lua-cli 3.49.0 → 3.49.2

package/dist/index.js

@@ -950,6 +950,35 @@ function aiGenerateInputFromSimplified(prompt, content) {
     ]
   };
 }
+function directProviderOfOpenRouterModel(model) {
+  return OPENROUTER_DIRECT_VENDORS.find((vendor) => vendor.pattern.test(model))?.provider;
+}
+function openRouterModelIssue(options) {
+  const model = typeof options.model === "string" && options.model ? options.model : void 0;
+  if (options.provider === "openrouter" && !model) return OPENROUTER_NEEDS_MODEL_MESSAGE;
+  if (!model || !model.includes("/")) return null;
+  const direct = directProviderOfOpenRouterModel(model);
+  if (!direct) return null;
+  return `model ${model} runs on provider '${direct}': set provider '${direct}' instead of a vendor/model id`;
+}
+function formatDecisionSandboxPrimitive(name, tool) {
+  return tool ? `${name}${DECISION_SANDBOX_TOOL_SEPARATOR}${tool}` : name;
+}
+function parseDecisionSandboxPrimitive(value3) {
+  const at = value3.indexOf(DECISION_SANDBOX_TOOL_SEPARATOR);
+  const name = at < 0 ? value3 : value3.slice(0, at);
+  const tool = at < 0 ? "" : value3.slice(at + DECISION_SANDBOX_TOOL_SEPARATOR.length);
+  if (name.length === 0) return void 0;
+  return tool.length > 0 ? {
+    name,
+    tool
+  } : {
+    name
+  };
+}
+function decisionPublishStampKey(agentId2) {
+  return `decisions:stamp:${agentId2}`;
+}
 function isIntegrationPassthroughReadMethod(method) {
   return typeof method === "string" && INTEGRATION_PASSTHROUGH_READ_METHODS.includes(method.toUpperCase());
 }
@@ -4693,6 +4722,10 @@ function browserLogContextOfWorkerContext(context) {
   if (context?.primitiveId) out.primitiveId = context.primitiveId;
   if (context?.primitiveName) out.primitiveName = context.primitiveName;
   if (context?.channel) out.channel = context.channel;
+  if (context?.environment && AGENT_LOG_ENVIRONMENTS.includes(context.environment)) {
+    out.environment = context.environment;
+  }
+  if (context?.agentVersion) out.agentVersion = context.agentVersion;
   return out;
 }
 function browserLogEventOfWorkerEvent(event, mapping = {}) {
@@ -7496,7 +7529,7 @@ function maskMcpServerHeaders(server) {
     headersSet: headerNames.length > 0
   };
 }
-var __defProp3, __name3, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_LIMITS, DECISION_ERROR_CODES, DECISION_INACTIVE_CODE, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, MESSAGING_CHANNELS, VOICE_CHANNELS, TURN_CATEGORIES, AGENT_TOOL_CATEGORIES, count, AnthropicSseUsageReader, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, SERVER_TRIGGERED_BROWSER_SOURCES, BROWSER_FALLBACKS, DEFAULT_BROWSER_FALLBACK, PROXY_COUNTRY_CODE, BROWSER_LOG_CONTENT_MODES, DEFAULT_BROWSER_LOG_CONTENT, BROWSER_SCREENSHOT_POLICIES, DEFAULT_BROWSER_SCREENSHOT_POLICY, BROWSER_ENGINES, BROWSER_PROFILE_NAME_PATTERN, BROWSER_LIMIT_KEYS, BROWSER_LIMIT_MAX, BROWSER_EXECUTE_METHOD, BROWSER_GLOBAL_METHODS, BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS, BROWSER_EXECUTE_MAX_TIMEOUT_MS, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, BROWSER_READ_FORMATS, BROWSER_READ_DEFAULT_TIMEOUT_MS, BROWSER_READ_MIN_TIMEOUT_MS, BROWSER_READ_MAX_TIMEOUT_MS, BROWSER_READ_MAX_CONTENT_CHARS, BROWSER_READ_DEFAULT_SELECTOR, BROWSER_READ_MATCH_SEPARATOR, BROWSER_READ_LOGIN_BLOCKER, BROWSER_ERROR_NAME, HTTP_STATUS_FAILURE, LOGIN_PATH_SEGMENTS, LOGIN_HOST_LABELS, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, BROWSER_LOG_EVENT_KINDS, BROWSER_LOG_ENGINES, BROWSER_SESSION_OPEN_REASONS, BROWSER_BLOCK_KINDS, BROWSER_WALL_KINDS, BROWSER_WALL_NEXT_ACTIONS, BROWSER_CONFIRM_DECISIONS, BROWSER_SESSION_CLOSE_REASONS, BROWSER_LOG_CONTEXT_KEYS, BROWSER_LOG_ID_MAX_CHARS, BROWSER_LOG_TEXT_MAX_CHARS, isString, isBoolean, isCount, isPlainObject2, oneOf, isLimits, EVENT_SHAPES, BASE_KEYS, BROWSER_WORKER_SESSION_ID_SEPARATOR, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_WALL_MS, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSETS, WEB_APP_ASSET_PATH_PATTERN, WEB_APP_ASSET_PATH_MAX_CHARS, WEB_APP_MAX_ROUTES, WEB_APP_MAX_ASSET_BYTES, WEB_APP_CSP_NONCE_PLACEHOLDER, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema;
+var __defProp3, __name3, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_FALLBACK_PROVIDERS, OPENROUTER_DIRECT_VENDORS, OPENROUTER_NEEDS_MODEL_MESSAGE, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_SANDBOX_SITE_HEADER, DECISION_SANDBOX_PRIMITIVE_HEADER, DECISION_SANDBOX_TOOL_SEPARATOR, DECISION_LIMITS, DECISION_ERROR_CODES, DECISION_INACTIVE_CODE, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, DecisionDefinitionWriteSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, MESSAGING_CHANNELS, VOICE_CHANNELS, TURN_CATEGORIES, AGENT_TOOL_CATEGORIES, count, AnthropicSseUsageReader, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, SERVER_TRIGGERED_BROWSER_SOURCES, BROWSER_FALLBACKS, DEFAULT_BROWSER_FALLBACK, PROXY_COUNTRY_CODE, BROWSER_LOG_CONTENT_MODES, DEFAULT_BROWSER_LOG_CONTENT, BROWSER_SCREENSHOT_POLICIES, DEFAULT_BROWSER_SCREENSHOT_POLICY, BROWSER_ENGINES, BROWSER_PROFILE_NAME_PATTERN, BROWSER_LIMIT_KEYS, BROWSER_LIMIT_MAX, BROWSER_EXECUTE_METHOD, BROWSER_GLOBAL_METHODS, BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS, BROWSER_EXECUTE_MAX_TIMEOUT_MS, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, BROWSER_READ_FORMATS, BROWSER_READ_DEFAULT_TIMEOUT_MS, BROWSER_READ_MIN_TIMEOUT_MS, BROWSER_READ_MAX_TIMEOUT_MS, BROWSER_READ_MAX_CONTENT_CHARS, BROWSER_READ_DEFAULT_SELECTOR, BROWSER_READ_MATCH_SEPARATOR, BROWSER_READ_LOGIN_BLOCKER, BROWSER_ERROR_NAME, HTTP_STATUS_FAILURE, LOGIN_PATH_SEGMENTS, LOGIN_HOST_LABELS, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, BROWSER_LOG_EVENT_KINDS, BROWSER_LOG_ENGINES, BROWSER_SESSION_OPEN_REASONS, BROWSER_BLOCK_KINDS, BROWSER_WALL_KINDS, BROWSER_WALL_NEXT_ACTIONS, BROWSER_CONFIRM_DECISIONS, BROWSER_SESSION_CLOSE_REASONS, BROWSER_LOG_CONTEXT_KEYS, BROWSER_LOG_ID_MAX_CHARS, BROWSER_LOG_TEXT_MAX_CHARS, isString, isBoolean, isCount, isPlainObject2, oneOf, isLimits, EVENT_SHAPES, BASE_KEYS, BROWSER_WORKER_SESSION_ID_SEPARATOR, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_WALL_MS, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSETS, WEB_APP_ASSET_PATH_PATTERN, WEB_APP_ASSET_PATH_MAX_CHARS, WEB_APP_MAX_ROUTES, WEB_APP_MAX_ASSET_BYTES, WEB_APP_CSP_NONCE_PLACEHOLDER, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -7569,15 +7602,44 @@ var init_dist = __esm({
     __name(aiGenerateInputFromSimplified, "aiGenerateInputFromSimplified");
     __name3(aiGenerateInputFromSimplified, "aiGenerateInputFromSimplified");
     DECISION_PROVIDERS = [
+      "jev",
+      "openai",
+      "openrouter"
+    ];
+    DECISION_FALLBACK_PROVIDERS = [
       "jev",
       "openai"
     ];
+    OPENROUTER_DIRECT_VENDORS = [
+      {
+        pattern: /^~?typesafe\//,
+        provider: "jev"
+      },
+      {
+        pattern: /^openai\//,
+        provider: "openai"
+      }
+    ];
+    __name(directProviderOfOpenRouterModel, "directProviderOfOpenRouterModel");
+    __name3(directProviderOfOpenRouterModel, "directProviderOfOpenRouterModel");
+    OPENROUTER_NEEDS_MODEL_MESSAGE = "provider openrouter needs a model id, such as liquid/d1";
+    __name(openRouterModelIssue, "openRouterModelIssue");
+    __name3(openRouterModelIssue, "openRouterModelIssue");
     DECISION_QUESTION_TYPES = [
       "odds",
       "choice",
       "score"
     ];
     DECISION_NAME_PATTERN = /^[a-zA-Z0-9_-]{1,64}$/;
+    DECISION_SANDBOX_SITE_HEADER = "x-lua-sandbox-site";
+    DECISION_SANDBOX_PRIMITIVE_HEADER = "x-lua-sandbox-primitive";
+    DECISION_SANDBOX_TOOL_SEPARATOR = "#";
+    __name(formatDecisionSandboxPrimitive, "formatDecisionSandboxPrimitive");
+    __name3(formatDecisionSandboxPrimitive, "formatDecisionSandboxPrimitive");
+    __name(parseDecisionSandboxPrimitive, "parseDecisionSandboxPrimitive");
+    __name3(parseDecisionSandboxPrimitive, "parseDecisionSandboxPrimitive");
+    __name(decisionPublishStampKey, "decisionPublishStampKey");
+    __name3(decisionPublishStampKey, "decisionPublishStampKey");
     DECISION_LIMITS = {
       maxQuestions: 64,
       minOptions: 2,
@@ -7603,7 +7665,8 @@ var init_dist = __esm({
       UNAVAILABLE: "decision_unavailable",
       DISABLED: "decision_disabled",
       INSUFFICIENT_CREDITS: "decision_insufficient_credits",
-      NOT_FOUND: "decision_not_found"
+      NOT_FOUND: "decision_not_found",
+      CANCELLED: "decision_cancelled"
     };
     DECISION_INACTIVE_CODE = "decision_inactive";
     MAX_NAME_CHARS = 64;
@@ -7645,7 +7708,7 @@ var init_dist = __esm({
       ]).optional(),
       model: z.string().min(1).optional(),
       fallback: z.union([
-        z.enum(DECISION_PROVIDERS),
+        z.enum(DECISION_FALLBACK_PROVIDERS),
         z.literal("none")
       ]).optional(),
       region: z.literal("eu").optional(),
@@ -7674,6 +7737,16 @@ var init_dist = __esm({
       description: z.string().max(DECISION_LIMITS.maxInstructionChars).optional(),
       questions: DecisionQuestionsSchema
     }).strict();
+    DecisionDefinitionWriteSchema = DecisionDefinitionSchema.superRefine((definition, ctx) => {
+      const issue = openRouterModelIssue(definition);
+      if (issue) ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [
+          "model"
+        ],
+        message: issue
+      });
+    });
     INTEGRATION_PASSTHROUGH_READ_METHODS = [
       "GET",
       "HEAD"
@@ -10224,7 +10297,11 @@ var init_dist = __esm({
       "max-steps",
       "cost-cap",
       "error",
-      "reaped"
+      "reaped",
+      "cancelled",
+      "confirmation",
+      "blocked",
+      "stopped"
     ];
     BROWSER_LOG_CONTEXT_KEYS = [
       "runId",
@@ -10252,7 +10329,8 @@ var init_dist = __esm({
         optional: {
           limits: isLimits,
           region: isString,
-          liveUrl: isString
+          liveUrl: isString,
+          browser: isString
         }
       },
       command: {
@@ -13329,6 +13407,218 @@ var init_auth_error = __esm({
   }
 });
 
+// ../sandbox-runtime/dist/decisions-api.mjs
+function isRecord3(value3) {
+  return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+}
+function isProvider(value3) {
+  return DECISION_PROVIDERS.includes(value3);
+}
+function invalid(message) {
+  return new DecisionError(message, {
+    code: DECISION_ERROR_CODES.INVALID
+  });
+}
+function assertInstructions(builder, instructions) {
+  if (typeof instructions !== "string" || instructions.trim().length === 0) {
+    throw invalid(`Decisions.${builder} needs non-empty instructions`);
+  }
+  if (instructions.length > DECISION_LIMITS.maxInstructionChars) {
+    throw invalid(`Decisions.${builder} instructions must be at most ${DECISION_LIMITS.maxInstructionChars} characters`);
+  }
+}
+function assertCount(what, count2, min, max) {
+  if (count2 < min || count2 > max) {
+    throw invalid(`${what} must hold ${min} to ${max} entries, got ${count2}`);
+  }
+}
+function odds(instructions, criteria) {
+  assertInstructions("odds", instructions);
+  if (criteria === void 0) return {
+    type: "odds",
+    instructions
+  };
+  if (!isRecord3(criteria)) throw invalid("Decisions.odds criteria must be an object like { yes, no }");
+  return {
+    type: "odds",
+    instructions,
+    criteria
+  };
+}
+function choice(instructions, options) {
+  assertInstructions("choice", instructions);
+  if (!isRecord3(options)) throw invalid("Decisions.choice options must be an object of label to description");
+  assertCount("Decisions.choice options", Object.keys(options).length, DECISION_LIMITS.minOptions, DECISION_LIMITS.maxOptions);
+  return {
+    type: "choice",
+    instructions,
+    options
+  };
+}
+function score(instructions, levels) {
+  assertInstructions("score", instructions);
+  if (!Array.isArray(levels)) throw invalid("Decisions.score levels must be an array");
+  assertCount("Decisions.score levels", levels.length, DECISION_LIMITS.minLevels, DECISION_LIMITS.maxLevels);
+  return {
+    type: "score",
+    instructions,
+    levels
+  };
+}
+function assertDecisionQuestion(name, question) {
+  if (!isRecord3(question) || !DECISION_QUESTION_TYPES.includes(question.type)) {
+    throw invalid(`questions.${name} must be built with Decisions.odds, Decisions.choice or Decisions.score`);
+  }
+  if (typeof question.instructions !== "string" || question.instructions.trim().length === 0) {
+    throw invalid(`questions.${name}.instructions must be a non-empty string`);
+  }
+}
+function checkDecisionRequest(request2) {
+  if (!isRecord3(request2)) {
+    throw invalid("Decisions.ask needs { state, questions } or (state, question)");
+  }
+  if (request2.state === void 0 || request2.state === null) {
+    throw invalid("Decisions.ask needs a state");
+  }
+  if (!isRecord3(request2.questions) || Object.keys(request2.questions).length === 0) {
+    throw invalid("Decisions.ask needs at least one question in questions");
+  }
+  for (const [name, question] of Object.entries(request2.questions)) assertDecisionQuestion(name, question);
+  return request2;
+}
+function checkDecisionRunRequest(request2) {
+  if (typeof request2.name !== "string" || !DECISION_NAME_PATTERN.test(request2.name)) {
+    throw invalid("Decisions.run needs the name of a decision declared on the agent");
+  }
+  if (request2.state === void 0 || request2.state === null) {
+    throw invalid("Decisions.run needs a state");
+  }
+  return request2;
+}
+function toDecisionError(caught) {
+  if (caught instanceof DecisionError) return caught;
+  const raw = isRecord3(caught) ? caught : {};
+  const detail = typeof raw.message === "string" && raw.message.length > 0 ? raw.message : "Decision failed";
+  const code = typeof raw.code === "string" && raw.code.length > 0 ? raw.code : DECISION_ERROR_CODES.UNAVAILABLE;
+  const message = detail.startsWith(`${code}: `) ? detail : `${code}: ${detail}`;
+  return new DecisionError(message, {
+    code,
+    ...isProvider(raw.provider) && {
+      provider: raw.provider
+    },
+    ...typeof raw.upstreamStatus === "number" && {
+      upstreamStatus: raw.upstreamStatus
+    },
+    ...typeof raw.decisionId === "string" && {
+      decisionId: raw.decisionId
+    }
+  });
+}
+function buildDecisionsApi(transport) {
+  async function relay2(send) {
+    if (!transport) {
+      throw new DecisionError("Decisions is not available in this runtime", {
+        code: DECISION_ERROR_CODES.UNAVAILABLE
+      });
+    }
+    try {
+      return await send(transport);
+    } catch (caught) {
+      throw toDecisionError(caught);
+    }
+  }
+  __name(relay2, "relay");
+  __name4(relay2, "relay");
+  async function ask(requestOrState, question, options) {
+    if (question === void 0) {
+      const request22 = checkDecisionRequest(requestOrState);
+      return relay2((t) => t.ask(request22));
+    }
+    const request2 = checkDecisionRequest({
+      ...options,
+      state: requestOrState,
+      questions: {
+        [SINGLE_DECISION_KEY]: question
+      }
+    });
+    const result = await relay2((t) => t.ask(request2));
+    return result.answers[SINGLE_DECISION_KEY];
+  }
+  __name(ask, "ask");
+  __name4(ask, "ask");
+  async function run(name, state3, options) {
+    const request2 = checkDecisionRunRequest({
+      ...options,
+      name,
+      state: state3
+    });
+    return await relay2((t) => t.run(request2));
+  }
+  __name(run, "run");
+  __name4(run, "run");
+  return {
+    ask,
+    run,
+    odds,
+    choice,
+    score
+  };
+}
+var __defProp4, __name4, DECISION_ERROR_NAME, SINGLE_DECISION_KEY, DecisionError;
+var init_decisions_api = __esm({
+  "../sandbox-runtime/dist/decisions-api.mjs"() {
+    "use strict";
+    init_dist();
+    __defProp4 = Object.defineProperty;
+    __name4 = /* @__PURE__ */ __name((target, value3) => __defProp4(target, "name", { value: value3, configurable: true }), "__name");
+    DECISION_ERROR_NAME = "DecisionError";
+    SINGLE_DECISION_KEY = "answer";
+    DecisionError = class extends Error {
+      static {
+        __name(this, "DecisionError");
+      }
+      static {
+        __name4(this, "DecisionError");
+      }
+      code;
+      constructor(message, fields) {
+        super(message);
+        this.name = DECISION_ERROR_NAME;
+        this.code = fields.code;
+        if (fields.provider !== void 0) this.provider = fields.provider;
+        if (fields.upstreamStatus !== void 0) this.upstreamStatus = fields.upstreamStatus;
+        if (fields.decisionId !== void 0) this.decisionId = fields.decisionId;
+      }
+    };
+    __name(isRecord3, "isRecord");
+    __name4(isRecord3, "isRecord");
+    __name(isProvider, "isProvider");
+    __name4(isProvider, "isProvider");
+    __name(invalid, "invalid");
+    __name4(invalid, "invalid");
+    __name(assertInstructions, "assertInstructions");
+    __name4(assertInstructions, "assertInstructions");
+    __name(assertCount, "assertCount");
+    __name4(assertCount, "assertCount");
+    __name(odds, "odds");
+    __name4(odds, "odds");
+    __name(choice, "choice");
+    __name4(choice, "choice");
+    __name(score, "score");
+    __name4(score, "score");
+    __name(assertDecisionQuestion, "assertDecisionQuestion");
+    __name4(assertDecisionQuestion, "assertDecisionQuestion");
+    __name(checkDecisionRequest, "checkDecisionRequest");
+    __name4(checkDecisionRequest, "checkDecisionRequest");
+    __name(checkDecisionRunRequest, "checkDecisionRunRequest");
+    __name4(checkDecisionRunRequest, "checkDecisionRunRequest");
+    __name(toDecisionError, "toDecisionError");
+    __name4(toDecisionError, "toDecisionError");
+    __name(buildDecisionsApi, "buildDecisionsApi");
+    __name4(buildDecisionsApi, "buildDecisionsApi");
+  }
+});
+
 // src/errors/cli.error.ts
 function apiErrorDetail(error) {
   return {
@@ -13357,6 +13647,12 @@ function joinHint(...parts) {
   const lines = parts.filter((part) => typeof part === "string" && part.length > 0);
   return lines.length > 0 ? lines.join("\n") : void 0;
 }
+function isLuaErrorBody(body) {
+  return typeof body.message === "string" || typeof body.statusCode === "number" || typeof body.code === "string";
+}
+function isEdgeBlockedError(error) {
+  return CliError.isCliError(error) && error.serverCode === EDGE_BLOCKED_CODE;
+}
 function isAccessDeniedError(error) {
   if (CliError.isCliError(error)) return error.statusCode === 403;
   return error instanceof Error && error.message.startsWith("Access denied (403)");
@@ -13459,6 +13755,41 @@ function numericStatus(error) {
   const candidate = error.statusCode ?? error.status;
   return typeof candidate === "number" && Number.isFinite(candidate) ? candidate : void 0;
 }
+function statusClass(status) {
