lua-cli 3.48.0 → 3.49.1

package/dist/api-exports.js

@@ -943,6 +943,24 @@ function aiGenerateInputFromSimplified(prompt, content) {
     ]
   };
 }
+function formatDecisionSandboxPrimitive(name, tool) {
+  return tool ? `${name}${DECISION_SANDBOX_TOOL_SEPARATOR}${tool}` : name;
+}
+function parseDecisionSandboxPrimitive(value3) {
+  const at = value3.indexOf(DECISION_SANDBOX_TOOL_SEPARATOR);
+  const name = at < 0 ? value3 : value3.slice(0, at);
+  const tool = at < 0 ? "" : value3.slice(at + DECISION_SANDBOX_TOOL_SEPARATOR.length);
+  if (name.length === 0) return void 0;
+  return tool.length > 0 ? {
+    name,
+    tool
+  } : {
+    name
+  };
+}
+function decisionPublishStampKey(agentId2) {
+  return `decisions:stamp:${agentId2}`;
+}
 function isIntegrationPassthroughReadMethod(method) {
   return typeof method === "string" && INTEGRATION_PASSTHROUGH_READ_METHODS.includes(method.toUpperCase());
 }
@@ -993,6 +1011,79 @@ function isPlatformInvocationCaller(v) {
 function supervisionSubjectId(agentId2) {
   return `agent:${agentId2}`;
 }
+function isModelCallCategory(category) {
+  return category.startsWith("llm:") || category.startsWith("voice:") || category === "embedding" || category === "workflow:job" || category === "decision:ask" || category.startsWith("tool:image-");
+}
+function deriveUsageSurface(row) {
+  const { category, channel } = row;
+  const data = row.data;
+  if (!isModelCallCategory(category)) return void 0;
+  if (category === "workflow:job") return "workflow-job";
+  if (category === "llm:sandbox") return "tool-code";
+  if (category === "llm:builder") return "builder";
+  if (category === "llm:website") return "website";
+  if (category.startsWith("voice:") || category === "llm:voice") return "voice";
+  if (category.startsWith("llm:tool:") || AGENT_TOOL_CATEGORIES.has(category)) return "agent-tool";
+  if (!TURN_CATEGORIES.has(category)) return "background";
+  if (channel === "workflow") return "workflow-step";
+  if (data?.gateway === "livekit-inference") return "voice";
+  if (channel === "dev") return "dev";
+  if (channel && VOICE_CHANNELS.has(channel)) return "voice";
+  if (channel && MESSAGING_CHANNELS.has(channel)) return "channel";
+  return "chat";
+}
+function fromRaw(raw, id2, model) {
+  const fiveMin = count(raw.cache_creation?.ephemeral_5m_input_tokens);
+  const oneHour = count(raw.cache_creation?.ephemeral_1h_input_tokens);
+  const split = !!(fiveMin || oneHour);
+  const flatWrite = count(raw.cache_creation_input_tokens);
+  const read = count(raw.cache_read_input_tokens);
+  return {
+    ...typeof id2 === "string" && id2 ? {
+      id: id2
+    } : {},
+    ...typeof model === "string" && model ? {
+      model
+    } : {},
+    inputTokens: count(raw.input_tokens) ?? 0,
+    outputTokens: count(raw.output_tokens) ?? 0,
+    ...read ? {
+      cacheReadTokens: read
+    } : {},
+    ...split ? {
+      ...fiveMin ? {
+        cacheCreationTokens5m: fiveMin
+      } : {},
+      ...oneHour ? {
+        cacheCreationTokens1h: oneHour
+      } : {}
+    } : flatWrite ? {
+      cacheCreationTokens: flatWrite
+    } : {},
+    ...typeof raw.service_tier === "string" && raw.service_tier && raw.service_tier !== "standard" ? {
+      serviceTier: raw.service_tier
+    } : {}
+  };
+}
+function anthropicMessageUsage(message) {
+  if (!message || typeof message !== "object") return void 0;
+  const m = message;
+  if (!m.usage || typeof m.usage !== "object") return void 0;
+  return fromRaw(m.usage, m.id, m.model);
+}
+function parseAnthropicReplyUsage(body) {
+  const start = body.trimStart();
+  if (start.startsWith("{")) {
+    try {
+      return anthropicMessageUsage(JSON.parse(start));
+    } catch {
+      return void 0;
+    }
+  }
+  const reader = new AnthropicSseUsageReader();
+  reader.push(body);
+  return reader.result();
+}
 function isSupervisionOp(op) {
   return typeof op === "string" && Object.prototype.hasOwnProperty.call(SUPERVISION_OPS, op);
 }
@@ -2164,24 +2255,24 @@ function addresses(text2) {
 function recordFacts(value3) {
   const senders = [];
   const labels = [];
-  let isRecord22 = false;
+  let isRecord32 = false;
   if (isPlainObject(value3.author_member)) {
-    isRecord22 = true;
+    isRecord32 = true;
     const email = lower(value3.author_member.email);
     if (email) senders.push(email);
     const userId = lower(value3.author_member.user_id);
     if (userId) senders.push(userId);
   }
   if (typeof value3.channel_id === "string") {
-    isRecord22 = true;
+    isRecord32 = true;
     labels.push(...idOrName(value3.channel_id));
   }
   if (Array.isArray(value3.channel_ids)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const id2 of value3.channel_ids) labels.push(...idOrName(id2));
   }
   if (Array.isArray(value3.channels) && (value3.author_member || value3.message !== void 0)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const channel of value3.channels) labels.push(...idOrName(channel));
   }
   for (const key of [
@@ -2190,11 +2281,11 @@ function recordFacts(value3) {
   ]) {
     const field = value3[key];
     if (isPlainObject(field) && isPlainObject(field.emailAddress)) {
-      isRecord22 = true;
+      isRecord32 = true;
       const address = lower(field.emailAddress.address);
       if (address) senders.push(address);
     } else if (key === "from" && typeof field === "string" && field.includes("@")) {
-      isRecord22 = true;
+      isRecord32 = true;
       senders.push(...addresses(field));
     }
   }
@@ -2202,12 +2293,12 @@ function recordFacts(value3) {
     const organizer = value3.organizer;
     const address = isPlainObject(organizer.emailAddress) ? lower(organizer.emailAddress.address) : lower(organizer.email);
     if (address) {
-      isRecord22 = true;
+      isRecord32 = true;
       senders.push(address);
     }
   }
   if (Array.isArray(value3.categories)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const category of value3.categories) labels.push(...idOrName(category));
   }
   if (isPlainObject(value3.from)) {
@@ -2218,13 +2309,13 @@ function recordFacts(value3) {
     ]) {
       const identity = value3.from[key];
       if (!isPlainObject(identity)) continue;
-      isRecord22 = true;
+      isRecord32 = true;
       const id2 = lower(identity.id);
       if (id2) senders.push(id2);
     }
   }
   if (isPlainObject(value3.channelIdentity)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const key of [
       "channelId",
       "teamId"
@@ -2234,21 +2325,21 @@ function recordFacts(value3) {
     }
   }
   if (typeof value3.chatId === "string") {
-    isRecord22 = true;
+    isRecord32 = true;
     labels.push(...idOrName(value3.chatId));
   }
   if (typeof value3.parentFolderId === "string") {
-    isRecord22 = true;
+    isRecord32 = true;
     labels.push(...idOrName(value3.parentFolderId));
   }
   let gmailSenderUnknown = false;
   const gmailMessage = typeof value3.threadId === "string" && (Array.isArray(value3.labelIds) || "payload" in value3 || "raw" in value3) || isPlainObject(value3.payload) && Array.isArray(value3.payload.headers);
   if (Array.isArray(value3.labelIds)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const id2 of value3.labelIds) labels.push(...idOrName(id2));
   }
   if (gmailMessage) {
-    isRecord22 = true;
+    isRecord32 = true;
     const headers = isPlainObject(value3.payload) && Array.isArray(value3.payload.headers) ? value3.payload.headers : [];
     const from = headers.find((header) => isPlainObject(header) && lower(header.name) === "from");
     const fromAddresses = addresses(from?.value);
@@ -2256,11 +2347,11 @@ function recordFacts(value3) {
     else gmailSenderUnknown = true;
   }
   if (Array.isArray(value3.labels)) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const label of value3.labels) labels.push(...idOrName(label));
   }
   if (typeof value3.ts === "string" && (typeof value3.user === "string" || typeof value3.bot_id === "string")) {
-    isRecord22 = true;
+    isRecord32 = true;
     for (const id2 of [
       value3.user,
       value3.bot_id,
@@ -2276,7 +2367,7 @@ function recordFacts(value3) {
     labels.push(...idOrName(value3.channel));
   }
   return {
-    isRecord: isRecord22,
+    isRecord: isRecord32,
     senders,
     labels,
     gmailSenderUnknown
@@ -3764,13 +3855,13 @@ function channelSettingsGroups(channel, config) {
   const groups = [];
   for (const def of channelSettingDefinitions(channel, config)) {
     const { tunableDefault: _tunable, ...shown } = def;
-    const unavailable2 = channelSettingUnavailable(channel, def);
+    const unavailable3 = channelSettingUnavailable(channel, def);
     const view = {
       ...shown,
       ...effectiveChannelSetting(channel, def),
       resettable: channelSettingResettable(def),
-      ...unavailable2 && {
-        unavailable: unavailable2
+      ...unavailable3 && {
+        unavailable: unavailable3
       }
     };
     const group = groups.find((candidate) => candidate.key === def.group);
@@ -4164,6 +4255,36 @@ function mutationWithoutWorkItems(mutation) {
     } : {}
   };
 }
+function isServerTriggeredBrowserSource(logSource) {
+  return SERVER_TRIGGERED_BROWSER_SOURCES.includes(logSource);
+}
+function resolveBrowserFallback(raw) {
+  return BROWSER_FALLBACKS.includes(raw) ? raw : DEFAULT_BROWSER_FALLBACK;
+}
+function resolveBrowserProxyCountry(raw) {
+  if (typeof raw !== "string") return void 0;
+  const code = raw.trim().toLowerCase();
+  return PROXY_COUNTRY_CODE.test(code) ? code : void 0;
+}
+function resolveBrowserLogOptions(raw) {
+  const logContent = BROWSER_LOG_CONTENT_MODES.includes(raw.logContent) ? raw.logContent : DEFAULT_BROWSER_LOG_CONTENT;
+  const screenshots = BROWSER_SCREENSHOT_POLICIES.includes(raw.screenshots) ? raw.screenshots : DEFAULT_BROWSER_SCREENSHOT_POLICY;
+  return {
+    logContent,
+    screenshots
+  };
+}
+function browserProfileNotFoundMessage(name) {
+  return `No browser named '${name}' is attached to this agent. Add it to the agent's \`browsers\` list and push again.`;
+}
+function resolveBrowserLimits(pick) {
+  const limits = {};
+  for (const key of BROWSER_LIMIT_KEYS) {
+    const value3 = pick(key);
+    if (typeof value3 === "number" && Number.isInteger(value3) && value3 > 0) limits[key] = value3;
+  }
+  return limits;
+}
 function utf8WidthAt(value3, index) {
   const code = value3.charCodeAt(index);
   if (code < 128) return {
@@ -4319,6 +4440,338 @@ function isDesktopFileCommandName(value3) {
 function isDesktopFileSessionId(value3) {
   return typeof value3 === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value3);
 }
+function browserError(code, message, status) {
+  return Object.assign(new Error(message), {
+    name: BROWSER_ERROR_NAME,
+    code,
+    ...typeof status === "number" ? {
+      status
+    } : {}
