lua-cli 3.48.0 → 3.49.0

package/dist/workflow-builder.js

@@ -1195,6 +1195,7 @@ var DECISION_LIMITS = {
   minLevels: 2,
   maxLevels: 10,
   maxInstructionChars: 4e3,
+  maxQuestionsChars: 1e5,
   maxStateChars: 12e4,
   maxImages: 4,
   maxImageBytes: 5 * 1024 * 1024,
@@ -1260,7 +1261,14 @@ var DecisionOptionsSchema = z.object({
     "none"
   ]).optional()
 });
-var DecisionQuestionsSchema = z.record(NameSchema, DecisionQuestionSchema).refine((questions) => Object.keys(questions).length >= 1 && Object.keys(questions).length <= DECISION_LIMITS.maxQuestions, `a decision needs between 1 and ${DECISION_LIMITS.maxQuestions} questions`);
+var DecisionQuestionsSchema = z.record(NameSchema, DecisionQuestionSchema).refine((questions) => Object.keys(questions).length >= 1 && Object.keys(questions).length <= DECISION_LIMITS.maxQuestions, `a decision needs between 1 and ${DECISION_LIMITS.maxQuestions} questions`).superRefine((questions, ctx) => {
+  const chars = JSON.stringify(questions).length;
+  if (chars <= DECISION_LIMITS.maxQuestionsChars) return;
+  ctx.addIssue({
+    code: z.ZodIssueCode.custom,
+    message: `the questions take ${chars} characters as JSON, more than the ${DECISION_LIMITS.maxQuestionsChars} characters a decision may hold`
+  });
+});
 var DecisionDefinitionSchema = DecisionOptionsSchema.extend({
   name: z.string().regex(DECISION_NAME_PATTERN, "a decision name is 1 to 64 letters, digits, underscores or hyphens"),
   description: z.string().max(DECISION_LIMITS.maxInstructionChars).optional(),
@@ -1351,6 +1359,158 @@ function supervisionSubjectId(agentId2) {
 }
 __name(supervisionSubjectId, "supervisionSubjectId");
 __name4(supervisionSubjectId, "supervisionSubjectId");
+var MESSAGING_CHANNELS = new Set(CHANNEL_CONVERSATION_CHANNELS);
+var VOICE_CHANNELS = /* @__PURE__ */ new Set([
+  "phone",
+  "meeting",
+  "voice"
+]);
+var TURN_CATEGORIES = /* @__PURE__ */ new Set([
+  "llm:inference",
+  "llm:chat-modes",
+  "llm:delegation",
+  "decision:ask"
+]);
+var AGENT_TOOL_CATEGORIES = /* @__PURE__ */ new Set([
+  "llm:media:describe",
+  "tool:image-generate",
+  "tool:image-edit"
+]);
+function isModelCallCategory(category) {
+  return category.startsWith("llm:") || category.startsWith("voice:") || category === "embedding" || category === "workflow:job" || category === "decision:ask" || category.startsWith("tool:image-");
+}
+__name(isModelCallCategory, "isModelCallCategory");
+__name4(isModelCallCategory, "isModelCallCategory");
+function deriveUsageSurface(row) {
+  const { category, channel } = row;
+  const data = row.data;
+  if (!isModelCallCategory(category)) return void 0;
+  if (category === "workflow:job") return "workflow-job";
+  if (category === "llm:sandbox") return "tool-code";
+  if (category === "llm:builder") return "builder";
+  if (category === "llm:website") return "website";
+  if (category.startsWith("voice:") || category === "llm:voice") return "voice";
+  if (category.startsWith("llm:tool:") || AGENT_TOOL_CATEGORIES.has(category)) return "agent-tool";
+  if (!TURN_CATEGORIES.has(category)) return "background";
+  if (channel === "workflow") return "workflow-step";
+  if (data?.gateway === "livekit-inference") return "voice";
+  if (channel === "dev") return "dev";
+  if (channel && VOICE_CHANNELS.has(channel)) return "voice";
+  if (channel && MESSAGING_CHANNELS.has(channel)) return "channel";
+  return "chat";
+}
+__name(deriveUsageSurface, "deriveUsageSurface");
+__name4(deriveUsageSurface, "deriveUsageSurface");
+var count = /* @__PURE__ */ __name4((v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.floor(v) : void 0, "count");
+function fromRaw(raw, id2, model) {
+  const fiveMin = count(raw.cache_creation?.ephemeral_5m_input_tokens);
+  const oneHour = count(raw.cache_creation?.ephemeral_1h_input_tokens);
+  const split = !!(fiveMin || oneHour);
+  const flatWrite = count(raw.cache_creation_input_tokens);
+  const read = count(raw.cache_read_input_tokens);
+  return {
+    ...typeof id2 === "string" && id2 ? {
+      id: id2
+    } : {},
+    ...typeof model === "string" && model ? {
+      model
+    } : {},
+    inputTokens: count(raw.input_tokens) ?? 0,
+    outputTokens: count(raw.output_tokens) ?? 0,
+    ...read ? {
+      cacheReadTokens: read
+    } : {},
+    ...split ? {
+      ...fiveMin ? {
+        cacheCreationTokens5m: fiveMin
+      } : {},
+      ...oneHour ? {
+        cacheCreationTokens1h: oneHour
+      } : {}
+    } : flatWrite ? {
+      cacheCreationTokens: flatWrite
+    } : {},
+    ...typeof raw.service_tier === "string" && raw.service_tier && raw.service_tier !== "standard" ? {
+      serviceTier: raw.service_tier
+    } : {}
+  };
+}
+__name(fromRaw, "fromRaw");
+__name4(fromRaw, "fromRaw");
+function anthropicMessageUsage(message) {
+  if (!message || typeof message !== "object") return void 0;
+  const m = message;
+  if (!m.usage || typeof m.usage !== "object") return void 0;
+  return fromRaw(m.usage, m.id, m.model);
+}
+__name(anthropicMessageUsage, "anthropicMessageUsage");
+__name4(anthropicMessageUsage, "anthropicMessageUsage");
+var AnthropicSseUsageReader = class {
+  static {
+    __name(this, "AnthropicSseUsageReader");
+  }
+  static {
+    __name4(this, "AnthropicSseUsageReader");
+  }
+  pending = "";
+  raw;
+  id;
+  model;
+  push(chunk) {
+    const text2 = this.pending + chunk;
+    const lines = text2.split("\n");
+    this.pending = lines.pop() ?? "";
+    for (const line of lines) this.line(line);
+  }
+  result() {
+    if (this.pending) {
+      this.line(this.pending);
+      this.pending = "";
+    }
+    return this.raw ? fromRaw(this.raw, this.id, this.model) : void 0;
+  }
+  line(line) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("data:")) return;
+    let event;
+    try {
+      event = JSON.parse(trimmed.slice(5).trim());
+    } catch {
