoCode) {
   const agentTypes = await fetchAgentTypes(apiKey);
   const selectedAgentType = selectBaseAgentType(agentTypes);
-  const { orgChoice } = await inquirer3.prompt([
+  const { orgChoice } = await safePrompt([
     {
       type: "list",
       name: "orgChoice",
@@ -41390,7 +41804,7 @@ async function createNewAgentFlow(apiKey, organizations, promoCode) {
     }
   }
   if (!orgId) {
-    const { organizationName } = await inquirer3.prompt([
+    const { organizationName } = await safePrompt([
       {
         type: "input",
         name: "organizationName",
@@ -41518,7 +41932,7 @@ async function promptPersonaReplacement(existingYaml, newPersona) {
   }
   writeInfo("\n\u{1F4DD} Persona Configuration:");
   writeInfo("   Existing persona found in project");
-  const { replacePersona } = await inquirer3.prompt([
+  const { replacePersona } = await safePrompt([
     {
       type: "confirm",
       name: "replacePersona",
@@ -41538,7 +41952,7 @@ async function checkAndRestoreBackup(apiKey, agentId, options) {
   }
   const conflicts = checkRestoreConflicts(manifest, targetDir);
   if (!options.autoRestore && conflicts.existingFiles.length > 0) {
-    const { confirm } = await inquirer3.prompt([
+    const { confirm } = await safePrompt([
       {
         type: "confirm",
         name: "confirm",
@@ -41587,7 +42001,7 @@ __name(checkAndRestoreBackup, "checkAndRestoreBackup");
 init_request_credential();
 init_cli();
 init_analytics();
-import inquirer4 from "inquirer";
+import inquirer3 from "inquirer";
 function report(result, requested) {
   const deleted = result.sessionCleared || result.apiKeyCleared;
   if (!deleted) {
@@ -41621,7 +42035,7 @@ async function destroyCommand(options) {
       });
       return;
     }
-    const { confirm } = await inquirer4.prompt([
+    const { confirm } = await inquirer3.prompt([
       {
         type: "confirm",
         name: "confirm",
@@ -41770,7 +42184,7 @@ async function sessionsRevokeCommand(sessionId) {
 __name(sessionsRevokeCommand, "sessionsRevokeCommand");
 
 // src/commands/apiKey.ts
-import inquirer5 from "inquirer";
+import inquirer4 from "inquirer";
 init_request_credential();
 init_cli();
 init_analytics();
@@ -41796,7 +42210,7 @@ async function apiKeyCommand(options) {
       });
       return;
     }
-    const { confirm } = await inquirer5.prompt([
+    const { confirm } = await inquirer4.prompt([
       {
         type: "confirm",
         name: "confirm",
@@ -43847,6 +44261,14 @@ function requireExpectActiveId(opts, what) {
 }
 __name(requireExpectActiveId, "requireExpectActiveId");
 __name8(requireExpectActiveId, "requireExpectActiveId");
+function optionalCommitHash(opts, what) {
+  const commitHash = opts?.commitHash;
+  if (commitHash === void 0) return void 0;
+  if (typeof commitHash === "string" && commitHash.length > 0) return commitHash;
+  throw typedError("supervision_bad_args", `${what} commitHash must be a non-empty string`);
+}
+__name(optionalCommitHash, "optionalCommitHash");
+__name8(optionalCommitHash, "optionalCommitHash");
 function approvalIdsOf(approval) {
   if (approval === void 0 || approval === null) return void 0;
   if (typeof approval !== "object" || Array.isArray(approval)) return {
@@ -43925,6 +44347,20 @@ function buildSupervisionAgentsApi(call2) {
       delete: /* @__PURE__ */ __name8((version) => call2("versions.delete", agentId, {
         version
       }), "delete"),
+      /**
+      * WD — restore a previously-active, OLDER `version` (watchdog grant; last 7 days; only from a workflow step the
+      * grant names). Compare-and-swap: `expectActive` is the active version number now (required, never null).
+      */
+      rollback: /* @__PURE__ */ __name8(async (version, opts) => {
+        const expectActive = requireExpectActive(opts, "versions.rollback");
+        if (expectActive === null) {
+          throw typedError("supervision_expect_active_required", "versions.rollback requires { expectActive } \u2014 the active version number (a rollback needs one)");
+        }
+        return call2("versions.rollback", agentId, {
+          version,
+          expectActive
+        });
+      }, "rollback"),
       // wave 2 U11
       /**
       * U11 (DOC2 §6.1) — open a TEST SESSION on staged `opts.version`: multi-turn `chat`, `fire`, `effects()` and
@@ -43962,11 +44398,18 @@ function buildSupervisionAgentsApi(call2) {
         }
       }), "push"),
       /** Publish workflow `version`. Compare-and-swap: refused unless `expectActive` is the live version id. */
-      deploy: /* @__PURE__ */ __name8(async (workflowId, version, opts) => call2("workflows.deploy", agentId, {
-        workflowId,
-        version,
-        expectActive: requireExpectActiveId(opts, "workflows.deploy")
-      }), "deploy")
+      deploy: /* @__PURE__ */ __name8(async (workflowId, version, opts) => {
+        const expectActive = requireExpectActiveId(opts, "workflows.deploy");
+        const commitHash = optionalCommitHash(opts, "workflows.deploy");
+        return call2("workflows.deploy", agentId, {
+          workflowId,
+          version,
+          expectActive,
+          ...commitHash !== void 0 ? {
+            commitHash
+          } : {}
+        });
+      }, "deploy")
     }), "workflows"),
     persona: /* @__PURE__ */ __name8((agentId) => ({
       versions: /* @__PURE__ */ __name8(() => call2("persona.versions", agentId), "versions"),
@@ -43987,6 +44430,12 @@ function buildSupervisionAgentsApi(call2) {
       keys: /* @__PURE__ */ __name8(() => call2("env.keys", agentId), "keys")
     }), "env"),
     /**
+    * SV (LUA-1080) — what `agentId` serves RIGHT NOW: its live skills (with tools), the published persona and its
+    * pre/postprocessors, each with the version id an agent version snapshot would pin. Works with no promoted agent
+    * version, so a release can diff live against a staged version. Metadata and hashes only (`observe`).
+    */
+    deployed: /* @__PURE__ */ __name8((agentId) => call2("primitives.deployed", agentId), "deployed"),
+    /**
     * U25 — supervision events of the target (`observe`): each event of a subscribed kind starts
     * one of the CALLER's own triggers (`triggerName`) with a `source: 'supervision'` body.
     */
@@ -44603,20 +45052,20 @@ init_artifact_loader();
 
 // src/api/threads.offline.ts
 init_dist();
-function unavailable2(member) {
+function unavailable(member) {
   return Object.assign(new Error(`Threads.${member} only runs on the Lua platform (deployed or sandbox agents), not in lua test / lua dev`), {
     name: "ThreadFollowUpError",
     code: THREAD_FOLLOW_UP_ERRORS.UNAVAILABLE
   });
 }
-__name(unavailable2, "unavailable");
+__name(unavailable, "unavailable");
 function createOfflineThreadsApi() {
   return {
     open: /* @__PURE__ */ __name(async () => {
-      throw unavailable2("open");
+      throw unavailable("open");
     }, "open"),
     followUp: /* @__PURE__ */ __name(async () => {
-      throw unavailable2("followUp");
+      throw unavailable("followUp");
     }, "followUp")
   };
 }
@@ -45755,13 +46204,13 @@ async function runWorkflowLocallyInner(rawOpts) {
   let artefactSeq = 0;
   const artefactsApi = /* @__PURE__ */ __name((stepId) => {
     const dir = opts.artefactsDir;
-    const unavailable3 = /* @__PURE__ */ __name(() => {
+    const unavailable2 = /* @__PURE__ */ __name(() => {
       throw new StepFailure("ARTEFACTS_NOT_AVAILABLE_OFFLINE", "ctx.artefacts needs --artefacts-dir (03 \xA73.9 step 7)");
     }, "unavailable");
     if (!dir) {
       return {
-        put: /* @__PURE__ */ __name(async () => unavailable3(), "put"),
-        get: /* @__PURE__ */ __name(async () => unavailable3(), "get"),
+        put: /* @__PURE__ */ __name(async () => unavailable2(), "put"),
+        get: /* @__PURE__ */ __name(async () => unavailable2(), "get"),
         list: /* @__PURE__ */ __name(async () => [], "list")
       };
     }
@@ -46969,39 +47418,52 @@ function createSandbox(options) {
     Workflows: createWorkflowsRuntime(async () => workflowService),
     // wave 2 U13b — `Threads` never posts into a real conversation offline: typed `thread_follow_up_unavailable`.
     Threads: createOfflineThreadsApi(),
-    // Device API (for sandbox — commands route through lua-api developer endpoint)
-    Device: {
-      sendCommand: /* @__PURE__ */ __name(async (deviceName, command, payload, timeout) => {
-        const { getDeviceInstance: getDeviceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
-        const deviceApi = await getDeviceInstance2();
-        const response = await deviceApi.sendCommand(deviceName, command, payload, timeout || 3e4);
-        if (!response.success) throw new Error(response.error?.message || "Device command failed");
-        return response.data;
-      }, "sendCommand"),
-      listDevices: /* @__PURE__ */ __name(async () => {
-        const { getDeviceInstance: getDeviceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
-        const deviceApi = await getDeviceInstance2();
-        const response = await deviceApi.getDevices();
-        return response.data?.devices || response.data || [];
-      }, "listDevices"),
-      getStatus: /* @__PURE__ */ __name(async (deviceName) => {
-        const { getDeviceInstance: getDeviceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
-        const deviceApi = await getDeviceInstance2();
-        const response = await deviceApi.getDeviceStatus(deviceName);
-        return response.data;
-      }, "getStatus")
-    },
+    // Device API (offline only — commands route through the lua-api developer endpoint). The deployed runtime
+    // has NO `Device` global, so code using it passes `lua test` and fails once deployed: it keeps working here
+    // and warns once, naming the supported routes (an agent step, or `Agents.invoke` from a code step).
+    Device: /* @__PURE__ */ (() => {
+      let warned2 = false;
+      const warnOnce2 = /* @__PURE__ */ __name(() => {
+        if (warned2) return;
+        warned2 = true;
+        console.warn("\u26A0\uFE0F  Device.* works only in local tests: the Lua platform has no Device global. Call a device from an agent step (its commands are tools) or from code with Agents.invoke(agentId, prompt).");
+      }, "warnOnce");
+      return {
+        sendCommand: /* @__PURE__ */ __name(async (deviceName, command, payload, timeout) => {
+          warnOnce2();
+          const { getDeviceInstance: getDeviceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
+          const deviceApi = await getDeviceInstance2();
+          const response = await deviceApi.sendCommand(deviceName, command, payload, timeout || 3e4);
+          if (!response.success) throw new Error(response.error?.message || "Device command failed");
+          return response.data;
+        }, "sendCommand"),
+        listDevices: /* @__PURE__ */ __name(async () => {
+          warnOnce2();
+          const { getDeviceInstance: getDeviceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
+          const deviceApi = await getDeviceInstance2();
+          const response = await deviceApi.getDevices();
+          return response.data?.devices || response.data || [];
+        }, "listDevices"),
+        getStatus: /* @__PURE__ */ __name(async (deviceName) => {
+          warnOnce2();
+          const { getDeviceInstance: getDeviceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
+          const deviceApi = await getDeviceInstance2();
+          const response = await deviceApi.getDeviceStatus(deviceName);
+          return response.data;
+        }, "getStatus")
+      };
+    })(),
     // Legacy `env('FOO')` getter — kept for backwards compatibility with skills
     // that use it instead of `process.env.FOO`. Both work.
     // LUA-751: `env.template(KEY)` too — a graph-form workflow file calls it at MODULE scope (`schedule.timezone:
     // env.template('FINANCE_TZ')`, the shipped `vendor-invoices`), `env` is not one of the builder names esbuild
     // injects (`WORKFLOW_SHIM_NAMES`), so the artifact resolves it against THIS global when `lua workflows run`
     // loads it — and threw `env.template is not a function`. The placeholder is the SDK's (`types/skill.ts`) and the
-    // compiler's tier-1 stub's (`graph-serializer.ts`); the local `--env` overlay substitutes it on the graph.
+    // compiler's tier-1 stub's (`graph-serializer.ts`) — the shared `envTemplatePlaceholder`, so the secret-key
+    // guard (`env-template-secret-key`) matches the SDK and the deployed runtime; the local `--env` overlay
+    // substitutes it on the graph.
     env: Object.assign((key) => envVars[key], {
-      template: /* @__PURE__ */ __name((key) => ({
-        __envRef: key
-      }), "template")
+      template: envTemplatePlaceholder
     }),
     // K1a (PRO-2142) — the `log` global, so `lua test` runs the same code
     // production runs. There is no `VmLogSink` here, so the line goes to the
@@ -47083,7 +47545,7 @@ function createSandbox(options) {
         return getConnectionRequestsInstance2();
       })
     },
-    // Outbound voice dispatch (BAC-212). `lua test` proxies via the same
+    // Voice: outbound dispatch (BAC-212) and web session creation (BAC-552). `lua test` proxies via the same
     // bearer-auth developer endpoint the lua-cli `Voice.call` namespace uses
     // — keeps the surface byte-equivalent to the lua-core production VM
     // (which routes through `/internal/voice-dispatch/:agentId` instead).