+  });
+}
+function isRecord(value3) {
+  return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+}
+function optionalString(raw, field) {
+  const value3 = raw[field];
+  if (value3 === void 0 || value3 === null || value3 === "") return void 0;
+  if (typeof value3 !== "string") throw new TypeError(`${field} must be a string`);
+  if (value3.startsWith("-")) throw new TypeError(`${field} may not start with '-'`);
+  if (value3.includes("\0")) throw new TypeError(`${field} may not contain NUL`);
+  return value3;
+}
+function readUrl(value3) {
+  if (typeof value3 !== "string" || !/^https?:\/\//i.test(value3.trim()) || value3.includes("\0")) {
+    throw new TypeError("url must be an absolute http(s) URL");
+  }
+  return value3.trim();
+}
+function readFormat(value3) {
+  if (value3 === void 0 || value3 === null || value3 === "") return "text";
+  if (!BROWSER_READ_FORMATS.includes(value3)) {
+    throw new TypeError(`format must be one of: ${BROWSER_READ_FORMATS.join(", ")}`);
+  }
+  return value3;
+}
+function readTimeout(value3) {
+  if (value3 === void 0 || value3 === null) return BROWSER_READ_DEFAULT_TIMEOUT_MS;
+  if (typeof value3 !== "number" || !Number.isFinite(value3)) throw new TypeError("timeoutMs must be a number");
+  return Math.min(BROWSER_READ_MAX_TIMEOUT_MS, Math.max(BROWSER_READ_MIN_TIMEOUT_MS, Math.round(value3)));
+}
+function parseBrowserReadPayload(raw) {
+  try {
+    const input = isRecord(raw) ? raw : {};
+    const waitFor = optionalString(input, "waitFor");
+    return {
+      payload: {
+        url: readUrl(input.url),
+        ...waitFor ? {
+          waitFor
+        } : {},
+        selector: optionalString(input, "selector") ?? BROWSER_READ_DEFAULT_SELECTOR,
+        format: readFormat(input.format),
+        timeoutMs: readTimeout(input.timeoutMs)
+      }
+    };
+  } catch (error) {
+    return {
+      error: {
+        code: "invalid_argument",
+        message: `read: ${error.message}`
+      }
+    };
+  }
+}
+function clampBrowserReadContent(content, maxChars = BROWSER_READ_MAX_CONTENT_CHARS) {
+  if (content.length <= maxChars) return {
+    content,
+    truncated: false
+  };
+  return {
+    content: content.slice(0, maxChars),
+    truncated: true
+  };
+}
+function joinBrowserReadMatches(parts, maxChars = BROWSER_READ_MAX_CONTENT_CHARS) {
+  const kept = parts.map((part) => part.trim()).filter((part) => part.length > 0);
+  return clampBrowserReadContent(kept.join(BROWSER_READ_MATCH_SEPARATOR), maxChars);
+}
+function isBrowserReadHttpFailure(message) {
+  return HTTP_STATUS_FAILURE.test(message ?? "");
+}
+function browserReadHttpErrorMessage(url, status) {
+  const answered = status === void 0 ? "an HTTP error status" : `HTTP ${status}`;
+  return `read: ${url} answered ${answered} with no page to read`;
+}
+function urlOf(value3) {
+  if (!value3) return void 0;
+  try {
+    return new URL(value3);
+  } catch {
+    return void 0;
+  }
+}
+function answeredDocuments(requests) {
+  if (!Array.isArray(requests)) return [];
+  const answered = [];
+  for (const entry of requests) {
+    if (!isRecord(entry) || typeof entry.status !== "number" || typeof entry.url !== "string") continue;
+    const url = urlOf(entry.url);
+    if (url) answered.unshift({
+      url,
+      status: entry.status
+    });
+  }
+  return answered;
+}
+function documentStatusOf(requests, requestedUrl, finalUrl) {
+  const latestFirst = answeredDocuments(requests);
+  const final = urlOf(finalUrl);
+  const requested = urlOf(requestedUrl);
+  const match = latestFirst.find((doc) => doc.url.href === final?.href) ?? latestFirst.find((doc) => doc.url.href === requested?.href) ?? latestFirst.find((doc) => doc.url.host === final?.host);
+  return match?.status;
+}
+function isLoginUrl(url) {
+  const segments = url.pathname.toLowerCase().split("/");
+  return segments.some((segment) => LOGIN_PATH_SEGMENTS.has(segment)) || LOGIN_HOST_LABELS.has(url.hostname.split(".")[0]);
+}
+function isLoginRedirect(requestedUrl, finalUrl) {
+  const requested = urlOf(requestedUrl);
+  const final = urlOf(finalUrl);
+  return Boolean(requested && final && !isLoginUrl(requested) && isLoginUrl(final));
+}
+function browserReadLoginBlock() {
+  return {
+    blocked: true,
+    blocker: BROWSER_READ_LOGIN_BLOCKER,
+    blockerKind: "login",
+    blockerGuidance: "This URL redirected to a sign-in page, so the content is the sign-in form, not the page you asked for. The page needs a signed-in session: read it on the desktop browser where the user is signed in, or use a public URL."
+  };
+}
+function utf8Bytes(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const code = value3.charCodeAt(i);
+    if (code < 128) {
+      bytes += 1;
+      i += 1;
+    } else if (code < 2048) {
+      bytes += 2;
+      i += 1;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value3.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        i += 2;
+      } else {
+        bytes += 3;
+        i += 1;
+      }
+    } else {
+      bytes += 3;
+      i += 1;
+    }
+  }
+  return bytes;
+}
+function isPlainFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
+  if (key === LOG_FIELDS_CLAMPED_KEY) return false;
+  return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+function describeAgentLogFieldsViolation(value3) {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) {
+    return "fields must be an object";
+  }
+  const entries = Object.entries(value3);
+  let userKeys = 0;
+  for (const [key, entry] of entries) {
+    if (key === LOG_FIELDS_CLAMPED_KEY) {
+      if (entry !== true) return `fields.${key} must be true`;
+      continue;
+    }
+    userKeys += 1;
+    if (key.endsWith(LOG_FIELD_ARRAY_COUNT_SUFFIX)) {
+      const base = key.slice(0, -LOG_FIELD_ARRAY_COUNT_SUFFIX.length);
+      if (!isPlainFieldKey(base)) return `fields key \`${key}\` is not a legal field key`;
+      if (typeof entry !== "number" || !Number.isFinite(entry)) {
+        return `fields.${key} must be a finite number`;
+      }
+      continue;
+    }
+    if (!isPlainFieldKey(key)) return `fields key \`${key}\` is not a legal field key`;
+    if (typeof entry === "string") {
+      if (utf8Bytes(entry) > LOG_FIELD_MAX_VALUE_BYTES) {
+        return `fields.${key} exceeds ${LOG_FIELD_MAX_VALUE_BYTES} bytes`;
+      }
+      continue;
+    }
+    if (typeof entry === "boolean") continue;
+    if (typeof entry === "number") {
+      if (!Number.isFinite(entry)) return `fields.${key} must be a finite number`;
+      continue;
+    }
+    return `fields.${key} must be a string, number or boolean`;
+  }
+  if (userKeys > LOG_FIELDS_MAX_KEYS) {
+    return `fields has ${userKeys} keys, over the cap of ${LOG_FIELDS_MAX_KEYS}`;
+  }
+  if (utf8Bytes(JSON.stringify(value3)) > LOG_FIELDS_MAX_BYTES) {
+    return `fields exceeds ${LOG_FIELDS_MAX_BYTES} bytes`;
+  }
+  return void 0;
+}
+function isAgentLogFields(value3) {
+  return describeAgentLogFieldsViolation(value3) === void 0;
+}
+function describeBaseViolation(event) {
+  if (!BROWSER_LOG_EVENT_KINDS.includes(event.event)) return "event is not a known kind";
+  if (typeof event.sessionId !== "string" || event.sessionId.length === 0) return "sessionId must be a string";
+  if (event.sessionId.length > BROWSER_LOG_ID_MAX_CHARS) return "sessionId is too long";
+  if (!BROWSER_LOG_ENGINES.includes(event.engine)) return "engine is not a known engine";
+  if (typeof event.at !== "string" || Number.isNaN(Date.parse(event.at))) return "at must be an ISO timestamp";
+  return void 0;
+}
+function describeFieldViolation(key, value3, check) {
+  if (!check) return `${key} is not a field of this event`;
+  if (!check(value3)) return `${key} has the wrong type`;
+  if (typeof value3 === "string" && value3.length > BROWSER_LOG_TEXT_MAX_CHARS) return `${key} is too long`;
+  return void 0;
+}
+function describeBrowserLogEventViolation(value3) {
+  if (!isPlainObject2(value3)) return "event must be an object";
+  const event = value3;
+  const base = describeBaseViolation(event);
+  if (base) return base;
+  const shape = EVENT_SHAPES[event.event];
+  for (const key of Object.keys(shape.required)) {
+    if (event[key] === void 0) return `${key} is required`;
+  }
+  for (const [key, entry] of Object.entries(event)) {
+    if (BASE_KEYS.has(key) || entry === void 0) continue;
+    const violation = describeFieldViolation(key, entry, shape.required[key] ?? shape.optional[key]);
+    if (violation) return violation;
+  }
+  return void 0;
+}
+function isBrowserLogEvent(value3) {
+  return describeBrowserLogEventViolation(value3) === void 0;
+}
+function describeBrowserLogContextViolation(value3) {
+  if (value3 === void 0) return void 0;
+  if (!isPlainObject2(value3)) return "logContext must be an object";
+  for (const [key, entry] of Object.entries(value3)) {
+    if (!BROWSER_LOG_CONTEXT_KEYS.includes(key)) return `logContext.${key} is not allowed`;
+    if (entry === void 0) continue;
+    if (typeof entry !== "string") return `logContext.${key} must be a string`;
+    if (entry.length > BROWSER_LOG_ID_MAX_CHARS) return `logContext.${key} is too long`;
+    if (key === "environment" && !AGENT_LOG_ENVIRONMENTS.includes(entry)) {
+      return "logContext.environment is not a known environment";
+    }
+  }
+  return void 0;
+}
+function browserWorkerSessionId(ref) {
+  return [
+    ref.agentId,
+    ref.userId,
+    ref.sessionKey
+  ].join(BROWSER_WORKER_SESSION_ID_SEPARATOR);
+}
+function browserLogContextOfWorkerContext(context) {
+  const out = {};
+  if (context?.runId) out.runId = context.runId;
+  if (context?.primitiveId) out.primitiveId = context.primitiveId;
+  if (context?.primitiveName) out.primitiveName = context.primitiveName;
+  if (context?.channel) out.channel = context.channel;
+  return out;
+}
+function browserLogEventOfWorkerEvent(event, mapping = {}) {
+  const base = {
+    sessionId: mapping.sessionId ?? event.sessionId,
+    engine: "agent-browser",
+    at: event.at
+  };
+  switch (event.event) {
+    case "session.opened":
+      return {
+        ...base,
+        event: "session.opened",
+        reason: mapping.reason ?? "stepwise-cloud",
+        limits: {
+          ...event.limits
+        }
+      };
+    case "session.closed":
+      return {
+        ...base,
+        event: "session.closed",
+        reason: event.reason,
+        durationMs: event.durationMs,
+        pagesVisited: event.pagesVisited,
+        bytes: event.bytes
+      };
+    case "command":
+      return {
+        ...base,
+        event: "command",
+        name: event.name,
+        ok: event.ok,
+        durationMs: event.durationMs,
+        resultBytes: event.resultBytes,
+        urlAfter: event.urlAfter,
+        title: event.title,
+        errorCode: event.errorCode,
+        errorMessage: event.errorMessage