+      return;
+    }
+    if (event.type === "message_start" && event.message) {
+      this.id = event.message.id;
+      this.model = event.message.model;
+      this.raw = {
+        ...event.message.usage ?? {}
+      };
+    } else if (event.type === "message_delta" && event.usage && typeof event.usage === "object") {
+      const delta = event.usage;
+      const merged = {
+        ...this.raw ?? {}
+      };
+      for (const [key, value3] of Object.entries(delta)) {
+        if (value3 !== null && value3 !== void 0) merged[key] = value3;
+      }
+      this.raw = merged;
+    }
+  }
+};
+function parseAnthropicReplyUsage(body) {
+  const start = body.trimStart();
+  if (start.startsWith("{")) {
+    try {
+      return anthropicMessageUsage(JSON.parse(start));
+    } catch {
+      return void 0;
+    }
+  }
+  const reader = new AnthropicSseUsageReader();
+  reader.push(body);
+  return reader.result();
+}
+__name(parseAnthropicReplyUsage, "parseAnthropicReplyUsage");
+__name4(parseAnthropicReplyUsage, "parseAnthropicReplyUsage");
 var SUPERVISION_OPS = {
   "agents.list": "discover",
   "agents.get": "discover",
@@ -3430,24 +3590,24 @@ __name4(addresses, "addresses");
 function recordFacts(value3) {
   const senders = [];
   const labels = [];
-  let isRecord22 = false;
+  let isRecord32 = false;
   if (isPlainObject(value3.author_member)) {
-    isRecord22 = true;
+    isRecord32 = true;
     const email = lower(value3.author_member.email);
     if (email) senders.push(email);
     const userId = lower(value3.author_member.user_id);
     if (userId) senders.push(userId);
   }
   if (typeof value3.channel_id === "string") {
-    isRecord22 = true;
+    isRecord32 = true;
     labels.push(...idOrName(value3.channel_id));
   }
   if (Array.isArray(value3.channel_ids)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const id2 of value3.channel_ids) labels.push(...idOrName(id2));
   }
   if (Array.isArray(value3.channels) && (value3.author_member || value3.message !== void 0)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const channel of value3.channels) labels.push(...idOrName(channel));
   }
   for (const key of [
@@ -3456,11 +3616,11 @@ function recordFacts(value3) {
   ]) {
     const field = value3[key];
     if (isPlainObject(field) && isPlainObject(field.emailAddress)) {
-      isRecord22 = true;
+      isRecord32 = true;
       const address = lower(field.emailAddress.address);
       if (address) senders.push(address);
     } else if (key === "from" && typeof field === "string" && field.includes("@")) {
-      isRecord22 = true;
+      isRecord32 = true;
       senders.push(...addresses(field));
     }
   }
@@ -3468,12 +3628,12 @@ function recordFacts(value3) {
     const organizer = value3.organizer;
     const address = isPlainObject(organizer.emailAddress) ? lower(organizer.emailAddress.address) : lower(organizer.email);
     if (address) {
-      isRecord22 = true;
+      isRecord32 = true;
       senders.push(address);
     }
   }
   if (Array.isArray(value3.categories)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const category of value3.categories) labels.push(...idOrName(category));
   }
   if (isPlainObject(value3.from)) {
@@ -3484,13 +3644,13 @@ function recordFacts(value3) {
     ]) {
       const identity = value3.from[key];
       if (!isPlainObject(identity)) continue;
-      isRecord22 = true;
+      isRecord32 = true;
       const id2 = lower(identity.id);
       if (id2) senders.push(id2);
     }
   }
   if (isPlainObject(value3.channelIdentity)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const key of [
       "channelId",
       "teamId"
@@ -3500,21 +3660,21 @@ function recordFacts(value3) {
     }
   }
   if (typeof value3.chatId === "string") {
-    isRecord22 = true;
+    isRecord32 = true;
     labels.push(...idOrName(value3.chatId));
   }
   if (typeof value3.parentFolderId === "string") {
-    isRecord22 = true;
+    isRecord32 = true;
     labels.push(...idOrName(value3.parentFolderId));
   }
   let gmailSenderUnknown = false;
   const gmailMessage = typeof value3.threadId === "string" && (Array.isArray(value3.labelIds) || "payload" in value3 || "raw" in value3) || isPlainObject(value3.payload) && Array.isArray(value3.payload.headers);
   if (Array.isArray(value3.labelIds)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const id2 of value3.labelIds) labels.push(...idOrName(id2));
   }
   if (gmailMessage) {
-    isRecord22 = true;
+    isRecord32 = true;
     const headers = isPlainObject(value3.payload) && Array.isArray(value3.payload.headers) ? value3.payload.headers : [];
     const from = headers.find((header) => isPlainObject(header) && lower(header.name) === "from");
     const fromAddresses = addresses(from?.value);
@@ -3522,11 +3682,11 @@ function recordFacts(value3) {
     else gmailSenderUnknown = true;
   }
   if (Array.isArray(value3.labels)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const label of value3.labels) labels.push(...idOrName(label));
   }
   if (typeof value3.ts === "string" && (typeof value3.user === "string" || typeof value3.bot_id === "string")) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const id2 of [
       value3.user,
       value3.bot_id,
@@ -3542,7 +3702,7 @@ function recordFacts(value3) {
     labels.push(...idOrName(value3.channel));
   }
   return {
-    isRecord: isRecord22,
+    isRecord: isRecord32,
     senders,
     labels,
     gmailSenderUnknown
@@ -6477,6 +6637,10 @@ var BROWSER_COMMANDS = [
     name: "close",
     description: "Close the session\u2019s browser."
   },
+  {
+    name: "read",
+    description: "Read one page in a fresh session that is closed afterwards: open the URL, wait, return its title and content. Args: url, waitFor?(load|networkidle|selector), selector?, format?(text|html|markdown), timeoutMs?."