+  if (status === 401) return {
+    code: "auth",
+    exitCode: CLI_EXIT.AUTH
+  };
+  if (status === 403) return {
+    code: "forbidden",
+    exitCode: CLI_EXIT.FORBIDDEN
+  };
+  if (status === 404) return {
+    code: "not_found",
+    exitCode: CLI_EXIT.NOT_FOUND
+  };
+  if (status >= 400 && status < 500) return {
+    code: `http_${status}`,
+    exitCode: CLI_EXIT.FORBIDDEN
+  };
+  if (status >= 500 || status === 0) return {
+    code: "unavailable",
+    exitCode: CLI_EXIT.UNAVAILABLE
+  };
+  return void 0;
+}
+function decisionErrorClass(error, message) {
+  if (error.name !== DECISION_ERROR_NAME || typeof error.code !== "string" || error.code.length === 0) return void 0;
+  const status = Object.hasOwn(DECISION_STATUS, error.code) ? DECISION_STATUS[error.code] : void 0;
+  return {
+    code: error.code,
+    exitCode: (status === void 0 ? void 0 : statusClass(status)?.exitCode) ?? CLI_EXIT.ERROR,
+    message,
+    ...typeof error.decisionId === "string" && error.decisionId.length > 0 ? {
+      decisionId: error.decisionId
+    } : {}
+  };
+}
 function classifyCliError(error) {
   if (CliError.isCliError(error)) {
     return {
@@ -13488,40 +13819,15 @@ function classifyCliError(error) {
       message
     };
   }
+  const decision = decisionErrorClass(e, message);
+  if (decision) return decision;
   const status = numericStatus(e);
-  if (status !== void 0) {
-    const statusCode = status;
-    if (status === 401) return {
-      code: "auth",
-      exitCode: CLI_EXIT.AUTH,
-      message,
-      statusCode
-    };
-    if (status === 403) return {
-      code: "forbidden",
-      exitCode: CLI_EXIT.FORBIDDEN,
-      message,
-      statusCode
-    };
-    if (status === 404) return {
-      code: "not_found",
-      exitCode: CLI_EXIT.NOT_FOUND,
-      message,
-      statusCode
-    };
-    if (status >= 400 && status < 500) return {
-      code: `http_${status}`,
-      exitCode: CLI_EXIT.FORBIDDEN,
-      message,
-      statusCode
-    };
-    if (status >= 500 || status === 0) return {
-      code: "unavailable",
-      exitCode: CLI_EXIT.UNAVAILABLE,
-      message,
-      statusCode
-    };
-  }
+  const byStatus = status === void 0 ? void 0 : statusClass(status);
+  if (byStatus) return {
+    ...byStatus,
+    message,
+    statusCode: status
+  };
   const causeCode = e.cause?.code;
   if (typeof e.code === "string" && NETWORK_ERRNO.has(e.code) || typeof causeCode === "string" && NETWORK_ERRNO.has(causeCode) || e.name === "AbortError" || e.name === "TimeoutError" || NETWORK_MESSAGE.test(message)) {
     return {
@@ -13560,20 +13866,26 @@ function renderCliError(reported, options = {}) {
   if (options.stack) lines.push("", options.stack);
   return lines;
 }
-function cliErrorEnvelope(error) {
+function cliErrorDetail(error) {
   const reported = classifyCliError(error);
+  return {
+    code: reported.serverCode ?? reported.code,
+    ...reported.statusCode !== void 0 ? {
+      statusCode: reported.statusCode
+    } : {},
+    message: reported.message,
+    ...reported.issues?.length ? {
+      issues: reported.issues
+    } : {},
+    ...reported.decisionId ? {
+      decisionId: reported.decisionId
+    } : {}
+  };
+}
+function cliErrorEnvelope(error) {
   return {
     success: false,
-    error: {
-      code: reported.serverCode ?? reported.code,
-      ...reported.statusCode !== void 0 ? {
-        statusCode: reported.statusCode
-      } : {},
-      message: reported.message,
-      ...reported.issues?.length ? {
-        issues: reported.issues
-      } : {}
-    }
+    error: cliErrorDetail(error)
   };
 }
 function reportCliError(error, options = {}) {
@@ -13612,10 +13924,12 @@ function reportUnhandledCliError(error) {
   process.exitCode = reported.exitCode;
   return reported.exitCode;
 }
-var CLI_EXIT, CliError, HandledCliError, debugFlag, NETWORK_ERRNO, NETWORK_MESSAGE, UNAVAILABLE_HINT, VENDOR_RETRY_SOON_SECONDS, VENDOR_LABELS, PROVIDER_REJECTED_SERVER_CODE, PROVIDER_REJECTED_HTTP_STATUS, PROVIDER_REJECTION_REASONS, PROVIDER_REJECTED_NO_RETRY, PROVIDER_REJECTED_LUA_SIDE, MODEL_SETTINGS_URL, CLI_EXIT_CODE_HELP;
+var CLI_EXIT, CliError, EDGE_BLOCKED_CODE, HandledCliError, debugFlag, NETWORK_ERRNO, NETWORK_MESSAGE, UNAVAILABLE_HINT, VENDOR_RETRY_SOON_SECONDS, VENDOR_LABELS, PROVIDER_REJECTED_SERVER_CODE, PROVIDER_REJECTED_HTTP_STATUS, PROVIDER_REJECTION_REASONS, PROVIDER_REJECTED_NO_RETRY, PROVIDER_REJECTED_LUA_SIDE, MODEL_SETTINGS_URL, DECISION_STATUS, CLI_EXIT_CODE_HELP;
 var init_cli_error = __esm({
   "src/errors/cli.error.ts"() {
     "use strict";
+    init_dist();
+    init_decisions_api();
     init_auth_error();
     CLI_EXIT = {
       OK: 0,
@@ -13726,6 +14040,9 @@ var init_cli_error = __esm({
     __name(isTypedCliError, "isTypedCliError");
     __name(listHint, "listHint");
     __name(joinHint, "joinHint");
+    EDGE_BLOCKED_CODE = "EDGE_BLOCKED";
+    __name(isLuaErrorBody, "isLuaErrorBody");
+    __name(isEdgeBlockedError, "isEdgeBlockedError");
     __name(isAccessDeniedError, "isAccessDeniedError");
     HandledCliError = class extends Error {
       static {
@@ -13792,9 +14109,22 @@ var init_cli_error = __esm({
     __name(providerRejectedHint, "providerRejectedHint");
     __name(authHint, "authHint");
     __name(numericStatus, "numericStatus");
+    __name(statusClass, "statusClass");
+    DECISION_STATUS = {
+      [DECISION_ERROR_CODES.INVALID]: 400,
+      [DECISION_ERROR_CODES.INSUFFICIENT_CREDITS]: 402,
+      [DECISION_ERROR_CODES.NOT_FOUND]: 404,
+      [DECISION_ERROR_CODES.REJECTED]: 422,
+      [DECISION_ERROR_CODES.TIMEOUT]: 503,
+      [DECISION_ERROR_CODES.UNAVAILABLE]: 503,
+      [DECISION_ERROR_CODES.DISABLED]: 503,
+      [DECISION_ERROR_CODES.CANCELLED]: 400
+    };
+    __name(decisionErrorClass, "decisionErrorClass");
     __name(classifyCliError, "classifyCliError");
     __name(issueLines, "issueLines");
     __name(renderCliError, "renderCliError");
+    __name(cliErrorDetail, "cliErrorDetail");
     __name(cliErrorEnvelope, "cliErrorEnvelope");
     __name(reportCliError, "reportCliError");
     __name(commanderExitCode, "commanderExitCode");
@@ -14832,12 +15162,12 @@ function renderWorkflowJobTarget(target, initData) {
     templated: true
   };
 }
-var __defProp4, __name4, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_READ_ONLY_DROPPED, WORKFLOW_JOB_DEFAULT_TOOLS, WORKFLOW_JOB_PLUGINS, WORKFLOW_JOB_PLUGIN_ROOT, WORKFLOW_JOB_PLUGINS_MAX, WORKFLOW_JOB_TARGET_TEMPLATE_RE, TARGET_PATH_SEGMENT_RE;
+var __defProp5, __name5, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_READ_ONLY_DROPPED, WORKFLOW_JOB_DEFAULT_TOOLS, WORKFLOW_JOB_PLUGINS, WORKFLOW_JOB_PLUGIN_ROOT, WORKFLOW_JOB_PLUGINS_MAX, WORKFLOW_JOB_TARGET_TEMPLATE_RE, TARGET_PATH_SEGMENT_RE;
 var init_workflow_job_tools = __esm({
   "../shared-types/dist/workflow-job-tools.mjs"() {
     "use strict";
-    __defProp4 = Object.defineProperty;
-    __name4 = /* @__PURE__ */ __name((target, value3) => __defProp4(target, "name", { value: value3, configurable: true }), "__name");
+    __defProp5 = Object.defineProperty;
+    __name5 = /* @__PURE__ */ __name((target, value3) => __defProp5(target, "name", { value: value3, configurable: true }), "__name");
     WORKFLOW_JOB_TOOLS = [
       "shell",
       "read",
@@ -14866,34 +15196,34 @@ var init_workflow_job_tools = __esm({
       "git"
     ];
     __name(effectiveJobTools, "effectiveJobTools");
-    __name4(effectiveJobTools, "effectiveJobTools");
+    __name5(effectiveJobTools, "effectiveJobTools");
     WORKFLOW_JOB_PLUGINS = [
       "lua-agent-builder"
     ];
     WORKFLOW_JOB_PLUGIN_ROOT = "/opt/lua/plugins";
     WORKFLOW_JOB_PLUGINS_MAX = 4;
     __name(isWorkflowJobPluginId, "isWorkflowJobPluginId");
-    __name4(isWorkflowJobPluginId, "isWorkflowJobPluginId");
+    __name5(isWorkflowJobPluginId, "isWorkflowJobPluginId");
     __name(workflowJobPluginDir, "workflowJobPluginDir");
-    __name4(workflowJobPluginDir, "workflowJobPluginDir");
+    __name5(workflowJobPluginDir, "workflowJobPluginDir");
     __name(workflowJobPluginsProblem, "workflowJobPluginsProblem");
-    __name4(workflowJobPluginsProblem, "workflowJobPluginsProblem");
+    __name5(workflowJobPluginsProblem, "workflowJobPluginsProblem");
     WORKFLOW_JOB_TARGET_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*\}$/;
     TARGET_PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
     __name(workflowJobTargetTemplatePath, "workflowJobTargetTemplatePath");
-    __name4(workflowJobTargetTemplatePath, "workflowJobTargetTemplatePath");
+    __name5(workflowJobTargetTemplatePath, "workflowJobTargetTemplatePath");
     __name(isWorkflowJobTargetTemplate, "isWorkflowJobTargetTemplate");
-    __name4(isWorkflowJobTargetTemplate, "isWorkflowJobTargetTemplate");
+    __name5(isWorkflowJobTargetTemplate, "isWorkflowJobTargetTemplate");
     __name(workflowJobLuaApiProblem, "workflowJobLuaApiProblem");
-    __name4(workflowJobLuaApiProblem, "workflowJobLuaApiProblem");
+    __name5(workflowJobLuaApiProblem, "workflowJobLuaApiProblem");
     __name(workflowJobUsesLuaApi, "workflowJobUsesLuaApi");
-    __name4(workflowJobUsesLuaApi, "workflowJobUsesLuaApi");
+    __name5(workflowJobUsesLuaApi, "workflowJobUsesLuaApi");
     __name(workflowJobTargetProblem, "workflowJobTargetProblem");
-    __name4(workflowJobTargetProblem, "workflowJobTargetProblem");
+    __name5(workflowJobTargetProblem, "workflowJobTargetProblem");
     __name(readInitDataPath, "readInitDataPath");
-    __name4(readInitDataPath, "readInitDataPath");
+    __name5(readInitDataPath, "readInitDataPath");
     __name(renderWorkflowJobTarget, "renderWorkflowJobTarget");
-    __name4(renderWorkflowJobTarget, "renderWorkflowJobTarget");
+    __name5(renderWorkflowJobTarget, "renderWorkflowJobTarget");
   }
 });
 
@@ -15001,7 +15331,7 @@ function isMapDescriptor(v) {
   if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
   const d = v;
   const keys = Object.keys(d);
-  const only = /* @__PURE__ */ __name5((...allowed2) => keys.every((k) => allowed2.includes(k)), "only");
+  const only = /* @__PURE__ */ __name6((...allowed2) => keys.every((k) => allowed2.includes(k)), "only");
   if ("value" in d) return keys.length === 1;
   if ("template" in d) return keys.length === 1 && typeof d.template === "string";
   if ("requestContextPath" in d) return keys.length === 1 && typeof d.requestContextPath === "string";
@@ -15280,13 +15610,13 @@ function validateApproverBlock(node, opts = {
   path: "approval"
 }) {
   const issues = [];
-  const push = /* @__PURE__ */ __name5((code, path32, message, severity = "error") => issues.push({
+  const push = /* @__PURE__ */ __name6((code, path32, message, severity = "error") => issues.push({
     code,
     path: path32,
     severity,
     message
   }), "push");
-  const checkSpec = /* @__PURE__ */ __name5((spec, path32) => {
+  const checkSpec = /* @__PURE__ */ __name6((spec, path32) => {
     const r = ApproverSpecSchema.safeParse(spec);
     if (!r.success) {
       const users = spec?.users;
@@ -15641,7 +15971,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   static: true
 }) {
   const issues = [];
-  const err = /* @__PURE__ */ __name5((code, message, path32, stepId) => {
+  const err = /* @__PURE__ */ __name6((code, message, path32, stepId) => {
     issues.push({
       code,
       message,
@@ -15650,7 +15980,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       stepId
     });
   }, "err");
-  const warn = /* @__PURE__ */ __name5((code, message, path32, stepId) => {
+  const warn = /* @__PURE__ */ __name6((code, message, path32, stepId) => {
     issues.push({
       code,
       message,
@@ -15717,7 +16047,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     ownKeys.add(key);
     declaredKeys.add(key);
   });
-  const undeclaredKey = /* @__PURE__ */ __name5((ref) => typeof ref === "string" && !declaredKeys.has(ref) && isConnectionKeyShaped(ref) && opts.connectionIds?.has(ref) !== true, "undeclaredKey");
+  const undeclaredKey = /* @__PURE__ */ __name6((ref) => typeof ref === "string" && !declaredKeys.has(ref) && isConnectionKeyShaped(ref) && opts.connectionIds?.has(ref) !== true, "undeclaredKey");
   const credentialsRef = envelopeWorkspace?.credentialsRef;
   if (undeclaredKey(credentialsRef)) {
     err("connection-key-undeclared", connectionKeyUndeclaredMessage("workspace.credentialsRef", credentialsRef), "workspace.credentialsRef");
@@ -15725,7 +16055,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const seen = /* @__PURE__ */ new Map();
   let nodeCount = 0;
   const upstream = /* @__PURE__ */ new Set();
-  const checkId = /* @__PURE__ */ __name5((id2, path32) => {
+  const checkId = /* @__PURE__ */ __name6((id2, path32) => {
     nodeCount += 1;
     if (seen.has(id2)) {
       err("duplicate-step-id", `step id "${id2}" is declared twice (first at ${seen.get(id2)})`, path32, id2);
@@ -15733,9 +16063,9 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       seen.set(id2, path32);
     }
   }, "checkId");
-  const checkPolicyEnums = /* @__PURE__ */ __name5((node, path32) => {
+  const checkPolicyEnums = /* @__PURE__ */ __name6((node, path32) => {
     const id2 = singleId(node);
-    const check = /* @__PURE__ */ __name5((member, allowed2) => {
+    const check = /* @__PURE__ */ __name6((member, allowed2) => {
       const value22 = node[member];
       if (value22 === void 0 || typeof value22 === "string" && allowed2.includes(value22)) return;
       err("invalid-envelope", `\`${member}\` must be ${allowed2.map((a) => `'${a}'`).join(" | ")} (got ${JSON.stringify(value22)})`, `${path32}.${member}`, id2);
@@ -15743,7 +16073,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     check("sideEffects", WORKFLOW_SIDE_EFFECTS);
     check("jobResources", WORKFLOW_JOB_RESOURCES);
   }, "checkPolicyEnums");
-  const checkRetry = /* @__PURE__ */ __name5((node, path32) => {
+  const checkRetry = /* @__PURE__ */ __name6((node, path32) => {
     const r = node.retry;
     if (!r) return;
     const id2 = singleId(node);
@@ -15769,7 +16099,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       }
     }
   }, "checkRetry");
-  const checkTimeout = /* @__PURE__ */ __name5((node, path32) => {
+  const checkTimeout = /* @__PURE__ */ __name6((node, path32) => {
     const t = node.timeoutSeconds;
     if (t === void 0) return;
     const id2 = singleId(node);
@@ -15788,7 +16118,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("timeout-exceeds-tier", `timeoutSeconds ${t} exceeds the worker tier's ${caps.maxWorkerTimeoutSeconds} s \u2014 steps longer than 10 min run on the Job tier: add tier:'job' (up to ${caps.maxJobSegmentSeconds} s)`, `${path32}.timeoutSeconds`, id2);
     }
   }, "checkTimeout");
-  const checkSpecialistRole = /* @__PURE__ */ __name5((node, path32) => {
+  const checkSpecialistRole = /* @__PURE__ */ __name6((node, path32) => {
     const role = node.role;
     const hasRef = typeof role.ref === "string";
     const hasInline = role.name !== void 0 || role.instructions !== void 0 || Array.isArray(role.tools) && role.tools.length > 0;
@@ -15820,7 +16150,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       }
     }
   }, "checkSpecialistRole");
-  const checkRequiredConnections = /* @__PURE__ */ __name5((node, path32) => {
+  const checkRequiredConnections = /* @__PURE__ */ __name6((node, path32) => {
     const required = node.requiredConnections;
     if (!Array.isArray(required)) return;
     const undeclared = required.filter(undeclaredKey);
@@ -15833,7 +16163,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("required-connection-unknown", `requiredConnections ${JSON.stringify(unknown)} are neither declared connections[].key values nor connections the owner can mount`, `${path32}.requiredConnections`, singleId(node));
     }
   }, "checkRequiredConnections");
-  const jobClassifiablePin = /* @__PURE__ */ __name5((model) => {
+  const jobClassifiablePin = /* @__PURE__ */ __name6((model) => {
     const pin = staticModelPin(model);
     const modelClass = modelClassOf(pin);
     if (modelClass === void 0) return pin;
@@ -15848,7 +16178,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     return void 0;
   }, "jobClassifiablePin");
-  const checkTier = /* @__PURE__ */ __name5((node, path32) => {
+  const checkTier = /* @__PURE__ */ __name6((node, path32) => {
     const id2 = singleId(node);
     if (node.workspace && node.workspace !== "inherit" && node.tier !== void 0 && node.tier !== "job") {
       err("workspace-requires-job-tier", "a step mounting a workspace must be tier:'job'", `${path32}.workspace`, id2);
@@ -15864,7 +16194,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       err("job-tier-provider-unsupported", `model provider '${provider}' is outside LUA_WF_JOB_PROVIDERS [${opts.policy.jobProviders.join(", ")}]`, `${path32}.model`, id2);
     }
   }, "checkTier");
-  const checkModel = /* @__PURE__ */ __name5((node, path32) => {
+  const checkModel = /* @__PURE__ */ __name6((node, path32) => {
     if (node.type !== "agent" || typeof node.model !== "string") return;
     const id2 = singleId(node);
     const parsed = parseModelTemplate(node.model);
@@ -15881,7 +16211,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const pin = parsed.kind === "template" ? parsed.template.default : node.model;
     if (pin === void 0) return;
     if (isModelClassRef(pin)) return;
-    const inContext = /* @__PURE__ */ __name5((message) => parsed.kind === "template" ? `${message} (the default of ${parsed.template.placeholder})` : message, "inContext");
+    const inContext = /* @__PURE__ */ __name6((message) => parsed.kind === "template" ? `${message} (the default of ${parsed.template.placeholder})` : message, "inContext");
     const registry = opts.approvedModels;
     if (registry === void 0) return;
     if (registry === "unavailable") {
@@ -15894,13 +16224,13 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const resolved2 = normalizeModelId(pin, registry);
     if (!resolved2.ok) err("model-unresolved", inContext(modelUnresolvedMessage(resolved2)), `${path32}.model`, id2);
   }, "checkModel");
-  const checkTaskClass = /* @__PURE__ */ __name5((node, path32) => {
+  const checkTaskClass = /* @__PURE__ */ __name6((node, path32) => {
     if (node.type !== "agent" || node.taskClass === void 0) return;
     if (!opts.static) return;
     if (typeof node.model === "string" && node.model.trim()) return;
     err("task-class-without-model", `taskClass '${String(node.taskClass)}' needs a \`model\` on a pushed definition \u2014 write a class (model: 'class/fast' | 'class/balanced' | 'class/strong') or an approved provider/model code; nothing maps a task class to a model at dispatch, so a step with neither would run on the agent\u2019s own model`, `${path32}.taskClass`, singleId(node));