+      };
+    case "navigation":
+      if (!event.ok) return void 0;
+      return {
+        ...base,
+        event: "navigation",
+        url: event.url,
+        finalUrl: event.finalUrl
+      };
+    case "blocked":
+      return {
+        ...base,
+        event: "blocked",
+        kind: event.kind,
+        rule: event.rule,
+        target: event.target,
+        command: event.command,
+        reason: event.detail ? event.detail.slice(0, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS) : void 0
+      };
+    case "wall":
+      return {
+        ...base,
+        event: "wall",
+        kind: event.kind,
+        url: event.url,
+        nextAction: event.nextAction
+      };
+  }
+}
 function workflowRetryMaxAttemptsMessage(got) {
   const tail = got === void 0 ? "" : ` (got ${JSON.stringify(got)})`;
   return `\`retry.maxAttempts\` must be an integer ${WORKFLOW_RETRY_MIN_ATTEMPTS}..${WORKFLOW_RETRY_MAX_ATTEMPTS}${tail}`;
@@ -4532,98 +4985,22 @@ function buildDefaultPersona(agentName) {
 function buildPersonalSpaceStartingPersona(agentName) {
   return PERSONAL_SPACE_STARTING_PERSONA.replace(new RegExp(AGENT_NAME_TOKEN.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), () => agentName || "Your assistant");
 }
-function utf8Bytes(value3) {
-  let bytes = 0;
-  for (let i = 0; i < value3.length; ) {
-    const code = value3.charCodeAt(i);
-    if (code < 128) {
-      bytes += 1;
-      i += 1;
-    } else if (code < 2048) {
-      bytes += 2;
-      i += 1;
-    } else if (code >= 55296 && code <= 56319) {
-      const next = value3.charCodeAt(i + 1);
-      if (next >= 56320 && next <= 57343) {
-        bytes += 4;
-        i += 2;
-      } else {
-        bytes += 3;
-        i += 1;
-      }
-    } else {
-      bytes += 3;
-      i += 1;
-    }
-  }
-  return bytes;
+function maxDrainsForTier(tier) {
+  return tier === "enterprise" ? LOG_DRAIN_MAX_PER_ORG_ENTERPRISE : LOG_DRAIN_MAX_PER_ORG;
 }
-function isPlainFieldKey(key) {
-  if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
-  if (key === LOG_FIELDS_CLAMPED_KEY) return false;
-  return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
+function resolvePresetEndpoint(type, site) {
+  const template3 = LOG_DRAIN_ENDPOINT_TEMPLATES[type];
+  if (!template3 || !site) return void 0;
+  return template3.replace("{site}", site);
 }
-function describeAgentLogFieldsViolation(value3) {
-  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) {
-    return "fields must be an object";
-  }
-  const entries = Object.entries(value3);
-  let userKeys = 0;
-  for (const [key, entry] of entries) {
-    if (key === LOG_FIELDS_CLAMPED_KEY) {
-      if (entry !== true) return `fields.${key} must be true`;
-      continue;
-    }
-    userKeys += 1;
-    if (key.endsWith(LOG_FIELD_ARRAY_COUNT_SUFFIX)) {
-      const base = key.slice(0, -LOG_FIELD_ARRAY_COUNT_SUFFIX.length);
-      if (!isPlainFieldKey(base)) return `fields key \`${key}\` is not a legal field key`;
-      if (typeof entry !== "number" || !Number.isFinite(entry)) {
-        return `fields.${key} must be a finite number`;
-      }
-      continue;
-    }
-    if (!isPlainFieldKey(key)) return `fields key \`${key}\` is not a legal field key`;
-    if (typeof entry === "string") {
-      if (utf8Bytes(entry) > LOG_FIELD_MAX_VALUE_BYTES) {
-        return `fields.${key} exceeds ${LOG_FIELD_MAX_VALUE_BYTES} bytes`;
-      }
-      continue;
-    }
-    if (typeof entry === "boolean") continue;
-    if (typeof entry === "number") {
-      if (!Number.isFinite(entry)) return `fields.${key} must be a finite number`;
-      continue;
-    }
-    return `fields.${key} must be a string, number or boolean`;
-  }
-  if (userKeys > LOG_FIELDS_MAX_KEYS) {
-    return `fields has ${userKeys} keys, over the cap of ${LOG_FIELDS_MAX_KEYS}`;
-  }
-  if (utf8Bytes(JSON.stringify(value3)) > LOG_FIELDS_MAX_BYTES) {
-    return `fields exceeds ${LOG_FIELDS_MAX_BYTES} bytes`;
-  }
-  return void 0;
-}
-function isAgentLogFields(value3) {
-  return describeAgentLogFieldsViolation(value3) === void 0;
-}
-function maxDrainsForTier(tier) {
-  return tier === "enterprise" ? LOG_DRAIN_MAX_PER_ORG_ENTERPRISE : LOG_DRAIN_MAX_PER_ORG;
-}
-function resolvePresetEndpoint(type, site) {
-  const template3 = LOG_DRAIN_ENDPOINT_TEMPLATES[type];
-  if (!template3 || !site) return void 0;
-  return template3.replace("{site}", site);
-}
-function isLogDrainBucketHostAllowed(provider, host) {
-  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
-  if (!normalized) return false;
-  return (LOG_DRAIN_BUCKET_HOST_PATTERNS[provider] ?? []).some((pattern) => pattern.test(normalized));
-}
-function resolveDrainBucketEndpoint(bucket) {
-  if (!LOG_DRAIN_BUCKET_NAME_PATTERN.test(bucket.bucket)) {
-    throw new Error("log drain bucket name is not a valid S3 bucket label");
+function isLogDrainBucketHostAllowed(provider, host) {
+  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (!normalized) return false;
+  return (LOG_DRAIN_BUCKET_HOST_PATTERNS[provider] ?? []).some((pattern) => pattern.test(normalized));
+}
+function resolveDrainBucketEndpoint(bucket) {
+  if (!LOG_DRAIN_BUCKET_NAME_PATTERN.test(bucket.bucket)) {
+    throw new Error("log drain bucket name is not a valid S3 bucket label");
   }
   if (bucket.provider === "aws") {
     const region = bucket.region.trim().toLowerCase();
@@ -5103,11 +5480,11 @@ function parseLogTimeBound(raw, now = /* @__PURE__ */ new Date()) {
   const at = Date.parse(value3);
   return Number.isNaN(at) ? null : new Date(at);
 }
-function isRecord(value3) {
+function isRecord2(value3) {
   return typeof value3 === "object" && value3 !== null;
 }
 function isCoreDrainingErrorResponse(value3) {
-  if (!isRecord(value3) || !isRecord(value3.error)) return false;
+  if (!isRecord2(value3) || !isRecord2(value3.error)) return false;
   return value3.error.code === CORE_DRAINING_CODE && typeof value3.error.message === "string" && value3.error.retryable === true;
 }
 function coreDrainingRetryDelayMs(retryAfter, nowMs = Date.now()) {
@@ -6304,11 +6681,11 @@ function recentRefs(lists) {
 function confidenceOf(n2) {
   return n2 < EVIDENCE_LOW_CONFIDENCE_N ? "low" : "ok";
 }
-function rateOf(count, conversations) {
+function rateOf(count2, conversations) {
   return {
-    count,
-    rate: conversations > 0 ? count / conversations : null,
-    confidence: confidenceOf(count)
+    count: count2,
+    rate: conversations > 0 ? count2 / conversations : null,
+    confidence: confidenceOf(count2)
   };
 }
 function evidenceDays(from, to) {
@@ -7130,7 +7507,7 @@ function maskMcpServerHeaders(server) {
     headersSet: headerNames.length > 0
   };
 }
-var __defProp4, __name4, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_LIMITS, DECISION_ERROR_CODES, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, CHANNEL_SEND_CHANNELS, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSET_BYTES, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema;
+var __defProp4, __name4, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_SANDBOX_SITE_HEADER, DECISION_SANDBOX_PRIMITIVE_HEADER, DECISION_SANDBOX_TOOL_SEPARATOR, DECISION_LIMITS, DECISION_ERROR_CODES, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, MESSAGING_CHANNELS, VOICE_CHANNELS, TURN_CATEGORIES, AGENT_TOOL_CATEGORIES, count, AnthropicSseUsageReader, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, CHANNEL_SEND_CHANNELS, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, SERVER_TRIGGERED_BROWSER_SOURCES, BROWSER_FALLBACKS, DEFAULT_BROWSER_FALLBACK, PROXY_COUNTRY_CODE, BROWSER_LOG_CONTENT_MODES, DEFAULT_BROWSER_LOG_CONTENT, BROWSER_SCREENSHOT_POLICIES, DEFAULT_BROWSER_SCREENSHOT_POLICY, BROWSER_PROFILE_NAME_PATTERN, BROWSER_LIMIT_KEYS, BROWSER_LIMIT_MAX, BROWSER_EXECUTE_METHOD, BROWSER_GLOBAL_METHODS, BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS, BROWSER_EXECUTE_MAX_TIMEOUT_MS, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, BROWSER_READ_FORMATS, BROWSER_READ_DEFAULT_TIMEOUT_MS, BROWSER_READ_MIN_TIMEOUT_MS, BROWSER_READ_MAX_TIMEOUT_MS, BROWSER_READ_MAX_CONTENT_CHARS, BROWSER_READ_DEFAULT_SELECTOR, BROWSER_READ_MATCH_SEPARATOR, BROWSER_READ_LOGIN_BLOCKER, BROWSER_ERROR_NAME, HTTP_STATUS_FAILURE, LOGIN_PATH_SEGMENTS, LOGIN_HOST_LABELS, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, BROWSER_LOG_EVENT_KINDS, BROWSER_LOG_ENGINES, BROWSER_SESSION_OPEN_REASONS, BROWSER_BLOCK_KINDS, BROWSER_WALL_KINDS, BROWSER_WALL_NEXT_ACTIONS, BROWSER_CONFIRM_DECISIONS, BROWSER_SESSION_CLOSE_REASONS, BROWSER_LOG_CONTEXT_KEYS, BROWSER_LOG_ID_MAX_CHARS, BROWSER_LOG_TEXT_MAX_CHARS, isString, isBoolean, isCount, isPlainObject2, oneOf, isLimits, EVENT_SHAPES, BASE_KEYS, BROWSER_WORKER_SESSION_ID_SEPARATOR, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSET_BYTES, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -7212,6 +7589,15 @@ var init_dist = __esm({
       "score"
     ];
     DECISION_NAME_PATTERN = /^[a-zA-Z0-9_-]{1,64}$/;
+    DECISION_SANDBOX_SITE_HEADER = "x-lua-sandbox-site";
+    DECISION_SANDBOX_PRIMITIVE_HEADER = "x-lua-sandbox-primitive";
+    DECISION_SANDBOX_TOOL_SEPARATOR = "#";
+    __name(formatDecisionSandboxPrimitive, "formatDecisionSandboxPrimitive");
+    __name4(formatDecisionSandboxPrimitive, "formatDecisionSandboxPrimitive");
+    __name(parseDecisionSandboxPrimitive, "parseDecisionSandboxPrimitive");
+    __name4(parseDecisionSandboxPrimitive, "parseDecisionSandboxPrimitive");
+    __name(decisionPublishStampKey, "decisionPublishStampKey");
+    __name4(decisionPublishStampKey, "decisionPublishStampKey");
     DECISION_LIMITS = {
       maxQuestions: 64,
       minOptions: 2,
@@ -7219,6 +7605,7 @@ var init_dist = __esm({
       minLevels: 2,
       maxLevels: 10,
       maxInstructionChars: 4e3,
+      maxQuestionsChars: 1e5,
       maxStateChars: 12e4,
       maxImages: 4,
       maxImageBytes: 5 * 1024 * 1024,
@@ -7236,7 +7623,8 @@ var init_dist = __esm({
       UNAVAILABLE: "decision_unavailable",
       DISABLED: "decision_disabled",
       INSUFFICIENT_CREDITS: "decision_insufficient_credits",
-      NOT_FOUND: "decision_not_found"
+      NOT_FOUND: "decision_not_found",
+      CANCELLED: "decision_cancelled"
     };
     MAX_NAME_CHARS = 64;
     InstructionsSchema = z.string().trim().min(1).max(DECISION_LIMITS.maxInstructionChars);
@@ -7293,7 +7681,14 @@ var init_dist = __esm({
         "none"
       ]).optional()
     });
-    DecisionQuestionsSchema = z.record(NameSchema, DecisionQuestionSchema).refine((questions) => Object.keys(questions).length >= 1 && Object.keys(questions).length <= DECISION_LIMITS.maxQuestions, `a decision needs between 1 and ${DECISION_LIMITS.maxQuestions} questions`);