@@ -47092,17 +47554,27 @@ function createSandbox(options) {
         const { getVoiceInstance: getVoiceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
         const voice = await getVoiceInstance2();
         return voice.dispatchForSandbox(input);
-      }, "call")
+      }, "call"),
+      createSession: /* @__PURE__ */ __name(async (input) => {
+        const { getVoiceInstance: getVoiceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
+        const voice = await getVoiceInstance2();
+        return voice.createSessionForSandbox(input ?? {});
+      }, "createSession")
     },
     // Lowercase alias matching lua-core's sandbox: `this.voice.call(...)` works
     // at the script top level (where `this === globalThis`), and arrow bodies
-    // can use `voice.call(...)` directly.
+    // can use `voice.call(...)` / `voice.createSession(...)` directly.
     voice: {
       call: /* @__PURE__ */ __name(async (input) => {
         const { getVoiceInstance: getVoiceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
         const voice = await getVoiceInstance2();
         return voice.dispatchForSandbox(input);
-      }, "call")
+      }, "call"),
+      createSession: /* @__PURE__ */ __name(async (input) => {
+        const { getVoiceInstance: getVoiceInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
+        const voice = await getVoiceInstance2();
+        return voice.createSessionForSandbox(input ?? {});
+      }, "createSession")
     },
     // Outbound channel send (PRO-93). Proxied via the lua-cli developer
     // endpoint (Bearer auth) — keeps lua test byte-equivalent to the lua-core
@@ -48428,7 +48900,7 @@ async function compileCommand(options) {
 __name(compileCommand, "compileCommand");
 
 // src/commands/test.ts
-import inquirer6 from "inquirer";
+import inquirer5 from "inquirer";
 
 // src/commands/test-output.helpers.ts
 import { inspect } from "util";
@@ -49487,7 +49959,8 @@ var ALIAS_MAP = {
       "disable",
       "remove",
       "test",
-      "test-trigger"
+      "test-trigger",
+      "credential"
     ],
     aliases: lowerKeys({
       ls: "list",
@@ -49503,7 +49976,9 @@ var ALIAS_MAP = {
       del: "remove",
       run: "test",
       exec: "test",
-      test_trigger: "test-trigger"
+      test_trigger: "test-trigger",
+      credentials: "credential",
+      key: "credential"
     })
   },
   "features.action": {
@@ -50975,6 +51450,9 @@ async function loadSeedFromRun(runId, wf, apiKey, agentId) {
     console.error(`\u274C Run ${runId} not found: ${run.error?.message ?? "unknown error"}`);
     return void 0;
   }
+  if (!run.data.graphHash) {
+    console.error("[from-run] source run carries no graphHash \u2014 graph drift cannot be detected; seeding by step id only (steps absent from the current graph are reported as dropped)");
+  }
   const plan = compilePlan(wf.graph);
   const rows3 = [];
   for (const stepId of plan.order) {
@@ -51096,7 +51574,7 @@ async function promptToolSelection(tools) {
     name: tool.skillName ? `${tool.name} (${tool.skillName}) - ${tool.description}` : `${tool.name} - ${tool.description}`,
     value: tool
   }));
-  const { selectedTool } = await inquirer6.prompt([
+  const { selectedTool } = await inquirer5.prompt([
     {
       type: "list",
       name: "selectedTool",
@@ -54892,7 +55370,7 @@ __name(deployAllCommand, "deployAllCommand");
 // src/commands/chat.ts
 init_cli();
 import * as readline from "readline";
-import inquirer7 from "inquirer";
+import inquirer6 from "inquirer";
 
 // src/api/chat.api.service.ts
 init_http_client();
@@ -55050,21 +55528,25 @@ init_cli();
 init_constants();
 import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, mkdirSync as mkdirSync7 } from "fs";
 import { dirname as dirname6 } from "path";
+function isPlainObject3(value3) {
+  return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+}
+__name(isPlainObject3, "isPlainObject");
 function readStore2() {
   try {
     const raw = readFileSync12(SANDBOX_STORAGE_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return {
       skills: parsed.skills ?? {},
-      preprocessors: parsed.preprocessors ?? {},
-      postprocessors: parsed.postprocessors ?? {},
+      preprocessorsById: isPlainObject3(parsed.preprocessorsById) ? parsed.preprocessorsById : {},
+      postprocessorsById: isPlainObject3(parsed.postprocessorsById) ? parsed.postprocessorsById : {},
       devices: parsed.devices ?? {}
     };
   } catch {
     return {
       skills: {},
-      preprocessors: {},
-      postprocessors: {},
+      preprocessorsById: {},
+      postprocessorsById: {},
       devices: {}
     };
   }
@@ -55115,14 +55597,14 @@ async function getAllSandboxSkillIds(yamlConfig) {
   }
 }
 __name(getAllSandboxSkillIds, "getAllSandboxSkillIds");
-async function getSandboxPreProcessorId(preprocessorName) {
+async function getSandboxPreProcessorId(preprocessorId) {
   const store = readStore2();
-  return store.preprocessors[preprocessorName] ?? null;
+  return store.preprocessorsById[preprocessorId] ?? null;
 }
 __name(getSandboxPreProcessorId, "getSandboxPreProcessorId");
-async function setSandboxPreProcessorId(sandboxId, preprocessorName) {
+async function setSandboxPreProcessorId(sandboxId, preprocessorId) {
   const store = readStore2();
-  store.preprocessors[preprocessorName] = sandboxId;
+  store.preprocessorsById[preprocessorId] = sandboxId;
   writeStore2(store);
 }
 __name(setSandboxPreProcessorId, "setSandboxPreProcessorId");
@@ -55131,8 +55613,8 @@ async function getAllSandboxPreProcessorIds(config) {
   try {
     const preprocessors = preprocessorHandler.getFromYaml(config);
     for (const preprocessor of preprocessors) {
-      if (preprocessor.preprocessorId && preprocessor.name) {
-        const sandboxId = await getSandboxPreProcessorId(preprocessor.name);
+      if (preprocessor.preprocessorId) {
+        const sandboxId = await getSandboxPreProcessorId(preprocessor.preprocessorId);
         if (sandboxId) {
           overrides.push({
             preprocessorId: preprocessor.preprocessorId,
@@ -55147,14 +55629,14 @@ async function getAllSandboxPreProcessorIds(config) {
   return overrides;
 }
 __name(getAllSandboxPreProcessorIds, "getAllSandboxPreProcessorIds");
-async function getSandboxPostProcessorId(postprocessorName) {
+async function getSandboxPostProcessorId(postprocessorId) {
   const store = readStore2();
-  return store.postprocessors[postprocessorName] ?? null;
+  return store.postprocessorsById[postprocessorId] ?? null;
 }
 __name(getSandboxPostProcessorId, "getSandboxPostProcessorId");
-async function setSandboxPostProcessorId(sandboxId, postprocessorName) {
+async function setSandboxPostProcessorId(sandboxId, postprocessorId) {
   const store = readStore2();
-  store.postprocessors[postprocessorName] = sandboxId;
+  store.postprocessorsById[postprocessorId] = sandboxId;
   writeStore2(store);
 }
 __name(setSandboxPostProcessorId, "setSandboxPostProcessorId");
@@ -55163,8 +55645,8 @@ async function getAllSandboxPostProcessorIds(config) {
   try {
     const postprocessors = postprocessorHandler.getFromYaml(config);
     for (const postprocessor of postprocessors) {
-      if (postprocessor.postprocessorId && postprocessor.name) {
-        const sandboxId = await getSandboxPostProcessorId(postprocessor.name);
+      if (postprocessor.postprocessorId) {
+        const sandboxId = await getSandboxPostProcessorId(postprocessor.postprocessorId);
         if (sandboxId) {
           overrides.push({
             postprocessorId: postprocessor.postprocessorId,
@@ -55251,17 +55733,15 @@ __name(pushDevVersion, "pushDevVersion");
 async function pushSingleSkillToSandbox(apiKey, agentId, skillId, skillData, isInitial = false) {
   const skillName = skillData.name || "Unknown Skill";
   const sandboxSkillId = await getSandboxSkillId(skillName);
-  const envVars = loadEnvironmentVariables2();
-  const payloadWithNameAndEnv = {
+  const payload = {
     ...skillData,
-    name: skillName,
-    env: envVars
+    name: skillName
   };
   if (sandboxSkillId) {
     if (!isInitial) {
       writeProgress("\u{1F504} Updating existing sandbox version...");
     }
-    const updateResult = await updateDevVersion(apiKey, agentId, skillId, sandboxSkillId, payloadWithNameAndEnv);
+    const updateResult = await updateDevVersion(apiKey, agentId, skillId, sandboxSkillId, payload);
     if (updateResult.success && updateResult.data) {
       if (!isInitial) {
       }
@@ -55281,7 +55761,7 @@ async function pushSingleSkillToSandbox(apiKey, agentId, skillId, skillData, isI
   if (!isInitial) {
     writeProgress("\u{1F504} Creating new sandbox version...");
   }
-  const result = await pushDevVersion(apiKey, agentId, skillId, payloadWithNameAndEnv);
+  const result = await pushDevVersion(apiKey, agentId, skillId, payload);
   if (result.success && result.data) {
     await setSandboxSkillId(result.data.skillId, skillName);
     if (!isInitial) {
@@ -55359,7 +55839,7 @@ async function pushSkillsToSandbox(apiKey, agentId, manifest, yamlConfig, isInit
 __name(pushSkillsToSandbox, "pushSkillsToSandbox");
 async function pushSinglePreProcessorToSandbox(apiKey, agentId, preprocessorId, preprocessorData, isInitial = false) {
   const preprocessorName = preprocessorData.name || "Unknown PreProcessor";
-  const sandboxPreProcessorId = await getSandboxPreProcessorId(preprocessorName);
+  const sandboxPreProcessorId = await getSandboxPreProcessorId(preprocessorId);
   const baseVersion = preprocessorData.version || "1.0.0";
   const sandboxVersion = baseVersion.endsWith("-sandbox") ? baseVersion : `${baseVersion}-sandbox`;
   const payload = {
@@ -55393,7 +55873,7 @@ async function pushSinglePreProcessorToSandbox(apiKey, agentId, preprocessorId,
   const api = new PreProcessorApi(BASE_URLS.API, apiKey, agentId);
   const result = await api.pushDevPreProcessor(preprocessorId, payload);
   if (result.success && result.data) {
-    await setSandboxPreProcessorId(result.data.versionId, preprocessorName);
+    await setSandboxPreProcessorId(result.data.versionId, preprocessorId);
     return true;
   } else if (result.error) {
     console.error(`\u274C PreProcessor sandbox push failed: ${result.error.message}`);
@@ -55404,7 +55884,7 @@ async function pushSinglePreProcessorToSandbox(apiKey, agentId, preprocessorId,
 __name(pushSinglePreProcessorToSandbox, "pushSinglePreProcessorToSandbox");
 async function pushSinglePostProcessorToSandbox(apiKey, agentId, postprocessorId, postprocessorData, isInitial = false) {
   const postprocessorName = postprocessorData.name || "Unknown PostProcessor";
-  const sandboxPostProcessorId = await getSandboxPostProcessorId(postprocessorName);
+  const sandboxPostProcessorId = await getSandboxPostProcessorId(postprocessorId);
   const baseVersion = postprocessorData.version || "1.0.0";
   const sandboxVersion = baseVersion.endsWith("-sandbox") ? baseVersion : `${baseVersion}-sandbox`;
   const payload = {
@@ -55437,7 +55917,7 @@ async function pushSinglePostProcessorToSandbox(apiKey, agentId, postprocessorId
   const api = new PostProcessorApi(BASE_URLS.API, apiKey, agentId);
   const result = await api.pushDevPostProcessor(postprocessorId, payload);
   if (result.success && result.data) {
-    await setSandboxPostProcessorId(result.data.versionId, postprocessorName);
+    await setSandboxPostProcessorId(result.data.versionId, postprocessorId);
     return true;
   } else if (result.error) {
     console.error(`\u274C PostProcessor sandbox push failed: ${result.error.message}`);
@@ -55993,7 +56473,7 @@ async function chatCommand(cmdObj) {
           selectedEnvironment = envResolution.environment;
           break;
         case "prompt": {
-          const { environment } = await inquirer7.prompt([
+          const { environment } = await inquirer6.prompt([
             {
               type: "list",
               name: "environment",
@@ -56572,7 +57052,7 @@ init_command_utils();
 init_developer_api_service();
 import fs19 from "fs";
 import path27 from "path";
-import inquirer8 from "inquirer";
+import inquirer7 from "inquirer";
 init_analytics();
 init_cli_error();
 function resolveEnvironment(env, hasNonInteractiveFlags) {
@@ -56669,7 +57149,7 @@ async function envCommand(env, cmdObj) {
         selectedEnvironment = envResolution.environment;
         break;
       case "prompt":
-        const { environment } = await inquirer8.prompt([
+        const { environment } = await inquirer7.prompt([
           {
             type: "list",
             name: "environment",
@@ -56859,7 +57339,7 @@ async function manageEnvironmentVariables(context) {
     const variables = await loadEnvironmentVariables(context);
     console.log("\n" + "=".repeat(60));
     displayVariables(variables, context, true);
-    const { action } = await inquirer8.prompt([
+    const { action } = await inquirer7.prompt([
       {
         type: "list",
         name: "action",
@@ -56954,7 +57434,7 @@ async function saveProductionEnvVariables(context, variables) {
 }
 __name(saveProductionEnvVariables, "saveProductionEnvVariables");
 async function addVariable(context, currentVariables) {