   }, "checkTaskClass");
-  const checkWorkspace = /* @__PURE__ */ __name5((node, path32) => {
+  const checkWorkspace = /* @__PURE__ */ __name6((node, path32) => {
     const id2 = singleId(node);
     const ws = workspaceOf(node);
     if (isJobTier(node) && opts.policy && opts.policy.jobTier !== true) {
@@ -15970,16 +16300,16 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
   }, "checkWorkspace");
   const outputSchemas = /* @__PURE__ */ new Map();
-  const recordOutputSchema = /* @__PURE__ */ __name5((node) => {
+  const recordOutputSchema = /* @__PURE__ */ __name6((node) => {
     const schema = node.type === "step" ? node.step.outputSchema : node.type === "agent" ? node.outputSchema : void 0;
     if (schema !== void 0) outputSchemas.set(singleId(node), schema);
   }, "recordOutputSchema");
-  const checkMapMembers = /* @__PURE__ */ __name5((cfg, basePath, id2) => {
+  const checkMapMembers = /* @__PURE__ */ __name6((cfg, basePath, id2) => {
     for (const m of malformedMapMembers(cfg)) {
       warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id2, m), `${basePath}.${m.member}`, id2);
     }
   }, "checkMapMembers");
-  const checkInputShape = /* @__PURE__ */ __name5((node, path32) => {
+  const checkInputShape = /* @__PURE__ */ __name6((node, path32) => {
     const input = node.input;
     if (input === void 0) return;
     const id2 = singleId(node);
@@ -15989,11 +16319,11 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path32}.input`, id2);
   }, "checkInputShape");
-  const checkBodyInput = /* @__PURE__ */ __name5((body, path32, container) => {
+  const checkBodyInput = /* @__PURE__ */ __name6((body, path32, container) => {
     if (body.type === "workflow" || body.input === void 0) return;
     err("arm-input-unsupported", container === "foreach" ? `a foreach body receives each item as its input \u2014 drop \`input\` on "${singleId(body)}" and map the items before the foreach instead` : `a loop body receives the previous output as its input \u2014 drop \`input\` on "${singleId(body)}" and put the map before the loop instead`, `${path32}.input`, singleId(body));
   }, "checkBodyInput");
-  const checkSingle = /* @__PURE__ */ __name5((node, path32, depth) => {
+  const checkSingle = /* @__PURE__ */ __name6((node, path32, depth) => {
     recordOutputSchema(node);
     if (node.type === "workflow" && (typeof node.workflowId !== "string" || node.workflowId.length === 0)) {
       checkId(node.id, path32);
@@ -16043,7 +16373,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       }
     }
   }, "checkSingle");
-  const checkHitl = /* @__PURE__ */ __name5((node, path32) => {
+  const checkHitl = /* @__PURE__ */ __name6((node, path32) => {
     if (node.type === "waitForSignal") {
       const w = node;
       checkId(w.id, path32);
@@ -16089,7 +16419,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
       }
     }
   }, "checkHitl");
-  const checkHitlArm = /* @__PURE__ */ __name5((node, path32, container) => {
+  const checkHitlArm = /* @__PURE__ */ __name6((node, path32, container) => {
     if (!workflowContainerRunsHitlArm(container)) {
       checkId(node.id, path32);
       err("node-type-unsupported-in-container", workflowHitlArmUnsupportedMessage(node.type, node.id, container), path32, node.id);
@@ -16097,7 +16427,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     checkHitl(node, path32);
   }, "checkHitlArm");
-  const checkArm = /* @__PURE__ */ __name5((arm, path32, depth, container) => {
+  const checkArm = /* @__PURE__ */ __name6((arm, path32, depth, container) => {
     if (arm.type === "mapping") {
       checkId(arm.id, path32);
       checkMapMembers(readMapConfig(arm.mapConfig), `${path32}.mapConfig`, arm.id);
@@ -16333,7 +16663,7 @@ function isWellFormedPredicate(p) {
 }
 function canonicalJson(value22) {
   const seen = /* @__PURE__ */ new WeakSet();
-  const encode = /* @__PURE__ */ __name5((v) => {
+  const encode = /* @__PURE__ */ __name6((v) => {
     if (v === null || typeof v === "number" || typeof v === "boolean") return JSON.stringify(v);
     if (typeof v === "string") return JSON.stringify(v);
     if (typeof v === "bigint") return JSON.stringify(`${v}n`);
@@ -16360,7 +16690,7 @@ function hashGraph(g) {
 function compilePlan(g) {
   const steps = {};
   const order = [];
-  const addNode = /* @__PURE__ */ __name5((id2, node) => {
+  const addNode = /* @__PURE__ */ __name6((id2, node) => {
     if (id2 in steps) {
       throw new WorkflowPlanError("duplicate-step-id", `Duplicate step id "${id2}" in definition.graph`);
     }
@@ -16690,7 +17020,7 @@ function renderRef(ref) {
 function step(s) {
   const id2 = stepIdOf(s);
   return {
-    path: /* @__PURE__ */ __name5((p) => ({
+    path: /* @__PURE__ */ __name6((p) => ({
       path: p === "" ? `stepResults.${id2}` : `stepResults.${id2}.${p}`
     }), "path")
   };
@@ -16778,7 +17108,7 @@ function resolvePlacements(calls) {
   const declared = /* @__PURE__ */ new Map();
   const placedBy = /* @__PURE__ */ new Map();
   const allIds = /* @__PURE__ */ new Map();
-  const claimId = /* @__PURE__ */ __name5((id2, callIndex) => {
+  const claimId = /* @__PURE__ */ __name6((id2, callIndex) => {
     const first = allIds.get(id2);
     if (first !== void 0 && first !== callIndex) {
       issues.push({
@@ -16818,7 +17148,7 @@ function resolvePlacements(calls) {
         break;
     }
   });
-  const armMapPlacementIssue = /* @__PURE__ */ __name5((node, ref, i, container) => {
+  const armMapPlacementIssue = /* @__PURE__ */ __name6((node, ref, i, container) => {
     if (!ref.armMap || node.type === "mapping" || isHitlNode2(node)) return void 0;
     const id2 = nodeIdOf(node);
     if ((container === "foreach" || container === "loop") && node.type !== "workflow") {
@@ -16839,7 +17169,7 @@ function resolvePlacements(calls) {
     }
     return void 0;
   }, "armMapPlacementIssue");
-  const hitlPlacementIssue = /* @__PURE__ */ __name5((node, ref, i, container) => {
+  const hitlPlacementIssue = /* @__PURE__ */ __name6((node, ref, i, container) => {
     if (!isHitlNode2(node)) return void 0;
     const id2 = node.id;
     if (ref.armMap) {
@@ -16860,7 +17190,7 @@ function resolvePlacements(calls) {
     }
     return void 0;
   }, "hitlPlacementIssue");
-  const resolve7 = /* @__PURE__ */ __name5((ref, i, allowMapping, container) => {
+  const resolve7 = /* @__PURE__ */ __name6((ref, i, allowMapping, container) => {
     if ("node" in ref) {
       if (ref.node.type === "mapping" && !allowMapping) {
         issues.push({
@@ -16915,7 +17245,7 @@ function resolvePlacements(calls) {
     placedBy.set(ref.ref, i);
     return d.node;
   }, "resolve");
-  const claim = /* @__PURE__ */ __name5((ref, i, allowMapping, container) => {
+  const claim = /* @__PURE__ */ __name6((ref, i, allowMapping, container) => {
     if ("ref" in ref) {
       resolve7(ref, i, allowMapping, container);
       return;
@@ -16950,7 +17280,7 @@ function resolvePlacements(calls) {
     }
   });
   const graph = [];
-  const lookup = /* @__PURE__ */ __name5((ref) => {
+  const lookup = /* @__PURE__ */ __name6((ref) => {
     const n2 = "node" in ref ? ref.node : declared.get(ref.ref)?.node;
     if (!n2 || !ref.armMap || n2.type === "mapping" || isHitlNode2(n2)) return n2;
     return inlineContainerArm(ref.armMap, n2);
@@ -17093,11 +17423,11 @@ function seedLedgerFromRun(run, steps, targetPlan, opts = {}) {
   const seeded = [];
   const unseeded = [];
   const known = new Set(Object.keys(targetPlan.steps));
-  const parentOf = /* @__PURE__ */ __name5((id2) => {
+  const parentOf = /* @__PURE__ */ __name6((id2) => {
     const m = /^(.*)(\[\d+\]|#\d+)$/.exec(id2);
     return m ? m[1] : void 0;
   }, "parentOf");
-  const dependsOf = /* @__PURE__ */ __name5((id2) => {
+  const dependsOf = /* @__PURE__ */ __name6((id2) => {
     const node = targetPlan.steps[id2];
     if (node) return node.dependsOn;
     const parent = parentOf(id2);
@@ -17184,7 +17514,7 @@ function replayLedger(g, ledger) {
     startedAt: 0,
     ...ledger.requestContext
   };
-  const ctxFor = /* @__PURE__ */ __name5((id2) => ({
+  const ctxFor = /* @__PURE__ */ __name6((id2) => ({
     initData: ledger.initData,
     stepResults: ancestorResults(plan, id2, rows22),
     state: ledger.state ?? {},
@@ -17266,7 +17596,7 @@ function ancestorResults(plan, id2, rows22) {
   const out = {};
   const joinAliased = /* @__PURE__ */ new Set();
   const seen = /* @__PURE__ */ new Set();
-  const take = /* @__PURE__ */ __name5((rowId) => {
+  const take = /* @__PURE__ */ __name6((rowId) => {
     const hit = replayResultOf(rows22.get(rowId), plan.steps[rowId]);
     if (!hit) return void 0;
     if (!joinAliased.has(rowId)) out[rowId] = hit.value;
@@ -17283,7 +17613,7 @@ function ancestorResults(plan, id2, rows22) {
     }
     return hit;
   }, "take");
-  const walk22 = /* @__PURE__ */ __name5((ids) => {
+  const walk22 = /* @__PURE__ */ __name6((ids) => {
     for (const dep of ids) {
       if (seen.has(dep)) continue;
       seen.add(dep);
@@ -17509,8 +17839,8 @@ function runWorkspaceView(ws) {
 function runSuspendedForView(run) {
   const s = run.suspendedFor;
   if (!s || typeof s !== "object" || typeof s.kind !== "string" || isTerminalRunStatus(run.status)) return void 0;
-  const str3 = /* @__PURE__ */ __name5((v) => typeof v === "string" && v ? v : void 0, "str");
-  const num = /* @__PURE__ */ __name5((v) => typeof v === "number" && Number.isFinite(v) ? v : void 0, "num");
+  const str3 = /* @__PURE__ */ __name6((v) => typeof v === "string" && v ? v : void 0, "str");
+  const num = /* @__PURE__ */ __name6((v) => typeof v === "number" && Number.isFinite(v) ? v : void 0, "num");
   const dimension = str3(s.dimension);
   return pruneUndefined({
     kind: s.kind,
@@ -17665,7 +17995,7 @@ function timeZoneSupported(tz) {
 }
 function validateBusinessHours(cal, path32 = "businessHours") {
   const issues = [];
-  const issue = /* @__PURE__ */ __name5((p, message) => issues.push({
+  const issue = /* @__PURE__ */ __name6((p, message) => issues.push({
     code: "business-hours-invalid",
     path: p,
     message
@@ -17734,7 +18064,7 @@ function formatter(tz) {
 }
 function localParts(ms, tz) {
   const parts = formatter(tz).formatToParts(new Date(ms));
-  const get = /* @__PURE__ */ __name5((t) => parts.find((p) => p.type === t)?.value ?? "", "get");
+  const get = /* @__PURE__ */ __name6((t) => parts.find((p) => p.type === t)?.value ?? "", "get");
   const hour = Number(get("hour")) % 24;
   return {
     year: Number(get("year")),
@@ -17904,7 +18234,7 @@ function matchesEditablePath(pointer, editablePaths, op = "replace") {
 }
 function changedPointers(before, after, base = "") {
   if (before === after) return [];
-  const isObj = /* @__PURE__ */ __name5((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObj");
+  const isObj = /* @__PURE__ */ __name6((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObj");
   if (Array.isArray(before) && Array.isArray(after)) {
     if (before.length !== after.length) return [
       base || "/"
@@ -18112,7 +18442,7 @@ function rebaseItemPointer(pointer, itemsPath, index) {
 }
 function validateWorkflowSchedule(schedule, path32 = "/schedule") {
   if (schedule === void 0 || schedule === null) return [];
-  const issue = /* @__PURE__ */ __name5((at, detail) => [
+  const issue = /* @__PURE__ */ __name6((at, detail) => [
     {
       code: WORKFLOW_SCHEDULE_SHAPE_ISSUE,
       severity: "error",
@@ -18162,7 +18492,7 @@ function validateWorkflowSchedule(schedule, path32 = "/schedule") {
 }
 function collectEnvTemplateKeys(value22) {
   const keys = /* @__PURE__ */ new Set();
-  const walk22 = /* @__PURE__ */ __name5((v) => {
+  const walk22 = /* @__PURE__ */ __name6((v) => {
     if (isEnvRef(v)) {
       keys.add(v.__envRef);
       return;
@@ -18189,7 +18519,7 @@ function collectEnvTemplateKeys(value22) {
 }
 function substituteEnvRefs(value22, overlay) {
   const missing = /* @__PURE__ */ new Set();
-  const walk22 = /* @__PURE__ */ __name5((v, slot = false) => {
+  const walk22 = /* @__PURE__ */ __name6((v, slot = false) => {
     if (isEnvRef(v)) {
       if (Object.prototype.hasOwnProperty.call(overlay, v.__envRef)) {
         const s = overlay[v.__envRef];
@@ -18399,7 +18729,7 @@ function estimateGraph(envelopeOrGraph) {
   };
 }
 function* singleStepsOf(entry) {
-  if (!isRecord3(entry)) return;
+  if (!isRecord4(entry)) return;
   switch (entry.type) {
     case "step":
     case "agent":
@@ -18423,8 +18753,8 @@ function* singleStepsOf(entry) {
   }
 }
 function entriesOf(graph) {
-  const definition = isRecord3(graph) ? graph.definition : void 0;
-  const entries = isRecord3(definition) ? definition.graph : void 0;
+  const definition = isRecord4(graph) ? graph.definition : void 0;
+  const entries = isRecord4(definition) ? definition.graph : void 0;
   return Array.isArray(entries) ? entries : [];
 }
 function inheritTargets(graphs) {
@@ -18441,7 +18771,7 @@ function inheritTargets(graphs) {
   return targets;
 }
 function needsInheritedWorkspace(graph) {
-  if (!isRecord3(graph) || graph.workspace !== void 0) return false;
+  if (!isRecord4(graph) || graph.workspace !== void 0) return false;
   for (const entry of entriesOf(graph)) {
     for (const node of singleStepsOf(entry)) {
       if (node.workspace !== void 0 && node.workspace !== "inherit") return true;
@@ -18522,7 +18852,7 @@ function collectJobTierSteps(entry, out) {
       return;
   }
 }
-var __defProp5, __name5, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_MODEL_TEMPLATE_ROOT, WORKFLOW_MODEL_TEMPLATE_RE, PATH_SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, APPROVAL_REMIND_AFTER_HOURS_MIN, APPROVAL_REMIND_AFTER_HOURS_MAX, APPROVAL_TIMEOUT_HOURS_MIN, APPROVAL_TIMEOUT_HOURS_MAX, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_WORKSPACE_TTL_MAX_HOURS_DEFAULT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS2, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, SUSPENDED_FOR_DIMENSIONS, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_SCHEDULE_TYPES, WORKFLOW_SCHEDULE_SHAPE_ISSUE, WORKFLOW_SCHEDULE_SHAPES_HINT, WORKFLOW_SCHEDULE_RUN_AS, isObject, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord3;
+var __defProp6, __name6, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_MODEL_TEMPLATE_ROOT, WORKFLOW_MODEL_TEMPLATE_RE, PATH_SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, APPROVAL_REMIND_AFTER_HOURS_MIN, APPROVAL_REMIND_AFTER_HOURS_MAX, APPROVAL_TIMEOUT_HOURS_MIN, APPROVAL_TIMEOUT_HOURS_MAX, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_WORKSPACE_TTL_MAX_HOURS_DEFAULT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS2, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, SUSPENDED_FOR_DIMENSIONS, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_SCHEDULE_TYPES, WORKFLOW_SCHEDULE_SHAPE_ISSUE, WORKFLOW_SCHEDULE_SHAPES_HINT, WORKFLOW_SCHEDULE_RUN_AS, isObject, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord4;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
@@ -18536,14 +18866,14 @@ var init_dist2 = __esm({
     init_dist();
     init_dist();
     init_dist();
-    __defProp5 = Object.defineProperty;
-    __name5 = /* @__PURE__ */ __name((target, value22) => __defProp5(target, "name", { value: value22, configurable: true }), "__name");
+    __defProp6 = Object.defineProperty;
+    __name6 = /* @__PURE__ */ __name((target, value22) => __defProp6(target, "name", { value: value22, configurable: true }), "__name");
     WorkflowTemplateError = class extends Error {
       static {
         __name(this, "WorkflowTemplateError");
       }
       static {
-        __name5(this, "WorkflowTemplateError");
+        __name6(this, "WorkflowTemplateError");
       }
       placeholder;
       constructor(message, placeholder) {
@@ -18552,11 +18882,11 @@ var init_dist2 = __esm({
       }
     };
     __name(isMapConfigObject, "isMapConfigObject");
-    __name5(isMapConfigObject, "isMapConfigObject");
+    __name6(isMapConfigObject, "isMapConfigObject");
     __name(parseMapConfig, "parseMapConfig");
-    __name5(parseMapConfig, "parseMapConfig");
+    __name6(parseMapConfig, "parseMapConfig");
     __name(mapConfigWire, "mapConfigWire");
-    __name5(mapConfigWire, "mapConfigWire");
+    __name6(mapConfigWire, "mapConfigWire");
     TEMPLATE_PLACEHOLDER = /\$\{([^}]*)\}/g;
     TEMPLATE_NAMESPACES = [
       "initData",
@@ -18565,21 +18895,21 @@ var init_dist2 = __esm({
       "stepResults"
     ];
     __name(describeBadPlaceholder, "describeBadPlaceholder");
-    __name5(describeBadPlaceholder, "describeBadPlaceholder");
+    __name6(describeBadPlaceholder, "describeBadPlaceholder");
     __name(parseTemplatePlaceholder, "parseTemplatePlaceholder");
-    __name5(parseTemplatePlaceholder, "parseTemplatePlaceholder");
+    __name6(parseTemplatePlaceholder, "parseTemplatePlaceholder");
     __name(traverseMappingPath, "traverseMappingPath");
-    __name5(traverseMappingPath, "traverseMappingPath");
+    __name6(traverseMappingPath, "traverseMappingPath");
     __name(stringifyTemplateValue, "stringifyTemplateValue");
-    __name5(stringifyTemplateValue, "stringifyTemplateValue");
+    __name6(stringifyTemplateValue, "stringifyTemplateValue");
     __name(escapeFence, "escapeFence");
-    __name5(escapeFence, "escapeFence");
+    __name6(escapeFence, "escapeFence");
     __name(fenceBlock, "fenceBlock");
-    __name5(fenceBlock, "fenceBlock");
+    __name6(fenceBlock, "fenceBlock");
     __name(renderTemplate, "renderTemplate");
-    __name5(renderTemplate, "renderTemplate");
+    __name6(renderTemplate, "renderTemplate");
     __name(isMapDescriptor, "isMapDescriptor");
-    __name5(isMapDescriptor, "isMapDescriptor");
+    __name6(isMapDescriptor, "isMapDescriptor");
     MAP_DESCRIPTOR_KEYS = [
       "step",
       "path",
@@ -18591,39 +18921,39 @@ var init_dist2 = __esm({
     ];
     MAP_MEMBER_MALFORMED_CODE = "map-member-malformed";
     __name(malformedMapMembers, "malformedMapMembers");
-    __name5(malformedMapMembers, "malformedMapMembers");
+    __name6(malformedMapMembers, "malformedMapMembers");
     __name(mapMemberMalformedMessage, "mapMemberMalformedMessage");
-    __name5(mapMemberMalformedMessage, "mapMemberMalformedMessage");
+    __name6(mapMemberMalformedMessage, "mapMemberMalformedMessage");
     __name(resolveDescriptor, "resolveDescriptor");
-    __name5(resolveDescriptor, "resolveDescriptor");
+    __name6(resolveDescriptor, "resolveDescriptor");
     __name(resolveMapping, "resolveMapping");