+    DecisionQuestionsSchema = z.record(NameSchema, DecisionQuestionSchema).refine((questions) => Object.keys(questions).length >= 1 && Object.keys(questions).length <= DECISION_LIMITS.maxQuestions, `a decision needs between 1 and ${DECISION_LIMITS.maxQuestions} questions`).superRefine((questions, ctx) => {
+      const chars = JSON.stringify(questions).length;
+      if (chars <= DECISION_LIMITS.maxQuestionsChars) return;
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `the questions take ${chars} characters as JSON, more than the ${DECISION_LIMITS.maxQuestionsChars} characters a decision may hold`
+      });
+    });
     DecisionDefinitionSchema = DecisionOptionsSchema.extend({
       name: z.string().regex(DECISION_NAME_PATTERN, "a decision name is 1 to 64 letters, digits, underscores or hyphens"),
       description: z.string().max(DECISION_LIMITS.maxInstructionChars).optional(),
@@ -7334,6 +7729,85 @@ var init_dist = __esm({
     __name4(isPlatformInvocationCaller, "isPlatformInvocationCaller");
     __name(supervisionSubjectId, "supervisionSubjectId");
     __name4(supervisionSubjectId, "supervisionSubjectId");
+    MESSAGING_CHANNELS = new Set(CHANNEL_CONVERSATION_CHANNELS);
+    VOICE_CHANNELS = /* @__PURE__ */ new Set([
+      "phone",
+      "meeting",
+      "voice"
+    ]);
+    TURN_CATEGORIES = /* @__PURE__ */ new Set([
+      "llm:inference",
+      "llm:chat-modes",
+      "llm:delegation",
+      "decision:ask"
+    ]);
+    AGENT_TOOL_CATEGORIES = /* @__PURE__ */ new Set([
+      "llm:media:describe",
+      "tool:image-generate",
+      "tool:image-edit"
+    ]);
+    __name(isModelCallCategory, "isModelCallCategory");
+    __name4(isModelCallCategory, "isModelCallCategory");
+    __name(deriveUsageSurface, "deriveUsageSurface");
+    __name4(deriveUsageSurface, "deriveUsageSurface");
+    count = /* @__PURE__ */ __name4((v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.floor(v) : void 0, "count");
+    __name(fromRaw, "fromRaw");
+    __name4(fromRaw, "fromRaw");
+    __name(anthropicMessageUsage, "anthropicMessageUsage");
+    __name4(anthropicMessageUsage, "anthropicMessageUsage");
+    AnthropicSseUsageReader = class {
+      static {
+        __name(this, "AnthropicSseUsageReader");
+      }
+      static {
+        __name4(this, "AnthropicSseUsageReader");
+      }
+      pending = "";
+      raw;
+      id;
+      model;
+      push(chunk) {
+        const text2 = this.pending + chunk;
+        const lines = text2.split("\n");
+        this.pending = lines.pop() ?? "";
+        for (const line of lines) this.line(line);
+      }
+      result() {
+        if (this.pending) {
+          this.line(this.pending);
+          this.pending = "";
+        }
+        return this.raw ? fromRaw(this.raw, this.id, this.model) : void 0;
+      }
+      line(line) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("data:")) return;
+        let event;
+        try {
+          event = JSON.parse(trimmed.slice(5).trim());
+        } catch {
+          return;
+        }
+        if (event.type === "message_start" && event.message) {
+          this.id = event.message.id;
+          this.model = event.message.model;
+          this.raw = {
+            ...event.message.usage ?? {}
+          };
+        } else if (event.type === "message_delta" && event.usage && typeof event.usage === "object") {
+          const delta = event.usage;
+          const merged = {
+            ...this.raw ?? {}
+          };
+          for (const [key, value3] of Object.entries(delta)) {
+            if (value3 !== null && value3 !== void 0) merged[key] = value3;
+          }
+          this.raw = merged;
+        }
+      }
+    };
+    __name(parseAnthropicReplyUsage, "parseAnthropicReplyUsage");
+    __name4(parseAnthropicReplyUsage, "parseAnthropicReplyUsage");
     SUPERVISION_OPS = {
       "agents.list": "discover",
       "agents.get": "discover",
@@ -9317,6 +9791,10 @@ var init_dist = __esm({
         name: "close",
         description: "Close the session\u2019s browser."
       },
+      {
+        name: "read",
+        description: "Read one page in a fresh session that is closed afterwards: open the URL, wait, return its title and content. Args: url, waitFor?(load|networkidle|selector), selector?, format?(text|html|markdown), timeoutMs?."
+      },
       // perception
       {
         name: "snapshot",
@@ -9490,6 +9968,62 @@ var init_dist = __esm({
       }
     ];
     BROWSER_COMMAND_NAMES = BROWSER_COMMANDS.map((c) => c.name);
+    SERVER_TRIGGERED_BROWSER_SOURCES = [
+      "job",
+      "webhook",
+      "web-route",
+      "trigger",
+      "workflow-step",
+      "workflow-script"
+    ];
+    __name(isServerTriggeredBrowserSource, "isServerTriggeredBrowserSource");
+    __name4(isServerTriggeredBrowserSource, "isServerTriggeredBrowserSource");
+    BROWSER_FALLBACKS = [
+      "browser-use",
+      "none"
+    ];
+    DEFAULT_BROWSER_FALLBACK = "browser-use";
+    __name(resolveBrowserFallback, "resolveBrowserFallback");
+    __name4(resolveBrowserFallback, "resolveBrowserFallback");
+    PROXY_COUNTRY_CODE = /^[a-z]{2}$/;
+    __name(resolveBrowserProxyCountry, "resolveBrowserProxyCountry");
+    __name4(resolveBrowserProxyCountry, "resolveBrowserProxyCountry");
+    BROWSER_LOG_CONTENT_MODES = [
+      "summary",
+      "full",
+      "none"
+    ];
+    DEFAULT_BROWSER_LOG_CONTENT = "summary";
+    BROWSER_SCREENSHOT_POLICIES = [
+      "always",
+      "onError",
+      "never"
+    ];
+    DEFAULT_BROWSER_SCREENSHOT_POLICY = "onError";
+    __name(resolveBrowserLogOptions, "resolveBrowserLogOptions");
+    __name4(resolveBrowserLogOptions, "resolveBrowserLogOptions");
+    BROWSER_PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+    __name(browserProfileNotFoundMessage, "browserProfileNotFoundMessage");
+    __name4(browserProfileNotFoundMessage, "browserProfileNotFoundMessage");
+    BROWSER_LIMIT_KEYS = [
+      "maxSessionMinutes",
+      "idleTimeoutSeconds",
+      "maxConcurrentSessions"
+    ];
+    BROWSER_LIMIT_MAX = {
+      maxSessionMinutes: 60,
+      idleTimeoutSeconds: 15 * 60,
+      maxConcurrentSessions: 100
+    };
+    __name(resolveBrowserLimits, "resolveBrowserLimits");
+    __name4(resolveBrowserLimits, "resolveBrowserLimits");
+    BROWSER_EXECUTE_METHOD = "execute";
+    BROWSER_GLOBAL_METHODS = [
+      ...BROWSER_COMMAND_NAMES,
+      BROWSER_EXECUTE_METHOD
+    ];
+    BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+    BROWSER_EXECUTE_MAX_TIMEOUT_MS = 15 * 60 * 1e3;
     LOG_FIELDS_MAX_KEYS = 32;
     LOG_FIELD_MAX_VALUE_BYTES = 1024;
     LOG_FIELDS_MAX_BYTES = 8192;
@@ -9555,6 +10089,308 @@ var init_dist = __esm({
     __name4(isDesktopFileCommandName, "isDesktopFileCommandName");
     __name(isDesktopFileSessionId, "isDesktopFileSessionId");
     __name4(isDesktopFileSessionId, "isDesktopFileSessionId");
+    BROWSER_READ_FORMATS = [
+      "text",
+      "html",
+      "markdown"
+    ];
+    BROWSER_READ_DEFAULT_TIMEOUT_MS = 6e4;
+    BROWSER_READ_MIN_TIMEOUT_MS = 1e3;
+    BROWSER_READ_MAX_TIMEOUT_MS = 1e5;
+    BROWSER_READ_MAX_CONTENT_CHARS = 1e5;
+    BROWSER_READ_DEFAULT_SELECTOR = "body";
+    BROWSER_READ_MATCH_SEPARATOR = "\n\n";
+    BROWSER_READ_LOGIN_BLOCKER = "login_required";
+    BROWSER_ERROR_NAME = "BrowserError";
+    __name(browserError, "browserError");
+    __name4(browserError, "browserError");
+    __name(isRecord, "isRecord");
+    __name4(isRecord, "isRecord");
+    __name(optionalString, "optionalString");
+    __name4(optionalString, "optionalString");
+    __name(readUrl, "readUrl");
+    __name4(readUrl, "readUrl");
+    __name(readFormat, "readFormat");
+    __name4(readFormat, "readFormat");
+    __name(readTimeout, "readTimeout");
+    __name4(readTimeout, "readTimeout");
+    __name(parseBrowserReadPayload, "parseBrowserReadPayload");
+    __name4(parseBrowserReadPayload, "parseBrowserReadPayload");
+    __name(clampBrowserReadContent, "clampBrowserReadContent");
+    __name4(clampBrowserReadContent, "clampBrowserReadContent");
+    __name(joinBrowserReadMatches, "joinBrowserReadMatches");
+    __name4(joinBrowserReadMatches, "joinBrowserReadMatches");
+    HTTP_STATUS_FAILURE = /ERR_HTTP_RESPONSE_CODE_FAILURE/;
+    __name(isBrowserReadHttpFailure, "isBrowserReadHttpFailure");
+    __name4(isBrowserReadHttpFailure, "isBrowserReadHttpFailure");
+    __name(browserReadHttpErrorMessage, "browserReadHttpErrorMessage");
+    __name4(browserReadHttpErrorMessage, "browserReadHttpErrorMessage");
+    __name(urlOf, "urlOf");
+    __name4(urlOf, "urlOf");
+    __name(answeredDocuments, "answeredDocuments");
+    __name4(answeredDocuments, "answeredDocuments");
+    __name(documentStatusOf, "documentStatusOf");
+    __name4(documentStatusOf, "documentStatusOf");
+    LOGIN_PATH_SEGMENTS = /* @__PURE__ */ new Set([
+      "login",
+      "log-in",
+      "logon",
+      "signin",
+      "sign-in",
+      "sign_in",
+      "auth",
+      "authenticate",
+      "authorize",
+      "sso"
+    ]);
+    LOGIN_HOST_LABELS = /* @__PURE__ */ new Set([
+      "login",
+      "signin",
+      "auth",
+      "sso"
+    ]);
+    __name(isLoginUrl, "isLoginUrl");
+    __name4(isLoginUrl, "isLoginUrl");
+    __name(isLoginRedirect, "isLoginRedirect");
+    __name4(isLoginRedirect, "isLoginRedirect");
+    __name(browserReadLoginBlock, "browserReadLoginBlock");
+    __name4(browserReadLoginBlock, "browserReadLoginBlock");
+    AGENT_LOG_SOURCES = [
+      "skill",
+      "job",
+      "webhook",
+      "web-route",
+      "trigger",
+      "preprocessor",
+      "postprocessor",
+      "user_message",
+      "agent_response",
+      "agent_error",
+      "runtime",
+      "mcp",
+      "rag",
+      "device",
+      "device-trigger",
+      "model-resolver",
+      "workflow-step",
+      "workflow-script",
+      "workflow",
+      "supervision",
+      "browser",
+      "decisions"
+    ];
+    AGENT_LOG_ENVIRONMENTS = [
+      "production",
+      "sandbox"
+    ];
+    AGENT_LOG_FIELDS_MAX_WIRE_KEYS = LOG_FIELDS_MAX_KEYS + 1;
+    __name(utf8Bytes, "utf8Bytes");
+    __name4(utf8Bytes, "utf8Bytes");
+    __name(isPlainFieldKey, "isPlainFieldKey");
+    __name4(isPlainFieldKey, "isPlainFieldKey");
+    __name(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+    __name4(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+    __name(isAgentLogFields, "isAgentLogFields");
+    __name4(isAgentLogFields, "isAgentLogFields");
+    BROWSER_LOG_EVENT_KINDS = [
+      "session.opened",
+      "command",
+      "navigation",
+      "blocked",
+      "wall",
+      "fallback",
+      "confirm",
+      "agent.step",
+      "session.closed"
+    ];
+    BROWSER_LOG_ENGINES = [
+      "desktop",
+      "agent-browser",
+      "browser-use",
+      "none"
+    ];
+    BROWSER_SESSION_OPEN_REASONS = [
+      "desktop-online",
+      "cloud-fallback",
+      "stepwise-cloud",
+      "pinned",