-  const answers = await inquirer8.prompt([
+  const answers = await inquirer7.prompt([
     {
       type: "input",
       name: "key",
@@ -56995,7 +57475,7 @@ async function updateVariable(context, currentVariables) {
     console.log("\n\u2139\uFE0F  No variables to update.\n");
     return;
   }
-  const { selectedKey } = await inquirer8.prompt([
+  const { selectedKey } = await inquirer7.prompt([
     {
       type: "list",
       name: "selectedKey",
@@ -57007,7 +57487,7 @@ async function updateVariable(context, currentVariables) {
     }
   ]);
   const currentVariable = currentVariables.find((v) => v.key === selectedKey);
-  const { newValue } = await inquirer8.prompt([
+  const { newValue } = await inquirer7.prompt([
     {
       type: "input",
       name: "newValue",
@@ -57036,7 +57516,7 @@ async function deleteVariable(context, currentVariables) {
     console.log("\n\u2139\uFE0F  No variables to delete.\n");
     return;
   }
-  const { selectedKey } = await inquirer8.prompt([
+  const { selectedKey } = await inquirer7.prompt([
     {
       type: "list",
       name: "selectedKey",
@@ -57047,7 +57527,7 @@ async function deleteVariable(context, currentVariables) {
       }))
     }
   ]);
-  const { confirm } = await inquirer8.prompt([
+  const { confirm } = await inquirer7.prompt([
     {
       type: "confirm",
       name: "confirm",
@@ -57080,7 +57560,7 @@ async function viewVariable(currentVariables) {
     console.log("\n\u2139\uFE0F  No variables to view.\n");
     return;
   }
-  const { selectedKey } = await inquirer8.prompt([
+  const { selectedKey } = await inquirer7.prompt([
     {
       type: "list",
       name: "selectedKey",
@@ -57097,7 +57577,7 @@ async function viewVariable(currentVariables) {
   console.log("=".repeat(60));
   console.log(variable.value);
   console.log("=".repeat(60) + "\n");
-  await inquirer8.prompt([
+  await inquirer7.prompt([
     {
       type: "input",
       name: "continue",
@@ -57111,7 +57591,6 @@ __name(viewVariable, "viewVariable");
 init_dist();
 init_cli();
 init_constants();
-import inquirer9 from "inquirer";
 init_command_utils();
 init_compiler2();
 init_artifact_loader();
@@ -57413,7 +57892,7 @@ async function viewPersonaInteractive(persona) {
     console.log("No persona configured.");
   }
   console.log("=".repeat(60) + "\n");
-  await inquirer9.prompt([
+  await safePrompt([
     {
       type: "input",
       name: "continue",
@@ -57537,7 +58016,7 @@ async function viewVersionDetailsInteractive(version) {
   console.log("=".repeat(60) + "\n");
   console.log(version.persona);
   console.log("\n" + "=".repeat(60) + "\n");
-  await inquirer9.prompt([
+  await safePrompt([
     {
       type: "input",
       name: "continue",
@@ -58781,6 +59260,7 @@ var EvalsApi = class extends HttpClient {
 };
 
 // src/commands/evals.ts
+var EVALS_DASHBOARD_URL = "https://evals.heylua.ai";
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
   "completed",
   "failed",
@@ -58927,16 +59407,22 @@ async function pushSuites(api, options) {
   });
 }
 __name(pushSuites, "pushSuites");
+function buildEvalsDashboardUrl(agentId) {
+  const url = new URL(EVALS_DASHBOARD_URL);
+  url.searchParams.set("agentID", agentId);
+  return url.toString();
+}
+__name(buildEvalsDashboardUrl, "buildEvalsDashboardUrl");
 async function openDashboard() {
   writeProgress("Opening Lua Evaluations Dashboard...");
-  const { agentId, apiKey } = await initializeCommand({
+  const { agentId } = await initializeCommand({
     showProgress: false
   });
-  const evalsUrl = `https://evals.heylua.ai?apiKey=${apiKey}&agentID=${agentId}`;
-  await open3(evalsUrl);
+  await open3(buildEvalsDashboardUrl(agentId));
   writeSuccess("Lua Evaluations Dashboard opened in your browser");
+  console.log("  The dashboard will ask you to sign in if needed.");
   console.log(`
-  Dashboard URL: https://evals.heylua.ai`);
+  Dashboard URL: ${EVALS_DASHBOARD_URL}`);
   console.log(`  Agent ID: ${agentId}
 `);
   trackEvent("cli_evals_opened");
@@ -59094,7 +59580,7 @@ async function docsCommand() {
 __name(docsCommand, "docsCommand");
 
 // src/commands/channels.ts
-import inquirer10 from "inquirer";
+import inquirer8 from "inquirer";
 import open5 from "open";
 init_cli();
 init_command_utils();
@@ -59607,7 +60093,7 @@ async function executeNonInteractive3(agentApi, agentId, action) {
 }
 __name(executeNonInteractive3, "executeNonInteractive");
 async function channelsInteractive(agentApi, agentId, apiKey, config) {
-  const { operation } = await inquirer10.prompt([
+  const { operation } = await inquirer8.prompt([
     {
       type: "list",
       name: "operation",
@@ -59693,7 +60179,7 @@ async function listChannelsInteractive(agentApi, agentId, config) {
     name: "\u2190 Back to main menu",
     value: -1
   });
-  const { selectedIndex } = await inquirer10.prompt([
+  const { selectedIndex } = await inquirer8.prompt([
     {
       type: "list",
       name: "selectedIndex",
@@ -59870,7 +60356,7 @@ function displayEmailDetails(channel) {
 }
 __name(displayEmailDetails, "displayEmailDetails");
 async function createChannel(agentApi, agentId) {
-  const { channelType } = await inquirer10.prompt([
+  const { channelType } = await inquirer8.prompt([
     {
       type: "list",
       name: "channelType",
@@ -59924,7 +60410,7 @@ async function createChannel(agentApi, agentId) {
 __name(createChannel, "createChannel");
 async function createWhatsAppChannel(agentApi, agentId) {
   writeInfo("\u{1F4F1} Creating WhatsApp Channel\n");
-  const answers = await inquirer10.prompt([
+  const answers = await inquirer8.prompt([
     {
       type: "input",
       name: "phoneNumberId",
@@ -59976,7 +60462,7 @@ async function createWhatsAppChannel(agentApi, agentId) {
 __name(createWhatsAppChannel, "createWhatsAppChannel");
 async function createFacebookChannel(agentApi, agentId) {
   writeInfo("\u{1F4AC} Creating Facebook Messenger Channel\n");
-  const answers = await inquirer10.prompt([
+  const answers = await inquirer8.prompt([
     {
       type: "password",
       name: "accessToken",
@@ -60018,7 +60504,7 @@ async function createFacebookChannel(agentApi, agentId) {
 __name(createFacebookChannel, "createFacebookChannel");
 async function createEmailChannel(agentApi, agentId) {
   writeInfo("\u{1F4E7} Creating Email Channel\n");
-  const { mode } = await inquirer10.prompt([
+  const { mode } = await inquirer8.prompt([
     {
       type: "list",
       name: "mode",
@@ -60036,7 +60522,7 @@ async function createEmailChannel(agentApi, agentId) {
     }
   ]);
   clearPromptLines(2);
-  const { displayName } = await inquirer10.prompt([
+  const { displayName } = await inquirer8.prompt([
     {
       type: "input",
       name: "displayName",
@@ -60054,7 +60540,7 @@ async function createEmailChannel(agentApi, agentId) {
     }
   };
   if (mode === "existing") {
-    const { email } = await inquirer10.prompt([
+    const { email } = await inquirer8.prompt([
       {
         type: "input",
         name: "email",
@@ -60150,7 +60636,7 @@ var SLACK_AGENT_PROMPTS_MAX = 4;
 var SLACK_AGENT_PROMPT_TITLE_MAX = 75;
 var SLACK_AGENT_PROMPT_MESSAGE_MAX = 2e3;
 async function promptSlackAgentMode(current) {
-  const { enabled } = await inquirer10.prompt([
+  const { enabled } = await inquirer8.prompt([
     {
       type: "confirm",
       name: "enabled",
@@ -60159,7 +60645,7 @@ async function promptSlackAgentMode(current) {
     }
   ]);
   if (!enabled) return null;
-  const { description } = await inquirer10.prompt([
+  const { description } = await inquirer8.prompt([
     {
       type: "input",
       name: "description",
@@ -60176,7 +60662,7 @@ async function promptSlackAgentMode(current) {
   }
   const prompts = [];
   while (prompts.length < SLACK_AGENT_PROMPTS_MAX) {
-    const { title } = await inquirer10.prompt([
+    const { title } = await inquirer8.prompt([
       {
         type: "input",
         name: "title",
@@ -60185,7 +60671,7 @@ async function promptSlackAgentMode(current) {
       }
     ]);
     if (!title.trim()) break;
-    const { message } = await inquirer10.prompt([
+    const { message } = await inquirer8.prompt([
       {
         type: "input",
         name: "message",
@@ -60208,7 +60694,7 @@ async function promptSlackAgentMode(current) {
 }
 __name(promptSlackAgentMode, "promptSlackAgentMode");
 async function offerToOpen(url, question) {
-  const { openIt } = await inquirer10.prompt([
+  const { openIt } = await inquirer8.prompt([
     {
       type: "confirm",
       name: "openIt",
@@ -60220,7 +60706,7 @@ async function offerToOpen(url, question) {
 }
 __name(offerToOpen, "offerToOpen");
 async function startSlackApp(agentApi, agentId, kind) {
-  const { source } = await inquirer10.prompt([
+  const { source } = await inquirer8.prompt([
     {
       type: "list",
       name: "source",
@@ -60280,7 +60766,7 @@ __name(printManifestUpdate, "printManifestUpdate");
 async function createSlackPrivateChannel(agentApi, agentId) {
   writeInfo("\u{1F512} Creating Private Slack Channel\n");
   const { existingApp, agentMode } = await startSlackApp(agentApi, agentId, "private");
-  const answers = await inquirer10.prompt([
+  const answers = await inquirer8.prompt([
     {
       type: "password",
       name: "accessToken",
@@ -60325,7 +60811,7 @@ __name(createSlackPrivateChannel, "createSlackPrivateChannel");
 async function createSlackPublicChannel(agentApi, agentId) {
   writeInfo("\u{1F310} Creating Public Slack Channel\n");
   const { existingApp, agentMode } = await startSlackApp(agentApi, agentId, "public");
-  const answers = await inquirer10.prompt([
+  const answers = await inquirer8.prompt([
     {
       type: "input",
       name: "appId",
@@ -60409,7 +60895,7 @@ async function slackConnectionActions(agentApi, agentId, channel) {
     name: "\u2190 Back",
     value: "back"
   });
-  const { action } = await inquirer10.prompt([
+  const { action } = await inquirer8.prompt([
     {
       type: "list",
       name: "action",
@@ -60441,7 +60927,7 @@ async function slackConnectionActions(agentApi, agentId, channel) {
     writeSuccess(`\u2705 Agent mode ${agentMode ? "saved" : "turned off"}. It takes effect once Slack has the new manifest:`);
     printManifestUpdate(response.data.manifestUrl ?? slackManifestEditorUrl(channel.data.appId, channel.data.teamId), response.data.manifest);
   } else if (action === "secret") {
-    const { signingSecret } = await inquirer10.prompt([
+    const { signingSecret } = await inquirer8.prompt([
       slackSigningSecretPrompt()
     ]);
     const response = await agentApi.saveSlackSigningSecret(agentId, channel.identifier, signingSecret.trim());
@@ -60478,7 +60964,7 @@ __name(slackConnectionActions, "slackConnectionActions");
 // src/commands/logs.ts
 init_cli();
 init_command_utils();
-import inquirer11 from "inquirer";
+import inquirer9 from "inquirer";
 import chalk2 from "chalk";
 init_device_api_service();
 init_constants();
@@ -60978,7 +61464,7 @@ async function nonInteractiveLogs(logsApi, agentId, apiKey, options) {
 }
 __name(nonInteractiveLogs, "nonInteractiveLogs");
 async function interactiveLogs(logsApi, agentId, apiKey) {
-  const { viewType } = await inquirer11.prompt([
+  const { viewType } = await inquirer9.prompt([
     {
       type: "list",
       name: "viewType",
@@ -61006,7 +61492,7 @@ __name(interactiveLogs, "interactiveLogs");
 async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
   let keepFiltering = true;
   while (keepFiltering) {
-    const { filterType } = await inquirer11.prompt([
+    const { filterType } = await inquirer9.prompt([
       {
         type: "list",
         name: "filterType",
@@ -61016,7 +61502,7 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
             name: "\u{1F4CB} All logs",
             value: "all"
           },
-          new inquirer11.Separator(),
+          new inquirer9.Separator(),
           {
             name: "Skills",
             value: "skill"
@@ -61041,7 +61527,7 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
             name: "Devices",
             value: "device"
           },
-          new inquirer11.Separator(),
+          new inquirer9.Separator(),
           {
             name: "\u{1F4AC} User Messages",
             value: "user_message"
@@ -61074,12 +61560,12 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
             name: "\u{1F4DE} Voice Calls",
             value: "calls"
           },
-          new inquirer11.Separator(),
+          new inquirer9.Separator(),
           {
             name: "\u2190 Back",
             value: "back"
           },
-          new inquirer11.Separator()
+          new inquirer9.Separator()
         ]
       }
     ]);
@@ -61112,7 +61598,7 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
 `);
       continue;
     }
-    const { selectedId } = await inquirer11.prompt([
+    const { selectedId } = await inquirer9.prompt([
       {
         type: "list",
         name: "selectedId",