-    __name5(resolveMapping, "resolveMapping");
-    fromInit = /* @__PURE__ */ __name5((path32) => ({
+    __name6(resolveMapping, "resolveMapping");
+    fromInit = /* @__PURE__ */ __name6((path32) => ({
       initData: true,
       path: path32
     }), "fromInit");
-    fromStep = /* @__PURE__ */ __name5((s, path32 = "") => {
-      const idOf = /* @__PURE__ */ __name5((x) => typeof x === "string" ? x : x.id, "idOf");
+    fromStep = /* @__PURE__ */ __name6((s, path32 = "") => {
+      const idOf = /* @__PURE__ */ __name6((x) => typeof x === "string" ? x : x.id, "idOf");
       return {
         step: Array.isArray(s) ? s.map(idOf) : idOf(s),
         path: path32
       };
     }, "fromStep");
-    value = /* @__PURE__ */ __name5((v) => ({
+    value = /* @__PURE__ */ __name6((v) => ({
       value: v
     }), "value");
-    template = /* @__PURE__ */ __name5((s) => ({
+    template = /* @__PURE__ */ __name6((s) => ({
       template: s
     }), "template");
-    fromRequest = /* @__PURE__ */ __name5((path32) => ({
+    fromRequest = /* @__PURE__ */ __name6((path32) => ({
       requestContextPath: path32
     }), "fromRequest");
-    rows = /* @__PURE__ */ __name5((s, path32, page) => ({
+    rows = /* @__PURE__ */ __name6((s, path32, page) => ({
       step: typeof s === "string" ? s : s.id,
       path: path32,
       rows: page
     }), "rows");
-    fromKnowledge = /* @__PURE__ */ __name5((k) => ({
+    fromKnowledge = /* @__PURE__ */ __name6((k) => ({
       knowledge: k
     }), "fromKnowledge");
     SideEffectsSchema = z9.enum(WORKFLOW_SIDE_EFFECTS);
@@ -18632,23 +18962,23 @@ var init_dist2 = __esm({
     WORKFLOW_MODEL_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*(?:\|([^}]*))?\}$/;
     PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
     __name(looksLikeModelTemplate, "looksLikeModelTemplate");
-    __name5(looksLikeModelTemplate, "looksLikeModelTemplate");
+    __name6(looksLikeModelTemplate, "looksLikeModelTemplate");
     __name(parseModelTemplate, "parseModelTemplate");
-    __name5(parseModelTemplate, "parseModelTemplate");
+    __name6(parseModelTemplate, "parseModelTemplate");
     __name(modelTemplateInvalidMessage, "modelTemplateInvalidMessage");
-    __name5(modelTemplateInvalidMessage, "modelTemplateInvalidMessage");
+    __name6(modelTemplateInvalidMessage, "modelTemplateInvalidMessage");
     __name(modelTemplateDefaultRequiredMessage, "modelTemplateDefaultRequiredMessage");
-    __name5(modelTemplateDefaultRequiredMessage, "modelTemplateDefaultRequiredMessage");
+    __name6(modelTemplateDefaultRequiredMessage, "modelTemplateDefaultRequiredMessage");
     __name(staticModelPin, "staticModelPin");
-    __name5(staticModelPin, "staticModelPin");
+    __name6(staticModelPin, "staticModelPin");
     __name(readPath2, "readPath");
-    __name5(readPath2, "readPath");
+    __name6(readPath2, "readPath");
     __name(renderModelTemplate, "renderModelTemplate");
-    __name5(renderModelTemplate, "renderModelTemplate");
+    __name6(renderModelTemplate, "renderModelTemplate");
     __name(modelTemplateUnboundMessage, "modelTemplateUnboundMessage");
-    __name5(modelTemplateUnboundMessage, "modelTemplateUnboundMessage");
+    __name6(modelTemplateUnboundMessage, "modelTemplateUnboundMessage");
     __name(modelTemplateInputNotObjectMessage, "modelTemplateInputNotObjectMessage");
-    __name5(modelTemplateInputNotObjectMessage, "modelTemplateInputNotObjectMessage");
+    __name6(modelTemplateInputNotObjectMessage, "modelTemplateInputNotObjectMessage");
     APPROVER_SPEC_MAX_USERS = 20;
     ESCALATION_MAX_HOPS = 3;
     TemplateBindingSchema = z22.object({
@@ -18714,7 +19044,7 @@ var init_dist2 = __esm({
     APPROVER_WRITTEN_MAX = 120;
     USER_ID_SHAPED_RE = /^[^\s@]{1,128}$/;
     __name(describeApproverSpecRefusal, "describeApproverSpecRefusal");
-    __name5(describeApproverSpecRefusal, "describeApproverSpecRefusal");
+    __name6(describeApproverSpecRefusal, "describeApproverSpecRefusal");
     BINDING_ROOTS = [
       "initData",
       "stepResults",
@@ -18722,42 +19052,42 @@ var init_dist2 = __esm({
       "state"
     ];
     __name(bindingRootsOk, "bindingRootsOk");
-    __name5(bindingRootsOk, "bindingRootsOk");
+    __name6(bindingRootsOk, "bindingRootsOk");
     __name(isTemplateBinding, "isTemplateBinding");
-    __name5(isTemplateBinding, "isTemplateBinding");
+    __name6(isTemplateBinding, "isTemplateBinding");
     __name(approvalEditable, "approvalEditable");
-    __name5(approvalEditable, "approvalEditable");
+    __name6(approvalEditable, "approvalEditable");
     __name(validateApproverBlock, "validateApproverBlock");
-    __name5(validateApproverBlock, "validateApproverBlock");
+    __name6(validateApproverBlock, "validateApproverBlock");
     APPROVAL_REMIND_AFTER_HOURS_MIN = 1;
     APPROVAL_REMIND_AFTER_HOURS_MAX = 720;
     APPROVAL_TIMEOUT_HOURS_MIN = 1;
     APPROVAL_TIMEOUT_HOURS_MAX = 720;
     __name(validateApprovalReminder, "validateApprovalReminder");
-    __name5(validateApprovalReminder, "validateApprovalReminder");
+    __name6(validateApprovalReminder, "validateApprovalReminder");
     __name(validateHitlTimeoutHours, "validateHitlTimeoutHours");
-    __name5(validateHitlTimeoutHours, "validateHitlTimeoutHours");
+    __name6(validateHitlTimeoutHours, "validateHitlTimeoutHours");
     __name(firstAskDeadline, "firstAskDeadline");
-    __name5(firstAskDeadline, "firstAskDeadline");
+    __name6(firstAskDeadline, "firstAskDeadline");
     __name(liftRenderedApprover, "liftRenderedApprover");
-    __name5(liftRenderedApprover, "liftRenderedApprover");
+    __name6(liftRenderedApprover, "liftRenderedApprover");
     __name(approverUsersOf, "approverUsersOf");
-    __name5(approverUsersOf, "approverUsersOf");
+    __name6(approverUsersOf, "approverUsersOf");
     WORKSPACE_TEMPLATE_EXPR_RE = /^\$\{\s*(?:initData|input)\.([^}]+?)\s*\}$/;
     __name(workspaceTemplatePath, "workspaceTemplatePath");
-    __name5(workspaceTemplatePath, "workspaceTemplatePath");
+    __name6(workspaceTemplatePath, "workspaceTemplatePath");
     __name(retryBackoffs, "retryBackoffs");
-    __name5(retryBackoffs, "retryBackoffs");
+    __name6(retryBackoffs, "retryBackoffs");
     SLEEP_UNTIL_REPLACEMENT = Object.freeze({
       type: "sleep",
       duration: 6e4
     });
     __name(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
-    __name5(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
+    __name6(sleepUntilUnsupportedMessage, "sleepUntilUnsupportedMessage");
     __name(signalNameInvalidMessage, "signalNameInvalidMessage");
-    __name5(signalNameInvalidMessage, "signalNameInvalidMessage");
+    __name6(signalNameInvalidMessage, "signalNameInvalidMessage");
     __name(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
-    __name5(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
+    __name6(armSubrunUnsupportedMessage, "armSubrunUnsupportedMessage");
     WORKFLOW_WORKSPACE_TTL_MAX_HOURS_DEFAULT = 168;
     WORKFLOW_CAPS_DEFAULT = Object.freeze({
       maxParallelArms: 16,
@@ -18785,60 +19115,60 @@ var init_dist2 = __esm({
       "api",
       "user"
     ];
-    clone = /* @__PURE__ */ __name5((v) => JSON.parse(JSON.stringify(v)), "clone");
+    clone = /* @__PURE__ */ __name6((v) => JSON.parse(JSON.stringify(v)), "clone");
     __name(fillPolicy, "fillPolicy");
-    __name5(fillPolicy, "fillPolicy");
+    __name6(fillPolicy, "fillPolicy");
     __name(fillSingle, "fillSingle");
-    __name5(fillSingle, "fillSingle");
+    __name6(fillSingle, "fillSingle");
     __name(fillHitl, "fillHitl");
-    __name5(fillHitl, "fillHitl");
+    __name6(fillHitl, "fillHitl");
     __name(fillArm, "fillArm");
-    __name5(fillArm, "fillArm");
+    __name6(fillArm, "fillArm");
     __name(fillEntry, "fillEntry");
-    __name5(fillEntry, "fillEntry");
+    __name6(fillEntry, "fillEntry");
     __name(withDefaultsFilled, "withDefaultsFilled");
-    __name5(withDefaultsFilled, "withDefaultsFilled");
+    __name6(withDefaultsFilled, "withDefaultsFilled");
     CONNECTION_ID_HEX_RE = /^[0-9a-f]{24}$/;
     __name(isConnectionKeyShaped, "isConnectionKeyShaped");
-    __name5(isConnectionKeyShaped, "isConnectionKeyShaped");
+    __name6(isConnectionKeyShaped, "isConnectionKeyShaped");
     __name(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
-    __name5(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
+    __name6(connectionKeyUndeclaredMessage, "connectionKeyUndeclaredMessage");
     WORKFLOW_JOB_MAX_WORKTREE_ARMS = 8;
     __name(classifyModelProvider, "classifyModelProvider");
-    __name5(classifyModelProvider, "classifyModelProvider");
-    workspaceOf = /* @__PURE__ */ __name5((node) => node.workspace, "workspaceOf");
-    mountsWorkspace = /* @__PURE__ */ __name5((node) => {
+    __name6(classifyModelProvider, "classifyModelProvider");
+    workspaceOf = /* @__PURE__ */ __name6((node) => node.workspace, "workspaceOf");
+    mountsWorkspace = /* @__PURE__ */ __name6((node) => {
       const w = workspaceOf(node);
       return w !== void 0 && w !== "inherit";
     }, "mountsWorkspace");
-    isJobTier = /* @__PURE__ */ __name5((node) => node.tier === "job" || mountsWorkspace(node), "isJobTier");
-    jobToolsOf = /* @__PURE__ */ __name5((node) => {
+    isJobTier = /* @__PURE__ */ __name6((node) => node.tier === "job" || mountsWorkspace(node), "isJobTier");
+    jobToolsOf = /* @__PURE__ */ __name6((node) => {
       if (node.type === "agent") return node.toolScope?.jobTools;
       return node.jobTools;
     }, "jobToolsOf");
     __name(schemaAtPath, "schemaAtPath");
-    __name5(schemaAtPath, "schemaAtPath");
-    schemaIsArray = /* @__PURE__ */ __name5((schema) => {
+    __name6(schemaAtPath, "schemaAtPath");
+    schemaIsArray = /* @__PURE__ */ __name6((schema) => {
       if (!schema) return void 0;
       const t = schema.type;
       if (t === void 0) return void 0;
       return Array.isArray(t) ? t.includes("array") : t === "array";
     }, "schemaIsArray");
-    isHitlNode = /* @__PURE__ */ __name5((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
-    isSingleStep = /* @__PURE__ */ __name5((n2) => !isHitlNode(n2), "isSingleStep");
-    singleId = /* @__PURE__ */ __name5((s) => s.type === "step" ? s.step.id : s.id, "singleId");
-    armId = /* @__PURE__ */ __name5((a) => a.type === "mapping" ? a.id : singleId(a), "armId");
+    isHitlNode = /* @__PURE__ */ __name6((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
+    isSingleStep = /* @__PURE__ */ __name6((n2) => !isHitlNode(n2), "isSingleStep");
+    singleId = /* @__PURE__ */ __name6((s) => s.type === "step" ? s.step.id : s.id, "singleId");
+    armId = /* @__PURE__ */ __name6((a) => a.type === "mapping" ? a.id : singleId(a), "armId");
     TEMPLATE_STEP_REF = /\$\{\s*stepResults\.([A-Za-z0-9_\-]+)/g;
     __name(templateStepRefs, "templateStepRefs");
-    __name5(templateStepRefs, "templateStepRefs");
+    __name6(templateStepRefs, "templateStepRefs");
     __name(readMapConfig, "readMapConfig");
-    __name5(readMapConfig, "readMapConfig");
+    __name6(readMapConfig, "readMapConfig");
     __name(mapConfigStepRefs, "mapConfigStepRefs");
-    __name5(mapConfigStepRefs, "mapConfigStepRefs");
+    __name6(mapConfigStepRefs, "mapConfigStepRefs");
     __name(nodeStepRefs, "nodeStepRefs");
-    __name5(nodeStepRefs, "nodeStepRefs");
+    __name6(nodeStepRefs, "nodeStepRefs");
     __name(validateLuaExtensions, "validateLuaExtensions");
-    __name5(validateLuaExtensions, "validateLuaExtensions");
+    __name6(validateLuaExtensions, "validateLuaExtensions");
     EDITABLE_PATH_RE = /^[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?(\.[A-Za-z_][A-Za-z0-9_]*(\[(\*|\d+)\])?)*$/;
     PREDICATE_OPS = /* @__PURE__ */ new Set([
       "eq",
@@ -18858,23 +19188,23 @@ var init_dist2 = __esm({
       "not"
     ]);
     __name(isPredicate, "isPredicate");
-    __name5(isPredicate, "isPredicate");
-    isPredicateScalar = /* @__PURE__ */ __name5((v) => v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean", "isPredicateScalar");
+    __name6(isPredicate, "isPredicate");
+    isPredicateScalar = /* @__PURE__ */ __name6((v) => v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean", "isPredicateScalar");
     __name(isPathOrLiteral, "isPathOrLiteral");
-    __name5(isPathOrLiteral, "isPathOrLiteral");
+    __name6(isPathOrLiteral, "isPathOrLiteral");
     __name(isWellFormedPredicate, "isWellFormedPredicate");
-    __name5(isWellFormedPredicate, "isWellFormedPredicate");
+    __name6(isWellFormedPredicate, "isWellFormedPredicate");
     GRAPH_HASH_PREFIX = "sha256-cj1:";
     __name(canonicalJson, "canonicalJson");
-    __name5(canonicalJson, "canonicalJson");
+    __name6(canonicalJson, "canonicalJson");
     __name(hashGraph, "hashGraph");
-    __name5(hashGraph, "hashGraph");
+    __name6(hashGraph, "hashGraph");
     WorkflowPlanError = class extends Error {
       static {
         __name(this, "WorkflowPlanError");
       }
       static {
-        __name5(this, "WorkflowPlanError");
+        __name6(this, "WorkflowPlanError");
       }
       code;
       constructor(code, message) {
@@ -18882,47 +19212,47 @@ var init_dist2 = __esm({
         this.name = "WorkflowPlanError";
       }
     };
-    isArmStep = /* @__PURE__ */ __name5((e) => isWorkflowArmEntryType(e.type), "isArmStep");
-    armStepId = /* @__PURE__ */ __name5((e) => e.type === "step" ? e.step.id : e.id, "armStepId");
-    armStepKind = /* @__PURE__ */ __name5((e) => WORKFLOW_ARM_ENTRY_STEP_KINDS[e.type], "armStepKind");
-    joinIdOf = /* @__PURE__ */ __name5((entryId) => `${entryId}.join`, "joinIdOf");
-    containerIdOf = /* @__PURE__ */ __name5((type, entryIndex) => `${type}@${entryIndex}`, "containerIdOf");
+    isArmStep = /* @__PURE__ */ __name6((e) => isWorkflowArmEntryType(e.type), "isArmStep");
+    armStepId = /* @__PURE__ */ __name6((e) => e.type === "step" ? e.step.id : e.id, "armStepId");
+    armStepKind = /* @__PURE__ */ __name6((e) => WORKFLOW_ARM_ENTRY_STEP_KINDS[e.type], "armStepKind");
+    joinIdOf = /* @__PURE__ */ __name6((entryId) => `${entryId}.join`, "joinIdOf");
+    containerIdOf = /* @__PURE__ */ __name6((type, entryIndex) => `${type}@${entryIndex}`, "containerIdOf");
     __name(compilePlan, "compilePlan");
-    __name5(compilePlan, "compilePlan");
+    __name6(compilePlan, "compilePlan");
     PATH_PLACEHOLDER = /^\$\{([^}]+)\}$/;
     MISSING = /* @__PURE__ */ Symbol("predicate.missing");
     __name(resolvePath, "resolvePath");
-    __name5(resolvePath, "resolvePath");
+    __name6(resolvePath, "resolvePath");
     __name(walk2, "walk");
-    __name5(walk2, "walk");
+    __name6(walk2, "walk");
     __name(resolveValue, "resolveValue");
-    __name5(resolveValue, "resolveValue");
+    __name6(resolveValue, "resolveValue");
     __name(evaluatePredicate, "evaluatePredicate");
-    __name5(evaluatePredicate, "evaluatePredicate");
+    __name6(evaluatePredicate, "evaluatePredicate");
     __name(compare, "compare");
-    __name5(compare, "compare");
+    __name6(compare, "compare");
     __name(derivePredicateLabel, "derivePredicateLabel");
-    __name5(derivePredicateLabel, "derivePredicateLabel");
+    __name6(derivePredicateLabel, "derivePredicateLabel");
     __name(renderPredicate, "renderPredicate");
-    __name5(renderPredicate, "renderPredicate");
+    __name6(renderPredicate, "renderPredicate");
     __name(wrapLabel, "wrapLabel");
-    __name5(wrapLabel, "wrapLabel");
+    __name6(wrapLabel, "wrapLabel");
     __name(renderRef, "renderRef");
-    __name5(renderRef, "renderRef");
-    stepIdOf = /* @__PURE__ */ __name5((s) => typeof s === "string" ? s : s.id, "stepIdOf");
+    __name6(renderRef, "renderRef");
+    stepIdOf = /* @__PURE__ */ __name6((s) => typeof s === "string" ? s : s.id, "stepIdOf");
     __name(step, "step");
-    __name5(step, "step");
+    __name6(step, "step");
     __name(stepOf, "stepOf");
-    __name5(stepOf, "stepOf");
+    __name6(stepOf, "stepOf");
     __name(init, "init");
-    __name5(init, "init");
+    __name6(init, "init");
     __name(state, "state");
-    __name5(state, "state");
+    __name6(state, "state");
     __name(lit, "lit");
-    __name5(lit, "lit");
+    __name6(lit, "lit");
     __name(toPathOrLiteral, "toPathOrLiteral");
-    __name5(toPathOrLiteral, "toPathOrLiteral");
-    cmp = /* @__PURE__ */ __name5((op) => (l, r) => ({
+    __name6(toPathOrLiteral, "toPathOrLiteral");
+    cmp = /* @__PURE__ */ __name6((op) => (l, r) => ({
       op,
       left: toPathOrLiteral(l),
       right: toPathOrLiteral(r)
@@ -18933,49 +19263,49 @@ var init_dist2 = __esm({
     gte = cmp("gte");
     lt = cmp("lt");
     lte = cmp("lte");
-    inSet = /* @__PURE__ */ __name5((v, set) => ({
+    inSet = /* @__PURE__ */ __name6((v, set) => ({
       op: "in",
       value: {
         path: v.path
       },
       set
     }), "inSet");
-    notIn = /* @__PURE__ */ __name5((v, set) => ({
+    notIn = /* @__PURE__ */ __name6((v, set) => ({
       op: "notIn",
       value: {
         path: v.path
       },
       set
     }), "notIn");
-    exists = /* @__PURE__ */ __name5((ref) => ({
+    exists = /* @__PURE__ */ __name6((ref) => ({
       op: "exists",
       path: ref.path
     }), "exists");
-    notExists = /* @__PURE__ */ __name5((ref) => ({
+    notExists = /* @__PURE__ */ __name6((ref) => ({
       op: "notExists",
       path: ref.path
     }), "notExists");
-    truthy = /* @__PURE__ */ __name5((ref) => ({
+    truthy = /* @__PURE__ */ __name6((ref) => ({
       op: "truthy",
       value: {
         path: ref.path
       }
     }), "truthy");
-    falsy = /* @__PURE__ */ __name5((ref) => ({
+    falsy = /* @__PURE__ */ __name6((ref) => ({
       op: "falsy",
       value: {
         path: ref.path
       }
     }), "falsy");
-    and = /* @__PURE__ */ __name5((...args2) => ({
+    and = /* @__PURE__ */ __name6((...args2) => ({
       op: "and",
       args: args2
     }), "and");
-    or = /* @__PURE__ */ __name5((...args2) => ({
+    or = /* @__PURE__ */ __name6((...args2) => ({
       op: "or",
       args: args2
     }), "or");
-    not = /* @__PURE__ */ __name5((arg) => ({
+    not = /* @__PURE__ */ __name6((arg) => ({
       op: "not",
       arg
     }), "not");
@@ -19027,17 +19357,17 @@ var init_dist2 = __esm({
       "text"
     ]);
     __name(continuedFailureValue, "continuedFailureValue");
-    __name5(continuedFailureValue, "continuedFailureValue");
+    __name6(continuedFailureValue, "continuedFailureValue");
     __name(isContinuedFailureValue, "isContinuedFailureValue");
-    __name5(isContinuedFailureValue, "isContinuedFailureValue");