+      "none"
+    ];
+    BROWSER_BLOCK_KINDS = [
+      "domain",
+      "private-network",
+      "policy",
+      "concurrency",
+      "bot-block"
+    ];
+    BROWSER_WALL_KINDS = [
+      "captcha",
+      "bot-block",
+      "consent",
+      "login",
+      "empty-content"
+    ];
+    BROWSER_WALL_NEXT_ACTIONS = [
+      "fallback",
+      "retry",
+      "ask-user",
+      "gave-up"
+    ];
+    BROWSER_CONFIRM_DECISIONS = [
+      "pending",
+      "approved",
+      "denied",
+      "expired"
+    ];
+    BROWSER_SESSION_CLOSE_REASONS = [
+      "done",
+      "idle",
+      "max-minutes",
+      "max-steps",
+      "cost-cap",
+      "error",
+      "reaped"
+    ];
+    BROWSER_LOG_CONTEXT_KEYS = [
+      "runId",
+      "executionId",
+      "primitiveId",
+      "primitiveName",
+      "channel",
+      "orgId",
+      "environment",
+      "agentVersion"
+    ];
+    BROWSER_LOG_ID_MAX_CHARS = 256;
+    BROWSER_LOG_TEXT_MAX_CHARS = 64 * 1024;
+    isString = /* @__PURE__ */ __name4((value3) => typeof value3 === "string", "isString");
+    isBoolean = /* @__PURE__ */ __name4((value3) => typeof value3 === "boolean", "isBoolean");
+    isCount = /* @__PURE__ */ __name4((value3) => typeof value3 === "number" && Number.isFinite(value3) && value3 >= 0, "isCount");
+    isPlainObject2 = /* @__PURE__ */ __name4((value3) => typeof value3 === "object" && value3 !== null && !Array.isArray(value3), "isPlainObject");
+    oneOf = /* @__PURE__ */ __name4((values) => (value3) => typeof value3 === "string" && values.includes(value3), "oneOf");
+    isLimits = /* @__PURE__ */ __name4((value3) => isPlainObject2(value3) && Object.values(value3).every((entry) => isCount(entry)), "isLimits");
+    EVENT_SHAPES = {
+      "session.opened": {
+        required: {
+          reason: oneOf(BROWSER_SESSION_OPEN_REASONS)
+        },
+        optional: {
+          limits: isLimits,
+          region: isString,
+          liveUrl: isString
+        }
+      },
+      command: {
+        required: {
+          name: oneOf(BROWSER_COMMAND_NAMES),
+          durationMs: isCount,
+          ok: isBoolean
+        },
+        optional: {
+          args: isPlainObject2,
+          urlBefore: isString,
+          urlAfter: isString,
+          resultBytes: isCount,
+          errorCode: isString,
+          errorMessage: isString,
+          title: isString,
+          pageText: isString,
+          screenshotRef: isString
+        }
+      },
+      navigation: {
+        required: {
+          url: isString
+        },
+        optional: {
+          finalUrl: isString,
+          status: isCount,
+          redirects: isCount
+        }
+      },
+      blocked: {
+        required: {
+          kind: oneOf(BROWSER_BLOCK_KINDS)
+        },
+        optional: {
+          rule: isString,
+          target: isString,
+          command: oneOf(BROWSER_COMMAND_NAMES),
+          reason: isString
+        }
+      },
+      wall: {
+        required: {
+          kind: oneOf(BROWSER_WALL_KINDS),
+          url: isString,
+          nextAction: oneOf(BROWSER_WALL_NEXT_ACTIONS)
+        },
+        optional: {}
+      },
+      fallback: {
+        required: {
+          from: oneOf(BROWSER_LOG_ENGINES),
+          to: oneOf(BROWSER_LOG_ENGINES),
+          reason: isString,
+          provider: isString
+        },
+        optional: {}
+      },
+      confirm: {
+        required: {
+          action: isString,
+          decision: oneOf(BROWSER_CONFIRM_DECISIONS)
+        },
+        optional: {
+          decidedBy: isString
+        }
+      },
+      "agent.step": {
+        required: {
+          step: isCount,
+          action: isString
+        },
+        optional: {
+          intent: isString,
+          url: isString
+        }
+      },
+      "session.closed": {
+        required: {
+          reason: oneOf(BROWSER_SESSION_CLOSE_REASONS),
+          durationMs: isCount,
+          pagesVisited: isCount,
+          bytes: isCount
+        },
+        optional: {
+          costUsd: isCount
+        }
+      }
+    };
+    BASE_KEYS = /* @__PURE__ */ new Set([
+      "event",
+      "sessionId",
+      "engine",
+      "at"
+    ]);
+    __name(describeBaseViolation, "describeBaseViolation");
+    __name4(describeBaseViolation, "describeBaseViolation");
+    __name(describeFieldViolation, "describeFieldViolation");
+    __name4(describeFieldViolation, "describeFieldViolation");
+    __name(describeBrowserLogEventViolation, "describeBrowserLogEventViolation");
+    __name4(describeBrowserLogEventViolation, "describeBrowserLogEventViolation");
+    __name(isBrowserLogEvent, "isBrowserLogEvent");
+    __name4(isBrowserLogEvent, "isBrowserLogEvent");
+    __name(describeBrowserLogContextViolation, "describeBrowserLogContextViolation");
+    __name4(describeBrowserLogContextViolation, "describeBrowserLogContextViolation");
+    BROWSER_WORKER_SESSION_ID_SEPARATOR = ":";
+    __name(browserWorkerSessionId, "browserWorkerSessionId");
+    __name4(browserWorkerSessionId, "browserWorkerSessionId");
+    BROWSER_WORKER_BLOCK_REASON_MAX_CHARS = 1024;
+    __name(browserLogContextOfWorkerContext, "browserLogContextOfWorkerContext");
+    __name4(browserLogContextOfWorkerContext, "browserLogContextOfWorkerContext");
+    __name(browserLogEventOfWorkerEvent, "browserLogEventOfWorkerEvent");
+    __name4(browserLogEventOfWorkerEvent, "browserLogEventOfWorkerEvent");
     WORKFLOW_RETRY_BACKOFFS = [
       "fixed",
       "exponential"
@@ -9856,38 +10692,6 @@ This text is who you are for this person. As you learn them, their name, their w
 `;
     __name(buildPersonalSpaceStartingPersona, "buildPersonalSpaceStartingPersona");
     __name4(buildPersonalSpaceStartingPersona, "buildPersonalSpaceStartingPersona");
-    AGENT_LOG_SOURCES = [
-      "skill",
-      "job",
-      "webhook",
-      "web-route",
-      "trigger",
-      "preprocessor",
-      "postprocessor",
-      "user_message",
-      "agent_response",
-      "agent_error",
-      "runtime",
-      "mcp",
-      "rag",
-      "device",
-      "device-trigger",
-      "model-resolver",
-      "workflow-step",
-      "workflow-script",
-      "workflow",
-      "supervision",
-      "decisions"
-    ];
-    AGENT_LOG_FIELDS_MAX_WIRE_KEYS = LOG_FIELDS_MAX_KEYS + 1;
-    __name(utf8Bytes, "utf8Bytes");
-    __name4(utf8Bytes, "utf8Bytes");
-    __name(isPlainFieldKey, "isPlainFieldKey");
-    __name4(isPlainFieldKey, "isPlainFieldKey");
-    __name(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
-    __name4(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
-    __name(isAgentLogFields, "isAgentLogFields");
-    __name4(isAgentLogFields, "isAgentLogFields");
     LOG_DRAIN_TYPES_PHASE1 = [
       "http",
       "otlp",
@@ -10180,8 +10984,8 @@ This text is who you are for this person. As you learn them, their name, their w
     CORE_DRAINING_CODE = "CORE_DRAINING";
     CORE_DRAINING_DEFAULT_RETRY_MS = 1e3;
     CORE_DRAINING_MAX_RETRY_MS = 5e3;
-    __name(isRecord, "isRecord");
-    __name4(isRecord, "isRecord");
+    __name(isRecord2, "isRecord2");
+    __name4(isRecord2, "isRecord");
     __name(isCoreDrainingErrorResponse, "isCoreDrainingErrorResponse");
     __name4(isCoreDrainingErrorResponse, "isCoreDrainingErrorResponse");
     __name(coreDrainingRetryDelayMs, "coreDrainingRetryDelayMs");
@@ -10211,7 +11015,7 @@ This text is who you are for this person. As you learn them, their name, their w
     ModelDescriptorSchema = z2.string().min(1).max(200);
     InferenceModelSchema = z2.object({
       kind: z2.literal("inference"),
-      /** Provider-prefixed model id (e.g. `'openai/gpt-5.2-chat-latest'`). */
+      /** Provider-prefixed model id (e.g. `'openai/chat-latest'`). */
       model: ModelDescriptorSchema,
       /**
       * TTS-only — provider voice id. Inference's TTS API takes voice
@@ -12616,6 +13420,218 @@ var init_auth_error = __esm({
   }
 });
 
+// ../sandbox-runtime/dist/decisions-api.mjs
+function isRecord3(value3) {
+  return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+}
+function isProvider(value3) {
+  return DECISION_PROVIDERS.includes(value3);
+}
+function invalid2(message) {
+  return new DecisionError(message, {
+    code: DECISION_ERROR_CODES.INVALID
+  });
+}
+function assertInstructions(builder, instructions) {
+  if (typeof instructions !== "string" || instructions.trim().length === 0) {
+    throw invalid2(`Decisions.${builder} needs non-empty instructions`);
+  }
+  if (instructions.length > DECISION_LIMITS.maxInstructionChars) {
+    throw invalid2(`Decisions.${builder} instructions must be at most ${DECISION_LIMITS.maxInstructionChars} characters`);
+  }
+}
+function assertCount(what, count2, min, max) {
+  if (count2 < min || count2 > max) {
+    throw invalid2(`${what} must hold ${min} to ${max} entries, got ${count2}`);
+  }
+}
+function odds(instructions, criteria) {
+  assertInstructions("odds", instructions);
+  if (criteria === void 0) return {
+    type: "odds",
+    instructions
+  };
+  if (!isRecord3(criteria)) throw invalid2("Decisions.odds criteria must be an object like { yes, no }");
+  return {
+    type: "odds",
+    instructions,
+    criteria
+  };
+}
+function choice(instructions, options) {
+  assertInstructions("choice", instructions);
+  if (!isRecord3(options)) throw invalid2("Decisions.choice options must be an object of label to description");
+  assertCount("Decisions.choice options", Object.keys(options).length, DECISION_LIMITS.minOptions, DECISION_LIMITS.maxOptions);
+  return {
+    type: "choice",
+    instructions,
+    options
+  };
+}
+function score(instructions, levels) {
+  assertInstructions("score", instructions);
+  if (!Array.isArray(levels)) throw invalid2("Decisions.score levels must be an array");
+  assertCount("Decisions.score levels", levels.length, DECISION_LIMITS.minLevels, DECISION_LIMITS.maxLevels);
+  return {
+    type: "score",
+    instructions,
+    levels
+  };
+}
+function assertDecisionQuestion(name, question) {
+  if (!isRecord3(question) || !DECISION_QUESTION_TYPES.includes(question.type)) {
+    throw invalid2(`questions.${name} must be built with Decisions.odds, Decisions.choice or Decisions.score`);
+  }
+  if (typeof question.instructions !== "string" || question.instructions.trim().length === 0) {
+    throw invalid2(`questions.${name}.instructions must be a non-empty string`);
+  }
+}
+function checkDecisionRequest(request) {
+  if (!isRecord3(request)) {
+    throw invalid2("Decisions.ask needs { state, questions } or (state, question)");
+  }
+  if (request.state === void 0 || request.state === null) {
+    throw invalid2("Decisions.ask needs a state");
+  }
+  if (!isRecord3(request.questions) || Object.keys(request.questions).length === 0) {
+    throw invalid2("Decisions.ask needs at least one question in questions");