@@ -61122,17 +61608,17 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
             name: `All ${capitalizedType}s`,
             value: "all"
           },
-          new inquirer11.Separator(),
+          new inquirer9.Separator(),
           ...items.map((item) => ({
             name: item.name,
             value: item.id
           })),
-          new inquirer11.Separator(),
+          new inquirer9.Separator(),
           {
             name: "\u2190 Back",
             value: "back"
           },
-          new inquirer11.Separator()
+          new inquirer9.Separator()
         ]
       }
     ]);
@@ -61161,7 +61647,7 @@ async function viewAgentLogsInteractive(logsApi, agentId, filters = {}) {
     }
     const data = response.data;
     displayLogsCore(data.logs, data.pagination, "All Agent Logs", true);
-    const { action } = await inquirer11.prompt([
+    const { action } = await inquirer9.prompt([
       {
         type: "list",
         name: "action",
@@ -61216,7 +61702,7 @@ async function handleNavigation(action, pagination, setPage) {
       if (pagination.hasNextPage) setPage(pagination.nextPage);
       return true;
     case "goto":
-      const { page } = await inquirer11.prompt({
+      const { page } = await inquirer9.prompt({
         type: "number",
         name: "page",
         message: `Enter page number (1-${pagination.totalPages}):`,
@@ -66357,13 +66843,23 @@ init_constants();
 init_command_utils();
 init_device_api_service();
 init_analytics();
+init_dist();
+init_cli_credentials_api_service();
+init_cli_error();
+init_request_credential();
+import { chmodSync, existsSync as existsSync11, writeFileSync as writeFileSync11 } from "fs";
 async function devicesCommand(action, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
       deviceName: cmdObj?.deviceName || null,
       group: cmdObj?.group || null,
       payload: cmdObj?.payload || "{}",
-      timeout: cmdObj?.timeout || "30000"
+      timeout: cmdObj?.timeout || "30000",
+      command: cmdObj?.command,
+      trigger: cmdObj?.trigger,
+      operations: cmdObj?.operations,
+      out: cmdObj?.out,
+      force: !!cmdObj?.force
     };
     const { apiKey, agentId } = await initializeCommand();
     const api = new DeviceApi(BASE_URLS.API, apiKey, agentId);
@@ -66404,6 +66900,10 @@ async function devicesCommand(action, cmdObj) {
             {
               name: "\u{1F514} Test trigger",
               value: "test-trigger"
+            },
+            {
+              name: "\u{1F511} Issue a device credential",
+              value: "credential"
             }
           ]
         }
@@ -66433,6 +66933,9 @@ async function devicesCommand(action, cmdObj) {
       case "test-trigger":
         await testTrigger(api, options);
         break;
+      case "credential":
+        await issueDeviceCredential(apiKey, agentId, options);
+        break;
     }
     trackEvent("cli_devices_completed", {
       action: selectedAction,
@@ -66444,33 +66947,25 @@ async function devicesCommand(action, cmdObj) {
 __name(devicesCommand, "devicesCommand");
 async function listDevices(api, options) {
   writeProgress("Fetching devices...");
-  const response = await api.getDevices();
-  if (!response.success || !response.data) {
-    throw new Error(response.error?.message || "Failed to fetch devices");
-  }
-  const devices = response.data.devices || response.data;
-  if (!Array.isArray(devices) || devices.length === 0) {
-    writeInfo("No devices registered. Connect a device using @lua/device-client.");
+  let devices = await knownDevices(api);
+  if (options.group) devices = devices.filter((d) => d.group === options.group);
+  if (devices.length === 0) {
+    writeInfo(options.group ? `No devices in group '${options.group}'.` : "No devices yet. Connect one with a device client, or declare one with defineDevice and `lua push device`.");
     return;
   }
-  let filtered = devices;
-  if (options.group) {
-    filtered = devices.filter((d) => d.group === options.group);
-    if (filtered.length === 0) {
-      writeInfo(`No devices found in group '${options.group}'.`);
-      return;
-    }
-  }
   console.log(`
-  Devices (${filtered.length}):
+  Devices (${devices.length}):
 `);
-  for (const d of filtered) {
-    const statusIcon = d.active === false ? "\u26D4" : "\u{1F4E1}";
-    console.log(`  ${statusIcon} ${d.name}${d.group ? ` [${d.group}]` : ""}`);
-    console.log(`     ID: ${d.id}`);
+  for (const d of devices) {
+    const tags = [
+      d.group ? `[${d.group}]` : "",
+      d.declared ? "declared" : ""
+    ].filter(Boolean).join(" ");
+    console.log(`  ${STATUS_ICON[d.status]} ${d.name}  ${d.status}${tags ? `  ${tags}` : ""}`);
     if (d.description) console.log(`     ${d.description}`);
-    console.log("");
+    if (d.lastSeenAt && d.status !== "online") console.log(`     Last seen ${d.lastSeenAt}`);
   }
+  console.log("");
 }
 __name(listDevices, "listDevices");
 async function deviceStatus(api, options) {
@@ -66481,8 +66976,14 @@ async function deviceStatus(api, options) {
     throw new Error(response.error?.message || "Failed to get device status");
   }
   const status = response.data.status;
-  const icon = status === "online" ? "\u{1F7E2}" : status === "disabled" ? "\u26D4" : "\u{1F534}";
-  writeSuccess(`${icon} Device '${name}' is ${status}`);
+  if (status === "online") {
+    writeSuccess(`\u{1F7E2} Device '${name}' is online`);
+  } else if (status === "disabled") {
+    writeSuccess(`\u26D4 Device '${name}' is disabled. Run \`lua devices enable --device-name ${name}\` to allow it back.`);
+  } else {
+    const known = (await knownDevices(api)).some((d) => d.name === name);
+    writeSuccess(known ? `\u{1F534} Device '${name}' is offline` : `\u{1F534} Device '${name}' has never connected to this agent`);
+  }
 }
 __name(deviceStatus, "deviceStatus");
 async function enableDevice(api, options) {
@@ -66493,6 +66994,7 @@ async function enableDevice(api, options) {
     throw new Error(response.error?.message || "Failed to enable device");
   }
   writeSuccess(`Device '${name}' enabled`);
+  writeInfo("Disabling disconnected it, so it is offline until its client connects again (restart it if it does not retry).");
 }
 __name(enableDevice, "enableDevice");
 async function disableDevice(api, options) {
@@ -66502,11 +67004,15 @@ async function disableDevice(api, options) {
   if (!response.success) {
     throw new Error(response.error?.message || "Failed to disable device");
   }
-  writeSuccess(`Device '${name}' disabled`);
+  writeSuccess(`Device '${name}' disabled. It is disconnected and refused until you enable it.`);
 }
 __name(disableDevice, "disableDevice");
 async function removeDevice(api, options, force) {
   const name = await resolveDeviceName(api, options.deviceName, "Remove");
+  const device = (await knownDevices(api)).find((d) => d.name === name);
+  if (!device) {
+    throw CliError.notFound(`No device named '${name}' on this agent.`, "Run `lua devices list` to see its devices");
+  }
   if (!force) {
     const confirm = await safePrompt([
       {
@@ -66522,35 +67028,25 @@ async function removeDevice(api, options, force) {
     }
   }
   writeProgress(`Removing '${name}'...`);
-  const response = await api.deleteDevice(name);
-  if (!response.success) {
-    throw new Error(response.error?.message || "Failed to remove device");
+  if (device.declared) {
+    const response = await api.deleteDevice(name);
+    if (!response.success) throw new Error(response.error?.message || "Failed to remove the device definition");
+  }
+  if (device.connected) {
+    const response = await api.deleteDeviceInstance(name);
+    if (!response.success) throw new Error(response.error?.message || "Failed to remove the device");
   }
   writeSuccess(`Device '${name}' removed`);
+  if (device.status === "online") {
+    writeInfo("It is still connected; it reappears if its client reconnects. Disable it to keep it out.");
+  }
 }
 __name(removeDevice, "removeDevice");
 async function testCommand2(api, options) {
   const name = await resolveDeviceName(api, options.deviceName, "Test command on");
-  let command;
-  if (cmdHasPositionalCommand(options)) {
-    command = options.command;
-  } else {
-    const answer = await safePrompt([
-      {
-        type: "input",
-        name: "command",
-        message: "Command name:"
-      }
-    ]);
-    if (!answer?.command) return;
-    command = answer.command;
-  }
-  let payload;
-  try {
-    payload = JSON.parse(options.payload || "{}");
-  } catch {
-    throw new Error(`Invalid JSON payload: ${options.payload}`);
-  }
+  const command = options.command || await promptFor("command", "Command name:");
+  if (!command) throw CliError.usage("A command name is required.", "Pass --command <name>");
+  const payload = parsePayload(options.payload);
   const timeout = parseInt(options.timeout || "30000");
   console.log(`
   Sending '${command}' to device '${name}'...`);
@@ -66561,62 +67057,173 @@ async function testCommand2(api, options) {
     const data = response.data;
     if (data.success !== false) {
       writeSuccess(`Response received (${latency}ms):`);
-      console.log(JSON.stringify(data.data || data, null, 2));
-    } else {
-      console.log(`
-  \u274C Device returned error (${latency}ms):`);
-      console.log(`  ${data.error || "Unknown error"}`);
-    }
-  } else {
-    const msg = response.error?.message || "Command failed";
-    if (msg.includes("offline")) {
-      console.log(`
-  \u274C Device '${name}' is offline`);
-    } else if (msg.includes("timed out")) {
-      console.log(`
-  \u274C Command timed out after ${timeout}ms`);
-    } else {
-      throw new Error(msg);
+      console.log(JSON.stringify(data.data ?? data, null, 2));
+      return;
     }
+    throw new Error(`Device '${name}' returned an error (${latency}ms): ${data.error || data.message || "unknown error"}`);
+  }
+  const deviceError = response.error;
+  if (typeof deviceError === "string") {
+    throw new Error(`Device '${name}' returned an error (${latency}ms): ${deviceError}`);
+  }
+  const status = response.error?.statusCode;
+  const msg = response.error?.message || `Command failed${status ? ` (HTTP ${status})` : ""}`;
+  if (/disabled/i.test(msg)) throw new Error(`Device '${name}' is disabled`);
+  if (/offline|not connected/i.test(msg) || status === 404) {
+    const current = await api.getDeviceStatus(name);
+    const disabled = current.success && current.data?.status === "disabled";
+    throw new Error(disabled ? `Device '${name}' is disabled. Run \`lua devices enable --device-name ${name}\` first.` : `Device '${name}' is offline`);
   }
+  if (/timed out/i.test(msg) || status === 408) {
+    throw new Error(`No reply within ${timeout}ms. Check that '${command}' is a command the device declares.`);
+  }
+  if (status === 429) throw new Error("Too many commands in flight for this agent; try again shortly");
+  throw new Error(msg);
 }
 __name(testCommand2, "testCommand");
 async function testTrigger(api, options) {
   const name = await resolveDeviceName(api, options.deviceName, "Test trigger on");
-  let triggerName;
-  const answer = await safePrompt([
-    {
-      type: "input",
-      name: "trigger",
-      message: "Trigger name:"
+  const trigger = options.trigger || await promptFor("trigger", "Trigger name:");
+  if (!trigger) throw CliError.usage("A trigger name is required.", "Pass --trigger <name>");
+  const payload = parsePayload(options.payload);
+  writeProgress(`Firing trigger '${trigger}' as device '${name}'...`);
+  const response = await api.fireTrigger(name, trigger, payload);
+  if (!response.success) {
+    if (response.error?.statusCode === 404) {
+      throw new Error("This Lua environment does not support test triggers yet.");
     }
-  ]);
-  if (!answer?.trigger) return;
-  triggerName = answer.trigger;
-  let payload;
-  try {
-    payload = JSON.parse(options.payload || "{}");
-  } catch {
-    throw new Error(`Invalid JSON payload: ${options.payload}`);
+    throw new Error(response.error?.message || "Failed to fire the trigger");
   }
-  console.log(`
-  Simulating trigger '${triggerName}' on device '${name}'...`);
-  writeInfo("Note: This sends the trigger through the full execution pipeline on the server.");
-  const response = await api.sendCommand(name, `__test_trigger__${triggerName}`, payload, parseInt(options.timeout || "30000"));
-  if (response.success) {
-    writeSuccess("Trigger sent successfully. Check agent logs for execution results.");
+  writeSuccess(`Trigger '${trigger}' queued (id ${response.data?.triggerId}). The live handler runs now.`);
+  writeInfo("Read its run with `lua logs --type device-trigger`. A trigger with no live handler is logged as skipped.");
+}
+__name(testTrigger, "testTrigger");
+async function issueDeviceCredential(credential, agentId, options) {
+  if (!isRequestCredential(credential) || credential.descriptor.kind !== "first-party-session") {
+    throw CliError.usage("Issuing a device credential needs an email sign-in; an API key cannot issue one.", "Run `lua auth configure` in your terminal and choose Email");