+  },
   // perception
   {
     name: "snapshot",
@@ -6650,6 +6814,91 @@ var BROWSER_COMMANDS = [
   }
 ];
 var BROWSER_COMMAND_NAMES = BROWSER_COMMANDS.map((c) => c.name);
+var SERVER_TRIGGERED_BROWSER_SOURCES = [
+  "job",
+  "webhook",
+  "web-route",
+  "trigger",
+  "workflow-step",
+  "workflow-script"
+];
+function isServerTriggeredBrowserSource(logSource) {
+  return SERVER_TRIGGERED_BROWSER_SOURCES.includes(logSource);
+}
+__name(isServerTriggeredBrowserSource, "isServerTriggeredBrowserSource");
+__name4(isServerTriggeredBrowserSource, "isServerTriggeredBrowserSource");
+var BROWSER_FALLBACKS = [
+  "browser-use",
+  "none"
+];
+var DEFAULT_BROWSER_FALLBACK = "browser-use";
+function resolveBrowserFallback(raw) {
+  return BROWSER_FALLBACKS.includes(raw) ? raw : DEFAULT_BROWSER_FALLBACK;
+}
+__name(resolveBrowserFallback, "resolveBrowserFallback");
+__name4(resolveBrowserFallback, "resolveBrowserFallback");
+var PROXY_COUNTRY_CODE = /^[a-z]{2}$/;
+function resolveBrowserProxyCountry(raw) {
+  if (typeof raw !== "string") return void 0;
+  const code = raw.trim().toLowerCase();
+  return PROXY_COUNTRY_CODE.test(code) ? code : void 0;
+}
+__name(resolveBrowserProxyCountry, "resolveBrowserProxyCountry");
+__name4(resolveBrowserProxyCountry, "resolveBrowserProxyCountry");
+var BROWSER_LOG_CONTENT_MODES = [
+  "summary",
+  "full",
+  "none"
+];
+var DEFAULT_BROWSER_LOG_CONTENT = "summary";
+var BROWSER_SCREENSHOT_POLICIES = [
+  "always",
+  "onError",
+  "never"
+];
+var DEFAULT_BROWSER_SCREENSHOT_POLICY = "onError";
+function resolveBrowserLogOptions(raw) {
+  const logContent = BROWSER_LOG_CONTENT_MODES.includes(raw.logContent) ? raw.logContent : DEFAULT_BROWSER_LOG_CONTENT;
+  const screenshots = BROWSER_SCREENSHOT_POLICIES.includes(raw.screenshots) ? raw.screenshots : DEFAULT_BROWSER_SCREENSHOT_POLICY;
+  return {
+    logContent,
+    screenshots
+  };
+}
+__name(resolveBrowserLogOptions, "resolveBrowserLogOptions");
+__name4(resolveBrowserLogOptions, "resolveBrowserLogOptions");
+function browserProfileNotFoundMessage(name) {
+  return `No browser named '${name}' is attached to this agent. Add it to the agent's \`browsers\` list and push again.`;
+}
+__name(browserProfileNotFoundMessage, "browserProfileNotFoundMessage");
+__name4(browserProfileNotFoundMessage, "browserProfileNotFoundMessage");
+var BROWSER_LIMIT_KEYS = [
+  "maxSessionMinutes",
+  "idleTimeoutSeconds",
+  "maxConcurrentSessions"
+];
+var BROWSER_LIMIT_MAX = {
+  maxSessionMinutes: 60,
+  idleTimeoutSeconds: 15 * 60,
+  maxConcurrentSessions: 100
+};
+function resolveBrowserLimits(pick) {
+  const limits = {};
+  for (const key of BROWSER_LIMIT_KEYS) {
+    const value3 = pick(key);
+    if (typeof value3 === "number" && Number.isInteger(value3) && value3 > 0) limits[key] = value3;
+  }
+  return limits;
+}
+__name(resolveBrowserLimits, "resolveBrowserLimits");
+__name4(resolveBrowserLimits, "resolveBrowserLimits");
+var BROWSER_EXECUTE_METHOD = "execute";
+var BROWSER_GLOBAL_METHODS = [
+  ...BROWSER_COMMAND_NAMES,
+  BROWSER_EXECUTE_METHOD
+];
+var BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+var BROWSER_EXECUTE_MAX_TIMEOUT_MS = 15 * 60 * 1e3;
 var LOG_FIELDS_MAX_KEYS = 32;
 var LOG_FIELD_MAX_VALUE_BYTES = 1024;
 var LOG_FIELDS_MAX_BYTES = 8192;
@@ -6870,6 +7119,640 @@ function isDesktopFileSessionId(value3) {
 }
 __name(isDesktopFileSessionId, "isDesktopFileSessionId");
 __name4(isDesktopFileSessionId, "isDesktopFileSessionId");
+var BROWSER_READ_FORMATS = [
+  "text",
+  "html",
+  "markdown"
+];
+var BROWSER_READ_DEFAULT_TIMEOUT_MS = 6e4;
+var BROWSER_READ_MIN_TIMEOUT_MS = 1e3;
+var BROWSER_READ_MAX_TIMEOUT_MS = 1e5;
+var BROWSER_READ_MAX_CONTENT_CHARS = 1e5;
+var BROWSER_READ_DEFAULT_SELECTOR = "body";
+var BROWSER_READ_MATCH_SEPARATOR = "\n\n";
+var BROWSER_READ_LOGIN_BLOCKER = "login_required";
+var BROWSER_ERROR_NAME = "BrowserError";
+function browserError(code, message, status) {
+  return Object.assign(new Error(message), {
+    name: BROWSER_ERROR_NAME,
+    code,
+    ...typeof status === "number" ? {
+      status
+    } : {}
+  });
+}
+__name(browserError, "browserError");
+__name4(browserError, "browserError");
+function isRecord(value3) {
+  return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+}
+__name(isRecord, "isRecord");
+__name4(isRecord, "isRecord");
+function optionalString(raw, field) {
+  const value3 = raw[field];
+  if (value3 === void 0 || value3 === null || value3 === "") return void 0;
+  if (typeof value3 !== "string") throw new TypeError(`${field} must be a string`);
+  if (value3.startsWith("-")) throw new TypeError(`${field} may not start with '-'`);
+  if (value3.includes("\0")) throw new TypeError(`${field} may not contain NUL`);
+  return value3;
+}
+__name(optionalString, "optionalString");
+__name4(optionalString, "optionalString");
+function readUrl(value3) {
+  if (typeof value3 !== "string" || !/^https?:\/\//i.test(value3.trim()) || value3.includes("\0")) {
+    throw new TypeError("url must be an absolute http(s) URL");
+  }
+  return value3.trim();
+}
+__name(readUrl, "readUrl");
+__name4(readUrl, "readUrl");
+function readFormat(value3) {
+  if (value3 === void 0 || value3 === null || value3 === "") return "text";