-    isHitlNode2 = /* @__PURE__ */ __name5((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
+    __name6(isContinuedFailureValue, "isContinuedFailureValue");
+    isHitlNode2 = /* @__PURE__ */ __name6((n2) => isWorkflowHitlEntryType(n2.type), "isHitlNode");
     __name(inlineContainerArm, "inlineContainerArm");
-    __name5(inlineContainerArm, "inlineContainerArm");
-    nodeIdOf = /* @__PURE__ */ __name5((n2) => n2.type === "step" ? n2.step.id : n2.id, "nodeIdOf");
+    __name6(inlineContainerArm, "inlineContainerArm");
+    nodeIdOf = /* @__PURE__ */ __name6((n2) => n2.type === "step" ? n2.step.id : n2.id, "nodeIdOf");
     __name(entryIds, "entryIds");
-    __name5(entryIds, "entryIds");
+    __name6(entryIds, "entryIds");
     __name(resolvePlacements, "resolvePlacements");
-    __name5(resolvePlacements, "resolvePlacements");
+    __name6(resolvePlacements, "resolvePlacements");
     GOAL_JUDGE_STEP_ID = "__goal_judge";
     NON_LEAF_KINDS = /* @__PURE__ */ new Set([
       "foreach",
@@ -19045,26 +19375,26 @@ var init_dist2 = __esm({
     ]);
     CONDITIONAL_JOIN_ID = /^conditional@\d+\.join$/;
     __name(isConditionalJoinId, "isConditionalJoinId");
-    __name5(isConditionalJoinId, "isConditionalJoinId");
+    __name6(isConditionalJoinId, "isConditionalJoinId");
     __name(isPlainObject3, "isPlainObject");
-    __name5(isPlainObject3, "isPlainObject");
+    __name6(isPlainObject3, "isPlainObject");
     __name(leafValue, "leafValue");
-    __name5(leafValue, "leafValue");
+    __name6(leafValue, "leafValue");
     __name(runOutputLeaves, "runOutputLeaves");
-    __name5(runOutputLeaves, "runOutputLeaves");
+    __name6(runOutputLeaves, "runOutputLeaves");
     __name(deriveRunOutput, "deriveRunOutput");
-    __name5(deriveRunOutput, "deriveRunOutput");
+    __name6(deriveRunOutput, "deriveRunOutput");
     __name(subrunSettledOutput, "subrunSettledOutput");
-    __name5(subrunSettledOutput, "subrunSettledOutput");
+    __name6(subrunSettledOutput, "subrunSettledOutput");
     __name(seedLedgerFromRun, "seedLedgerFromRun");
-    __name5(seedLedgerFromRun, "seedLedgerFromRun");
-    branchArmId = /* @__PURE__ */ __name5((arm) => arm.type === "step" ? arm.step.id : arm.id, "branchArmId");
+    __name6(seedLedgerFromRun, "seedLedgerFromRun");
+    branchArmId = /* @__PURE__ */ __name6((arm) => arm.type === "step" ? arm.step.id : arm.id, "branchArmId");
     __name(branchSpecFromConditional, "branchSpecFromConditional");
-    __name5(branchSpecFromConditional, "branchSpecFromConditional");
+    __name6(branchSpecFromConditional, "branchSpecFromConditional");
     __name(selectBranchArms, "selectBranchArms");
-    __name5(selectBranchArms, "selectBranchArms");
-    canonical = /* @__PURE__ */ __name5((v) => JSON.stringify(sortKeys(v)), "canonical");
-    sortKeys = /* @__PURE__ */ __name5((v) => {
+    __name6(selectBranchArms, "selectBranchArms");
+    canonical = /* @__PURE__ */ __name6((v) => JSON.stringify(sortKeys(v)), "canonical");
+    sortKeys = /* @__PURE__ */ __name6((v) => {
       if (Array.isArray(v)) return v.map(sortKeys);
       if (v && typeof v === "object") {
         return Object.fromEntries(Object.keys(v).sort().map((k) => [
@@ -19075,63 +19405,63 @@ var init_dist2 = __esm({
       return v;
     }, "sortKeys");
     __name(replayLedger, "replayLedger");
-    __name5(replayLedger, "replayLedger");
+    __name6(replayLedger, "replayLedger");
     JOIN = ".join";
-    entryOfJoin = /* @__PURE__ */ __name5((id2) => id2.endsWith(JOIN) ? id2.slice(0, -JOIN.length) : void 0, "entryOfJoin");
+    entryOfJoin = /* @__PURE__ */ __name6((id2) => id2.endsWith(JOIN) ? id2.slice(0, -JOIN.length) : void 0, "entryOfJoin");
     __name(replayResultOf, "replayResultOf");
-    __name5(replayResultOf, "replayResultOf");
+    __name6(replayResultOf, "replayResultOf");
     __name(ancestorResults, "ancestorResults");
-    __name5(ancestorResults, "ancestorResults");
+    __name6(ancestorResults, "ancestorResults");
     __name(inferTaken, "inferTaken");
-    __name5(inferTaken, "inferTaken");
+    __name6(inferTaken, "inferTaken");
     __name(countChildren, "countChildren");
-    __name5(countChildren, "countChildren");
+    __name6(countChildren, "countChildren");
     FORCE_CANCEL_STALE_MS = 10 * 60 * 1e3;
     TERMINAL = new Set(WORKFLOW_RUN_TERMINAL);
     __name(isTerminalRunStatus, "isTerminalRunStatus");
-    __name5(isTerminalRunStatus, "isTerminalRunStatus");
+    __name6(isTerminalRunStatus, "isTerminalRunStatus");
     __name(pruneUndefined, "pruneUndefined");
-    __name5(pruneUndefined, "pruneUndefined");
+    __name6(pruneUndefined, "pruneUndefined");
     WORKFLOW_INLINE_RUN_TAG = "inline";
     __name(runOrigin, "runOrigin");
-    __name5(runOrigin, "runOrigin");
+    __name6(runOrigin, "runOrigin");
     RUN_ERROR_ISSUES_MAX = 20;
     __name(runErrorIssues, "runErrorIssues");
-    __name5(runErrorIssues, "runErrorIssues");
+    __name6(runErrorIssues, "runErrorIssues");
     __name(runNextAction, "runNextAction");
-    __name5(runNextAction, "runNextAction");
+    __name6(runNextAction, "runNextAction");
     IN_FLIGHT = new Set(WORKFLOW_STEP_IN_FLIGHT);
     __name(emptyRunCounts, "emptyRunCounts");
-    __name5(emptyRunCounts, "emptyRunCounts");
+    __name6(emptyRunCounts, "emptyRunCounts");
     __name(runCountsFromStatusTally, "runCountsFromStatusTally");
-    __name5(runCountsFromStatusTally, "runCountsFromStatusTally");
+    __name6(runCountsFromStatusTally, "runCountsFromStatusTally");
     __name(runCountsFromStepStatuses, "runCountsFromStepStatuses");
-    __name5(runCountsFromStepStatuses, "runCountsFromStepStatuses");
+    __name6(runCountsFromStepStatuses, "runCountsFromStepStatuses");
     __name(isBillingHeldStep, "isBillingHeldStep");
-    __name5(isBillingHeldStep, "isBillingHeldStep");
+    __name6(isBillingHeldStep, "isBillingHeldStep");
     __name(stepEffectiveStatus, "stepEffectiveStatus");
-    __name5(stepEffectiveStatus, "stepEffectiveStatus");
-    n = /* @__PURE__ */ __name5((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
+    __name6(stepEffectiveStatus, "stepEffectiveStatus");
+    n = /* @__PURE__ */ __name6((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
     __name(runCounts, "runCounts");
-    __name5(runCounts, "runCounts");
+    __name6(runCounts, "runCounts");
     __name(isPricedStepReceipt, "isPricedStepReceipt");
-    __name5(isPricedStepReceipt, "isPricedStepReceipt");
+    __name6(isPricedStepReceipt, "isPricedStepReceipt");
     __name(receiptEngine, "receiptEngine");
-    __name5(receiptEngine, "receiptEngine");
+    __name6(receiptEngine, "receiptEngine");
     __name(receiptTier, "receiptTier");
-    __name5(receiptTier, "receiptTier");
+    __name6(receiptTier, "receiptTier");
     __name(stepBillingView, "stepBillingView");
-    __name5(stepBillingView, "stepBillingView");
+    __name6(stepBillingView, "stepBillingView");
     __name(runUsage, "runUsage");
-    __name5(runUsage, "runUsage");
+    __name6(runUsage, "runUsage");
     __name(runBudgetCap, "runBudgetCap");
-    __name5(runBudgetCap, "runBudgetCap");
+    __name6(runBudgetCap, "runBudgetCap");
     __name(runBudgetRemaining, "runBudgetRemaining");
-    __name5(runBudgetRemaining, "runBudgetRemaining");
+    __name6(runBudgetRemaining, "runBudgetRemaining");
     __name(runCancelView, "runCancelView");
-    __name5(runCancelView, "runCancelView");
+    __name6(runCancelView, "runCancelView");
     __name(runWorkspaceView, "runWorkspaceView");
-    __name5(runWorkspaceView, "runWorkspaceView");
+    __name6(runWorkspaceView, "runWorkspaceView");
     SUSPENDED_FOR_DIMENSIONS = /* @__PURE__ */ new Set([
       "credits",
       "actions",
@@ -19139,9 +19469,9 @@ var init_dist2 = __esm({
       "jobSeconds"
     ]);
     __name(runSuspendedForView, "runSuspendedForView");
-    __name5(runSuspendedForView, "runSuspendedForView");
+    __name6(runSuspendedForView, "runSuspendedForView");
     __name(toWorkflowRunSummary, "toWorkflowRunSummary");
-    __name5(toWorkflowRunSummary, "toWorkflowRunSummary");
+    __name6(toWorkflowRunSummary, "toWorkflowRunSummary");
     STEP_ERROR_DETAIL_KEYS = [
       "reason",
       "key",
@@ -19195,9 +19525,9 @@ var init_dist2 = __esm({
     DETAIL_MAX_DEPTH = 4;
     DETAIL_MAX_ITEMS = 100;
     __name(scrubDetailValue, "scrubDetailValue");
-    __name5(scrubDetailValue, "scrubDetailValue");
+    __name6(scrubDetailValue, "scrubDetailValue");
     __name(stepErrorDetail, "stepErrorDetail");
-    __name5(stepErrorDetail, "stepErrorDetail");
+    __name6(stepErrorDetail, "stepErrorDetail");
     MAX_HOLIDAYS = 366;
     MAX_WALK_DAYS = 400;
     HHMM = /^([01]\d|2[0-3]):([0-5]\d)$/;
@@ -19217,18 +19547,18 @@ var init_dist2 = __esm({
     };
     supportedTz = null;
     __name(timeZoneSupported, "timeZoneSupported");
-    __name5(timeZoneSupported, "timeZoneSupported");
+    __name6(timeZoneSupported, "timeZoneSupported");
     __name(validateBusinessHours, "validateBusinessHours");
-    __name5(validateBusinessHours, "validateBusinessHours");
+    __name6(validateBusinessHours, "validateBusinessHours");
     __name(toMinutes, "toMinutes");
-    __name5(toMinutes, "toMinutes");
+    __name6(toMinutes, "toMinutes");
     __name(resolveCalendar, "resolveCalendar");
-    __name5(resolveCalendar, "resolveCalendar");
+    __name6(resolveCalendar, "resolveCalendar");
     __name(assertValid, "assertValid");
-    __name5(assertValid, "assertValid");
+    __name6(assertValid, "assertValid");
     fmtCache = /* @__PURE__ */ new Map();
     __name(formatter, "formatter");
-    __name5(formatter, "formatter");
+    __name6(formatter, "formatter");
     WEEKDAYS = {
       Sun: 0,
       Mon: 1,
@@ -19239,25 +19569,25 @@ var init_dist2 = __esm({
       Sat: 6
     };
     __name(localParts, "localParts");
-    __name5(localParts, "localParts");
+    __name6(localParts, "localParts");
     __name(offsetAt, "offsetAt");
-    __name5(offsetAt, "offsetAt");
+    __name6(offsetAt, "offsetAt");
     __name(localToUtc, "localToUtc");
-    __name5(localToUtc, "localToUtc");
+    __name6(localToUtc, "localToUtc");
     __name(sameWall, "sameWall");
-    __name5(sameWall, "sameWall");
+    __name6(sameWall, "sameWall");
     __name(ymd, "ymd");
-    __name5(ymd, "ymd");
+    __name6(ymd, "ymd");
     __name(windowOf, "windowOf");
-    __name5(windowOf, "windowOf");
+    __name6(windowOf, "windowOf");
     __name(nextDayAnchor, "nextDayAnchor");
-    __name5(nextDayAnchor, "nextDayAnchor");
+    __name6(nextDayAnchor, "nextDayAnchor");
     __name(addBusinessTime, "addBusinessTime");
-    __name5(addBusinessTime, "addBusinessTime");
+    __name6(addBusinessTime, "addBusinessTime");
     __name(roundToBusinessTime, "roundToBusinessTime");
-    __name5(roundToBusinessTime, "roundToBusinessTime");
+    __name6(roundToBusinessTime, "roundToBusinessTime");
     __name(isBusinessTime, "isBusinessTime");
-    __name5(isBusinessTime, "isBusinessTime");
+    __name6(isBusinessTime, "isBusinessTime");
     JSON_PATCH_OPS = [
       "replace",
       "add",
@@ -19268,27 +19598,27 @@ var init_dist2 = __esm({
     JSON_PATCH_MAX_TOTAL_BYTES = 1024 * 1024;
     SEGMENT_RE = /^([A-Za-z_$][\w$-]*)((?:\[(?:\*|\d+)\])*)$/;
     __name(parseEditablePath, "parseEditablePath");
-    __name5(parseEditablePath, "parseEditablePath");
+    __name6(parseEditablePath, "parseEditablePath");
     __name(isEditablePathEntry, "isEditablePathEntry");
-    __name5(isEditablePathEntry, "isEditablePathEntry");
+    __name6(isEditablePathEntry, "isEditablePathEntry");
     __name(pointerToSegments, "pointerToSegments");
-    __name5(pointerToSegments, "pointerToSegments");
+    __name6(pointerToSegments, "pointerToSegments");
     __name(pointerToDotPath, "pointerToDotPath");
-    __name5(pointerToDotPath, "pointerToDotPath");
+    __name6(pointerToDotPath, "pointerToDotPath");
     __name(coveredBy, "coveredBy");
-    __name5(coveredBy, "coveredBy");
+    __name6(coveredBy, "coveredBy");
     __name(matchesEditablePath, "matchesEditablePath");
-    __name5(matchesEditablePath, "matchesEditablePath");
+    __name6(matchesEditablePath, "matchesEditablePath");
     __name(changedPointers, "changedPointers");
-    __name5(changedPointers, "changedPointers");
+    __name6(changedPointers, "changedPointers");
     __name(escapePointer, "escapePointer");
-    __name5(escapePointer, "escapePointer");
+    __name6(escapePointer, "escapePointer");
     __name(validateJsonPatch, "validateJsonPatch");
-    __name5(validateJsonPatch, "validateJsonPatch");
+    __name6(validateJsonPatch, "validateJsonPatch");
     __name(applyJsonPatch, "applyJsonPatch");
-    __name5(applyJsonPatch, "applyJsonPatch");
+    __name6(applyJsonPatch, "applyJsonPatch");
     __name(rebaseItemPointer, "rebaseItemPointer");
-    __name5(rebaseItemPointer, "rebaseItemPointer");
+    __name6(rebaseItemPointer, "rebaseItemPointer");
     WORKFLOW_SCHEDULE_TYPES = [
       "cron",
       "interval",
@@ -19300,22 +19630,22 @@ var init_dist2 = __esm({
       "installer",
       "system"
     ];
-    isObject = /* @__PURE__ */ __name5((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObject");
+    isObject = /* @__PURE__ */ __name6((v) => typeof v === "object" && v !== null && !Array.isArray(v), "isObject");
     __name(validateWorkflowSchedule, "validateWorkflowSchedule");
-    __name5(validateWorkflowSchedule, "validateWorkflowSchedule");
+    __name6(validateWorkflowSchedule, "validateWorkflowSchedule");
     WORKFLOW_ENV_OVERLAY_MAX_KEYS = 64;
     WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES = 4096;
     WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE = /(SECRET|TOKEN|KEY|PASSWORD)$/;
-    isEnvRef = /* @__PURE__ */ __name5((v) => typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.__envRef === "string" && Object.keys(v).length === 1, "isEnvRef");
-    looksLikeEmbeddedJson = /* @__PURE__ */ __name5((s) => s.length > 1 && s[0] === "{" && s.includes("__envRef"), "looksLikeEmbeddedJson");
+    isEnvRef = /* @__PURE__ */ __name6((v) => typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.__envRef === "string" && Object.keys(v).length === 1, "isEnvRef");
+    looksLikeEmbeddedJson = /* @__PURE__ */ __name6((s) => s.length > 1 && s[0] === "{" && s.includes("__envRef"), "looksLikeEmbeddedJson");
     __name(collectEnvTemplateKeys, "collectEnvTemplateKeys");
-    __name5(collectEnvTemplateKeys, "collectEnvTemplateKeys");
+    __name6(collectEnvTemplateKeys, "collectEnvTemplateKeys");
     __name(substituteEnvRefs, "substituteEnvRefs");
-    __name5(substituteEnvRefs, "substituteEnvRefs");
+    __name6(substituteEnvRefs, "substituteEnvRefs");
     __name(hashEnvOverlay, "hashEnvOverlay");
-    __name5(hashEnvOverlay, "hashEnvOverlay");
+    __name6(hashEnvOverlay, "hashEnvOverlay");
     __name(validateEnvOverlay, "validateEnvOverlay");
-    __name5(validateEnvOverlay, "validateEnvOverlay");
+    __name6(validateEnvOverlay, "validateEnvOverlay");
     ZERO = {
       steps: {
         min: 0,
@@ -19328,36 +19658,36 @@ var init_dist2 = __esm({
       agentCalls: 0
     };
     __name(add, "add");
-    __name5(add, "add");
+    __name6(add, "add");
     __name(scale, "scale");
-    __name5(scale, "scale");
+    __name6(scale, "scale");
     __name(armEntry, "armEntry");
-    __name5(armEntry, "armEntry");
+    __name6(armEntry, "armEntry");
     __name(ofEntry, "ofEntry");
-    __name5(ofEntry, "ofEntry");
+    __name6(ofEntry, "ofEntry");
     __name(estimateGraph, "estimateGraph");
-    __name5(estimateGraph, "estimateGraph");
-    isRecord3 = /* @__PURE__ */ __name5((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
+    __name6(estimateGraph, "estimateGraph");
+    isRecord4 = /* @__PURE__ */ __name6((v) => !!v && typeof v === "object" && !Array.isArray(v), "isRecord");
     __name(singleStepsOf, "singleStepsOf");
-    __name5(singleStepsOf, "singleStepsOf");
+    __name6(singleStepsOf, "singleStepsOf");
     __name(entriesOf, "entriesOf");
-    __name5(entriesOf, "entriesOf");
+    __name6(entriesOf, "entriesOf");
     __name(inheritTargets, "inheritTargets");
-    __name5(inheritTargets, "inheritTargets");
+    __name6(inheritTargets, "inheritTargets");
     __name(needsInheritedWorkspace, "needsInheritedWorkspace");
-    __name5(needsInheritedWorkspace, "needsInheritedWorkspace");
+    __name6(needsInheritedWorkspace, "needsInheritedWorkspace");
     __name(armEntry2, "armEntry2");
-    __name5(armEntry2, "armEntry");
+    __name6(armEntry2, "armEntry");
     __name(entryHasJobTier, "entryHasJobTier");
-    __name5(entryHasJobTier, "entryHasJobTier");
+    __name6(entryHasJobTier, "entryHasJobTier");
     __name(graphHasJobTierStep, "graphHasJobTierStep");
-    __name5(graphHasJobTierStep, "graphHasJobTierStep");
+    __name6(graphHasJobTierStep, "graphHasJobTierStep");
     __name(jobTierSteps, "jobTierSteps");
-    __name5(jobTierSteps, "jobTierSteps");
+    __name6(jobTierSteps, "jobTierSteps");
     __name(jobTierStepIds, "jobTierStepIds");
-    __name5(jobTierStepIds, "jobTierStepIds");
+    __name6(jobTierStepIds, "jobTierStepIds");
     __name(collectJobTierSteps, "collectJobTierSteps");
-    __name5(collectJobTierSteps, "collectJobTierSteps");
+    __name6(collectJobTierSteps, "collectJobTierSteps");
   }
 });
 
@@ -20411,7 +20741,9 @@ var init_compile_constants = __esm({
       template: template2,
       fromRequest: fromRequest2,
       rows: rows2,
-      fromKnowledge: fromKnowledge2
+      fromKnowledge: fromKnowledge2,
+      WORKFLOW_DEFAULT_MAX_DURATION_SECONDS,
+      WORKFLOW_HITL_MAX_DURATION_SECONDS
     };
     WORKFLOW_SHIM_NAMES = [
       "LuaWorkflow",
@@ -20444,7 +20776,9 @@ var init_compile_constants = __esm({
       "template",
       "fromRequest",
       "rows",
-      "fromKnowledge"
+      "fromKnowledge",
+      "WORKFLOW_DEFAULT_MAX_DURATION_SECONDS",
+      "WORKFLOW_HITL_MAX_DURATION_SECONDS"
     ];
     COMPILE_DIRS = {
       DIST: "dist",
@@ -20543,6 +20877,14 @@ async function classifyErrorResponse(response) {
     }
     throw new AuthenticationError(`Authentication failed: ${serverMessage}`, "unknown", serverMessage);
   }
+  if (response.status === 403 && !isLuaErrorBody(errorData) && isHtmlResponse(response)) {
+    throw new CliError("forbidden", "The request was blocked before it reached Lua (HTTP 403 from the network firewall), not by your credentials.", {
+      exitCode: CLI_EXIT.FORBIDDEN,
+      statusCode: 403,
+      serverCode: EDGE_BLOCKED_CODE,
+      hint: "Something in the request looked like an attack to the firewall, for example a URL that contains a system path. Change the request and try again."