+  }
+  let deviceName = options.deviceName;
+  if (!deviceName) {
+    const answer = await safePrompt([
+      {
+        type: "input",
+        name: "name",
+        message: "Device name the client will connect with:"
+      }
+    ]);
+    deviceName = answer?.name?.trim();
+  }
+  if (!deviceName) throw CliError.usage("A device name is required.", "Pass --device-name <name>");
+  const operations = (options.operations || "commands,triggers").split(",").map((op) => op.trim()).filter(Boolean);
+  const unknown = operations.filter((op) => !DEVICE_OPERATIONS.includes(op));
+  if (operations.length === 0 || unknown.length > 0) {
+    throw CliError.usage(`Unknown operation${unknown.length === 1 ? "" : "s"}: ${unknown.join(", ") || "(none)"}.`, `--operations takes a comma list of ${DEVICE_OPERATIONS.join(", ")}`);
+  }
+  if (options.out && existsSync11(options.out) && !options.force) {
+    throw CliError.usage(`${options.out} already exists.`, "Pass --force to overwrite it");
+  }
+  writeProgress(`Issuing a credential for '${deviceName}' (${operations.join(", ")})...`);
+  const api = new CliCredentialsApi(BASE_URLS.API);
+  const response = await api.issueDeviceCredential(await credential.bearer(), {
+    agentId,
+    deviceName,
+    operations: [
+      ...new Set(operations)
+    ],
+    name: `lua-cli: ${deviceName}`
+  });
+  if (!response.success || !response.data?.secret) {
+    throw new Error(response.error?.message || "Failed to issue the device credential");
+  }
+  const { secret, credential: issued } = response.data;
+  if (options.out) {
+    writeFileSync11(options.out, `LUA_AGENT_ID=${envValue(agentId)}
+LUA_DEVICE_NAME=${envValue(deviceName)}
+LUA_DEVICE_CREDENTIAL=${envValue(secret)}
+`, {
+      mode: 384
+    });
+    chmodSync(options.out, 384);
+    writeSuccess(`Device credential for '${deviceName}' saved to ${options.out} (id ${issued.id})`);
   } else {
+    writeSuccess(`Device credential for '${deviceName}' (id ${issued.id}). It is shown only once:`);
     console.log(`
-  \u274C ${response.error?.message || "Failed to send trigger"}`);
+  ${secret}
+`);
   }
+  writeInfo(`Connect with agent ${agentId}, device name '${deviceName}', and this secret as the device credential.`);
 }
-__name(testTrigger, "testTrigger");
+__name(issueDeviceCredential, "issueDeviceCredential");
+function envValue(value3) {
+  return /^[A-Za-z0-9_.:@-]*$/.test(value3) ? value3 : JSON.stringify(value3);
+}
+__name(envValue, "envValue");
+var STATUS_ICON = {
+  online: "\u{1F7E2}",
+  offline: "\u26AA",
+  disabled: "\u26D4"
+};
+function mergeDevices(definitions, connected) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const d of definitions) {
+    if (!d?.name) continue;
+    byName.set(d.name, {
+      name: d.name,
+      status: d.active === false ? "disabled" : "offline",
+      declared: true,
+      connected: false,
+      ...d.group ? {
+        group: d.group
+      } : {},
+      ...d.description ? {
+        description: d.description
+      } : {}
+    });
+  }
+  for (const c of connected) {
+    const existing = byName.get(c.name);
+    byName.set(c.name, {
+      ...existing ?? {
+        declared: false
+      },
+      name: c.name,
+      status: c.status,
+      connected: true,
+      ...c.group ?? existing?.group ? {
+        group: c.group ?? existing?.group
+      } : {},
+      ...c.description || existing?.description ? {
+        description: c.description || existing?.description
+      } : {},
+      lastSeenAt: c.lastSeenAt
+    });
+  }
+  const order = {
+    online: 0,
+    offline: 1,
+    disabled: 2
+  };
+  return [
+    ...byName.values()
+  ].sort((a, b) => order[a.status] - order[b.status] || a.name.localeCompare(b.name));
+}
+__name(mergeDevices, "mergeDevices");
+async function knownDevices(api) {
+  const [definitions, connected] = await Promise.all([
+    api.getDevices(),
+    api.getConnectedDevices()
+  ]);
+  if (!definitions.success) throw new Error(definitions.error?.message || "Failed to fetch devices");
+  const defs = definitions.data?.devices ?? definitions.data ?? [];
+  const live = connected.success ? connected.data?.devices ?? [] : [];
+  return mergeDevices(Array.isArray(defs) ? defs : [], live);
+}
+__name(knownDevices, "knownDevices");
 async function resolveDeviceName(api, name, actionLabel) {
   if (name) return name;
-  const response = await api.getDevices();
-  const devices = response.data?.devices || response.data || [];
-  if (!Array.isArray(devices) || devices.length === 0) {
-    throw new Error("No devices registered.");
+  const devices = await knownDevices(api);
+  if (devices.length === 0) {
+    throw CliError.notFound("This agent has no devices yet.", "Connect a device, or pass --device-name <name>");
   }
   const answer = await safePrompt([
     {
@@ -66624,19 +67231,34 @@ async function resolveDeviceName(api, name, actionLabel) {
       name: "device",
       message: `${actionLabel} which device?`,
       choices: devices.map((d) => ({
-        name: `${d.name}${d.group ? ` [${d.group}]` : ""}`,
+        name: `${STATUS_ICON[d.status]} ${d.name}${d.group ? ` [${d.group}]` : ""}`,
         value: d.name
       }))
     }
   ]);
-  if (!answer?.device) throw new Error("No device selected.");
+  if (!answer?.device) throw CliError.usage("No device selected.", "Pass --device-name <name>");
   return answer.device;
 }
 __name(resolveDeviceName, "resolveDeviceName");
-function cmdHasPositionalCommand(options) {
-  return !!options.command;
+async function promptFor(field, message) {
+  const answer = await safePrompt([
+    {
+      type: "input",
+      name: field,
+      message
+    }
+  ]);
+  return answer?.[field]?.trim() || void 0;
+}
+__name(promptFor, "promptFor");
+function parsePayload(raw) {
+  try {
+    return JSON.parse(raw || "{}");
+  } catch {
+    throw CliError.usage(`Invalid JSON payload: ${raw}`, `Pass --payload '{"key":"value"}'`);
+  }
 }
-__name(cmdHasPositionalCommand, "cmdHasPositionalCommand");
+__name(parsePayload, "parsePayload");
 
 // src/commands/jobs.ts
 init_cli();
@@ -68123,9 +68745,7 @@ __name(startResultLine, "startResultLine");
 async function startCore(ctx, name, o) {
   const input = parsedOrUsage(() => o.input ? parseJsonOrFile(o.input, "--input") : {});
   const waitSeconds = parsedOrUsage(() => parseIntFlag(o.wait, "--wait"));
-  const budgetCredits = parsedOrUsage(() => parseIntegerFlag(o.budgetCredits, "--budget-credits", {
-    min: 1
-  }));
+  const budgetCredits = parsedOrUsage(() => parseCapFlag(o.budgetCredits, o.budgetActions, "--budget-credits", "--budget-actions"));
   if (waitSeconds !== void 0 && (waitSeconds < 0 || waitSeconds > 55)) {
     throw CliError.usage("--wait must be 0..55 (a server long-poll; the CLI raises its own deadline to wait+10 s)");
   }
@@ -68846,6 +69466,21 @@ function priorAttemptTail(a) {
   return `${parts.length ? ` \u2014 ${parts.join(" \xB7 ")}` : ""}${e?.providerMessage ? ` \u2014 ${e.providerMessage}` : ""}`;
 }
 __name(priorAttemptTail, "priorAttemptTail");
+function budgetTokensParts(b) {
+  const n2 = /* @__PURE__ */ __name((v) => v.toLocaleString("en-US"), "n");
+  const split = [
+    typeof b.uncachedInputTokens === "number" ? `${n2(b.uncachedInputTokens)} uncached` : void 0,
+    typeof b.cachedInputTokens === "number" ? `${n2(b.cachedInputTokens)} cached` : void 0
+  ].filter((p) => !!p);
+  const input = `${n2(b.inputTokens)}${b.maxInputTokens !== void 0 ? ` of ${n2(b.maxInputTokens)}` : ""} input tokens${split.length ? ` (${split.join(" / ")})` : ""}`;
+  return typeof b.outputTokens === "number" ? [
+    input,
+    `${n2(b.outputTokens)} output tokens`
+  ] : [
+    input
+  ];
+}
+__name(budgetTokensParts, "budgetTokensParts");
 function stepFailureLine(e) {
   if (!e || !e.reason && e.providerStatus === void 0 && !e.providerMessage) return void 0;
   const b = e.budget;
@@ -68854,7 +69489,7 @@ function stepFailureLine(e) {
     e.providerStatus !== void 0 ? `HTTP ${e.providerStatus}` : void 0,
     e.model ? `model ${e.model}` : void 0,
     e.turnIndex !== void 0 ? `message ${e.turnIndex}${e.assistantTurns !== void 0 ? ` (${e.assistantTurns} replies)` : ""}${b?.maxMessages !== void 0 ? ` of ${b.maxMessages}` : ""}` : void 0,
-    b ? `${b.inputTokens.toLocaleString("en-US")}${b.maxInputTokens !== void 0 ? ` of ${b.maxInputTokens.toLocaleString("en-US")}` : ""} input tokens` : void 0,
+    ...b ? budgetTokensParts(b) : [],
     e.providerRetries ? `${e.providerRetries} provider ${e.providerRetries === 1 ? "retry" : "retries"}` : void 0
   ].filter((p) => !!p);
   return `${parts.join(" \xB7 ")}${e.providerMessage ? `${parts.length ? " \u2014 " : ""}${e.providerMessage}` : ""}`;
@@ -68867,7 +69502,7 @@ function attemptCountersLine(c) {
   const replies = c.assistantTurns ?? b?.assistantTurns;
   const parts = [
     messages !== void 0 ? `message ${messages}${replies !== void 0 ? ` (${replies} replies)` : ""}${b?.maxMessages !== void 0 ? ` of ${b.maxMessages}` : ""}` : void 0,
-    b ? `${b.inputTokens.toLocaleString("en-US")}${b.maxInputTokens !== void 0 ? ` of ${b.maxInputTokens.toLocaleString("en-US")}` : ""} input tokens` : void 0,
+    ...b ? budgetTokensParts(b) : [],
     c.repairRounds ? `${c.repairRounds} repair ${c.repairRounds === 1 ? "round" : "rounds"}` : void 0,
     c.providerRetries ? `${c.providerRetries} provider ${c.providerRetries === 1 ? "retry" : "retries"}` : void 0
   ].filter((p) => !!p);
@@ -69338,9 +69973,7 @@ async function raiseBudgetCore(ctx, runId, o) {
   let dto;
   try {
     dto = {};
-    const credits = parseIntegerFlag(o.credits, "--credits", {
-      min: 1
-    });
+    const credits = parseCapFlag(o.credits, o.actions, "--credits", "--actions");
     if (credits !== void 0) dto.maxCredits = credits;
     const steps = parseIntegerFlag(o.maxSteps, "--max-steps", {
       min: 1
@@ -70591,6 +71224,17 @@ function parseIntegerFlag(v, flag, range2 = {}) {
   return n2;
 }
 __name(parseIntegerFlag, "parseIntegerFlag");
+function parseCapFlag(primary, alias, primaryFlag, aliasFlag) {
+  if (primary !== void 0 && alias !== void 0) {
+    throw new WorkflowLocalUsageError("usage", `${aliasFlag}: pass either ${primaryFlag} or ${aliasFlag}, not both`);
+  }
+  return alias !== void 0 ? parseIntegerFlag(alias, aliasFlag, {
+    min: 1
+  }) : parseIntegerFlag(primary, primaryFlag, {
+    min: 1
+  });
+}
+__name(parseCapFlag, "parseCapFlag");
 var GOAL_LIVE_STATUSES = /* @__PURE__ */ new Set([
   "active",
   "paused"
@@ -71180,9 +71824,7 @@ async function goalsCreateCore(ctx, o, positional) {
     }
     const cadence = parseCadenceFlag(o.cadence, o.timezone);
     const input = o.input ? parseJsonOrFile(o.input, "--input") : void 0;
-    const budgetCredits = parseIntegerFlag(o.budgetCredits, "--budget-credits", {
-      min: 1
-    });
+    const budgetCredits = parseCapFlag(o.budgetCredits, o.budgetActions, "--budget-credits", "--budget-actions");
     const maxTotalCredits = parseIntegerFlag(o.maxTotalCredits, "--max-total-credits", {
       min: 1
     });
@@ -71392,9 +72034,7 @@ async function schedulesCreateCore(ctx, o, positional) {
       if (!SCHEDULE_NOTIFY.includes(o.notify)) throw usage(`--notify: expected ${SCHEDULE_NOTIFY.join("|")} (got "${o.notify}")`);
       draft.notify = o.notify;
     }
-    const credits = parseIntegerFlag(o.budgetCredits, "--budget-credits", {
-      min: 1
-    });
+    const credits = parseCapFlag(o.budgetCredits, o.budgetActions, "--budget-credits", "--budget-actions");
     if (credits !== void 0) draft.budget = {
       maxCredits: credits
     };
@@ -71810,12 +72450,13 @@ async function recomposeCore(ctx, name, _o) {
     return WORKFLOW_EXIT.OK;
   }
   const saved = d.composed?.saved;
-  const version = saved?.version ?? saved?.versionId ?? "(new)";
+  const savedVersion = saved?.version ?? saved?.versionId;
+  const version = savedVersion ?? "(new)";
   writeSuccess(`\u2705 ${wf.name} recomposed \u2192 version ${version} \xB7 ${rewrittenCount} agent step${rewrittenCount === 1 ? "" : "s"} rewritten`);
   if (saved?.supersededBy) {
     writeInfo(`\u2139\uFE0F  a concurrent recompose already holds the pin at version ${saved.supersededBy} \u2014 that is what runs.`);
   }
-  for (const line of recomposeNextSteps(wf, version)) console.log(line);
+  for (const line of recomposeNextSteps(wf, savedVersion)) console.log(line);
   return WORKFLOW_EXIT.OK;
 }
 __name(recomposeCore, "recomposeCore");
@@ -73623,7 +74264,7 @@ init_skills_api_service();
 init_developer_api_service();
 init_semver();
 init_analytics();
-import inquirer12 from "inquirer";
+import inquirer10 from "inquirer";
 
 // src/commands/template.ts
 init_cli();
@@ -73751,6 +74392,54 @@ init_command_utils();
 init_analytics();
 init_files();
 init_cli_error();
+
+// src/commands/template-install-flags.ts
+init_cli_error();
+var PERSONA_HINT = "Use --persona-vars NAME=value[,NAME=value...] (repeatable)";
+var ACCEPT_HINT = "e.g. skills/refund-skill (the primitives named in the 409 MODIFIED_SINCE_INSTALL response)";