+  if (!BROWSER_READ_FORMATS.includes(value3)) {
+    throw new TypeError(`format must be one of: ${BROWSER_READ_FORMATS.join(", ")}`);
+  }
+  return value3;
+}
+__name(readFormat, "readFormat");
+__name4(readFormat, "readFormat");
+function readTimeout(value3) {
+  if (value3 === void 0 || value3 === null) return BROWSER_READ_DEFAULT_TIMEOUT_MS;
+  if (typeof value3 !== "number" || !Number.isFinite(value3)) throw new TypeError("timeoutMs must be a number");
+  return Math.min(BROWSER_READ_MAX_TIMEOUT_MS, Math.max(BROWSER_READ_MIN_TIMEOUT_MS, Math.round(value3)));
+}
+__name(readTimeout, "readTimeout");
+__name4(readTimeout, "readTimeout");
+function parseBrowserReadPayload(raw) {
+  try {
+    const input = isRecord(raw) ? raw : {};
+    const waitFor = optionalString(input, "waitFor");
+    return {
+      payload: {
+        url: readUrl(input.url),
+        ...waitFor ? {
+          waitFor
+        } : {},
+        selector: optionalString(input, "selector") ?? BROWSER_READ_DEFAULT_SELECTOR,
+        format: readFormat(input.format),
+        timeoutMs: readTimeout(input.timeoutMs)
+      }
+    };
+  } catch (error) {
+    return {
+      error: {
+        code: "invalid_argument",
+        message: `read: ${error.message}`
+      }
+    };
+  }
+}
+__name(parseBrowserReadPayload, "parseBrowserReadPayload");
+__name4(parseBrowserReadPayload, "parseBrowserReadPayload");
+function clampBrowserReadContent(content, maxChars = BROWSER_READ_MAX_CONTENT_CHARS) {
+  if (content.length <= maxChars) return {
+    content,
+    truncated: false
+  };
+  return {
+    content: content.slice(0, maxChars),
+    truncated: true
+  };
+}
+__name(clampBrowserReadContent, "clampBrowserReadContent");
+__name4(clampBrowserReadContent, "clampBrowserReadContent");
+function joinBrowserReadMatches(parts, maxChars = BROWSER_READ_MAX_CONTENT_CHARS) {
+  const kept = parts.map((part) => part.trim()).filter((part) => part.length > 0);
+  return clampBrowserReadContent(kept.join(BROWSER_READ_MATCH_SEPARATOR), maxChars);
+}
+__name(joinBrowserReadMatches, "joinBrowserReadMatches");
+__name4(joinBrowserReadMatches, "joinBrowserReadMatches");
+var HTTP_STATUS_FAILURE = /ERR_HTTP_RESPONSE_CODE_FAILURE/;
+function isBrowserReadHttpFailure(message) {
+  return HTTP_STATUS_FAILURE.test(message ?? "");
+}
+__name(isBrowserReadHttpFailure, "isBrowserReadHttpFailure");
+__name4(isBrowserReadHttpFailure, "isBrowserReadHttpFailure");
+function browserReadHttpErrorMessage(url, status) {
+  const answered = status === void 0 ? "an HTTP error status" : `HTTP ${status}`;
+  return `read: ${url} answered ${answered} with no page to read`;
+}
+__name(browserReadHttpErrorMessage, "browserReadHttpErrorMessage");
+__name4(browserReadHttpErrorMessage, "browserReadHttpErrorMessage");
+function urlOf(value3) {
+  if (!value3) return void 0;
+  try {
+    return new URL(value3);
+  } catch {
+    return void 0;
+  }
+}
+__name(urlOf, "urlOf");
+__name4(urlOf, "urlOf");
+function answeredDocuments(requests) {
+  if (!Array.isArray(requests)) return [];
+  const answered = [];
+  for (const entry of requests) {
+    if (!isRecord(entry) || typeof entry.status !== "number" || typeof entry.url !== "string") continue;
+    const url = urlOf(entry.url);
+    if (url) answered.unshift({
+      url,
+      status: entry.status
+    });
+  }
+  return answered;
+}
+__name(answeredDocuments, "answeredDocuments");
+__name4(answeredDocuments, "answeredDocuments");
+function documentStatusOf(requests, requestedUrl, finalUrl) {
+  const latestFirst = answeredDocuments(requests);
+  const final = urlOf(finalUrl);
+  const requested = urlOf(requestedUrl);
+  const match = latestFirst.find((doc) => doc.url.href === final?.href) ?? latestFirst.find((doc) => doc.url.href === requested?.href) ?? latestFirst.find((doc) => doc.url.host === final?.host);
+  return match?.status;
+}
+__name(documentStatusOf, "documentStatusOf");
+__name4(documentStatusOf, "documentStatusOf");
+var LOGIN_PATH_SEGMENTS = /* @__PURE__ */ new Set([
+  "login",
+  "log-in",
+  "logon",
+  "signin",
+  "sign-in",
+  "sign_in",
+  "auth",
+  "authenticate",
+  "authorize",
+  "sso"
+]);
+var LOGIN_HOST_LABELS = /* @__PURE__ */ new Set([
+  "login",
+  "signin",
+  "auth",
+  "sso"
+]);
+function isLoginUrl(url) {
+  const segments = url.pathname.toLowerCase().split("/");
+  return segments.some((segment) => LOGIN_PATH_SEGMENTS.has(segment)) || LOGIN_HOST_LABELS.has(url.hostname.split(".")[0]);
+}
+__name(isLoginUrl, "isLoginUrl");
+__name4(isLoginUrl, "isLoginUrl");
+function isLoginRedirect(requestedUrl, finalUrl) {
+  const requested = urlOf(requestedUrl);
+  const final = urlOf(finalUrl);
+  return Boolean(requested && final && !isLoginUrl(requested) && isLoginUrl(final));
+}
+__name(isLoginRedirect, "isLoginRedirect");
+__name4(isLoginRedirect, "isLoginRedirect");
+function browserReadLoginBlock() {
+  return {
+    blocked: true,
+    blocker: BROWSER_READ_LOGIN_BLOCKER,
+    blockerKind: "login",
+    blockerGuidance: "This URL redirected to a sign-in page, so the content is the sign-in form, not the page you asked for. The page needs a signed-in session: read it on the desktop browser where the user is signed in, or use a public URL."