+    });
+  }
   if (response.status === 403) {
     const detail = errorData.message || "You do not have permission to access this resource.";
     const serverCode = serverCodeOf(errorData.code, errorData.error);
@@ -20658,6 +21000,9 @@ async function* parseSseStream(body, signal) {
     }
   }
 }
+function isHtmlResponse(response) {
+  return (response.headers.get("content-type") ?? "").toLowerCase().includes("text/html");
+}
 function parseRetryAfter(raw) {
   if (!raw) return void 0;
   const seconds = Number.parseInt(raw, 10);
@@ -21076,6 +21421,7 @@ var init_http_client = __esm({
     __name(serverCodeOf, "serverCodeOf");
     __name(refusalFromResponse, "refusalFromResponse");
     __name(parseSseStream, "parseSseStream");
+    __name(isHtmlResponse, "isHtmlResponse");
     __name(parseRetryAfter, "parseRetryAfter");
     __name(isCoreDrainApiError, "isCoreDrainApiError");
     __name(coreDrainApiRetryDelayMs, "coreDrainApiRetryDelayMs");
@@ -21357,7 +21703,7 @@ function walkWorkspace(rootDir, opts = {}) {
   const refs = [];
   const contentByHash = /* @__PURE__ */ new Map();
   let totalSize = 0;
-  const visit = /* @__PURE__ */ __name6((relPrefix) => {
+  const visit = /* @__PURE__ */ __name7((relPrefix) => {
     const absDir = relPrefix ? join4(rootDir, relPrefix) : rootDir;
     let entries;
     try {
@@ -21651,21 +21997,21 @@ function walk3(root, prefix, out) {
     }
   }
 }
-var __defProp6, __name6, FILE_HASH_LENGTH, SKIP_DIRECTORIES, ARCHIVE_ONLY_SKIP_DIRECTORIES, DEFAULT_MAX_FILE_BYTES, KIND_BY_EXT, CHECK_BLOBS_MAX_HASHES, BackupHttpError, BackupHttpClient, DEFAULT_CONCURRENCY, CREDENTIAL_PATHS, WINDOWS_ABSOLUTE_PATH, ARCHIVE_SCHEMA_VERSION, SKILL_SOURCE_ARCHIVE_MAX_BYTES;
+var __defProp7, __name7, FILE_HASH_LENGTH, SKIP_DIRECTORIES, ARCHIVE_ONLY_SKIP_DIRECTORIES, DEFAULT_MAX_FILE_BYTES, KIND_BY_EXT, CHECK_BLOBS_MAX_HASHES, BackupHttpError, BackupHttpClient, DEFAULT_CONCURRENCY, CREDENTIAL_PATHS, WINDOWS_ABSOLUTE_PATH, ARCHIVE_SCHEMA_VERSION, SKILL_SOURCE_ARCHIVE_MAX_BYTES;
 var init_dist3 = __esm({
   "../shared-source-sync/dist/index.mjs"() {
     "use strict";
-    __defProp6 = Object.defineProperty;
-    __name6 = /* @__PURE__ */ __name((target, value3) => __defProp6(target, "name", { value: value3, configurable: true }), "__name");
+    __defProp7 = Object.defineProperty;
+    __name7 = /* @__PURE__ */ __name((target, value3) => __defProp7(target, "name", { value: value3, configurable: true }), "__name");
     FILE_HASH_LENGTH = 16;
     __name(hashContentTruncated, "hashContentTruncated");
-    __name6(hashContentTruncated, "hashContentTruncated");
+    __name7(hashContentTruncated, "hashContentTruncated");
     __name(sha256Hex, "sha256Hex");
-    __name6(sha256Hex, "sha256Hex");
+    __name7(sha256Hex, "sha256Hex");
     __name(matchesFileHash, "matchesFileHash");
-    __name6(matchesFileHash, "matchesFileHash");
+    __name7(matchesFileHash, "matchesFileHash");
     __name(combineFileHashes, "combineFileHashes");
-    __name6(combineFileHashes, "combineFileHashes");
+    __name7(combineFileHashes, "combineFileHashes");
     SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
       "node_modules",
       "dist",
@@ -21682,9 +22028,9 @@ var init_dist3 = __esm({
     ]);
     DEFAULT_MAX_FILE_BYTES = 256 * 1024;
     __name(shouldSkipDirectory, "shouldSkipDirectory");
-    __name6(shouldSkipDirectory, "shouldSkipDirectory");
+    __name7(shouldSkipDirectory, "shouldSkipDirectory");
     __name(shouldSkipFile, "shouldSkipFile");
-    __name6(shouldSkipFile, "shouldSkipFile");
+    __name7(shouldSkipFile, "shouldSkipFile");
     KIND_BY_EXT = {
       ".ts": "source",
       ".tsx": "source",
@@ -21696,16 +22042,16 @@ var init_dist3 = __esm({
       ".toml": "config"
     };
     __name(classifyFile, "classifyFile");
-    __name6(classifyFile, "classifyFile");
+    __name7(classifyFile, "classifyFile");
     __name(walkWorkspace, "walkWorkspace");
-    __name6(walkWorkspace, "walkWorkspace");
+    __name7(walkWorkspace, "walkWorkspace");
     CHECK_BLOBS_MAX_HASHES = 500;
     BackupHttpError = class extends Error {
       static {
         __name(this, "BackupHttpError");
       }
       static {
-        __name6(this, "BackupHttpError");
+        __name7(this, "BackupHttpError");
       }
       status;
       endpoint;
@@ -21720,7 +22066,7 @@ var init_dist3 = __esm({
         __name(this, "BackupHttpClient");
       }
       static {
-        __name6(this, "BackupHttpClient");
+        __name7(this, "BackupHttpClient");
       }
       options;
       fetchFn;
@@ -21825,17 +22171,17 @@ var init_dist3 = __esm({
     };
     DEFAULT_CONCURRENCY = 10;
     __name(uploadBlobs, "uploadBlobs");
-    __name6(uploadBlobs, "uploadBlobs");
+    __name7(uploadBlobs, "uploadBlobs");
     __name(decodeBlob, "decodeBlob");
-    __name6(decodeBlob, "decodeBlob");
+    __name7(decodeBlob, "decodeBlob");
     __name(verifyDownloaded, "verifyDownloaded");
-    __name6(verifyDownloaded, "verifyDownloaded");
+    __name7(verifyDownloaded, "verifyDownloaded");
     __name(downloadBlobs, "downloadBlobs");
-    __name6(downloadBlobs, "downloadBlobs");
+    __name7(downloadBlobs, "downloadBlobs");
     __name(resolveBackupFileTarget, "resolveBackupFileTarget");
-    __name6(resolveBackupFileTarget, "resolveBackupFileTarget");
+    __name7(resolveBackupFileTarget, "resolveBackupFileTarget");
     __name(restoreFromBlobs, "restoreFromBlobs");
-    __name6(restoreFromBlobs, "restoreFromBlobs");
+    __name7(restoreFromBlobs, "restoreFromBlobs");
     CREDENTIAL_PATHS = /* @__PURE__ */ new Set([
       ".env",
       ".lua/config.json",
@@ -21843,22 +22189,22 @@ var init_dist3 = __esm({
     ]);
     WINDOWS_ABSOLUTE_PATH = /^[a-z]:\//i;
     __name(normalizeWorkspaceRelativePath, "normalizeWorkspaceRelativePath");
-    __name6(normalizeWorkspaceRelativePath, "normalizeWorkspaceRelativePath");
+    __name7(normalizeWorkspaceRelativePath, "normalizeWorkspaceRelativePath");
     __name(isCredentialPersistencePath, "isCredentialPersistencePath");
-    __name6(isCredentialPersistencePath, "isCredentialPersistencePath");
+    __name7(isCredentialPersistencePath, "isCredentialPersistencePath");
     __name(pushAgentBackup, "pushAgentBackup");
-    __name6(pushAgentBackup, "pushAgentBackup");
+    __name7(pushAgentBackup, "pushAgentBackup");
     __name(pullAgentBackup, "pullAgentBackup");
-    __name6(pullAgentBackup, "pullAgentBackup");
+    __name7(pullAgentBackup, "pullAgentBackup");
     ARCHIVE_SCHEMA_VERSION = 1;
     __name(encodeWorkspaceArchive, "encodeWorkspaceArchive");
-    __name6(encodeWorkspaceArchive, "encodeWorkspaceArchive");
+    __name7(encodeWorkspaceArchive, "encodeWorkspaceArchive");
     __name(decodeWorkspaceArchive, "decodeWorkspaceArchive");
-    __name6(decodeWorkspaceArchive, "decodeWorkspaceArchive");
+    __name7(decodeWorkspaceArchive, "decodeWorkspaceArchive");
     __name(writeArchiveToWorkspace, "writeArchiveToWorkspace");
-    __name6(writeArchiveToWorkspace, "writeArchiveToWorkspace");
+    __name7(writeArchiveToWorkspace, "writeArchiveToWorkspace");
     __name(walk3, "walk");
-    __name6(walk3, "walk");
+    __name7(walk3, "walk");
     SKILL_SOURCE_ARCHIVE_MAX_BYTES = 4 * 1024 * 1024;
   }
 });
@@ -22117,6 +22463,9 @@ var init_bundle_upload = __esm({
 });
 
 // src/primitives/base.handler.ts
+function nameFlagDeleteCommand(deleteCommand, displayName, name) {
+  return `${deleteCommand} --${displayName.toLowerCase().replace(/\s+/g, "-")}-name ${name}`;
+}
 var DEFAULT_VERSION, BaseVersionedHandler, BaseNonVersionedHandler;
 var init_base_handler = __esm({
   "src/primitives/base.handler.ts"() {
@@ -22129,10 +22478,14 @@ var init_base_handler = __esm({
     init_auth_error();
     init_cli_error();
     DEFAULT_VERSION = SKILL_DEFAULTS.VERSION;
+    __name(nameFlagDeleteCommand, "nameFlagDeleteCommand");
     BaseVersionedHandler = class {
       static {
         __name(this, "BaseVersionedHandler");
       }
+      serverDeleteCommand(name) {
+        return nameFlagDeleteCommand(this.deleteCommand, this.displayName, name);
+      }
       /**
       * Strip a YAML item to only the canonical fields: name, version, [idField].
       * Override if your YAML type has additional fields.
@@ -22270,7 +22623,6 @@ var init_base_handler = __esm({
             }));
             yamlItems.push(...stubs);
             yamlUpdated = true;
-            const flagName = `--${this.displayName.toLowerCase().replace(/\s+/g, "-")}-name`;
             console.log(`
 \u26A0\uFE0F  Found ${this.displayNamePlural} on server not in your local code:`);
             for (const item of orphans) {
@@ -22279,7 +22631,7 @@ var init_base_handler = __esm({
               console.log(msg);
             }
             console.log(`   Added to lua.skill.yaml as server-only entries.`);
-            console.log(`   To remove from server: ${this.deleteCommand} ${flagName} <name>`);
+            console.log(`   To remove from server: ${this.serverDeleteCommand("<name>")}`);
             console.log(`   To restore source from backup: lua sync --accept
 `);
             orphanedCount = orphans.length;
@@ -22581,6 +22933,9 @@ var init_base_handler = __esm({
       static {
         __name(this, "BaseNonVersionedHandler");
       }
+      serverDeleteCommand(name) {
+        return nameFlagDeleteCommand(this.deleteCommand, this.displayName, name);
+      }
       /**
       * Optional hook run after a successful upsert when autoDeploy is set.
       * Default: no-op. Handlers override for post-upsert actions (e.g. MCP
@@ -22657,7 +23012,6 @@ var init_base_handler = __esm({
               ...stubs
             ], config);
             yamlUpdated = true;
-            const flagName = `--${this.displayName.toLowerCase().replace(/\s+/g, "-")}-name`;
             console.log(`
 \u26A0\uFE0F  Found ${this.displayNamePlural} on server not in your local code:`);
             for (const item of orphans) {
@@ -22666,7 +23020,7 @@ var init_base_handler = __esm({
               console.log(msg);
             }
             console.log(`   Added to lua.skill.yaml as server-only entries.`);
-            console.log(`   To remove from server: ${this.deleteCommand} ${flagName} <name>`);
+            console.log(`   To remove from server: ${this.serverDeleteCommand("<name>")}`);
             console.log(`   To restore source from backup: lua sync --accept
 `);
             orphanedCount = orphans.length;
@@ -23383,15 +23737,22 @@ var init_analytics = __esm({
 });
 
 // src/utils/write-info.ts
+function clearLineFor(stream) {
+  return stream.isTTY ? CLEAR_LINE : "";
+}
 function writeInfo(message) {
-  process.stdout.write("\r\x1B[K" + message + "\n");
+  process.stdout.write(clearLineFor(process.stdout) + message + "\n");
 }
 function writeProgress(message) {
-  process.stderr.write("\r\x1B[K" + message);
+  if (process.stderr.isTTY) process.stderr.write(CLEAR_LINE + message);
+  else process.stderr.write(message + "\n");
 }
+var CLEAR_LINE;
 var init_write_info = __esm({
   "src/utils/write-info.ts"() {
     "use strict";
+    CLEAR_LINE = "\r\x1B[K";
+    __name(clearLineFor, "clearLineFor");
     __name(writeInfo, "writeInfo");
     __name(writeProgress, "writeProgress");
   }
@@ -23560,10 +23921,10 @@ function clearPromptLines(count2 = 1) {
   }
 }
 function writeSuccess(message) {
-  process.stdout.write("\r\x1B[K" + message + "\n");
+  process.stdout.write(clearLineFor(process.stdout) + message + "\n");
 }
 function writeError(message) {
-  process.stderr.write("\r\x1B[K" + message + "\n");
+  process.stderr.write(clearLineFor(process.stderr) + message + "\n");
 }
 var isCiMode, jsonOutputRequested;
 var init_cli = __esm({
@@ -23576,6 +23937,7 @@ var init_cli = __esm({
     init_analytics();
     init_hints();
     init_write_info();
+    init_write_info();
     isCiMode = false;
     __name(setCiMode, "setCiMode");
     __name(isCiModeEnabled, "isCiModeEnabled");
@@ -23607,11 +23969,11 @@ function invalidContract(message) {
     }
   };
 }
-function isRecord4(value3) {
+function isRecord5(value3) {
   return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
 }
 function parseCredentialIdentityContext(value3) {
-  if (!isRecord4(value3)) return void 0;
+  if (!isRecord5(value3)) return void 0;
   const email = value3.email;
   const fullName = value3.fullName;
   if (email !== null && typeof email !== "string" || fullName !== null && typeof fullName !== "string") {
@@ -23639,7 +24001,7 @@ var init_cli_credentials_api_service = __esm({
     init_dist();
     __name(bearerHeaders, "bearerHeaders");
     __name(invalidContract, "invalidContract");
-    __name(isRecord4, "isRecord");
+    __name(isRecord5, "isRecord");
     __name(parseCredentialIdentityContext, "parseCredentialIdentityContext");
     __name(resourceQuery, "resourceQuery");
     CliCredentialsApi = class extends HttpClient {
@@ -29357,23 +29719,23 @@ import { Agent as Agent2, buildConnector } from "undici";
 import * as net4 from "net";
 import { promises as dns2 } from "dns";
 function buildSandboxProcess(opts) {
-  const hrtimeFn = /* @__PURE__ */ __name7((time) => process.hrtime(time), "hrtimeFn");
+  const hrtimeFn = /* @__PURE__ */ __name8((time) => process.hrtime(time), "hrtimeFn");
   hrtimeFn.bigint = () => process.hrtime.bigint();
-  const nextTickFn = /* @__PURE__ */ __name7((cb, ...args2) => {
+  const nextTickFn = /* @__PURE__ */ __name8((cb, ...args2) => {
     process.nextTick(cb, ...args2);
   }, "nextTickFn");
-  const buildStdioStub = /* @__PURE__ */ __name7((fd) => {
+  const buildStdioStub = /* @__PURE__ */ __name8((fd) => {
     const stub = {
       fd,
       isTTY: false,
-      write: /* @__PURE__ */ __name7(() => true, "write"),
-      end: /* @__PURE__ */ __name7(() => stub, "end"),
-      on: /* @__PURE__ */ __name7(() => stub, "on"),
-      once: /* @__PURE__ */ __name7(() => stub, "once"),
-      removeListener: /* @__PURE__ */ __name7(() => stub, "removeListener"),
-      cork: /* @__PURE__ */ __name7(() => {
+      write: /* @__PURE__ */ __name8(() => true, "write"),
+      end: /* @__PURE__ */ __name8(() => stub, "end"),
+      on: /* @__PURE__ */ __name8(() => stub, "on"),
+      once: /* @__PURE__ */ __name8(() => stub, "once"),
+      removeListener: /* @__PURE__ */ __name8(() => stub, "removeListener"),
+      cork: /* @__PURE__ */ __name8(() => {
       }, "cork"),
-      uncork: /* @__PURE__ */ __name7(() => {
+      uncork: /* @__PURE__ */ __name8(() => {
       }, "uncork")
     };
     return stub;
@@ -29393,21 +29755,21 @@ function buildSandboxProcess(opts) {
     hrtime: hrtimeFn,
     // Lie — don't leak host filesystem layout. Skills should not depend on
     // the value matching anything real.
-    cwd: /* @__PURE__ */ __name7(() => "/", "cwd"),
-    uptime: /* @__PURE__ */ __name7(() => process.uptime(), "uptime"),
-    memoryUsage: /* @__PURE__ */ __name7(() => process.memoryUsage(), "memoryUsage"),
+    cwd: /* @__PURE__ */ __name8(() => "/", "cwd"),
+    uptime: /* @__PURE__ */ __name8(() => process.uptime(), "uptime"),
+    memoryUsage: /* @__PURE__ */ __name8(() => process.memoryUsage(), "memoryUsage"),
     argv: [
       "node"
     ],
     argv0: "node",
     // No-op event API. Returns `proc` for chaining (matches Node convention).
     // Skills CANNOT register handlers on host signals via this stub.
-    on: /* @__PURE__ */ __name7(() => proc, "on"),
-    once: /* @__PURE__ */ __name7(() => proc, "once"),
-    off: /* @__PURE__ */ __name7(() => proc, "off"),
-    addListener: /* @__PURE__ */ __name7(() => proc, "addListener"),
-    removeListener: /* @__PURE__ */ __name7(() => proc, "removeListener"),
-    emit: /* @__PURE__ */ __name7(() => false, "emit")
+    on: /* @__PURE__ */ __name8(() => proc, "on"),
+    once: /* @__PURE__ */ __name8(() => proc, "once"),
+    off: /* @__PURE__ */ __name8(() => proc, "off"),
+    addListener: /* @__PURE__ */ __name8(() => proc, "addListener"),
+    removeListener: /* @__PURE__ */ __name8(() => proc, "removeListener"),
+    emit: /* @__PURE__ */ __name8(() => false, "emit")
   };
   return Object.freeze(proc);
 }
@@ -29502,7 +29864,7 @@ function isRequireBlocklisted(id2) {
 }
 function buildSandboxRequire(opts) {
   const realRequire = createRequire(path6.join(opts.cwd, "package.json"));
-  const wrapped = /* @__PURE__ */ __name7((id2) => {
+  const wrapped = /* @__PURE__ */ __name8((id2) => {
     if (isRequireBlocklisted(id2)) {
       const evt = {
         event: "sandbox_require_blocklisted",
@@ -29793,7 +30155,7 @@ function buildFetchDispatcher(guard, target) {
 function wrapFetch(realFetch, opts) {
   if (opts.mode === "off") return realFetch;
   const guard = compile(opts);
-  const wrapped = /* @__PURE__ */ __name7(async (input, init3) => {
+  const wrapped = /* @__PURE__ */ __name8(async (input, init3) => {
     const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
     let parsed;
     try {
@@ -29925,7 +30287,7 @@ function wrapHttpLike(real, opts) {
   for (const key of Object.keys(real)) {
     wrapped[key] = real[key];
   }
-  const wrapRequest = /* @__PURE__ */ __name7((origRequest) => function(...args2) {
+  const wrapRequest = /* @__PURE__ */ __name8((origRequest) => function(...args2) {
     const first = args2[0];
     const host = extractHostname(first);
     if (host && net2.isIP(host)) {
@@ -29969,7 +30331,7 @@ function wrapHttpLike(real, opts) {
       __name(this, "WrappedAgent");
     }
     static {
-      __name7(this, "WrappedAgent");
+      __name8(this, "WrappedAgent");
     }
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     createConnection(options, cb) {
@@ -30048,11 +30410,11 @@ function wrapNetModule(real, opts) {
   for (const key of Object.keys(real)) {
     wrapped[key] = real[key];
   }
-  const wrappedCreate = /* @__PURE__ */ __name7(function(...args2) {
+  const wrappedCreate = /* @__PURE__ */ __name8(function(...args2) {
     guardConnectArgs(args2, guard, "net.createConnection");
     return real.createConnection.apply(real, args2);
   }, "wrappedCreate");
-  const guardedSocketConnect = /* @__PURE__ */ __name7(function(...args2) {
+  const guardedSocketConnect = /* @__PURE__ */ __name8(function(...args2) {
     guardConnectArgs(args2, guard, "net.Socket.connect");
     return real.Socket.prototype.connect.apply(this, args2);
   }, "guardedSocketConnect");
@@ -30061,7 +30423,7 @@ function wrapNetModule(real, opts) {
       __name(this, "WrappedSocket");
     }
     static {
-      __name7(this, "WrappedSocket");
+      __name8(this, "WrappedSocket");
     }
   };
   Object.defineProperty(WrappedSocket.prototype, "connect", {
@@ -30090,11 +30452,11 @@ function wrapTlsModule(real, opts) {
   for (const key of Object.keys(real)) {
     wrapped[key] = real[key];
   }
-  const wrappedConnect = /* @__PURE__ */ __name7(function(...args2) {
+  const wrappedConnect = /* @__PURE__ */ __name8(function(...args2) {
     guardConnectArgs(args2, guard, "tls.connect");
     return real.connect.apply(real, args2);
   }, "wrappedConnect");
-  const guardedTLSConnect = /* @__PURE__ */ __name7(function(...args2) {
+  const guardedTLSConnect = /* @__PURE__ */ __name8(function(...args2) {
     guardConnectArgs(args2, guard, "tls.TLSSocket.connect");
     return real.TLSSocket.prototype.connect.apply(this, args2);
   }, "guardedTLSConnect");
@@ -30103,7 +30465,7 @@ function wrapTlsModule(real, opts) {
       __name(this, "WrappedTLSSocket");
     }
     static {
-      __name7(this, "WrappedTLSSocket");
+      __name8(this, "WrappedTLSSocket");
     }
   };
   Object.defineProperty(WrappedTLSSocket.prototype, "connect", {
@@ -30131,7 +30493,7 @@ function wrapHttp2Module(real, opts) {
   for (const key of Object.keys(real)) {
     wrapped[key] = real[key];
   }
-  const wrappedConnect = /* @__PURE__ */ __name7(function(...args2) {
+  const wrappedConnect = /* @__PURE__ */ __name8(function(...args2) {
     const authority = args2[0];
     const host = extractHostname(authority);
     if (host && net2.isIP(host)) {
@@ -30342,7 +30704,7 @@ function buildResponse(r) {
 function buildRecordFetch(opts) {
   const fixtures = compileFixtures(opts.fixtures);
   const recorder = opts.recorder;
-  const record = /* @__PURE__ */ __name7((entry) => {
+  const record = /* @__PURE__ */ __name8((entry) => {
     if (!recorder) return;
     try {
       const result = recorder(entry);
@@ -30352,7 +30714,7 @@ function buildRecordFetch(opts) {
     } catch {
     }
   }, "record");
-  const recordFetch = /* @__PURE__ */ __name7(async (input, init3) => {
+  const recordFetch = /* @__PURE__ */ __name8(async (input, init3) => {
     const req = isRequestLike(input) ? input : null;
     const signal = init3?.signal ?? req?.signal ?? null;
     if (signal?.aborted) throw abortReason(signal);
@@ -30403,7 +30765,7 @@ function abortReason(signal) {
   return signal.reason ?? new DOMException("This operation was aborted", "AbortError");
 }
 function blocker(via) {
-  return /* @__PURE__ */ __name7(/* @__PURE__ */ __name(function blocked() {
+  return /* @__PURE__ */ __name8(/* @__PURE__ */ __name(function blocked() {
     throw testEgressBlockedError({
       via
     });
@@ -30424,7 +30786,7 @@ function blockedSubclass(Real, method, via) {
       __name(this, "Blocked");
     }
     static {
-      __name7(this, "Blocked");
+      __name8(this, "Blocked");
     }
   };
   lockMethod(Blocked.prototype, method, block);
@@ -30569,7 +30931,7 @@ function namedError(name) {
       __name(this, "Ctor");
     }
     static {
-      __name7(this, "Ctor");
+      __name8(this, "Ctor");
     }
     type;
     code;
@@ -30586,11 +30948,11 @@ function namedError(name) {
   return Ctor;
 }
 function buildNodeFetchShim(recordFetch) {
-  const shim = /* @__PURE__ */ __name7(async (input, init3) => {
+  const shim = /* @__PURE__ */ __name8(async (input, init3) => {
     const res = await recordFetch(input, init3);
     if (typeof res.buffer !== "function") {
       Object.defineProperty(res, "buffer", {
-        value: /* @__PURE__ */ __name7(async () => Buffer.from(await res.arrayBuffer()), "value"),
+        value: /* @__PURE__ */ __name8(async () => Buffer.from(await res.arrayBuffer()), "value"),
         configurable: true
       });
     }
@@ -30665,7 +31027,7 @@ function createBaseSandboxContext(opts) {
     fixtures: opts.testEgressFixtures,
     recorder: opts.testEgressRecorder
   }) : void 0;
-  const requireWithEgress = /* @__PURE__ */ __name7((id2) => {
+  const requireWithEgress = /* @__PURE__ */ __name8((id2) => {
     if (recordFetch) {
       if (wrappedModuleCache.has(id2)) return wrappedModuleCache.get(id2);
       let override;
@@ -30796,7 +31158,7 @@ function pinnedDispatcherFor(addresses2) {
     addresses: pinned,
     // `destroy`, not `close`: close waits for in-flight requests, and this is called
     // once the body has been read or cancelled, where waiting can only hang.