+function parsePersonaVars(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  const result = {};
+  for (const entry of raw) {
+    for (const pair of entry.split(/,(?=\s*[A-Za-z_][A-Za-z0-9_]*\s*=)/)) {
+      const trimmed2 = pair.trim();
+      if (!trimmed2) continue;
+      const eqIdx = trimmed2.indexOf("=");
+      if (eqIdx === -1) {
+        throw CliError.usage(`Invalid --persona-vars entry "${trimmed2}": expected KEY=value`, PERSONA_HINT);
+      }
+      const key = trimmed2.slice(0, eqIdx).trim();
+      if (!key) {
+        throw CliError.usage(`Invalid --persona-vars entry "${trimmed2}": the variable name is empty`, PERSONA_HINT);
+      }
+      if (Object.prototype.hasOwnProperty.call(result, key)) {
+        throw CliError.usage(`Duplicate --persona-vars key "${key}"`, PERSONA_HINT);
+      }
+      result[key] = trimmed2.slice(eqIdx + 1).trim();
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+__name(parsePersonaVars, "parsePersonaVars");
+function parseAcceptModified(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  const result = [];
+  for (const entry of raw) {
+    for (const part of entry.split(",")) {
+      const trimmed2 = part.trim();
+      if (!trimmed2) continue;
+      const slash = trimmed2.indexOf("/");
+      if (slash <= 0 || slash === trimmed2.length - 1) {
+        throw CliError.usage(`Invalid --accept-modified entry "${trimmed2}": expected kind/key`, ACCEPT_HINT);
+      }
+      if (!result.includes(trimmed2)) result.push(trimmed2);
+    }
+  }
+  return result.length > 0 ? result : void 0;
+}
+__name(parseAcceptModified, "parseAcceptModified");
+
+// src/commands/template.ts
 function showTemplateUsage() {
   console.log("\nUsage:");
   console.log("  lua marketplace template                       Interactive mode");
@@ -73761,7 +74450,7 @@ function showTemplateUsage() {
   console.log("  publish    --template-id <id> [--source-version <n>] [--changelog <text>] [--env-contract KEY=desc,...] [--skip-auto-apply]");
   console.log("  view       --template-id <id> [--version <n>] [--json]");
   console.log("  versions   --template-id <id> [--json]");
-  console.log("  install    --template-id <id> [--version <n>] [--env-vars k=v,...] --force");
+  console.log("  install    --template-id <id> [--version <n>] [--env-vars k=v,...] [--persona-vars K=v,...] [--accept-modified kind/key,...] --force");
   console.log("  apply      --template-id <id> [--version <n>] (--agents a,b | --file <path> | --all-installed) --force [--no-wait]");
   console.log("  status     --template-id <id> [--json]");
   console.log("  health     --template-id <id> [--window-days <n>] [--json]   Fleet workflow health per install (R46)");
@@ -74175,6 +74864,12 @@ var TEMPLATE_SECTION_KEYS = [
   "onUninstall",
   "installPolicy"
 ];
+var HOOK_KEYS = [
+  "tool",
+  "instruction",
+  "startWorkflow",
+  "firstProof"
+];
 function sectionKeys(section2, value3) {
   if (value3 === void 0 || value3 === null) return [];
   if (section2 === "connections") return (value3 ?? []).map((entry) => entry.key);
@@ -74184,14 +74879,7 @@ function sectionKeys(section2, value3) {
   }
   if (section2 === "onInstall" || section2 === "onUninstall") {
     const hook = value3;
-    return [
-      ...hook.tool ? [
-        "tool"
-      ] : [],
-      ...hook.instruction ? [
-        "instruction"
-      ] : []
-    ];
+    return HOOK_KEYS.filter((key) => Boolean(hook[key]));
   }
   return Object.keys(value3);
 }
@@ -74377,6 +75065,8 @@ async function templateInstallAction(templateApi, config, options) {
   const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to install?", false);
   const version = options.version ? Number.parseInt(options.version, 10) : void 0;
   const envValues = options.envVars ? parseKeyValuePairs(options.envVars) : void 0;
+  const personaVars = parsePersonaVars(options.personaVars);
+  const acceptModifiedPrimitives = parseAcceptModified(options.acceptModified);
   if (!options.force) {
     writeInfo("\n\u{1F4CB} Install Summary:");
     writeInfo(`  Template: ${templateId}`);
@@ -74385,6 +75075,12 @@ async function templateInstallAction(templateApi, config, options) {
     if (envValues && Object.keys(envValues).length > 0) {
       writeInfo(`  Env values: ${Object.keys(envValues).length} configured`);
     }
+    if (personaVars) {
+      writeInfo(`  Persona vars: ${Object.keys(personaVars).length} configured`);
+    }
+    if (acceptModifiedPrimitives) {
+      writeInfo(`  Accepting modified: ${acceptModifiedPrimitives.join(", ")}`);
+    }
     throw CliError.usage("This action requires --force to confirm", "Use --force to confirm installation");
   }
   if (options.skipEnvCheck) {
@@ -74394,7 +75090,9 @@ async function templateInstallAction(templateApi, config, options) {
   const install = await templateApi.install(templateId, agentId, {
     version,
     envValues,
-    allowCreatorUpdates: options.allowCreatorUpdates
+    allowCreatorUpdates: options.allowCreatorUpdates,
+    personaVars,
+    acceptModifiedPrimitives
   });
   if (options.json) {
     console.log(JSON.stringify(install, null, 2));
@@ -75076,12 +75774,12 @@ __name(transferOwnershipNonInteractive, "transferOwnershipNonInteractive");
 async function viewListedSkillsNonInteractive(marketplaceApi, options, mode) {
   writeProgress(mode === "authored" ? "\u{1F504} Loading skills you authored..." : "\u{1F504} Loading this organization's skills...");
   const skills = mode === "authored" ? await marketplaceApi.getCreatorSkills() : await marketplaceApi.getOrgSkills();
-  if (!skills || skills.length === 0) {
-    writeInfo(mode === "authored" ? "\u{1F4E6} You haven't authored any marketplace skills yet." : "\u{1F4E6} This organization doesn't own any marketplace skills yet.");
+  if (options.json) {
+    console.log(JSON.stringify(skills ?? [], null, 2));
     return;
   }
-  if (options.json) {
-    console.log(JSON.stringify(skills, null, 2));
+  if (!skills || skills.length === 0) {
+    writeInfo(mode === "authored" ? "\u{1F4E6} You haven't authored any marketplace skills yet." : "\u{1F4E6} This organization doesn't own any marketplace skills yet.");
     return;
   }
   console.log(mode === "authored" ? `
@@ -75310,12 +76008,12 @@ async function listInstalledSkillsNonInteractive(marketplaceApi, config, options
   }
   writeProgress("\u{1F504} Loading installed marketplace skills...");
   const skills = await marketplaceApi.getInstalledSkills(agentId);
-  if (!skills || skills.length === 0) {
-    writeInfo("\u{1F4E6} No marketplace skills installed on this agent.");
+  if (options.json) {
+    console.log(JSON.stringify(skills ?? [], null, 2));
     return;
   }
-  if (options.json) {
-    console.log(JSON.stringify(skills, null, 2));
+  if (!skills || skills.length === 0) {
+    writeInfo("\u{1F4E6} No marketplace skills installed on this agent.");
     return;
   }
   console.log(`
@@ -75918,7 +76616,7 @@ async function handleEnvVarConfiguration(initialEnvVars) {
             name: "Delete a variable",
             value: "delete"
           },
-          new inquirer12.Separator(),
+          new inquirer10.Separator(),
           {
             name: "Finish and continue",
             value: "done"
@@ -75955,7 +76653,7 @@ async function handleEnvVarAction(action, envVars, detectedKeys) {
         name: `From .env file: ${key}`,
         value: key
       })),
-      new inquirer12.Separator(),
+      new inquirer10.Separator(),
       {
         name: "Manually enter a variable name",
         value: "manual"
@@ -76000,7 +76698,7 @@ async function handleEnvVarAction(action, envVars, detectedKeys) {
         message: "Which variable do you want to edit?",
         choices: [
           ...keys,
-          new inquirer12.Separator(),
+          new inquirer10.Separator(),
           {
             name: "Back",
             value: "back"
@@ -76022,7 +76720,7 @@ async function handleEnvVarAction(action, envVars, detectedKeys) {
         message: "Which variable do you want to delete?",
         choices: [
           ...keys,
-          new inquirer12.Separator(),
+          new inquirer10.Separator(),
           {
             name: "Back",
             value: "back"
@@ -76125,7 +76823,7 @@ async function browseAndSelectSkill(marketplaceApi, purpose, publishedVersionsOn
         }))
       ];
       if (hasNextPage || hasPrevPage) {
-        choices.push(new inquirer12.Separator());
+        choices.push(new inquirer10.Separator());
         if (hasPrevPage) {
           choices.push({
             name: `\u2190 Previous page (${currentPage - 1}/${totalPages})`,
@@ -76143,7 +76841,7 @@ async function browseAndSelectSkill(marketplaceApi, purpose, publishedVersionsOn
           });
         }
       }
-      choices.push(new inquirer12.Separator());
+      choices.push(new inquirer10.Separator());
       choices.push({
         name: "\u2190 Back to menu",
         value: {
@@ -77493,6 +78191,11 @@ var CALLBACK_PORT = 19837;
 var CALLBACK_HOST = "127.0.0.1";
 var CALLBACK_URL = `http://${CALLBACK_HOST}:${CALLBACK_PORT}/callback`;
 var AGENT_WEBHOOK_URL = `${BASE_URLS.API}/webhook/unifiedto/data`;
+var DEFAULT_HIDE_SENSITIVE = false;
+function coerceHideSensitive(raw) {
+  return raw === "true";
+}
+__name(coerceHideSensitive, "coerceHideSensitive");
 var DEFAULT_VIRTUAL_WEBHOOK_INTERVAL = 1;
 var VIRTUAL_WEBHOOK_INTERVAL_CHOICES = [
   {
@@ -77719,7 +78422,7 @@ async function executeNonInteractive12(context, action, cmdOptions) {
     connectionId: cmdOptions?.connectionId,
     authMethod: cmdOptions?.authMethod,
     scopes: cmdOptions?.scopes,
-    hideSensitive: cmdOptions?.hideSensitive === "true",
+    hideSensitive: coerceHideSensitive(cmdOptions?.hideSensitive),
     hideSensitiveProvided: cmdOptions?.hideSensitive !== void 0,
     accountLabel: cmdOptions?.accountLabel,
     scope: cmdOptions?.scope,
@@ -78325,7 +79028,7 @@ async function connectIntegrationFlow(context, options = {}) {
     });
     console.log("\nYou will enter these on the Unified.to authorization page.\n");
   }
-  let hideSensitive = false;
+  let hideSensitive = DEFAULT_HIDE_SENSITIVE;
   if (userScope) {
   } else if (options.hideSensitive !== void 0) {
     hideSensitive = options.hideSensitive;
@@ -78335,7 +79038,7 @@ async function connectIntegrationFlow(context, options = {}) {
         type: "confirm",
         name: "hide",
         message: "Hide sensitive data (PII) from MCP tools?",
-        default: false
+        default: DEFAULT_HIDE_SENSITIVE
       }
     ]);
     if (sensitiveAnswer) {
@@ -78550,7 +79253,7 @@ Integration: ${selectedIntegration.name}`);
   }
 }
 __name(connectIntegrationFlow, "connectIntegrationFlow");
-async function finalizeConnection(context, integration, connectionId, scopes, hideSensitive = false, webhookConfig = {
+async function finalizeConnection(context, integration, connectionId, scopes, hideSensitive = DEFAULT_HIDE_SENSITIVE, webhookConfig = {
   triggers: [],
   webhookUrl: "",
   isCustomWebhook: false
@@ -79134,7 +79837,7 @@ async function updateConnectionFlow(context, options = {}) {
     console.log(`
 \u2713 Will request ${selectedScopes.length} scope(s)`);
   }
-  let hideSensitive = false;
+  let hideSensitive = DEFAULT_HIDE_SENSITIVE;
   if (options.hideSensitive !== void 0) {
     hideSensitive = options.hideSensitive;
   } else {
@@ -79143,7 +79846,7 @@ async function updateConnectionFlow(context, options = {}) {
         type: "confirm",
         name: "hide",
         message: "Hide sensitive data (PII) from MCP tools?",
-        default: false
+        default: DEFAULT_HIDE_SENSITIVE
       }
     ]);
     if (sensitiveAnswer) {
@@ -80631,7 +81334,7 @@ __name(telemetryCommand, "telemetryCommand");
 init_cli();
 init_command_utils();
 init_analytics();
-import { writeFileSync as writeFileSync11, existsSync as existsSync11, unlinkSync as unlinkSync3 } from "fs";
+import { writeFileSync as writeFileSync12, existsSync as existsSync12, unlinkSync as unlinkSync3 } from "fs";
 import { resolve as resolve5, join as join11 } from "path";
 init_artifact_loader();
 init_types();
@@ -80655,9 +81358,9 @@ async function governanceCommand(action) {
       return;
     }
     const srcDir = resolve5(process.cwd(), "src");
-    const targetDir = existsSync11(srcDir) ? srcDir : process.cwd();
+    const targetDir = existsSync12(srcDir) ? srcDir : process.cwd();
     const filePath = join11(targetDir, "governance.ts");
-    if (existsSync11(filePath)) {
+    if (existsSync12(filePath)) {
       const { overwrite } = await safePrompt([
         {
           type: "confirm",
@@ -80748,7 +81451,7 @@ async function governanceCommand(action) {
       }
     }
     const content = generateGovernanceFile(setup);
-    writeFileSync11(filePath, content, "utf-8");
+    writeFileSync12(filePath, content, "utf-8");
     const relativePath = filePath.replace(process.cwd() + "/", "");
     writeSuccess(`Created ${relativePath}`);
     console.log("");
@@ -80786,9 +81489,9 @@ async function governanceCommand(action) {
 __name(governanceCommand, "governanceCommand");
 async function governanceRemove() {