+  };
+}
+__name(browserReadLoginBlock, "browserReadLoginBlock");
+__name4(browserReadLoginBlock, "browserReadLoginBlock");
+var AGENT_LOG_SOURCES = [
+  "skill",
+  "job",
+  "webhook",
+  "web-route",
+  "trigger",
+  "preprocessor",
+  "postprocessor",
+  "user_message",
+  "agent_response",
+  "agent_error",
+  "runtime",
+  "mcp",
+  "rag",
+  "device",
+  "device-trigger",
+  "model-resolver",
+  "workflow-step",
+  "workflow-script",
+  "workflow",
+  "supervision",
+  "browser",
+  "decisions"
+];
+var AGENT_LOG_ENVIRONMENTS = [
+  "production",
+  "sandbox"
+];
+var AGENT_LOG_FIELDS_MAX_WIRE_KEYS = LOG_FIELDS_MAX_KEYS + 1;
+function utf8Bytes(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const code = value3.charCodeAt(i);
+    if (code < 128) {
+      bytes += 1;
+      i += 1;
+    } else if (code < 2048) {
+      bytes += 2;
+      i += 1;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value3.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        i += 2;
+      } else {
+        bytes += 3;
+        i += 1;
+      }
+    } else {
+      bytes += 3;
+      i += 1;
+    }
+  }
+  return bytes;
+}
+__name(utf8Bytes, "utf8Bytes");
+__name4(utf8Bytes, "utf8Bytes");
+function isPlainFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
+  if (key === LOG_FIELDS_CLAMPED_KEY) return false;
+  return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+__name(isPlainFieldKey, "isPlainFieldKey");
+__name4(isPlainFieldKey, "isPlainFieldKey");
+function describeAgentLogFieldsViolation(value3) {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) {
+    return "fields must be an object";
+  }
+  const entries = Object.entries(value3);
+  let userKeys = 0;
+  for (const [key, entry] of entries) {
+    if (key === LOG_FIELDS_CLAMPED_KEY) {
+      if (entry !== true) return `fields.${key} must be true`;
+      continue;
+    }
+    userKeys += 1;
+    if (key.endsWith(LOG_FIELD_ARRAY_COUNT_SUFFIX)) {
+      const base = key.slice(0, -LOG_FIELD_ARRAY_COUNT_SUFFIX.length);
+      if (!isPlainFieldKey(base)) return `fields key \`${key}\` is not a legal field key`;
+      if (typeof entry !== "number" || !Number.isFinite(entry)) {
+        return `fields.${key} must be a finite number`;
+      }
+      continue;
+    }
+    if (!isPlainFieldKey(key)) return `fields key \`${key}\` is not a legal field key`;
+    if (typeof entry === "string") {
+      if (utf8Bytes(entry) > LOG_FIELD_MAX_VALUE_BYTES) {
+        return `fields.${key} exceeds ${LOG_FIELD_MAX_VALUE_BYTES} bytes`;
+      }
+      continue;
+    }
+    if (typeof entry === "boolean") continue;
+    if (typeof entry === "number") {
+      if (!Number.isFinite(entry)) return `fields.${key} must be a finite number`;
+      continue;
+    }
+    return `fields.${key} must be a string, number or boolean`;
+  }
+  if (userKeys > LOG_FIELDS_MAX_KEYS) {
+    return `fields has ${userKeys} keys, over the cap of ${LOG_FIELDS_MAX_KEYS}`;
+  }
+  if (utf8Bytes(JSON.stringify(value3)) > LOG_FIELDS_MAX_BYTES) {
+    return `fields exceeds ${LOG_FIELDS_MAX_BYTES} bytes`;
+  }
+  return void 0;
+}
+__name(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+__name4(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+function isAgentLogFields(value3) {
+  return describeAgentLogFieldsViolation(value3) === void 0;
+}
+__name(isAgentLogFields, "isAgentLogFields");
+__name4(isAgentLogFields, "isAgentLogFields");
+var BROWSER_LOG_EVENT_KINDS = [
+  "session.opened",
+  "command",
+  "navigation",
+  "blocked",
+  "wall",
+  "fallback",
+  "confirm",
+  "agent.step",
+  "session.closed"
+];
+var BROWSER_LOG_ENGINES = [
+  "desktop",
+  "agent-browser",
+  "browser-use",
+  "none"
+];
+var BROWSER_SESSION_OPEN_REASONS = [
+  "desktop-online",
+  "cloud-fallback",
+  "stepwise-cloud",
+  "pinned",
+  "none"
+];
+var BROWSER_BLOCK_KINDS = [
+  "domain",
+  "private-network",
+  "policy",
+  "concurrency",
+  "bot-block"
+];
+var BROWSER_WALL_KINDS = [
+  "captcha",
+  "bot-block",
+  "consent",
+  "login",
+  "empty-content"
+];
+var BROWSER_WALL_NEXT_ACTIONS = [
+  "fallback",
+  "retry",
+  "ask-user",
+  "gave-up"
+];
+var BROWSER_CONFIRM_DECISIONS = [
+  "pending",
+  "approved",
+  "denied",
+  "expired"
+];
+var BROWSER_SESSION_CLOSE_REASONS = [
+  "done",
+  "idle",
+  "max-minutes",
+  "max-steps",
+  "cost-cap",
+  "error",
+  "reaped"
+];
+var BROWSER_LOG_CONTEXT_KEYS = [
+  "runId",
+  "executionId",
+  "primitiveId",
+  "primitiveName",
+  "channel",
+  "orgId",
+  "environment",
+  "agentVersion"
+];
+var BROWSER_LOG_ID_MAX_CHARS = 256;
+var BROWSER_LOG_TEXT_MAX_CHARS = 64 * 1024;
+var isString = /* @__PURE__ */ __name4((value3) => typeof value3 === "string", "isString");
+var isBoolean = /* @__PURE__ */ __name4((value3) => typeof value3 === "boolean", "isBoolean");
+var isCount = /* @__PURE__ */ __name4((value3) => typeof value3 === "number" && Number.isFinite(value3) && value3 >= 0, "isCount");
+var isPlainObject2 = /* @__PURE__ */ __name4((value3) => typeof value3 === "object" && value3 !== null && !Array.isArray(value3), "isPlainObject");
+var oneOf = /* @__PURE__ */ __name4((values) => (value3) => typeof value3 === "string" && values.includes(value3), "oneOf");
+var isLimits = /* @__PURE__ */ __name4((value3) => isPlainObject2(value3) && Object.values(value3).every((entry) => isCount(entry)), "isLimits");
+var EVENT_SHAPES = {
+  "session.opened": {
+    required: {
+      reason: oneOf(BROWSER_SESSION_OPEN_REASONS)
+    },
+    optional: {
+      limits: isLimits,