+  }
+  for (const [name, question] of Object.entries(request.questions)) assertDecisionQuestion(name, question);
+  return request;
+}
+function checkDecisionRunRequest(request) {
+  if (typeof request.name !== "string" || !DECISION_NAME_PATTERN.test(request.name)) {
+    throw invalid2("Decisions.run needs the name of a decision declared on the agent");
+  }
+  if (request.state === void 0 || request.state === null) {
+    throw invalid2("Decisions.run needs a state");
+  }
+  return request;
+}
+function toDecisionError(caught) {
+  if (caught instanceof DecisionError) return caught;
+  const raw = isRecord3(caught) ? caught : {};
+  const detail = typeof raw.message === "string" && raw.message.length > 0 ? raw.message : "Decision failed";
+  const code = typeof raw.code === "string" && raw.code.length > 0 ? raw.code : DECISION_ERROR_CODES.UNAVAILABLE;
+  const message = detail.startsWith(`${code}: `) ? detail : `${code}: ${detail}`;
+  return new DecisionError(message, {
+    code,
+    ...isProvider(raw.provider) && {
+      provider: raw.provider
+    },
+    ...typeof raw.upstreamStatus === "number" && {
+      upstreamStatus: raw.upstreamStatus
+    },
+    ...typeof raw.decisionId === "string" && {
+      decisionId: raw.decisionId
+    }
+  });
+}
+function buildDecisionsApi(transport) {
+  async function relay2(send) {
+    if (!transport) {
+      throw new DecisionError("Decisions is not available in this runtime", {
+        code: DECISION_ERROR_CODES.UNAVAILABLE
+      });
+    }
+    try {
+      return await send(transport);
+    } catch (caught) {
+      throw toDecisionError(caught);
+    }
+  }
+  __name(relay2, "relay");
+  __name6(relay2, "relay");
+  async function ask(requestOrState, question, options) {
+    if (question === void 0) {
+      const request2 = checkDecisionRequest(requestOrState);
+      return relay2((t) => t.ask(request2));
+    }
+    const request = checkDecisionRequest({
+      ...options,
+      state: requestOrState,
+      questions: {
+        [SINGLE_DECISION_KEY]: question
+      }
+    });
+    const result = await relay2((t) => t.ask(request));
+    return result.answers[SINGLE_DECISION_KEY];
+  }
+  __name(ask, "ask");
+  __name6(ask, "ask");
+  async function run(name, state3, options) {
+    const request = checkDecisionRunRequest({
+      ...options,
+      name,
+      state: state3
+    });
+    return await relay2((t) => t.run(request));
+  }
+  __name(run, "run");
+  __name6(run, "run");
+  return {
+    ask,
+    run,
+    odds,
+    choice,
+    score
+  };
+}
+var __defProp6, __name6, DECISION_ERROR_NAME, SINGLE_DECISION_KEY, DecisionError;
+var init_decisions_api = __esm({
+  "../sandbox-runtime/dist/decisions-api.mjs"() {
+    "use strict";
+    init_dist();
+    __defProp6 = Object.defineProperty;
+    __name6 = /* @__PURE__ */ __name((target, value3) => __defProp6(target, "name", { value: value3, configurable: true }), "__name");
+    DECISION_ERROR_NAME = "DecisionError";
+    SINGLE_DECISION_KEY = "answer";
+    DecisionError = class extends Error {
+      static {
+        __name(this, "DecisionError");
+      }
+      static {
+        __name6(this, "DecisionError");
+      }
+      code;
+      constructor(message, fields) {
+        super(message);
+        this.name = DECISION_ERROR_NAME;
+        this.code = fields.code;
+        if (fields.provider !== void 0) this.provider = fields.provider;
+        if (fields.upstreamStatus !== void 0) this.upstreamStatus = fields.upstreamStatus;
+        if (fields.decisionId !== void 0) this.decisionId = fields.decisionId;
+      }
+    };
+    __name(isRecord3, "isRecord");
+    __name6(isRecord3, "isRecord");
+    __name(isProvider, "isProvider");
+    __name6(isProvider, "isProvider");
+    __name(invalid2, "invalid");
+    __name6(invalid2, "invalid");
+    __name(assertInstructions, "assertInstructions");
+    __name6(assertInstructions, "assertInstructions");
+    __name(assertCount, "assertCount");
+    __name6(assertCount, "assertCount");
+    __name(odds, "odds");
+    __name6(odds, "odds");
+    __name(choice, "choice");
+    __name6(choice, "choice");
+    __name(score, "score");
+    __name6(score, "score");
+    __name(assertDecisionQuestion, "assertDecisionQuestion");
+    __name6(assertDecisionQuestion, "assertDecisionQuestion");
+    __name(checkDecisionRequest, "checkDecisionRequest");
+    __name6(checkDecisionRequest, "checkDecisionRequest");
+    __name(checkDecisionRunRequest, "checkDecisionRunRequest");
+    __name6(checkDecisionRunRequest, "checkDecisionRunRequest");
+    __name(toDecisionError, "toDecisionError");
+    __name6(toDecisionError, "toDecisionError");
+    __name(buildDecisionsApi, "buildDecisionsApi");
+    __name6(buildDecisionsApi, "buildDecisionsApi");
+  }
+});
+
 // src/errors/cli.error.ts
 function apiErrorDetail(error) {
   return {
@@ -12696,6 +13712,41 @@ function numericStatus(error) {
   const candidate = error.statusCode ?? error.status;
   return typeof candidate === "number" && Number.isFinite(candidate) ? candidate : void 0;
 }
+function statusClass(status) {
+  if (status === 401) return {
+    code: "auth",
+    exitCode: CLI_EXIT.AUTH
+  };
+  if (status === 403) return {
+    code: "forbidden",
+    exitCode: CLI_EXIT.FORBIDDEN
+  };
+  if (status === 404) return {
+    code: "not_found",
+    exitCode: CLI_EXIT.NOT_FOUND
+  };
+  if (status >= 400 && status < 500) return {
+    code: `http_${status}`,
+    exitCode: CLI_EXIT.FORBIDDEN
+  };
+  if (status >= 500 || status === 0) return {
+    code: "unavailable",
+    exitCode: CLI_EXIT.UNAVAILABLE
+  };
+  return void 0;
+}
+function decisionErrorClass(error, message) {
+  if (error.name !== DECISION_ERROR_NAME || typeof error.code !== "string" || error.code.length === 0) return void 0;
+  const status = Object.hasOwn(DECISION_STATUS, error.code) ? DECISION_STATUS[error.code] : void 0;
+  return {
+    code: error.code,
+    exitCode: (status === void 0 ? void 0 : statusClass(status)?.exitCode) ?? CLI_EXIT.ERROR,
+    message,
+    ...typeof error.decisionId === "string" && error.decisionId.length > 0 ? {
+      decisionId: error.decisionId
+    } : {}
+  };
+}
 function classifyCliError(error) {
   if (CliError.isCliError(error)) {
     return {
@@ -12725,40 +13776,15 @@ function classifyCliError(error) {
       message
     };
   }
+  const decision = decisionErrorClass(e, message);
+  if (decision) return decision;
   const status = numericStatus(e);
-  if (status !== void 0) {
-    const statusCode = status;
-    if (status === 401) return {
-      code: "auth",
-      exitCode: CLI_EXIT.AUTH,
-      message,
-      statusCode
-    };
-    if (status === 403) return {
-      code: "forbidden",
-      exitCode: CLI_EXIT.FORBIDDEN,
-      message,
-      statusCode
-    };
-    if (status === 404) return {
-      code: "not_found",
-      exitCode: CLI_EXIT.NOT_FOUND,
-      message,
-      statusCode
-    };
-    if (status >= 400 && status < 500) return {
-      code: `http_${status}`,
-      exitCode: CLI_EXIT.FORBIDDEN,
-      message,
-      statusCode
-    };
-    if (status >= 500 || status === 0) return {
-      code: "unavailable",
-      exitCode: CLI_EXIT.UNAVAILABLE,
-      message,
-      statusCode
-    };
-  }
+  const byStatus = status === void 0 ? void 0 : statusClass(status);
+  if (byStatus) return {
+    ...byStatus,
+    message,
+    statusCode: status
+  };
   const causeCode = e.cause?.code;
   if (typeof e.code === "string" && NETWORK_ERRNO.has(e.code) || typeof causeCode === "string" && NETWORK_ERRNO.has(causeCode) || e.name === "AbortError" || e.name === "TimeoutError" || NETWORK_MESSAGE.test(message)) {
     return {
@@ -12774,10 +13800,12 @@ function classifyCliError(error) {
     message
   };
 }
-var CLI_EXIT, CliError, NETWORK_ERRNO, NETWORK_MESSAGE, UNAVAILABLE_HINT, VENDOR_RETRY_SOON_SECONDS, VENDOR_LABELS, PROVIDER_REJECTED_SERVER_CODE, PROVIDER_REJECTED_HTTP_STATUS, PROVIDER_REJECTION_REASONS, PROVIDER_REJECTED_NO_RETRY, PROVIDER_REJECTED_LUA_SIDE, MODEL_SETTINGS_URL;
+var CLI_EXIT, CliError, NETWORK_ERRNO, NETWORK_MESSAGE, UNAVAILABLE_HINT, VENDOR_RETRY_SOON_SECONDS, VENDOR_LABELS, PROVIDER_REJECTED_SERVER_CODE, PROVIDER_REJECTED_HTTP_STATUS, PROVIDER_REJECTION_REASONS, PROVIDER_REJECTED_NO_RETRY, PROVIDER_REJECTED_LUA_SIDE, MODEL_SETTINGS_URL, DECISION_STATUS;
 var init_cli_error = __esm({
   "src/errors/cli.error.ts"() {
     "use strict";
+    init_dist();
+    init_decisions_api();
     init_auth_error();
     CLI_EXIT = {
       OK: 0,
@@ -12930,6 +13958,18 @@ var init_cli_error = __esm({
     __name(providerRejectedHint, "providerRejectedHint");
     __name(authHint, "authHint");
     __name(numericStatus, "numericStatus");
+    __name(statusClass, "statusClass");
+    DECISION_STATUS = {
+      [DECISION_ERROR_CODES.INVALID]: 400,
+      [DECISION_ERROR_CODES.INSUFFICIENT_CREDITS]: 402,
+      [DECISION_ERROR_CODES.NOT_FOUND]: 404,
+      [DECISION_ERROR_CODES.REJECTED]: 422,
+      [DECISION_ERROR_CODES.TIMEOUT]: 503,
+      [DECISION_ERROR_CODES.UNAVAILABLE]: 503,
+      [DECISION_ERROR_CODES.DISABLED]: 503,
+      [DECISION_ERROR_CODES.CANCELLED]: 400
+    };
+    __name(decisionErrorClass, "decisionErrorClass");
     __name(classifyCliError, "classifyCliError");
   }
 });
@@ -14186,217 +15226,6 @@ var init_connection_requests_api_service = __esm({
   }
 });
 
-// ../sandbox-runtime/dist/decisions-api.mjs
-function isRecord2(value3) {
-  return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
-}
-function isProvider(value3) {
-  return DECISION_PROVIDERS.includes(value3);
-}
-function invalid2(message) {
-  return new DecisionError(message, {
-    code: DECISION_ERROR_CODES.INVALID
-  });
-}
-function assertInstructions(builder, instructions) {
-  if (typeof instructions !== "string" || instructions.trim().length === 0) {
-    throw invalid2(`Decisions.${builder} needs non-empty instructions`);
-  }
-  if (instructions.length > DECISION_LIMITS.maxInstructionChars) {
-    throw invalid2(`Decisions.${builder} instructions must be at most ${DECISION_LIMITS.maxInstructionChars} characters`);
-  }
-}
-function assertCount(what, count, min, max) {
-  if (count < min || count > max) {
-    throw invalid2(`${what} must hold ${min} to ${max} entries, got ${count}`);
-  }
-}
-function odds(instructions, criteria) {
-  assertInstructions("odds", instructions);
-  if (criteria === void 0) return {
-    type: "odds",
-    instructions
-  };
-  if (!isRecord2(criteria)) throw invalid2("Decisions.odds criteria must be an object like { yes, no }");
-  return {
-    type: "odds",
-    instructions,
-    criteria
-  };
-}
-function choice(instructions, options) {
-  assertInstructions("choice", instructions);