   const srcDir = resolve5(process.cwd(), "src");
-  const targetDir = existsSync11(srcDir) ? srcDir : process.cwd();
+  const targetDir = existsSync12(srcDir) ? srcDir : process.cwd();
   const filePath = join11(targetDir, "governance.ts");
-  const hasLocal = existsSync11(filePath);
+  const hasLocal = existsSync12(filePath);
   const { confirm } = await safePrompt([
     {
       type: "confirm",
@@ -81139,7 +81842,7 @@ init_command_utils();
 init_artifact_loader();
 init_types();
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync12, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
+import { existsSync as existsSync13, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
 import { join as join12, relative as relative2, resolve as resolve6 } from "path";
 init_voice_api_service();
 init_constants();
@@ -81729,7 +82432,7 @@ function escapeRegex(s) {
 __name(escapeRegex, "escapeRegex");
 function detectRunner(cwd) {
   const pkgPath = join12(cwd, "package.json");
-  if (!existsSync12(pkgPath)) return null;
+  if (!existsSync13(pkgPath)) return null;
   try {
     const pkg2 = JSON.parse(__require("fs").readFileSync(pkgPath, "utf8"));
     const deps = {
@@ -82126,7 +82829,7 @@ init_command_utils();
 init_files();
 init_cli();
 init_constants();
-import inquirer13 from "inquirer";
+import inquirer11 from "inquirer";
 init_lua_fetch();
 init_request_credential();
 async function sourceListCommand(opts) {
@@ -82172,7 +82875,7 @@ async function sourceRollbackCommand(opts) {
   const dlBlobs = opts.downloadBlobs ?? downloadBlobsParallel;
   const restore = opts.restoreFiles ?? defaultRestore;
   if (!opts.force) {
-    const { confirm } = await inquirer13.prompt([
+    const { confirm } = await inquirer11.prompt([
       {
         type: "confirm",
         name: "confirm",
@@ -82500,6 +83203,8 @@ async function versionListCommand(options = {}) {
         createdByEmail: v.createdByEmail,
         createdAt: v.createdAt,
         commitHash: v.commitHash,
+        commitHashSource: v.commitHashSource,
+        commitHashMissingReason: v.commitHashMissingReason,
         sourceManifestVersion: v.sourceManifestVersion,
         sourceDigest: v.sourceDigest
       }));
@@ -82542,6 +83247,7 @@ async function versionShowCommand(versionArg, options = {}) {
       console.log(`  Created: ${v.createdAt} by ${v.createdBy}`);
       if (v.message) console.log(`  Message: ${v.message}`);
       if (v.commitHash) console.log(`  Commit:  ${v.commitHash}`);
+      else if (v.commitHashMissingReason) console.log(`  Commit missing: ${v.commitHashMissingReason}`);
       console.log(`  Model:   ${v.snapshot.model}`);
       console.log(`  Snapshot:`);
       console.log(`    Skills:         ${v.snapshot.skills.length}`);
@@ -83681,7 +84387,13 @@ function setupMarketplaceCommands(program2) {
   program2.command("marketplace [noun] [action]").description("\u{1F6CD}\uFE0F  Browse, install, and manage marketplace skills and agent templates").option("--skill-name <name>", "Skill name (for skill list/update/uninstall)").option("--marketplace-id <id>", "Marketplace skill ID").option("--new-org-id <id>", "Destination organization ID (for skill transfer)").option("--version-id <id>", "Version ID (for skill publish/install)").option("--env-vars-json <json>", "JSON string with env var metadata (for skill publish)").option("--query <text>", "Search query (for skill search)").option("--page <n>", "Page number (for skill search)").option("--limit <n>", "Results per page (for skill search)").option("--name <name>", "Template name, an internal identifier (for template create)").option("--description <text>", "Description (for template create)").option("--template-id <id>", "Template ID").option("--window-days <n>", "Fleet-health window in days (template health, R46)").option("--source-version <n>", "Agent version to freeze into this template version (default: active) (for template publish)").option("--env-contract <pair>", "KEY=description env contract entry, repeatable; use KEY?=description for optional (for template publish)", (val, previous) => [
     ...previous,
     val
-  ], []).option("--skip-auto-apply", "Publish without auto-updating the installs that consented to creator updates (for template publish)").option("--version <n>", "Template version (for template view/install/apply)").option("--allow-creator-updates", "Allow the template creator to push future updates onto this install").option("--skip-env-check", "Deprecated no-op: the env-contract check is server-enforced; use `lua env` to satisfy the contract (for template install/apply)").option("--agents <ids>", "Comma-separated target agent IDs (for template apply)").option("--file <path>", "Path to a file with one target agent ID per line (for template apply)").option("--all-installed", "Target every agent that already has this template installed (for template apply)").option("--no-wait", "Print the apply runId immediately instead of polling for completion (for template apply)").option("--display-name <name>", "Display name (for skill list/edit, template create)").option("--visibility <visibility>", "Who can see and install it: public or private (for skill list, template create)").option("--changelog <text>", "Changelog for this version (for skill/template publish)").option("--env-vars <pairs>", "Comma-separated key=value pairs (for skill/template install/update)").option("--json", "Output as JSON").option("--force", "Skip confirmation prompts").option("--yes", "Auto-confirm ONLY the template-publish consequence prompt (section clear/narrow); unlike --force it skips no other confirmation").addHelpText("after", `
+  ], []).option("--skip-auto-apply", "Publish without auto-updating the installs that consented to creator updates (for template publish)").option("--version <n>", "Template version (for template view/install/apply)").option("--allow-creator-updates", "Allow the template creator to push future updates onto this install").option("--persona-vars <pairs>", "Comma-separated KEY=value answers for the template's persona {{vars}}; repeatable, put a value containing ',KEY=' in its own occurrence (for template install)", (val, previous) => [
+    ...previous ?? [],
+    val
+  ]).option("--accept-modified <entries>", "Comma-separated kind/key primitives you allow the install to overwrite after a 409 MODIFIED_SINCE_INSTALL; repeatable (for template install)", (val, previous) => [
+    ...previous ?? [],
+    val
+  ]).option("--skip-env-check", "Deprecated no-op: the env-contract check is server-enforced; use `lua env` to satisfy the contract (for template install/apply)").option("--agents <ids>", "Comma-separated target agent IDs (for template apply)").option("--file <path>", "Path to a file with one target agent ID per line (for template apply)").option("--all-installed", "Target every agent that already has this template installed (for template apply)").option("--no-wait", "Print the apply runId immediately instead of polling for completion (for template apply)").option("--display-name <name>", "Display name (for skill list/edit, template create)").option("--visibility <visibility>", "Who can see and install it: public or private (for skill list, template create)").option("--changelog <text>", "Changelog for this version (for skill/template publish)").option("--env-vars <pairs>", "Comma-separated key=value pairs (for skill/template install/update)").option("--json", "Output as JSON").option("--force", "Skip confirmation prompts").option("--yes", "Auto-confirm ONLY the template-publish consequence prompt (section clear/narrow); unlike --force it skips no other confirmation").addHelpText("after", `
 Arguments:
   noun                   Optional: 'skill' or 'template' (prompts if not provided)
   action                 Optional: specific action for non-interactive mode
@@ -83707,7 +84419,7 @@ Template Actions:
   publish    --template-id <id> [--source-version <n>] [--changelog <text>] [--env-contract KEY=desc,...]
   view       --template-id <id> [--version <n>] [--json]
   versions   --template-id <id> [--json]
-  install    --template-id <id> [--version <n>] [--env-vars <k=v,...>] --force
+  install    --template-id <id> [--version <n>] [--env-vars <k=v,...>] [--persona-vars <K=v,...>] [--accept-modified <kind/key,...>] --force
   apply      --template-id <id> [--version <n>] (--agents <a,b,c> | --file <path> | --all-installed) --force [--no-wait]
   status     --template-id <id> [--json]
   installed  [--json]
@@ -83729,6 +84441,7 @@ Examples:
   $ lua marketplace template                                            Template action menu
   $ lua marketplace template create --name support-bot --display-name "Support Bot"
   $ lua marketplace template publish --template-id xyz --changelog "Add refund skill"
+  $ lua marketplace template install --template-id xyz --persona-vars COMPANY_NAME=Acme,TONE=warm --force
   $ lua marketplace template apply --template-id xyz --all-installed --force
 `).action(marketplaceCommand);
 }
@@ -83792,7 +84505,7 @@ Examples:
     ...opts,
     accept: opts.pull || opts.accept
   }));
-  program2.command("test [type]").description("\u{1F9EA} Test skills, webhooks, or jobs interactively").option("--name <name>", "Entity name to test").option("--input <json>", "JSON input string for testing").option("--json", "Output result as raw JSON (useful for scripting and piping)").option("--route <route>", "Web app: the route to call, e.g. 'GET /tickets?status=open'").option("--step-output <id=json>", "Workflow: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "Workflow: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "Workflow: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "Workflow: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "Workflow: seed completed steps from a real run").option("--force", "Workflow: seed from a run whose graph differs").option("--record <dir>", "Workflow: record agent/tool outputs as fixtures").option("--fixtures <dir>", "Workflow: replay recorded fixtures (exit 5 when one is missing)").option("--step-wall <s>", "Workflow: per-step wall in seconds (default 600)").option("--job-wall <s>", "Workflow: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--max-ticks <n>", "Workflow (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--ledger-out <file>", "Workflow: write the in-memory ledger as JSON").option("--agents <fake|live>", "Workflow: fake agent steps (default) or call the dev API").option("--now <iso>", "Workflow: virtual clock start").option("--park <id>", "Workflow: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "Workflow: collapse retry backoff waits to 0").option("--real-time", "Workflow: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "Workflow: back ctx.artefacts.* on disk").option("--workspace <dir>", "Workflow: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").addHelpText("after", `
+  program2.command("test [type]").description("\u{1F9EA} Test skills, webhooks, or jobs interactively").option("--name <name>", "Entity name to test").option("--input <json>", "JSON input string for testing").option("--json", "Output result as raw JSON (useful for scripting and piping)").option("--route <route>", "Web app: the route to call, e.g. 'GET /tickets?status=open'").option("--step-output <id=json>", "Workflow: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "Workflow: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "Workflow: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "Workflow: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "Workflow: seed completed steps from a real run").option("--force", "Workflow: seed from a run whose graph differs").option("--record <dir>", "Workflow: record live agent replies as fixtures (needs --agents live; tool steps never run offline)").option("--fixtures <dir>", "Workflow: replay recorded fixtures (exit 5 when one is missing)").option("--step-wall <s>", "Workflow: per-step wall in seconds (default 600)").option("--job-wall <s>", "Workflow: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--max-ticks <n>", "Workflow (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--ledger-out <file>", "Workflow: write the in-memory ledger as JSON").option("--agents <fake|live>", "Workflow: fake agent steps (default) or call the dev API").option("--now <iso>", "Workflow: virtual clock start").option("--park <id>", "Workflow: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "Workflow: collapse retry backoff waits to 0").option("--real-time", "Workflow: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "Workflow: back ctx.artefacts.* on disk").option("--workspace <dir>", "Workflow: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").addHelpText("after", `
 Arguments:
   type                   Optional: 'skill', 'webhook', 'job' or 'workflow' (prompts if not provided)
 
@@ -84125,28 +84838,36 @@ Notes:
   read it back, 'lua drains verify' finishes on its own; if it is write-only \u2014 the grant we
   recommend \u2014 list your prefix, find the object, and run 'lua drains confirm <id> --token <token>'.