+      region: isString,
+      liveUrl: isString
+    }
+  },
+  command: {
+    required: {
+      name: oneOf(BROWSER_COMMAND_NAMES),
+      durationMs: isCount,
+      ok: isBoolean
+    },
+    optional: {
+      args: isPlainObject2,
+      urlBefore: isString,
+      urlAfter: isString,
+      resultBytes: isCount,
+      errorCode: isString,
+      errorMessage: isString,
+      title: isString,
+      pageText: isString,
+      screenshotRef: isString
+    }
+  },
+  navigation: {
+    required: {
+      url: isString
+    },
+    optional: {
+      finalUrl: isString,
+      status: isCount,
+      redirects: isCount
+    }
+  },
+  blocked: {
+    required: {
+      kind: oneOf(BROWSER_BLOCK_KINDS)
+    },
+    optional: {
+      rule: isString,
+      target: isString,
+      command: oneOf(BROWSER_COMMAND_NAMES),
+      reason: isString
+    }
+  },
+  wall: {
+    required: {
+      kind: oneOf(BROWSER_WALL_KINDS),
+      url: isString,
+      nextAction: oneOf(BROWSER_WALL_NEXT_ACTIONS)
+    },
+    optional: {}
+  },
+  fallback: {
+    required: {
+      from: oneOf(BROWSER_LOG_ENGINES),
+      to: oneOf(BROWSER_LOG_ENGINES),
+      reason: isString,
+      provider: isString
+    },
+    optional: {}
+  },
+  confirm: {
+    required: {
+      action: isString,
+      decision: oneOf(BROWSER_CONFIRM_DECISIONS)
+    },
+    optional: {
+      decidedBy: isString
+    }
+  },
+  "agent.step": {
+    required: {
+      step: isCount,
+      action: isString
+    },
+    optional: {
+      intent: isString,
+      url: isString
+    }
+  },
+  "session.closed": {
+    required: {
+      reason: oneOf(BROWSER_SESSION_CLOSE_REASONS),
+      durationMs: isCount,
+      pagesVisited: isCount,
+      bytes: isCount
+    },
+    optional: {
+      costUsd: isCount
+    }
+  }
+};
+var BASE_KEYS = /* @__PURE__ */ new Set([
+  "event",
+  "sessionId",
+  "engine",
+  "at"
+]);
+function describeBaseViolation(event) {
+  if (!BROWSER_LOG_EVENT_KINDS.includes(event.event)) return "event is not a known kind";
+  if (typeof event.sessionId !== "string" || event.sessionId.length === 0) return "sessionId must be a string";
+  if (event.sessionId.length > BROWSER_LOG_ID_MAX_CHARS) return "sessionId is too long";
+  if (!BROWSER_LOG_ENGINES.includes(event.engine)) return "engine is not a known engine";
+  if (typeof event.at !== "string" || Number.isNaN(Date.parse(event.at))) return "at must be an ISO timestamp";
+  return void 0;
+}
+__name(describeBaseViolation, "describeBaseViolation");
+__name4(describeBaseViolation, "describeBaseViolation");
+function describeFieldViolation(key, value3, check) {
+  if (!check) return `${key} is not a field of this event`;
+  if (!check(value3)) return `${key} has the wrong type`;
+  if (typeof value3 === "string" && value3.length > BROWSER_LOG_TEXT_MAX_CHARS) return `${key} is too long`;
+  return void 0;
+}
+__name(describeFieldViolation, "describeFieldViolation");
+__name4(describeFieldViolation, "describeFieldViolation");
+function describeBrowserLogEventViolation(value3) {
+  if (!isPlainObject2(value3)) return "event must be an object";
+  const event = value3;
+  const base = describeBaseViolation(event);
+  if (base) return base;
+  const shape = EVENT_SHAPES[event.event];
+  for (const key of Object.keys(shape.required)) {
+    if (event[key] === void 0) return `${key} is required`;
+  }
+  for (const [key, entry] of Object.entries(event)) {
+    if (BASE_KEYS.has(key) || entry === void 0) continue;
+    const violation = describeFieldViolation(key, entry, shape.required[key] ?? shape.optional[key]);
+    if (violation) return violation;
+  }
+  return void 0;
+}
+__name(describeBrowserLogEventViolation, "describeBrowserLogEventViolation");
+__name4(describeBrowserLogEventViolation, "describeBrowserLogEventViolation");
+function isBrowserLogEvent(value3) {
+  return describeBrowserLogEventViolation(value3) === void 0;
+}
+__name(isBrowserLogEvent, "isBrowserLogEvent");
+__name4(isBrowserLogEvent, "isBrowserLogEvent");
+function describeBrowserLogContextViolation(value3) {
+  if (value3 === void 0) return void 0;
+  if (!isPlainObject2(value3)) return "logContext must be an object";
+  for (const [key, entry] of Object.entries(value3)) {
+    if (!BROWSER_LOG_CONTEXT_KEYS.includes(key)) return `logContext.${key} is not allowed`;
+    if (entry === void 0) continue;
+    if (typeof entry !== "string") return `logContext.${key} must be a string`;
+    if (entry.length > BROWSER_LOG_ID_MAX_CHARS) return `logContext.${key} is too long`;
+    if (key === "environment" && !AGENT_LOG_ENVIRONMENTS.includes(entry)) {
+      return "logContext.environment is not a known environment";
+    }
+  }
+  return void 0;
+}
+__name(describeBrowserLogContextViolation, "describeBrowserLogContextViolation");
+__name4(describeBrowserLogContextViolation, "describeBrowserLogContextViolation");
+var BROWSER_WORKER_SESSION_ID_SEPARATOR = ":";
+function browserWorkerSessionId(ref) {
+  return [
+    ref.agentId,
+    ref.userId,
+    ref.sessionKey
+  ].join(BROWSER_WORKER_SESSION_ID_SEPARATOR);
+}
+__name(browserWorkerSessionId, "browserWorkerSessionId");
+__name4(browserWorkerSessionId, "browserWorkerSessionId");
+var BROWSER_WORKER_BLOCK_REASON_MAX_CHARS = 1024;
+function browserLogContextOfWorkerContext(context) {
+  const out = {};
+  if (context?.runId) out.runId = context.runId;
+  if (context?.primitiveId) out.primitiveId = context.primitiveId;
+  if (context?.primitiveName) out.primitiveName = context.primitiveName;