-  if (!isRecord2(options)) throw invalid2("Decisions.choice options must be an object of label to description");
-  assertCount("Decisions.choice options", Object.keys(options).length, DECISION_LIMITS.minOptions, DECISION_LIMITS.maxOptions);
-  return {
-    type: "choice",
-    instructions,
-    options
-  };
-}
-function score(instructions, levels) {
-  assertInstructions("score", instructions);
-  if (!Array.isArray(levels)) throw invalid2("Decisions.score levels must be an array");
-  assertCount("Decisions.score levels", levels.length, DECISION_LIMITS.minLevels, DECISION_LIMITS.maxLevels);
-  return {
-    type: "score",
-    instructions,
-    levels
-  };
-}
-function assertDecisionQuestion(name, question) {
-  if (!isRecord2(question) || !DECISION_QUESTION_TYPES.includes(question.type)) {
-    throw invalid2(`questions.${name} must be built with Decisions.odds, Decisions.choice or Decisions.score`);
-  }
-  if (typeof question.instructions !== "string" || question.instructions.trim().length === 0) {
-    throw invalid2(`questions.${name}.instructions must be a non-empty string`);
-  }
-}
-function checkDecisionRequest(request) {
-  if (!isRecord2(request)) {
-    throw invalid2("Decisions.ask needs { state, questions } or (state, question)");
-  }
-  if (request.state === void 0 || request.state === null) {
-    throw invalid2("Decisions.ask needs a state");
-  }
-  if (!isRecord2(request.questions) || Object.keys(request.questions).length === 0) {
-    throw invalid2("Decisions.ask needs at least one question in questions");
-  }
-  for (const [name, question] of Object.entries(request.questions)) assertDecisionQuestion(name, question);
-  return request;
-}
-function checkDecisionRunRequest(request) {
-  if (typeof request.name !== "string" || !DECISION_NAME_PATTERN.test(request.name)) {
-    throw invalid2("Decisions.run needs the name of a decision declared on the agent");
-  }
-  if (request.state === void 0 || request.state === null) {
-    throw invalid2("Decisions.run needs a state");
-  }
-  return request;
-}
-function toDecisionError(caught) {
-  if (caught instanceof DecisionError) return caught;
-  const raw = isRecord2(caught) ? caught : {};
-  const message = typeof raw.message === "string" && raw.message.length > 0 ? raw.message : "Decision failed";
-  const code = typeof raw.code === "string" && raw.code.length > 0 ? raw.code : DECISION_ERROR_CODES.UNAVAILABLE;
-  return new DecisionError(message, {
-    code,
-    ...isProvider(raw.provider) && {
-      provider: raw.provider
-    },
-    ...typeof raw.upstreamStatus === "number" && {
-      upstreamStatus: raw.upstreamStatus
-    },
-    ...typeof raw.decisionId === "string" && {
-      decisionId: raw.decisionId
-    }
-  });
-}
-function buildDecisionsApi(transport) {
-  async function relay2(send) {
-    if (!transport) {
-      throw new DecisionError("Decisions is not available in this runtime", {
-        code: DECISION_ERROR_CODES.UNAVAILABLE
-      });
-    }
-    try {
-      return await send(transport);
-    } catch (caught) {
-      throw toDecisionError(caught);
-    }
-  }
-  __name(relay2, "relay");
-  __name6(relay2, "relay");
-  async function ask(requestOrState, question, options) {
-    if (question === void 0) {
-      const request2 = checkDecisionRequest(requestOrState);
-      return relay2((t) => t.ask(request2));
-    }
-    const request = checkDecisionRequest({
-      ...options,
-      state: requestOrState,
-      questions: {
-        [SINGLE_DECISION_KEY]: question
-      }
-    });
-    const result = await relay2((t) => t.ask(request));
-    return result.answers[SINGLE_DECISION_KEY];
-  }
-  __name(ask, "ask");
-  __name6(ask, "ask");
-  async function run(name, state3, options) {
-    const request = checkDecisionRunRequest({
-      ...options,
-      name,
-      state: state3
-    });
-    return await relay2((t) => t.run(request));
-  }
-  __name(run, "run");
-  __name6(run, "run");
-  return {
-    ask,
-    run,
-    odds,
-    choice,
-    score
-  };
-}
-var __defProp6, __name6, DECISION_ERROR_NAME, SINGLE_DECISION_KEY, DecisionError;
-var init_decisions_api = __esm({
-  "../sandbox-runtime/dist/decisions-api.mjs"() {
-    "use strict";
-    init_dist();
-    __defProp6 = Object.defineProperty;
-    __name6 = /* @__PURE__ */ __name((target, value3) => __defProp6(target, "name", { value: value3, configurable: true }), "__name");
-    DECISION_ERROR_NAME = "DecisionError";
-    SINGLE_DECISION_KEY = "answer";
-    DecisionError = class extends Error {
-      static {
-        __name(this, "DecisionError");
-      }
-      static {
-        __name6(this, "DecisionError");
-      }
-      code;
-      constructor(message, fields) {
-        super(message);
-        this.name = DECISION_ERROR_NAME;
-        this.code = fields.code;
-        if (fields.provider !== void 0) this.provider = fields.provider;
-        if (fields.upstreamStatus !== void 0) this.upstreamStatus = fields.upstreamStatus;
-        if (fields.decisionId !== void 0) this.decisionId = fields.decisionId;
-      }
-    };
-    __name(isRecord2, "isRecord");
-    __name6(isRecord2, "isRecord");
-    __name(isProvider, "isProvider");
-    __name6(isProvider, "isProvider");
-    __name(invalid2, "invalid");
-    __name6(invalid2, "invalid");
-    __name(assertInstructions, "assertInstructions");
-    __name6(assertInstructions, "assertInstructions");
-    __name(assertCount, "assertCount");
-    __name6(assertCount, "assertCount");
-    __name(odds, "odds");
-    __name6(odds, "odds");
-    __name(choice, "choice");
-    __name6(choice, "choice");
-    __name(score, "score");
-    __name6(score, "score");
-    __name(assertDecisionQuestion, "assertDecisionQuestion");
-    __name6(assertDecisionQuestion, "assertDecisionQuestion");
-    __name(checkDecisionRequest, "checkDecisionRequest");
-    __name6(checkDecisionRequest, "checkDecisionRequest");
-    __name(checkDecisionRunRequest, "checkDecisionRunRequest");
-    __name6(checkDecisionRunRequest, "checkDecisionRunRequest");
-    __name(toDecisionError, "toDecisionError");
-    __name6(toDecisionError, "toDecisionError");
-    __name(buildDecisionsApi, "buildDecisionsApi");
-    __name6(buildDecisionsApi, "buildDecisionsApi");
-  }
-});
-
 // src/api/decisions.api.service.ts
 function resultOf(response) {
   if (!response.success) throw toDecisionError(response.error);
@@ -14407,13 +15236,20 @@ function resultOf(response) {
   }
   return response.data;
 }
-function buildOfflineDecisionsApi(getService) {
+function decisionTestSiteHeaders(site) {
+  return {
+    [DECISION_SANDBOX_SITE_HEADER]: DECISION_LUA_TEST_SITE,
+    [DECISION_SANDBOX_PRIMITIVE_HEADER]: formatDecisionSandboxPrimitive(`${site.kind}:${site.name}`, site.tool)
+  };
+}
+function buildOfflineDecisionsApi(getService, testSite) {
+  const headers = testSite ? decisionTestSiteHeaders(testSite) : void 0;
   return buildDecisionsApi({
-    ask: /* @__PURE__ */ __name(async (request) => (await getService()).askForSandbox(request), "ask"),
-    run: /* @__PURE__ */ __name(async (request) => (await getService()).runForSandbox(request), "run")
+    ask: /* @__PURE__ */ __name(async (request) => (await getService()).askForSandbox(request, headers), "ask"),
+    run: /* @__PURE__ */ __name(async (request) => (await getService()).runForSandbox(request, headers), "run")
   });
 }
-var DecisionsApiService;
+var DECISION_LUA_TEST_SITE, DecisionsApiService;
 var init_decisions_api_service = __esm({
   "src/api/decisions.api.service.ts"() {
     "use strict";
@@ -14421,6 +15257,8 @@ var init_decisions_api_service = __esm({
     init_decisions_api();
     init_http_client();
     __name(resultOf, "resultOf");
+    DECISION_LUA_TEST_SITE = "lua-test";
+    __name(decisionTestSiteHeaders, "decisionTestSiteHeaders");
     DecisionsApiService = class extends HttpClient {
       static {
         __name(this, "DecisionsApiService");
@@ -14429,17 +15267,17 @@ var init_decisions_api_service = __esm({
       constructor(baseUrl, credential, agentId2) {
         super(baseUrl, credential), this.agentId = agentId2;
       }
-      async ask(body) {
-        return this.httpPostOnce(`/developer/decisions/${this.agentId}/ask`, body, {});
+      async ask(body, headers = {}) {
+        return this.httpPostOnce(`/developer/decisions/${this.agentId}/ask`, body, headers);
       }
-      async run({ name, ...body }) {
-        return this.httpPostOnce(`/developer/decisions/${this.agentId}/run/${encodeURIComponent(name)}`, body, {});
+      async run({ name, ...body }, headers = {}) {
+        return this.httpPostOnce(`/developer/decisions/${this.agentId}/run/${encodeURIComponent(name)}`, body, headers);
       }
-      async askForSandbox(request) {
-        return resultOf(await this.ask(request));
+      async askForSandbox(request, headers) {
+        return resultOf(await this.ask(request, headers));
       }
-      async runForSandbox(request) {
-        return resultOf(await this.run(request));
+      async runForSandbox(request, headers) {
+        return resultOf(await this.run(request, headers));
       }
       async getDecisions() {
         return this.httpGet(`/developer/decisions/${this.agentId}/definitions`, {});
@@ -16795,7 +17633,7 @@ function resolvePlacements(calls) {
 function isConditionalJoinId(stepId) {
   return CONDITIONAL_JOIN_ID.test(stepId);
 }
-function isPlainObject2(v) {
+function isPlainObject3(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function leafValue(row) {
@@ -16816,7 +17654,7 @@ function deriveRunOutput(steps) {
   if (leaves.length === 1) {
     const leaf = leaves[0];
     const value22 = leafValue(leaf);
-    if (isConditionalJoinId(leaf.stepId) && isPlainObject2(value22)) {
+    if (isConditionalJoinId(leaf.stepId) && isPlainObject3(value22)) {
       const keys = Object.keys(value22);
       if (keys.length === 1) return {
         output: value22[keys[0]],
@@ -18159,7 +18997,7 @@ function estimateGraph(envelopeOrGraph) {
   };
 }
 function* singleStepsOf(entry) {
-  if (!isRecord3(entry)) return;
+  if (!isRecord4(entry)) return;
   switch (entry.type) {
     case "step":
     case "agent":
@@ -18183,8 +19021,8 @@ function* singleStepsOf(entry) {
   }
 }
 function entriesOf(graph) {
-  const definition = isRecord3(graph) ? graph.definition : void 0;
-  const entries = isRecord3(definition) ? definition.graph : void 0;
+  const definition = isRecord4(graph) ? graph.definition : void 0;
+  const entries = isRecord4(definition) ? definition.graph : void 0;
   return Array.isArray(entries) ? entries : [];
 }
 function inheritTargets(graphs) {
@@ -18201,7 +19039,7 @@ function inheritTargets(graphs) {
   return targets;
 }
 function needsInheritedWorkspace(graph) {
-  if (!isRecord3(graph) || graph.workspace !== void 0) return false;
+  if (!isRecord4(graph) || graph.workspace !== void 0) return false;