 `).action(drainsCommand);
-  program2.command("devices [action]").description("\u{1F4E1} Manage connected devices").option("--device-name <name>", "Device name").option("--group <group>", "Filter by device group").option("--payload <json>", "JSON payload for test/test-trigger", "{}").option("--timeout <ms>", "Timeout in milliseconds", "30000").option("--force", "Skip confirmation prompts").addHelpText("after", `
+  program2.command("devices [action]").description("\u{1F4E1} Manage connected devices").option("--device-name <name>", "Device name").option("--group <group>", "Filter by device group").option("--command <name>", "test: the command to send").option("--trigger <name>", "test-trigger: the trigger to fire").option("--payload <json>", "JSON payload for test/test-trigger", "{}").option("--timeout <ms>", "Timeout in milliseconds", "30000").option("--operations <list>", "credential: comma list of commands, triggers, assets.upload", "commands,triggers").option("--out <file>", "credential: write the secret to this file (mode 600) instead of printing it").option("--force", "Skip confirmation prompts").addHelpText("after", `
 Arguments:
-  action                   Optional: list, status, enable, disable, remove, test, test-trigger
+  action                   Optional: list, status, enable, disable, remove, test, test-trigger, credential
 
 Options:
   --device-name <name>     Device name (required for most actions, prompted if not provided)
   --group <group>          Filter device list by group
+  --command <name>         test: the command to send (prompted if not provided)
+  --trigger <name>         test-trigger: the trigger to fire (prompted if not provided)
   --payload <json>         JSON payload for test command or test-trigger
   --timeout <ms>           Command timeout in milliseconds (default: 30000)
-  --force                  Skip confirmation prompts
+  --operations <list>      credential: what the device may do (default: commands,triggers)
+  --out <file>             credential: save the secret to a file instead of printing it
+  --force                  Skip confirmation prompts (credential: overwrite --out)
 
 Examples:
   $ lua devices                                                     Interactive management
-  $ lua devices list                                                List all devices
+  $ lua devices list                                                List declared and connected devices, with status
   $ lua devices list --group printers                               List devices in group
   $ lua devices status --device-name label-printer                  Check device status
   $ lua devices enable --device-name label-printer                  Enable a device
   $ lua devices disable --device-name label-printer                 Disable a device
   $ lua devices remove --device-name label-printer                  Remove a device
   $ lua devices remove --device-name label-printer --force          Remove without confirmation
-  $ lua devices test --device-name label-printer                    Test a command interactively
-  $ lua devices test-trigger --device-name label-printer            Test a trigger
+  $ lua devices test --device-name label-printer --command print_label --payload '{"orderId":"o1"}'
+                                                                    Send one command and print the reply
+  $ lua devices test-trigger --device-name bench --trigger too_hot --payload '{"temperature":41}'
+                                                                    Fire a trigger; the live handler runs
+  $ lua devices credential --device-name pico-sensor --out .env.device
+                                                                    Issue a credential the device connects with
 `).action(devicesCommand);
   program2.command("jobs [action]").description("\u23F0 Manage and view scheduled jobs").option("-i, --job-name <name>", "Job name").option("-v, --job-version <version>", "Version for deploy action (or 'latest')").addHelpText("after", `
 Arguments:
@@ -84168,7 +84889,7 @@ Examples:
   $ lua jobs versions -i myJob                         View job versions
   $ lua jobs history -i myJob                          View execution history
 `).action(jobsCommand);
-  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, retry-step, resolve-step, raise-budget, approve, signal, replay, export, schedules)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/export/goals create/schedules create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create/schedules create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs/schedules create: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start/schedules create: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list/approval-payload --path: page size").option("--cursor <c>", "runs/goals list/approval-payload --path: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status, 6 for a gated run").option("--compose <on|off>", "policy models set: may the composer be shown the model menu").option("--max-class <fast|balanced|strong>", "policy models set: ceiling for class requests and the class map").option("--consent-actions <n>", "policy models set: estimated actions above which a composed run shows the card").option("--allow <codes>", "policy models set: comma-separated approved codes to narrow the set to").option("--class-fast <codes>", "policy models set: ordered overrides of the fast class (comma-separated)").option("--class-balanced <codes>", "policy models set: ordered overrides of the balanced class (comma-separated)").option("--class-strong <codes>", "policy models set: ordered overrides of the strong class (comma-separated)").option("--class-map <pairs>", "policy models set: comma-separated <taskClass>=<modelClass> pairs").option("--pins <class-only|allowed>", "policy models set: may a composed definition pin a concrete code").option("--fallback <same-class|same-provider>", "policy models set: where a failed leg may hop to").option("--enabled <on|off>", "policy autonomy set: may a start inside the envelope skip the consent card").option("--max-duration <seconds>", "policy autonomy set: the envelope\u2019s duration bound, in seconds").option("--max-actions <n>", "policy autonomy set: the envelope\u2019s estimated-actions bound").option("--max-runs-per-hour <n>", "policy autonomy set: autonomous starts per hour, per agent").option("--forms <list>", "policy autonomy set: comma-separated forms the envelope admits (graph,script,static)").option("--clear <keys>", "policy autonomy set: comma-separated members to clear back to the platform default").option("--agent <agentId>", "policy autonomy: not supported \u2014 no route writes a per-agent envelope (see the refusal)").option("--kind <kind>", "clear-gate: the gate kind to clear (e.g. model_policy)").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/retry-step/resolve-step/logs: step id").option("--outcome <skip|complete|fail>", "resolve-step: the decision on the parked step (--action is accepted too)").option("--action <skip|complete|fail>", "resolve-step: alias of --outcome").option("--output <json|@file>", "resolve-step: the output a completed step would have produced (required with --outcome complete)").option("--credits <n>", "raise-budget: the new priced cap of a budget-parked run, in the run's own budget unit \u2014 credits, or actions on a seat plan (above the current one)").option("--max-steps <n>", "raise-budget: the new step cap").option("--max-job-seconds <n>", "raise-budget: the new Job-tier seconds cap").option("--max-duration-seconds <n>", "raise-budget: the new wall-clock cap").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve/approval-payload: the wfa_\u2026 approval id (lua workflows status <runId> --steps --json \u2192 suspend.approvalId), not the step id").option("--path <array.path>", "approval-payload: page one array of a large payload (--cursor / --limit inside it)").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/retry-step/resolve-step/raise-budget/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: only events at/after this time (Nd/Nh/Nm or ISO) \xB7 archive-runs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph \xB7 export: overwrite files").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip) \xB7 export: target dir").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create/schedules create: cadence entry (repeatable, \u2264 5); goals: none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit/schedules create: IANA timezone for bare cron cadences").option("--notify <emailApp|email|app|off>", "schedules create: where each fire notifies").option("--backfill-on-enable <n|none>", "schedules create/patch/resume: replay \u2264 n missed fires on re-enable (patch: none clears it)").option("--backfill-now", "schedules resume (or patch --paused false): one-shot backfill on THIS re-enable").option("--paused <true|false>", "schedules patch: pause (true) or re-enable (false) the schedule").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit/schedules create: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
+  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, retry-step, resolve-step, raise-budget, approve, signal, replay, export, schedules)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/export/goals create/schedules create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create/schedules create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs/schedules create: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start/schedules create/goals create: run budget, in the run's own unit \u2014 credits, or actions on a seat plan").option("--budget-actions <n>", "start/schedules create/goals create: alias of --budget-credits (seat plans)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list/approval-payload --path: page size").option("--cursor <c>", "runs/goals list/approval-payload --path: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status, 6 for a gated run").option("--compose <on|off>", "policy models set: may the composer be shown the model menu").option("--max-class <fast|balanced|strong>", "policy models set: ceiling for class requests and the class map").option("--consent-actions <n>", "policy models set: estimated actions above which a composed run shows the card").option("--allow <codes>", "policy models set: comma-separated approved codes to narrow the set to").option("--class-fast <codes>", "policy models set: ordered overrides of the fast class (comma-separated)").option("--class-balanced <codes>", "policy models set: ordered overrides of the balanced class (comma-separated)").option("--class-strong <codes>", "policy models set: ordered overrides of the strong class (comma-separated)").option("--class-map <pairs>", "policy models set: comma-separated <taskClass>=<modelClass> pairs").option("--pins <class-only|allowed>", "policy models set: may a composed definition pin a concrete code").option("--fallback <same-class|same-provider>", "policy models set: where a failed leg may hop to").option("--enabled <on|off>", "policy autonomy set: may a start inside the envelope skip the consent card").option("--max-duration <seconds>", "policy autonomy set: the envelope\u2019s duration bound, in seconds").option("--max-actions <n>", "policy autonomy set: the envelope\u2019s estimated-actions bound").option("--max-runs-per-hour <n>", "policy autonomy set: autonomous starts per hour, per agent").option("--forms <list>", "policy autonomy set: comma-separated forms the envelope admits (graph,script,static)").option("--clear <keys>", "policy autonomy set: comma-separated members to clear back to the platform default").option("--agent <agentId>", "policy autonomy: not supported \u2014 no route writes a per-agent envelope (see the refusal)").option("--kind <kind>", "clear-gate: the gate kind to clear (e.g. model_policy)").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/retry-step/resolve-step/logs: step id").option("--outcome <skip|complete|fail>", "resolve-step: the decision on the parked step (--action is accepted too)").option("--action <skip|complete|fail>", "resolve-step: alias of --outcome").option("--output <json|@file>", "resolve-step: the output a completed step would have produced (required with --outcome complete)").option("--credits <n>", "raise-budget: the new priced cap of a budget-parked run, in the run's own budget unit \u2014 credits, or actions on a seat plan (above the current one)").option("--actions <n>", "raise-budget: alias of --credits (seat plans)").option("--max-steps <n>", "raise-budget: the new step cap").option("--max-job-seconds <n>", "raise-budget: the new Job-tier seconds cap").option("--max-duration-seconds <n>", "raise-budget: the new wall-clock cap").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve/approval-payload: the wfa_\u2026 approval id (lua workflows status <runId> --steps --json \u2192 suspend.approvalId), not the step id").option("--path <array.path>", "approval-payload: page one array of a large payload (--cursor / --limit inside it)").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/retry-step/resolve-step/raise-budget/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: only events at/after this time (Nd/Nh/Nm or ISO) \xB7 archive-runs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph \xB7 export: overwrite files").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record live agent replies as fixtures (needs --agents live; tool steps never run offline)").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip) \xB7 export: target dir").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create/schedules create: cadence entry (repeatable, \u2264 5); goals: none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit/schedules create: IANA timezone for bare cron cadences").option("--notify <emailApp|email|app|off>", "schedules create: where each fire notifies").option("--backfill-on-enable <n|none>", "schedules create/patch/resume: replay \u2264 n missed fires on re-enable (patch: none clears it)").option("--backfill-now", "schedules resume (or patch --paused false): one-shot backfill on THIS re-enable").option("--paused <true|false>", "schedules patch: pause (true) or re-enable (false) the schedule").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit/schedules create: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
 Arguments:
   action    list \xB7 view \xB7 versions \xB7 deploy \xB7 activate \xB7 deactivate \xB7 start \xB7 run \xB7 runs \xB7 status \xB7
             watch \xB7 cancel \xB7 resume \xB7 retry-step \xB7 resolve-step \xB7 raise-budget \xB7 approve \xB7 approval-payload \xB7
@@ -84303,7 +85024,7 @@ Examples:
   $ lua mcp deactivate --server-name api-server Deactivate a server
   $ lua mcp delete --server-name old-server     Delete a server
 `).action(mcpCommand);
-  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--scope <scope>", "Who owns the connection: 'agent' (default) or 'user'").option("--force", "Skip the confirmation prompt (for convert)").option("--forget", "Also forget what a personal connection (--scope user) added to memory on disconnect (default: false, memories kept)").option("--connection-id <id>", "Exact connection ID to update, disconnect, convert or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval in minutes for virtual webhooks, 1-2880 (default 1; e.g. 1, 5, 15, 60, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for list, info, requests and webhooks list/events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
+  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: false; pass 'true' to hide)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--scope <scope>", "Who owns the connection: 'agent' (default) or 'user'").option("--force", "Skip the confirmation prompt (for convert)").option("--forget", "Also forget what a personal connection (--scope user) added to memory on disconnect (default: false, memories kept)").option("--connection-id <id>", "Exact connection ID to update, disconnect, convert or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval in minutes for virtual webhooks, 1-2880 (default 1; e.g. 1, 5, 15, 60, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for list, info, requests and webhooks list/events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
 Arguments:
   action                 Optional: 'connect', 'update', 'list', 'available', 'info', 'disconnect',
                          'convert', 'webhooks' (alias: 'triggers'), or 'mcp'
@@ -84318,7 +85039,7 @@ Options:
                          create later. Publishing an agent removes its access.
   --auth-method <method> Authentication method: 'oauth' or 'token'
   --scopes <scopes>      Comma-separated OAuth scopes, or 'all' for all available scopes
-  --hide-sensitive <bool> Hide sensitive data from MCP tools (default: true, use 'false' to show)
+  --hide-sensitive <bool> Hide sensitive data from MCP tools (default: false, use 'true' to hide)
   --triggers <events>    Comma-separated triggers to enable (e.g., task_task.created,task_task.updated)
   --custom-webhook       Use custom webhook URL instead of agent trigger
   --hook-url <url>       Custom webhook URL (use with --custom-webhook)
@@ -84711,6 +85432,7 @@ program.hook("preAction", (thisCommand) => {
     setCiMode(true);
   }
 });
+registerJsonErrorEnvelope(program);
 setupAuthCommands(program);
 setupSkillCommands(program);
 setupMarketplaceCommands(program);