+  if (context?.channel) out.channel = context.channel;
+  return out;
+}
+__name(browserLogContextOfWorkerContext, "browserLogContextOfWorkerContext");
+__name4(browserLogContextOfWorkerContext, "browserLogContextOfWorkerContext");
+function browserLogEventOfWorkerEvent(event, mapping = {}) {
+  const base = {
+    sessionId: mapping.sessionId ?? event.sessionId,
+    engine: "agent-browser",
+    at: event.at
+  };
+  switch (event.event) {
+    case "session.opened":
+      return {
+        ...base,
+        event: "session.opened",
+        reason: mapping.reason ?? "stepwise-cloud",
+        limits: {
+          ...event.limits
+        }
+      };
+    case "session.closed":
+      return {
+        ...base,
+        event: "session.closed",
+        reason: event.reason,
+        durationMs: event.durationMs,
+        pagesVisited: event.pagesVisited,
+        bytes: event.bytes
+      };
+    case "command":
+      return {
+        ...base,
+        event: "command",
+        name: event.name,
+        ok: event.ok,
+        durationMs: event.durationMs,
+        resultBytes: event.resultBytes,
+        urlAfter: event.urlAfter,
+        title: event.title,
+        errorCode: event.errorCode,
+        errorMessage: event.errorMessage
+      };
+    case "navigation":
+      if (!event.ok) return void 0;
+      return {
+        ...base,
+        event: "navigation",
+        url: event.url,
+        finalUrl: event.finalUrl
+      };
+    case "blocked":
+      return {
+        ...base,
+        event: "blocked",
+        kind: event.kind,
+        rule: event.rule,
+        target: event.target,
+        command: event.command,
+        reason: event.detail ? event.detail.slice(0, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS) : void 0
+      };
+    case "wall":
+      return {
+        ...base,
+        event: "wall",
+        kind: event.kind,
+        url: event.url,
+        nextAction: event.nextAction
+      };
+  }
+}
+__name(browserLogEventOfWorkerEvent, "browserLogEventOfWorkerEvent");
+__name4(browserLogEventOfWorkerEvent, "browserLogEventOfWorkerEvent");
 var WORKFLOW_RETRY_BACKOFFS = [
   "fixed",
   "exponential"
@@ -7376,114 +8259,6 @@ function buildPersonalSpaceStartingPersona(agentName) {
 }
 __name(buildPersonalSpaceStartingPersona, "buildPersonalSpaceStartingPersona");
 __name4(buildPersonalSpaceStartingPersona, "buildPersonalSpaceStartingPersona");
-var AGENT_LOG_SOURCES = [
-  "skill",
-  "job",
-  "webhook",
-  "web-route",
-  "trigger",
-  "preprocessor",
-  "postprocessor",
-  "user_message",
-  "agent_response",
-  "agent_error",
-  "runtime",
-  "mcp",
-  "rag",
-  "device",
-  "device-trigger",
-  "model-resolver",
-  "workflow-step",
-  "workflow-script",
-  "workflow",
-  "supervision",
-  "decisions"
-];
-var AGENT_LOG_FIELDS_MAX_WIRE_KEYS = LOG_FIELDS_MAX_KEYS + 1;
-function utf8Bytes(value3) {
-  let bytes = 0;
-  for (let i = 0; i < value3.length; ) {
-    const code = value3.charCodeAt(i);
-    if (code < 128) {
-      bytes += 1;
-      i += 1;
-    } else if (code < 2048) {
-      bytes += 2;
-      i += 1;
-    } else if (code >= 55296 && code <= 56319) {
-      const next = value3.charCodeAt(i + 1);
-      if (next >= 56320 && next <= 57343) {
-        bytes += 4;
-        i += 2;
-      } else {
-        bytes += 3;
-        i += 1;
-      }
-    } else {
-      bytes += 3;
-      i += 1;
-    }
-  }
-  return bytes;
-}
-__name(utf8Bytes, "utf8Bytes");
-__name4(utf8Bytes, "utf8Bytes");
-function isPlainFieldKey(key) {
-  if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
-  if (key === LOG_FIELDS_CLAMPED_KEY) return false;
-  return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
-}
-__name(isPlainFieldKey, "isPlainFieldKey");
-__name4(isPlainFieldKey, "isPlainFieldKey");
-function describeAgentLogFieldsViolation(value3) {
-  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) {
-    return "fields must be an object";
-  }
-  const entries = Object.entries(value3);
-  let userKeys = 0;
-  for (const [key, entry] of entries) {
-    if (key === LOG_FIELDS_CLAMPED_KEY) {
-      if (entry !== true) return `fields.${key} must be true`;
-      continue;
-    }
-    userKeys += 1;
-    if (key.endsWith(LOG_FIELD_ARRAY_COUNT_SUFFIX)) {
-      const base = key.slice(0, -LOG_FIELD_ARRAY_COUNT_SUFFIX.length);
-      if (!isPlainFieldKey(base)) return `fields key \`${key}\` is not a legal field key`;
-      if (typeof entry !== "number" || !Number.isFinite(entry)) {
-        return `fields.${key} must be a finite number`;
-      }
-      continue;
-    }
-    if (!isPlainFieldKey(key)) return `fields key \`${key}\` is not a legal field key`;
-    if (typeof entry === "string") {
-      if (utf8Bytes(entry) > LOG_FIELD_MAX_VALUE_BYTES) {
-        return `fields.${key} exceeds ${LOG_FIELD_MAX_VALUE_BYTES} bytes`;
-      }
-      continue;
-    }
-    if (typeof entry === "boolean") continue;
-    if (typeof entry === "number") {
-      if (!Number.isFinite(entry)) return `fields.${key} must be a finite number`;
-      continue;
-    }
-    return `fields.${key} must be a string, number or boolean`;
-  }
-  if (userKeys > LOG_FIELDS_MAX_KEYS) {
-    return `fields has ${userKeys} keys, over the cap of ${LOG_FIELDS_MAX_KEYS}`;
-  }
-  if (utf8Bytes(JSON.stringify(value3)) > LOG_FIELDS_MAX_BYTES) {
-    return `fields exceeds ${LOG_FIELDS_MAX_BYTES} bytes`;
-  }
-  return void 0;
-}
-__name(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
-__name4(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