   for (const entry of entriesOf(graph)) {
     for (const node of singleStepsOf(entry)) {
       if (node.workspace !== void 0 && node.workspace !== "inherit") return true;
@@ -18282,7 +19120,7 @@ function collectJobTierSteps(entry, out) {
       return;
   }
 }
-var __defProp8, __name8, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_MODEL_TEMPLATE_ROOT, WORKFLOW_MODEL_TEMPLATE_RE, PATH_SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, APPROVAL_REMIND_AFTER_HOURS_MIN, APPROVAL_REMIND_AFTER_HOURS_MAX, APPROVAL_TIMEOUT_HOURS_MIN, APPROVAL_TIMEOUT_HOURS_MAX, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_WORKSPACE_TTL_MAX_HOURS_DEFAULT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS2, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, SUSPENDED_FOR_DIMENSIONS, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_SCHEDULE_TYPES, WORKFLOW_SCHEDULE_SHAPE_ISSUE, WORKFLOW_SCHEDULE_SHAPES_HINT, WORKFLOW_SCHEDULE_RUN_AS, isObject, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord3;
+var __defProp8, __name8, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_MODEL_TEMPLATE_ROOT, WORKFLOW_MODEL_TEMPLATE_RE, PATH_SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, APPROVAL_REMIND_AFTER_HOURS_MIN, APPROVAL_REMIND_AFTER_HOURS_MAX, APPROVAL_TIMEOUT_HOURS_MIN, APPROVAL_TIMEOUT_HOURS_MAX, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_WORKSPACE_TTL_MAX_HOURS_DEFAULT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS2, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, SUSPENDED_FOR_DIMENSIONS, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_SCHEDULE_TYPES, WORKFLOW_SCHEDULE_SHAPE_ISSUE, WORKFLOW_SCHEDULE_SHAPES_HINT, WORKFLOW_SCHEDULE_RUN_AS, isObject, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord4;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
@@ -18806,8 +19644,8 @@ var init_dist2 = __esm({
     CONDITIONAL_JOIN_ID = /^conditional@\d+\.join$/;
     __name(isConditionalJoinId, "isConditionalJoinId");
     __name8(isConditionalJoinId, "isConditionalJoinId");
-    __name(isPlainObject2, "isPlainObject");
-    __name8(isPlainObject2, "isPlainObject");
+    __name(isPlainObject3, "isPlainObject");
+    __name8(isPlainObject3, "isPlainObject");
     __name(leafValue, "leafValue");
     __name8(leafValue, "leafValue");
     __name(runOutputLeaves, "runOutputLeaves");
@@ -19097,7 +19935,7 @@ var init_dist2 = __esm({
     __name8(ofEntry, "ofEntry");
     __name(estimateGraph, "estimateGraph");
     __name8(estimateGraph, "estimateGraph");
-    isRecord3 = /* @__PURE__ */ __name8((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
+    isRecord4 = /* @__PURE__ */ __name8((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
     __name(singleStepsOf, "singleStepsOf");
     __name8(singleStepsOf, "singleStepsOf");
     __name(entriesOf, "entriesOf");
@@ -19239,6 +20077,10 @@ function createWorkflow(cfg) {
     const n2 = cfg.backfillOnEnable.maxOccurrences;
     if (!Number.isInteger(n2) || n2 < 1 || n2 > 200) throw new LuaWorkflowBuildError("invalid-envelope", "backfillOnEnable.maxOccurrences must be an integer in 1..200 (backfill-max-occurrences-out-of-range; the org maxBatchItems twin is checked at publish/R56)");
   }
+  if (cfg.concurrencyKey !== void 0) {
+    if (cfg.concurrencyKey !== "correlationKey") throw new LuaWorkflowBuildError("invalid-envelope", "concurrencyKey must be 'correlationKey'");
+    if (cfg.concurrencyPolicy !== "forbid") throw new LuaWorkflowBuildError("concurrency-key-requires-forbid", `workflow "${cfg.name}": concurrencyKey requires concurrencyPolicy:'forbid'`, "set concurrencyPolicy:'forbid' or remove concurrencyKey");
+  }
   if (cfg.health !== void 0) {
     const issues = validateScheduleHealth(cfg.health, {
       target: "workflow",
@@ -20181,6 +21023,7 @@ var init_types = __esm({
       PrimitiveKind2["VOICE"] = "voice";
       PrimitiveKind2["WORKFLOW"] = "workflow";
       PrimitiveKind2["WEB_APP"] = "web-app";
+      PrimitiveKind2["BROWSER"] = "browser";
       PrimitiveKind2["DECISION"] = "decision";
       return PrimitiveKind2;
     })({});
@@ -21012,6 +21855,9 @@ var init_semver = __esm({
 });
 
 // src/primitives/base.handler.ts
+function nameFlagDeleteCommand(deleteCommand, displayName, name) {
+  return `${deleteCommand} --${displayName.toLowerCase().replace(/\s+/g, "-")}-name ${name}`;
+}
 var DEFAULT_VERSION, BaseVersionedHandler;
 var init_base_handler = __esm({
   "src/primitives/base.handler.ts"() {
@@ -21024,10 +21870,14 @@ var init_base_handler = __esm({
     init_auth_error();
     init_cli_error();
     DEFAULT_VERSION = SKILL_DEFAULTS.VERSION;
+    __name(nameFlagDeleteCommand, "nameFlagDeleteCommand");
     BaseVersionedHandler = class {
       static {
         __name(this, "BaseVersionedHandler");
       }
+      serverDeleteCommand(name) {
+        return nameFlagDeleteCommand(this.deleteCommand, this.displayName, name);
+      }
       /**
       * Strip a YAML item to only the canonical fields: name, version, [idField].
       * Override if your YAML type has additional fields.
@@ -21148,7 +21998,7 @@ var init_base_handler = __esm({
             const { [idField]: goneId, ...rest } = stale;
             yamlItems[idx] = rest;
             yamlUpdated = true;
-            const msg = `\u2139\uFE0F  ${this.displayName} "${stale.name}" (${goneId}) no longer exists on the server \u2014 re-registering it`;
+            const msg = this.staleRowMessage(stale, String(goneId), serverData.serverItems);
             messages.push(msg);
             console.log(msg);
           }
@@ -21165,7 +22015,6 @@ var init_base_handler = __esm({
             }));
             yamlItems.push(...stubs);
             yamlUpdated = true;
-            const flagName = `--${this.displayName.toLowerCase().replace(/\s+/g, "-")}-name`;
             console.log(`
 \u26A0\uFE0F  Found ${this.displayNamePlural} on server not in your local code:`);
             for (const item of orphans) {
@@ -21174,7 +22023,7 @@ var init_base_handler = __esm({
               console.log(msg);
             }
             console.log(`   Added to lua.skill.yaml as server-only entries.`);
-            console.log(`   To remove from server: ${this.deleteCommand} ${flagName} <name>`);
+            console.log(`   To remove from server: ${this.serverDeleteCommand("<name>")}`);
             console.log(`   To restore source from backup: lua sync --accept
 `);
             orphanedCount = orphans.length;
@@ -21403,6 +22252,9 @@ var init_base_handler = __esm({
       staleYamlRows(_yamlItems, _serverItems, _manifestNames) {
         return [];
       }
+      staleRowMessage(stale, goneId, _serverItems) {
+        return `\u2139\uFE0F  ${this.displayName} "${stale.name}" (${goneId}) no longer exists on the server \u2014 re-registering it`;
+      }
       buildMaps(serverItems, yamlItems) {
         const yamlById = /* @__PURE__ */ new Map();
         const yamlByName = /* @__PURE__ */ new Map();
@@ -27824,6 +28676,7 @@ var LuaAgent = class {
   batching;
   governance;
   browser;
+  browsers;
   /**
   * Creates a new LuaAgent instance.
   *
@@ -27870,6 +28723,7 @@ var LuaAgent = class {
     this.batching = config.batching;
     this.governance = config.governance;
     this.browser = config.browser;
+    this.browsers = config.browsers;
   }
   getName() {
     return this.name;
@@ -27927,6 +28781,9 @@ var LuaAgent = class {
   getVoices() {
     return this.voices;
   }
+  getBrowsers() {
+    return this.browsers;
+  }
   getDecisions() {
     return this.decisions;
   }
@@ -28045,6 +28902,51 @@ function defineVoice(config) {
 }
 __name(defineVoice, "defineVoice");
 
+// src/types/browser.ts
+init_dist();
+var LuaBrowser = class {
+  static {
+    __name(this, "LuaBrowser");
+  }
+  name;
+  description;
+  engine;
+  fallback;
+  proxyCountry;
+  allowedDomains;
+  confirmActions;
+  maxSessionMinutes;
+  idleTimeoutSeconds;
+  maxConcurrentSessions;
+  screenshots;
+  logContent;
+  persist;
+  credentials;
+  constructor(config) {
+    if (!config.name || !BROWSER_PROFILE_NAME_PATTERN.test(config.name)) {
+      throw new Error("LuaBrowser requires a `name` that starts with a letter or digit and uses only letters, digits, underscores or hyphens (max 64).");
+    }
+    this.name = config.name;
+    this.description = config.description;
+    this.engine = config.engine;
+    this.fallback = config.fallback;
+    this.proxyCountry = config.proxyCountry;
+    this.allowedDomains = config.allowedDomains;
+    this.confirmActions = config.confirmActions;
+    this.maxSessionMinutes = config.maxSessionMinutes;
+    this.idleTimeoutSeconds = config.idleTimeoutSeconds;
+    this.maxConcurrentSessions = config.maxConcurrentSessions;
+    this.screenshots = config.screenshots;
+    this.logContent = config.logContent;
+    this.persist = config.persist;
+    this.credentials = config.credentials;
+  }
+};
+function defineBrowser(config) {
+  return new LuaBrowser(config);
+}
+__name(defineBrowser, "defineBrowser");
+
 // src/types/decision.ts
 init_dist();
 init_decisions_api();
@@ -28228,6 +29130,26 @@ function createOfflineThreadsApi() {
 }
 __name(createOfflineThreadsApi, "createOfflineThreadsApi");
 
+// src/api/browser.offline.ts
+init_dist();
+function unavailable2(member) {
+  return browserError("BROWSER_UNAVAILABLE", `Browser.${member} only runs on the Lua platform (deployed or sandbox agents with \`browser\` on), not in lua test / lua dev`);
+}
+__name(unavailable2, "unavailable");
+function createOfflineBrowserApi() {
+  const members = Object.fromEntries([
+    ...BROWSER_COMMAND_NAMES,
+    BROWSER_EXECUTE_METHOD
+  ].map((name) => [
+    name,
+    async () => {
+      throw unavailable2(name);
+    }
+  ]));
+  return members;
+}
+__name(createOfflineBrowserApi, "createOfflineBrowserApi");
+
 // src/api/progress.api.service.ts
 function createOfflineProgressApi() {
   return Object.freeze({
@@ -29098,6 +30020,7 @@ var Secrets = {
 };
 var Metrics = offlineMetrics;
 var Threads = createOfflineThreadsApi();
+var Browser = createOfflineBrowserApi();
 var Progress = createOfflineProgressApi();
 function defineDevice(config) {
   return new LuaDevice(config);
@@ -29117,6 +30040,7 @@ export {
   BasketInstance,
   BasketStatus,
   Baskets,
+  Browser,
   CDN,
   CHANNEL_SEND_CHANNELS,
   Channels,
@@ -29129,6 +30053,7 @@ export {
   Jobs,
   Lua,
   LuaAgent,
+  LuaBrowser,
   LuaDecision,
   LuaDevice,
   LuaDeviceTrigger,
@@ -29162,11 +30087,14 @@ export {
   UserDataInstance,
   Voice,
   WEB_APP_NAME_PATTERN,
+  WORKFLOW_DEFAULT_MAX_DURATION_SECONDS,
+  WORKFLOW_HITL_MAX_DURATION_SECONDS,
   Workflows,
   and2 as and,
   checkAsUserRequiresUser,
   createStep,
   createWorkflow,
+  defineBrowser,
   defineDecision,
   defineDevice,
   defineDeviceTrigger,