-    close: /* @__PURE__ */ __name7(async () => {
+    close: /* @__PURE__ */ __name8(async () => {
       try {
         await dispatcher.destroy();
       } catch {
@@ -30841,7 +31203,7 @@ function buildWorkflowScriptGlobals(hostConsole) {
       __name(this, "WorkflowDate");
     }
     static {
-      __name7(this, "WorkflowDate");
+      __name8(this, "WorkflowDate");
     }
     constructor(...args2) {
       if (args2.length === 0) throw new WorkflowDeterminismError("new Date()", "new Date(now())");
@@ -31000,7 +31362,7 @@ function createGuardedDispatcher(opts = {}) {
   const base = buildConnector({
     lookup: guardedLookup(opts)
   });
-  const connect = /* @__PURE__ */ __name7((connectOpts, callback) => {
+  const connect = /* @__PURE__ */ __name8((connectOpts, callback) => {
     const host = normalizeAddressHost(connectOpts.hostname ?? "");
     if (isIP2(host)) {
       const blockClass = classify(host);
@@ -31059,16 +31421,16 @@ function classifyHostname(host) {
   if (host === "metadata.google.internal" || host === "metadata") return "imds";
   return null;
 }
-var __defProp7, __name7, REQUIRE_BLOCKLIST, SANDBOX_FAKE_DIRNAME, SANDBOX_FAKE_FILENAME, BLOCKLISTED_PACKAGES, EGRESS_DENIED_CODE, EGRESS_PROBE_DEFAULT_MS, PRIVATE_RANGES, dnsLookup, DEFAULT_BLOCK_CIDRS, HOSTNAME_NON_OVERRIDABLE_CIDRS, TEST_EGRESS_BLOCKED_CODE, REDACTED, SENSITIVE_NAME, SENSITIVE_HEADER, ENCODED_REDACTED, TELEGRAM_BOT_TOKEN_SEGMENT, MAX_REDACT_DEPTH, CHILD_PROCESS_ENTRY_POINTS, EXTERNAL_NETWORK_PACKAGES_BLOCKED, REQUIRE_BLOCKED_PACKAGES, REQUIRE_BLOCKED_BUILTINS, NODE_FETCH_MAIN_FILES, PINNED_ADDRESSES, WorkflowDeterminismError, WORKFLOW_SCRIPT_REMOVED_GLOBALS, WORKFLOW_SCRIPT_TRAPPED_GLOBALS, WORKFLOW_SCRIPT_FORBIDDEN_PLATFORM_KEYS, USER_CODE_ERROR_CODE, PLATFORM_VM_ERROR_CODE, UserCodeError, DEFAULT_MAX_CAUSE_DEPTH, MissingPrimitiveCodeError, BLOCKED_ADDRESS_CODE, BlockedAddressError, defaultResolve, MCP_URL_BLOCKED_CODE, McpUrlBlockedError, normalizeHost, DEFAULT_UNIFIED_MCP_HOSTS, defaultLookup, McpUrlGuard;
+var __defProp8, __name8, REQUIRE_BLOCKLIST, SANDBOX_FAKE_DIRNAME, SANDBOX_FAKE_FILENAME, BLOCKLISTED_PACKAGES, EGRESS_DENIED_CODE, EGRESS_PROBE_DEFAULT_MS, PRIVATE_RANGES, dnsLookup, DEFAULT_BLOCK_CIDRS, HOSTNAME_NON_OVERRIDABLE_CIDRS, TEST_EGRESS_BLOCKED_CODE, REDACTED, SENSITIVE_NAME, SENSITIVE_HEADER, ENCODED_REDACTED, TELEGRAM_BOT_TOKEN_SEGMENT, MAX_REDACT_DEPTH, CHILD_PROCESS_ENTRY_POINTS, EXTERNAL_NETWORK_PACKAGES_BLOCKED, REQUIRE_BLOCKED_PACKAGES, REQUIRE_BLOCKED_BUILTINS, NODE_FETCH_MAIN_FILES, PINNED_ADDRESSES, WorkflowDeterminismError, WORKFLOW_SCRIPT_REMOVED_GLOBALS, WORKFLOW_SCRIPT_TRAPPED_GLOBALS, WORKFLOW_SCRIPT_FORBIDDEN_PLATFORM_KEYS, USER_CODE_ERROR_CODE, PLATFORM_VM_ERROR_CODE, UserCodeError, DEFAULT_MAX_CAUSE_DEPTH, MissingPrimitiveCodeError, BLOCKED_ADDRESS_CODE, BlockedAddressError, defaultResolve, MCP_URL_BLOCKED_CODE, McpUrlBlockedError, normalizeHost, DEFAULT_UNIFIED_MCP_HOSTS, defaultLookup, McpUrlGuard;
 var init_dist4 = __esm({
   "../shared-sandbox/dist/index.mjs"() {
     "use strict";
-    __defProp7 = Object.defineProperty;
-    __name7 = /* @__PURE__ */ __name((target, value3) => __defProp7(target, "name", { value: value3, configurable: true }), "__name");
+    __defProp8 = Object.defineProperty;
+    __name8 = /* @__PURE__ */ __name((target, value3) => __defProp8(target, "name", { value: value3, configurable: true }), "__name");
     __name(buildSandboxProcess, "buildSandboxProcess");
-    __name7(buildSandboxProcess, "buildSandboxProcess");
+    __name8(buildSandboxProcess, "buildSandboxProcess");
     __name(buildSandboxGlobals, "buildSandboxGlobals");
-    __name7(buildSandboxGlobals, "buildSandboxGlobals");
+    __name8(buildSandboxGlobals, "buildSandboxGlobals");
     REQUIRE_BLOCKLIST = /* @__PURE__ */ new Set([
       "child_process",
       "node:child_process",
@@ -31107,15 +31469,15 @@ var init_dist4 = __esm({
       ...REQUIRE_BLOCKLIST
     ].filter((id2) => !id2.startsWith("node:") && !builtinModules.includes(id2));
     __name(isRequireBlocklisted, "isRequireBlocklisted");
-    __name7(isRequireBlocklisted, "isRequireBlocklisted");
+    __name8(isRequireBlocklisted, "isRequireBlocklisted");
     __name(buildSandboxRequire, "buildSandboxRequire");
-    __name7(buildSandboxRequire, "buildSandboxRequire");
+    __name8(buildSandboxRequire, "buildSandboxRequire");
     EGRESS_DENIED_CODE = "EGRESS_DENIED";
     EGRESS_PROBE_DEFAULT_MS = 3e3;
     __name(v4ToInt, "v4ToInt");
-    __name7(v4ToInt, "v4ToInt");
+    __name8(v4ToInt, "v4ToInt");
     __name(range, "range");
-    __name7(range, "range");
+    __name8(range, "range");
     PRIVATE_RANGES = [
       range("169.254.169.254/32", "imds"),
       range("169.254.0.0/16", "link_local"),
@@ -31125,19 +31487,19 @@ var init_dist4 = __esm({
       range("100.64.0.0/10", "cgnat")
     ];
     __name(inRange, "inRange");
-    __name7(inRange, "inRange");
+    __name8(inRange, "inRange");
     __name(mappedV4, "mappedV4");
-    __name7(mappedV4, "mappedV4");
+    __name8(mappedV4, "mappedV4");
     __name(classifyPrivateAddress, "classifyPrivateAddress");
-    __name7(classifyPrivateAddress, "classifyPrivateAddress");
+    __name8(classifyPrivateAddress, "classifyPrivateAddress");
     __name(egressDeniedMessage, "egressDeniedMessage");
-    __name7(egressDeniedMessage, "egressDeniedMessage");
+    __name8(egressDeniedMessage, "egressDeniedMessage");
     __name(egressDeniedError, "egressDeniedError");
-    __name7(egressDeniedError, "egressDeniedError");
+    __name8(egressDeniedError, "egressDeniedError");
     __name(isEgressDeniedError, "isEgressDeniedError");
-    __name7(isEgressDeniedError, "isEgressDeniedError");
+    __name8(isEgressDeniedError, "isEgressDeniedError");
     __name(resolveEgressProbeMs, "resolveEgressProbeMs");
-    __name7(resolveEgressProbeMs, "resolveEgressProbeMs");
+    __name8(resolveEgressProbeMs, "resolveEgressProbeMs");
     dnsLookup = promisify(dns.lookup);
     DEFAULT_BLOCK_CIDRS = [
       // IPv4
@@ -31162,116 +31524,116 @@ var init_dist4 = __esm({
       "fd00:ec2::254/128"
     ];
     __name(ipv4ToInt, "ipv4ToInt");
-    __name7(ipv4ToInt, "ipv4ToInt");
+    __name8(ipv4ToInt, "ipv4ToInt");
     __name(ipv6ToBigInt, "ipv6ToBigInt");
-    __name7(ipv6ToBigInt, "ipv6ToBigInt");
+    __name8(ipv6ToBigInt, "ipv6ToBigInt");
     __name(ipv4MappedFromIpv6, "ipv4MappedFromIpv6");
-    __name7(ipv4MappedFromIpv6, "ipv4MappedFromIpv6");
+    __name8(ipv4MappedFromIpv6, "ipv4MappedFromIpv6");
     __name(parseCidr, "parseCidr");
-    __name7(parseCidr, "parseCidr");
+    __name8(parseCidr, "parseCidr");
     __name(ipInCidr, "ipInCidr");
-    __name7(ipInCidr, "ipInCidr");
+    __name8(ipInCidr, "ipInCidr");
     __name(normalizeHostname, "normalizeHostname");
-    __name7(normalizeHostname, "normalizeHostname");
+    __name8(normalizeHostname, "normalizeHostname");
     __name(parseAllowedHostname, "parseAllowedHostname");
-    __name7(parseAllowedHostname, "parseAllowedHostname");
+    __name8(parseAllowedHostname, "parseAllowedHostname");
     __name(compile, "compile");
-    __name7(compile, "compile");
+    __name8(compile, "compile");
     __name(isAllowedHostname, "isAllowedHostname");
-    __name7(isAllowedHostname, "isAllowedHostname");
+    __name8(isAllowedHostname, "isAllowedHostname");
     __name(checkAddress, "checkAddress");
-    __name7(checkAddress, "checkAddress");
+    __name8(checkAddress, "checkAddress");
     __name(resolveAndCheck, "resolveAndCheck");
-    __name7(resolveAndCheck, "resolveAndCheck");
+    __name8(resolveAndCheck, "resolveAndCheck");
     __name(emit, "emit");
-    __name7(emit, "emit");
+    __name8(emit, "emit");
     __name(extractHostname, "extractHostname");
-    __name7(extractHostname, "extractHostname");
+    __name8(extractHostname, "extractHostname");
     __name(stripBrackets, "stripBrackets");
-    __name7(stripBrackets, "stripBrackets");
+    __name8(stripBrackets, "stripBrackets");
     __name(parseHostHeader, "parseHostHeader");
-    __name7(parseHostHeader, "parseHostHeader");
+    __name8(parseHostHeader, "parseHostHeader");
     __name(buildFetchDispatcher, "buildFetchDispatcher");
-    __name7(buildFetchDispatcher, "buildFetchDispatcher");
+    __name8(buildFetchDispatcher, "buildFetchDispatcher");
     __name(wrapFetch, "wrapFetch");
-    __name7(wrapFetch, "wrapFetch");
+    __name8(wrapFetch, "wrapFetch");
     __name(privateProbeTarget, "privateProbeTarget");
-    __name7(privateProbeTarget, "privateProbeTarget");
+    __name8(privateProbeTarget, "privateProbeTarget");
     __name(fetchWithPrivateProbe, "fetchWithPrivateProbe");
-    __name7(fetchWithPrivateProbe, "fetchWithPrivateProbe");
+    __name8(fetchWithPrivateProbe, "fetchWithPrivateProbe");
     __name(buildBlockingLookup, "buildBlockingLookup");
-    __name7(buildBlockingLookup, "buildBlockingLookup");
+    __name8(buildBlockingLookup, "buildBlockingLookup");
     __name(wrapHttpLike, "wrapHttpLike");
-    __name7(wrapHttpLike, "wrapHttpLike");
+    __name8(wrapHttpLike, "wrapHttpLike");
     __name(wrapHttpModule, "wrapHttpModule");
-    __name7(wrapHttpModule, "wrapHttpModule");
+    __name8(wrapHttpModule, "wrapHttpModule");
     __name(wrapHttpsModule, "wrapHttpsModule");
-    __name7(wrapHttpsModule, "wrapHttpsModule");
+    __name8(wrapHttpsModule, "wrapHttpsModule");
     __name(guardConnectArgs, "guardConnectArgs");
-    __name7(guardConnectArgs, "guardConnectArgs");
+    __name8(guardConnectArgs, "guardConnectArgs");
     __name(wrapNetModule, "wrapNetModule");
-    __name7(wrapNetModule, "wrapNetModule");
+    __name8(wrapNetModule, "wrapNetModule");
     __name(wrapTlsModule, "wrapTlsModule");
-    __name7(wrapTlsModule, "wrapTlsModule");
+    __name8(wrapTlsModule, "wrapTlsModule");
     __name(wrapHttp2Module, "wrapHttp2Module");
-    __name7(wrapHttp2Module, "wrapHttp2Module");
+    __name8(wrapHttp2Module, "wrapHttp2Module");
     TEST_EGRESS_BLOCKED_CODE = "TEST_EGRESS_BLOCKED";
     __name(testEgressBlockedError, "testEgressBlockedError");
-    __name7(testEgressBlockedError, "testEgressBlockedError");
+    __name8(testEgressBlockedError, "testEgressBlockedError");
     __name(isTestEgressBlockedError, "isTestEgressBlockedError");
-    __name7(isTestEgressBlockedError, "isTestEgressBlockedError");
+    __name8(isTestEgressBlockedError, "isTestEgressBlockedError");
     REDACTED = "[REDACTED]";
     SENSITIVE_NAME = /auth|cookie|token|secret|passw|pwd|api[-_]?key|access[-_]?key|private[-_]?key|subscription[-_]?key|session|signature|^sig$|^key$|credential/i;
     SENSITIVE_HEADER = new RegExp(`${SENSITIVE_NAME.source}|key|subscription`, "i");
     __name(redactHeaders, "redactHeaders");
-    __name7(redactHeaders, "redactHeaders");
+    __name8(redactHeaders, "redactHeaders");
     ENCODED_REDACTED = /%5BREDACTED%5D/g;
     __name(readableRedacted, "readableRedacted");
-    __name7(readableRedacted, "readableRedacted");
+    __name8(readableRedacted, "readableRedacted");
     TELEGRAM_BOT_TOKEN_SEGMENT = /^bot\d+:[A-Za-z0-9_-]+$/;
     __name(redactSecretPath, "redactSecretPath");
-    __name7(redactSecretPath, "redactSecretPath");
+    __name8(redactSecretPath, "redactSecretPath");
     __name(redactUrl, "redactUrl");
-    __name7(redactUrl, "redactUrl");
+    __name8(redactUrl, "redactUrl");
     MAX_REDACT_DEPTH = 8;
     __name(redactJsonValue, "redactJsonValue");
-    __name7(redactJsonValue, "redactJsonValue");
+    __name8(redactJsonValue, "redactJsonValue");
     __name(redactBody, "redactBody");
-    __name7(redactBody, "redactBody");
+    __name8(redactBody, "redactBody");
     __name(globToRegExp, "globToRegExp");
-    __name7(globToRegExp, "globToRegExp");
+    __name8(globToRegExp, "globToRegExp");
     __name(compileFixtures, "compileFixtures");
-    __name7(compileFixtures, "compileFixtures");
+    __name8(compileFixtures, "compileFixtures");
     __name(tagOf, "tagOf");
-    __name7(tagOf, "tagOf");
+    __name8(tagOf, "tagOf");
     __name(isRequestLike, "isRequestLike");
-    __name7(isRequestLike, "isRequestLike");
+    __name8(isRequestLike, "isRequestLike");
     __name(describeBody, "describeBody");
-    __name7(describeBody, "describeBody");
+    __name8(describeBody, "describeBody");
     __name(buildResponse, "buildResponse");
-    __name7(buildResponse, "buildResponse");
+    __name8(buildResponse, "buildResponse");
     __name(buildRecordFetch, "buildRecordFetch");
-    __name7(buildRecordFetch, "buildRecordFetch");
+    __name8(buildRecordFetch, "buildRecordFetch");
     __name(abortReason, "abortReason");
-    __name7(abortReason, "abortReason");
+    __name8(abortReason, "abortReason");
     __name(blocker, "blocker");
-    __name7(blocker, "blocker");
+    __name8(blocker, "blocker");
     __name(lockMethod, "lockMethod");
-    __name7(lockMethod, "lockMethod");
+    __name8(lockMethod, "lockMethod");
     __name(blockedSubclass, "blockedSubclass");
-    __name7(blockedSubclass, "blockedSubclass");
+    __name8(blockedSubclass, "blockedSubclass");
     __name(shallowCopy, "shallowCopy");
-    __name7(shallowCopy, "shallowCopy");
+    __name8(shallowCopy, "shallowCopy");
     __name(blockedCtor, "blockedCtor");
-    __name7(blockedCtor, "blockedCtor");
+    __name8(blockedCtor, "blockedCtor");
     __name(blockHttpLike, "blockHttpLike");
-    __name7(blockHttpLike, "blockHttpLike");
+    __name8(blockHttpLike, "blockHttpLike");
     __name(blockNet, "blockNet");
-    __name7(blockNet, "blockNet");
+    __name8(blockNet, "blockNet");
     __name(blockTls, "blockTls");
-    __name7(blockTls, "blockTls");
+    __name8(blockTls, "blockTls");
     __name(blockHttp2, "blockHttp2");
-    __name7(blockHttp2, "blockHttp2");
+    __name8(blockHttp2, "blockHttp2");
     CHILD_PROCESS_ENTRY_POINTS = [
       "spawn",
       "spawnSync",
@@ -31283,13 +31645,13 @@ var init_dist4 = __esm({
       "_forkChild"
     ];
     __name(blockChildProcess, "blockChildProcess");
-    __name7(blockChildProcess, "blockChildProcess");
+    __name8(blockChildProcess, "blockChildProcess");
     __name(blockWorkerThreads, "blockWorkerThreads");
-    __name7(blockWorkerThreads, "blockWorkerThreads");
+    __name8(blockWorkerThreads, "blockWorkerThreads");
     __name(blockCluster, "blockCluster");
-    __name7(blockCluster, "blockCluster");
+    __name8(blockCluster, "blockCluster");
     __name(blockModuleModule, "blockModuleModule");
-    __name7(blockModuleModule, "blockModuleModule");
+    __name8(blockModuleModule, "blockModuleModule");
     EXTERNAL_NETWORK_PACKAGES_BLOCKED = [
       "ws",
       "socket.io-client"
@@ -31306,54 +31668,54 @@ var init_dist4 = __esm({
       "inspector/promises"
     ]);
     __name(isTestEgressRequireBlocked, "isTestEgressRequireBlocked");
-    __name7(isTestEgressRequireBlocked, "isTestEgressRequireBlocked");
+    __name8(isTestEgressRequireBlocked, "isTestEgressRequireBlocked");
     NODE_FETCH_MAIN_FILES = /* @__PURE__ */ new Set([
       "lib/index.js",
       "lib/index"
     ]);
     __name(isNodeFetchId, "isNodeFetchId");
-    __name7(isNodeFetchId, "isNodeFetchId");
+    __name8(isNodeFetchId, "isNodeFetchId");
     __name(isPathId, "isPathId");
-    __name7(isPathId, "isPathId");
+    __name8(isPathId, "isPathId");
     __name(packageOfResolvedPath, "packageOfResolvedPath");
-    __name7(packageOfResolvedPath, "packageOfResolvedPath");
+    __name8(packageOfResolvedPath, "packageOfResolvedPath");
     __name(interceptedIdForPath, "interceptedIdForPath");
-    __name7(interceptedIdForPath, "interceptedIdForPath");
+    __name8(interceptedIdForPath, "interceptedIdForPath");
     __name(namedError, "namedError");
-    __name7(namedError, "namedError");
+    __name8(namedError, "namedError");
     __name(buildNodeFetchShim, "buildNodeFetchShim");
-    __name7(buildNodeFetchShim, "buildNodeFetchShim");
+    __name8(buildNodeFetchShim, "buildNodeFetchShim");
     __name(testEgressRequireOverride, "testEgressRequireOverride");
-    __name7(testEgressRequireOverride, "testEgressRequireOverride");
+    __name8(testEgressRequireOverride, "testEgressRequireOverride");
     __name(wrapModuleForTestEgress, "wrapModuleForTestEgress");
-    __name7(wrapModuleForTestEgress, "wrapModuleForTestEgress");
+    __name8(wrapModuleForTestEgress, "wrapModuleForTestEgress");
     __name(createBaseSandboxContext, "createBaseSandboxContext");
-    __name7(createBaseSandboxContext, "createBaseSandboxContext");
+    __name8(createBaseSandboxContext, "createBaseSandboxContext");
     __name(applyGlobalSelfReference, "applyGlobalSelfReference");
-    __name7(applyGlobalSelfReference, "applyGlobalSelfReference");
+    __name8(applyGlobalSelfReference, "applyGlobalSelfReference");
     __name(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
-    __name7(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
+    __name8(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
     __name(resolveExtraAllowedHostnames, "resolveExtraAllowedHostnames");
-    __name7(resolveExtraAllowedHostnames, "resolveExtraAllowedHostnames");
+    __name8(resolveExtraAllowedHostnames, "resolveExtraAllowedHostnames");
     PINNED_ADDRESSES = /* @__PURE__ */ Symbol.for("lua.pinnedDispatch.addresses");
     __name(pinnedLookup, "pinnedLookup");
-    __name7(pinnedLookup, "pinnedLookup");
+    __name8(pinnedLookup, "pinnedLookup");
     __name(pinnedDispatcherFor, "pinnedDispatcherFor");
-    __name7(pinnedDispatcherFor, "pinnedDispatcherFor");
+    __name8(pinnedDispatcherFor, "pinnedDispatcherFor");
     __name(pinnedAddressesOf, "pinnedAddressesOf");
-    __name7(pinnedAddressesOf, "pinnedAddressesOf");