-function isAgentLogFields(value3) {
-  return describeAgentLogFieldsViolation(value3) === void 0;
-}
-__name(isAgentLogFields, "isAgentLogFields");
-__name4(isAgentLogFields, "isAgentLogFields");
 var LOG_DRAIN_TYPES_PHASE1 = [
   "http",
   "otlp",
@@ -8271,13 +9046,13 @@ __name4(parseLogTimeBound, "parseLogTimeBound");
 var CORE_DRAINING_CODE = "CORE_DRAINING";
 var CORE_DRAINING_DEFAULT_RETRY_MS = 1e3;
 var CORE_DRAINING_MAX_RETRY_MS = 5e3;
-function isRecord(value3) {
+function isRecord2(value3) {
   return typeof value3 === "object" && value3 !== null;
 }
-__name(isRecord, "isRecord");
-__name4(isRecord, "isRecord");
+__name(isRecord2, "isRecord2");
+__name4(isRecord2, "isRecord");
 function isCoreDrainingErrorResponse(value3) {
-  if (!isRecord(value3) || !isRecord(value3.error)) return false;
+  if (!isRecord2(value3) || !isRecord2(value3.error)) return false;
   return value3.error.code === CORE_DRAINING_CODE && typeof value3.error.message === "string" && value3.error.retryable === true;
 }
 __name(isCoreDrainingErrorResponse, "isCoreDrainingErrorResponse");
@@ -8360,7 +9135,7 @@ var PluginClassSchema = z2.enum([
 var ModelDescriptorSchema = z2.string().min(1).max(200);
 var InferenceModelSchema = z2.object({
   kind: z2.literal("inference"),
-  /** Provider-prefixed model id (e.g. `'openai/gpt-5.2-chat-latest'`). */
+  /** Provider-prefixed model id (e.g. `'openai/chat-latest'`). */
   model: ModelDescriptorSchema,
   /**
   * TTS-only — provider voice id. Inference's TTS API takes voice
@@ -10960,11 +11735,11 @@ function confidenceOf(n2) {
 }
 __name(confidenceOf, "confidenceOf");
 __name4(confidenceOf, "confidenceOf");
-function rateOf(count, conversations) {
+function rateOf(count2, conversations) {
   return {
-    count,
-    rate: conversations > 0 ? count / conversations : null,
-    confidence: confidenceOf(count)
+    count: count2,
+    rate: conversations > 0 ? count2 / conversations : null,
+    confidence: confidenceOf(count2)
   };
 }
 __name(rateOf, "rateOf");
@@ -15148,11 +15923,11 @@ function isConditionalJoinId(stepId) {
 }
 __name(isConditionalJoinId, "isConditionalJoinId");
 __name5(isConditionalJoinId, "isConditionalJoinId");
-function isPlainObject2(v) {
+function isPlainObject3(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-__name(isPlainObject2, "isPlainObject");
-__name5(isPlainObject2, "isPlainObject");
+__name(isPlainObject3, "isPlainObject");
+__name5(isPlainObject3, "isPlainObject");
 function leafValue(row) {
   if (row.status === "completed") return row.output === void 0 ? null : row.output;
   return continuedFailureValue(row.error, row.killReason);
@@ -15175,7 +15950,7 @@ function deriveRunOutput(steps) {
   if (leaves.length === 1) {
     const leaf = leaves[0];
     const value22 = leafValue(leaf);
-    if (isConditionalJoinId(leaf.stepId) && isPlainObject2(value22)) {
+    if (isConditionalJoinId(leaf.stepId) && isPlainObject3(value22)) {
       const keys = Object.keys(value22);
       if (keys.length === 1) return {
         output: value22[keys[0]],
@@ -16802,9 +17577,9 @@ function estimateGraph(envelopeOrGraph) {
 }
 __name(estimateGraph, "estimateGraph");
 __name5(estimateGraph, "estimateGraph");
-var isRecord2 = /* @__PURE__ */ __name5((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
+var isRecord3 = /* @__PURE__ */ __name5((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
 function* singleStepsOf(entry) {
-  if (!isRecord2(entry)) return;
+  if (!isRecord3(entry)) return;
   switch (entry.type) {
     case "step":
     case "agent":
@@ -16830,8 +17605,8 @@ function* singleStepsOf(entry) {
 __name(singleStepsOf, "singleStepsOf");
 __name5(singleStepsOf, "singleStepsOf");
 function entriesOf(graph) {
-  const definition = isRecord2(graph) ? graph.definition : void 0;
-  const entries = isRecord2(definition) ? definition.graph : void 0;
+  const definition = isRecord3(graph) ? graph.definition : void 0;
+  const entries = isRecord3(definition) ? definition.graph : void 0;
   return Array.isArray(entries) ? entries : [];
 }
 __name(entriesOf, "entriesOf");
@@ -16852,7 +17627,7 @@ function inheritTargets(graphs) {
 __name(inheritTargets, "inheritTargets");
 __name5(inheritTargets, "inheritTargets");
 function needsInheritedWorkspace(graph) {
-  if (!isRecord2(graph) || graph.workspace !== void 0) return false;
+  if (!isRecord3(graph) || graph.workspace !== void 0) return false;
   for (const entry of entriesOf(graph)) {
     for (const node of singleStepsOf(entry)) {
       if (node.workspace !== void 0 && node.workspace !== "inherit") return true;
@@ -17876,6 +18651,10 @@ function createWorkflow(cfg) {
     const n2 = cfg.backfillOnEnable.maxOccurrences;
     if (!Number.isInteger(n2) || n2 < 1 || n2 > 200) throw new LuaWorkflowBuildError("invalid-envelope", "backfillOnEnable.maxOccurrences must be an integer in 1..200 (backfill-max-occurrences-out-of-range; the org maxBatchItems twin is checked at publish/R56)");
   }
+  if (cfg.concurrencyKey !== void 0) {
+    if (cfg.concurrencyKey !== "correlationKey") throw new LuaWorkflowBuildError("invalid-envelope", "concurrencyKey must be 'correlationKey'");
+    if (cfg.concurrencyPolicy !== "forbid") throw new LuaWorkflowBuildError("concurrency-key-requires-forbid", `workflow "${cfg.name}": concurrencyKey requires concurrencyPolicy:'forbid'`, "set concurrencyPolicy:'forbid' or remove concurrencyKey");
+  }
   if (cfg.health !== void 0) {
     const issues = validateScheduleHealth(cfg.health, {
       target: "workflow",