+    __name8(pinnedAddressesOf, "pinnedAddressesOf");
     __name(withPinnedDispatcher, "withPinnedDispatcher");
-    __name7(withPinnedDispatcher, "withPinnedDispatcher");
+    __name8(withPinnedDispatcher, "withPinnedDispatcher");
     __name(wrapBundleAsCjsModule, "wrapBundleAsCjsModule");
-    __name7(wrapBundleAsCjsModule, "wrapBundleAsCjsModule");
+    __name8(wrapBundleAsCjsModule, "wrapBundleAsCjsModule");
     __name(runBundleInContext, "runBundleInContext");
-    __name7(runBundleInContext, "runBundleInContext");
+    __name8(runBundleInContext, "runBundleInContext");
     WorkflowDeterminismError = class extends Error {
       static {
         __name(this, "WorkflowDeterminismError");
       }
       static {
-        __name7(this, "WorkflowDeterminismError");
+        __name8(this, "WorkflowDeterminismError");
       }
       api;
       code = "WORKFLOW_DETERMINISM";
@@ -31449,7 +31811,7 @@ var init_dist4 = __esm({
       "compressCode"
     ];
     __name(buildWorkflowScriptGlobals, "buildWorkflowScriptGlobals");
-    __name7(buildWorkflowScriptGlobals, "buildWorkflowScriptGlobals");
+    __name8(buildWorkflowScriptGlobals, "buildWorkflowScriptGlobals");
     USER_CODE_ERROR_CODE = "USER_CODE_ERROR";
     PLATFORM_VM_ERROR_CODE = "PLATFORM_VM_ERROR";
     UserCodeError = class extends Error {
@@ -31457,7 +31819,7 @@ var init_dist4 = __esm({
         __name(this, "UserCodeError");
       }
       static {
-        __name7(this, "UserCodeError");
+        __name8(this, "UserCodeError");
       }
       code = USER_CODE_ERROR_CODE;
       source;
@@ -31473,18 +31835,18 @@ var init_dist4 = __esm({
       }
     };
     __name(isUserCodeError, "isUserCodeError");
-    __name7(isUserCodeError, "isUserCodeError");
+    __name8(isUserCodeError, "isUserCodeError");
     __name(isPlatformVmError, "isPlatformVmError");
-    __name7(isPlatformVmError, "isPlatformVmError");
+    __name8(isPlatformVmError, "isPlatformVmError");
     DEFAULT_MAX_CAUSE_DEPTH = 10;
     __name(findUserCodeErrorInCauseChain, "findUserCodeErrorInCauseChain");
-    __name7(findUserCodeErrorInCauseChain, "findUserCodeErrorInCauseChain");
+    __name8(findUserCodeErrorInCauseChain, "findUserCodeErrorInCauseChain");
     MissingPrimitiveCodeError = class extends Error {
       static {
         __name(this, "MissingPrimitiveCodeError");
       }
       static {
-        __name7(this, "MissingPrimitiveCodeError");
+        __name8(this, "MissingPrimitiveCodeError");
       }
       code = PLATFORM_VM_ERROR_CODE;
       source;
@@ -31501,26 +31863,26 @@ var init_dist4 = __esm({
       }
     };
     __name(assertPrimitiveCodePresent, "assertPrimitiveCodePresent");
-    __name7(assertPrimitiveCodePresent, "assertPrimitiveCodePresent");
+    __name8(assertPrimitiveCodePresent, "assertPrimitiveCodePresent");
     __name(withUserCodeBoundary, "withUserCodeBoundary");
-    __name7(withUserCodeBoundary, "withUserCodeBoundary");
+    __name8(withUserCodeBoundary, "withUserCodeBoundary");
     __name(logUserCodeOrError, "logUserCodeOrError");
-    __name7(logUserCodeOrError, "logUserCodeOrError");
+    __name8(logUserCodeOrError, "logUserCodeOrError");
     __name(normalizeAddressHost, "normalizeAddressHost");
-    __name7(normalizeAddressHost, "normalizeAddressHost");
+    __name8(normalizeAddressHost, "normalizeAddressHost");
     __name(ipv6Hextets, "ipv6Hextets");
-    __name7(ipv6Hextets, "ipv6Hextets");
+    __name8(ipv6Hextets, "ipv6Hextets");
     __name(classifyV4, "classifyV4");
-    __name7(classifyV4, "classifyV4");
+    __name8(classifyV4, "classifyV4");
     __name(classifyBlockedAddress, "classifyBlockedAddress");
-    __name7(classifyBlockedAddress, "classifyBlockedAddress");
+    __name8(classifyBlockedAddress, "classifyBlockedAddress");
     BLOCKED_ADDRESS_CODE = "EBLOCKEDADDRESS";
     BlockedAddressError = class extends Error {
       static {
         __name(this, "BlockedAddressError");
       }
       static {
-        __name7(this, "BlockedAddressError");
+        __name8(this, "BlockedAddressError");
       }
       code = BLOCKED_ADDRESS_CODE;
       host;
@@ -31537,24 +31899,24 @@ var init_dist4 = __esm({
       }
     };
     __name(isBlockedAddressError, "isBlockedAddressError");
-    __name7(isBlockedAddressError, "isBlockedAddressError");
-    defaultResolve = /* @__PURE__ */ __name7(async (host) => (await dnsPromises.lookup(host, {
+    __name8(isBlockedAddressError, "isBlockedAddressError");
+    defaultResolve = /* @__PURE__ */ __name8(async (host) => (await dnsPromises.lookup(host, {
       all: true,
       verbatim: true
     })).map((r) => r.address), "defaultResolve");
     __name(guardedLookup, "guardedLookup");
-    __name7(guardedLookup, "guardedLookup");
+    __name8(guardedLookup, "guardedLookup");
     __name(createGuardedDispatcher, "createGuardedDispatcher");
-    __name7(createGuardedDispatcher, "createGuardedDispatcher");
+    __name8(createGuardedDispatcher, "createGuardedDispatcher");
     __name(fetchVia, "fetchVia");
-    __name7(fetchVia, "fetchVia");
+    __name8(fetchVia, "fetchVia");
     MCP_URL_BLOCKED_CODE = "MCP_URL_BLOCKED";
     McpUrlBlockedError = class extends Error {
       static {
         __name(this, "McpUrlBlockedError");
       }
       static {
-        __name7(this, "McpUrlBlockedError");
+        __name8(this, "McpUrlBlockedError");
       }
       code = MCP_URL_BLOCKED_CODE;
       host;
@@ -31569,24 +31931,24 @@ var init_dist4 = __esm({
       }
     };
     __name(isMcpUrlBlockedError, "isMcpUrlBlockedError");
-    __name7(isMcpUrlBlockedError, "isMcpUrlBlockedError");
+    __name8(isMcpUrlBlockedError, "isMcpUrlBlockedError");
     __name(resolveMcpSsrfGuardMode, "resolveMcpSsrfGuardMode");
-    __name7(resolveMcpSsrfGuardMode, "resolveMcpSsrfGuardMode");
+    __name8(resolveMcpSsrfGuardMode, "resolveMcpSsrfGuardMode");
     normalizeHost = normalizeAddressHost;
     __name(hostListEntry, "hostListEntry");
-    __name7(hostListEntry, "hostListEntry");
+    __name8(hostListEntry, "hostListEntry");
     __name(parseHostList, "parseHostList");
-    __name7(parseHostList, "parseHostList");
+    __name8(parseHostList, "parseHostList");
     __name(parseMcpSsrfAllowHosts, "parseMcpSsrfAllowHosts");
-    __name7(parseMcpSsrfAllowHosts, "parseMcpSsrfAllowHosts");
+    __name8(parseMcpSsrfAllowHosts, "parseMcpSsrfAllowHosts");
     DEFAULT_UNIFIED_MCP_HOSTS = /* @__PURE__ */ new Set([
       "mcp-api.unified.to"
     ]);
     __name(isTrustedUnifiedMcpHost, "isTrustedUnifiedMcpHost");
-    __name7(isTrustedUnifiedMcpHost, "isTrustedUnifiedMcpHost");
+    __name8(isTrustedUnifiedMcpHost, "isTrustedUnifiedMcpHost");
     __name(classifyHostname, "classifyHostname");
-    __name7(classifyHostname, "classifyHostname");
-    defaultLookup = /* @__PURE__ */ __name7(async (host) => {
+    __name8(classifyHostname, "classifyHostname");
+    defaultLookup = /* @__PURE__ */ __name8(async (host) => {
       const records = await dns2.lookup(host, {
         all: true,
         verbatim: true
@@ -31598,7 +31960,7 @@ var init_dist4 = __esm({
         __name(this, "_McpUrlGuard");
       }
       static {
-        __name7(this, "McpUrlGuard");
+        __name8(this, "McpUrlGuard");
       }
       opts;
       allowMemo = /* @__PURE__ */ new Map();
@@ -31652,7 +32014,7 @@ var init_dist4 = __esm({
             ...this.opts.lookup ? {
               resolve: this.opts.lookup
             } : {},
-            onBlocked: /* @__PURE__ */ __name7((info) => this.opts.onConnectBlocked?.(info), "onBlocked")
+            onBlocked: /* @__PURE__ */ __name8((info) => this.opts.onConnectBlocked?.(info), "onBlocked")
           });
           this.guardedFetch = fetchVia(dispatcher);
         }
@@ -32186,10 +32548,11 @@ function deterministicCrypto() {
     }
   });
 }
-function throwingFacade(name) {
+function throwingFacade(name, pure = {}) {
   return new Proxy({}, {
     get: /* @__PURE__ */ __name((_t, prop) => {
       if (prop === "then" || typeof prop === "symbol") return void 0;
+      if (Object.hasOwn(pure, prop)) return pure[prop];
       return notStaticStub(`${name}.${String(prop)}`)();
     }, "get")
   });
@@ -32240,7 +32603,7 @@ function createSerializationContext() {
     });
   }, "sandboxRequire");
   const facades = {};
-  for (const name of PLATFORM_GLOBALS) facades[name] = throwingFacade(name);
+  for (const name of PLATFORM_GLOBALS) facades[name] = throwingFacade(name, PURE_FACADE_MEMBERS[name]);
   const context = vm3.createContext({
     ...PRIMITIVE_SHIMS,
     ...facades,
@@ -32817,11 +33180,12 @@ function applyInheritCandidate(d) {
     })
   };
 }
-var NOT_STATIC, isNotStatic, isBuildError, inheritRefsOf, COMMITTED_WORKFLOW_MEMBERS, isCommittedWorkflow, PLATFORM_GLOBALS, calleeName, kindOf, GRAPH_HASH_PLACEHOLDER, issueKey;
+var NOT_STATIC, isNotStatic, isBuildError, inheritRefsOf, COMMITTED_WORKFLOW_MEMBERS, isCommittedWorkflow, PLATFORM_GLOBALS, PURE_FACADE_MEMBERS, calleeName, kindOf, GRAPH_HASH_PLACEHOLDER, issueKey;
 var init_graph_serializer = __esm({
   "src/compiler/utils/graph-serializer.ts"() {
     "use strict";
     init_dist4();
+    init_decisions_api();
     init_dist();
     init_dist2();
     init_compile_constants();
@@ -32867,6 +33231,13 @@ var init_graph_serializer = __esm({
       "Threads",
       "Browser"
     ];
+    PURE_FACADE_MEMBERS = {
+      Decisions: {
+        odds,
+        choice,
+        score
+      }
+    };
     __name(safeDate, "safeDate");
     __name(safeMath, "safeMath");
     __name(createSerializationContext, "createSerializationContext");
@@ -34019,7 +34390,7 @@ function unresolvedRefIssues(all, browsers) {
   }
   return issues;
 }
-var oneOf2, stringList, positiveIntUpTo, SETTING_CHECKS, BROWSER_SETTING_KEYS, BrowserPlugin;
+var oneOf2, stringList, positiveIntUpTo, SETTING_CHECKS, wholeNumberUpTo, SETTING_RULES, BROWSER_SETTING_KEYS, BrowserPlugin;
 var init_browser_plugin = __esm({
   "src/compiler/plugins/browser.plugin.ts"() {
     "use strict";
@@ -34046,6 +34417,21 @@ var init_browser_plugin = __esm({
       persist: /* @__PURE__ */ __name((value3) => typeof value3 === "boolean", "persist"),
       credentials: stringList
     };
+    wholeNumberUpTo = /* @__PURE__ */ __name((max, unit) => `it must be a whole number of ${unit} from 1 to ${max}`, "wholeNumberUpTo");
+    SETTING_RULES = {
+      engine: `it must be one of ${BROWSER_ENGINES.join(", ")}`,
+      fallback: `it must be one of ${BROWSER_FALLBACKS.join(", ")}`,
+      proxyCountry: 'it must be a two-letter country code, like "de"',
+      allowedDomains: "it must be a list of non-empty domain strings",
+      confirmActions: "it must be a list of non-empty action names",
+      maxSessionMinutes: wholeNumberUpTo(BROWSER_LIMIT_MAX.maxSessionMinutes, "minutes"),
+      idleTimeoutSeconds: wholeNumberUpTo(BROWSER_LIMIT_MAX.idleTimeoutSeconds, "seconds"),
+      maxConcurrentSessions: wholeNumberUpTo(BROWSER_LIMIT_MAX.maxConcurrentSessions, "sessions"),
+      screenshots: `it must be one of ${BROWSER_SCREENSHOT_POLICIES.join(", ")}`,
+      logContent: `it must be one of ${BROWSER_LOG_CONTENT_MODES.join(", ")}`,
+      persist: "it must be true or false",
+      credentials: "it must be a list of non-empty credential names"
+    };
     BROWSER_SETTING_KEYS = Object.keys(SETTING_CHECKS);
     __name(shapeBrowserSettings, "shapeBrowserSettings");
     __name(duplicateNameIssues, "duplicateNameIssues");
@@ -34087,7 +34473,7 @@ var init_browser_plugin = __esm({
           }));
         }
         for (const key of metadata.metadata.invalidSettings ?? []) {
-          errors.push(validationError(`Browser "${metadata.name}" has an invalid \`${key}\``, {
+          errors.push(validationError(`Browser "${metadata.name}" has an invalid \`${key}\`: ${SETTING_RULES[key]}`, {
             line: metadata.line
           }));
         }
@@ -34137,217 +34523,6 @@ var init_browser_plugin = __esm({
   }
 });
 
-// ../sandbox-runtime/dist/decisions-api.mjs
-function isRecord5(value3) {
-  return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
-}
-function isProvider(value3) {
-  return DECISION_PROVIDERS.includes(value3);
-}
-function invalid(message) {
-  return new DecisionError(message, {
-    code: DECISION_ERROR_CODES.INVALID
-  });
-}
-function assertInstructions(builder, instructions) {
-  if (typeof instructions !== "string" || instructions.trim().length === 0) {
-    throw invalid(`Decisions.${builder} needs non-empty instructions`);
-  }
-  if (instructions.length > DECISION_LIMITS.maxInstructionChars) {
-    throw invalid(`Decisions.${builder} instructions must be at most ${DECISION_LIMITS.maxInstructionChars} characters`);
-  }
-}
-function assertCount(what, count2, min, max) {
-  if (count2 < min || count2 > max) {
-    throw invalid(`${what} must hold ${min} to ${max} entries, got ${count2}`);
-  }
-}
-function odds(instructions, criteria) {
-  assertInstructions("odds", instructions);
-  if (criteria === void 0) return {
-    type: "odds",
-    instructions
-  };
-  if (!isRecord5(criteria)) throw invalid("Decisions.odds criteria must be an object like { yes, no }");
-  return {
-    type: "odds",
-    instructions,
-    criteria
-  };
-}
-function choice(instructions, options) {
-  assertInstructions("choice", instructions);
-  if (!isRecord5(options)) throw invalid("Decisions.choice options must be an object of label to description");
-  assertCount("Decisions.choice options", Object.keys(options).length, DECISION_LIMITS.minOptions, DECISION_LIMITS.maxOptions);
-  return {
-    type: "choice",
-    instructions,
-    options
-  };
-}
-function score(instructions, levels) {
-  assertInstructions("score", instructions);
-  if (!Array.isArray(levels)) throw invalid("Decisions.score levels must be an array");
-  assertCount("Decisions.score levels", levels.length, DECISION_LIMITS.minLevels, DECISION_LIMITS.maxLevels);
-  return {
-    type: "score",
-    instructions,
-    levels
-  };
-}
-function assertDecisionQuestion(name, question) {
-  if (!isRecord5(question) || !DECISION_QUESTION_TYPES.includes(question.type)) {
-    throw invalid(`questions.${name} must be built with Decisions.odds, Decisions.choice or Decisions.score`);
-  }
-  if (typeof question.instructions !== "string" || question.instructions.trim().length === 0) {
-    throw invalid(`questions.${name}.instructions must be a non-empty string`);
-  }
-}
-function checkDecisionRequest(request2) {
-  if (!isRecord5(request2)) {
-    throw invalid("Decisions.ask needs { state, questions } or (state, question)");
-  }
-  if (request2.state === void 0 || request2.state === null) {
-    throw invalid("Decisions.ask needs a state");
-  }
-  if (!isRecord5(request2.questions) || Object.keys(request2.questions).length === 0) {
-    throw invalid("Decisions.ask needs at least one question in questions");
-  }
-  for (const [name, question] of Object.entries(request2.questions)) assertDecisionQuestion(name, question);
-  return request2;
-}
-function checkDecisionRunRequest(request2) {
-  if (typeof request2.name !== "string" || !DECISION_NAME_PATTERN.test(request2.name)) {
-    throw invalid("Decisions.run needs the name of a decision declared on the agent");
-  }
-  if (request2.state === void 0 || request2.state === null) {
-    throw invalid("Decisions.run needs a state");
-  }
-  return request2;
-}
-function toDecisionError(caught) {
-  if (caught instanceof DecisionError) return caught;
-  const raw = isRecord5(caught) ? caught : {};
-  const message = typeof raw.message === "string" && raw.message.length > 0 ? raw.message : "Decision failed";
-  const code = typeof raw.code === "string" && raw.code.length > 0 ? raw.code : DECISION_ERROR_CODES.UNAVAILABLE;
-  return new DecisionError(message, {
-    code,
-    ...isProvider(raw.provider) && {
-      provider: raw.provider
-    },
-    ...typeof raw.upstreamStatus === "number" && {
-      upstreamStatus: raw.upstreamStatus
-    },
-    ...typeof raw.decisionId === "string" && {
-      decisionId: raw.decisionId
-    }
-  });
-}
-function buildDecisionsApi(transport) {
-  async function relay2(send) {
-    if (!transport) {
-      throw new DecisionError("Decisions is not available in this runtime", {
-        code: DECISION_ERROR_CODES.UNAVAILABLE
-      });
-    }
-    try {
-      return await send(transport);
-    } catch (caught) {
-      throw toDecisionError(caught);
-    }
-  }
-  __name(relay2, "relay");
-  __name8(relay2, "relay");
-  async function ask(requestOrState, question, options) {
-    if (question === void 0) {
-      const request22 = checkDecisionRequest(requestOrState);
-      return relay2((t) => t.ask(request22));
-    }
-    const request2 = checkDecisionRequest({
-      ...options,
-      state: requestOrState,
-      questions: {
-        [SINGLE_DECISION_KEY]: question
-      }
-    });
-    const result = await relay2((t) => t.ask(request2));
-    return result.answers[SINGLE_DECISION_KEY];
-  }
-  __name(ask, "ask");
-  __name8(ask, "ask");
-  async function run(name, state3, options) {
-    const request2 = checkDecisionRunRequest({
-      ...options,
-      name,
-      state: state3
-    });
-    return await relay2((t) => t.run(request2));
-  }
-  __name(run, "run");
-  __name8(run, "run");
-  return {
-    ask,
-    run,
-    odds,
-    choice,
-    score
-  };
-}
-var __defProp8, __name8, DECISION_ERROR_NAME, SINGLE_DECISION_KEY, DecisionError;
-var init_decisions_api = __esm({
-  "../sandbox-runtime/dist/decisions-api.mjs"() {
-    "use strict";
-    init_dist();
-    __defProp8 = Object.defineProperty;
-    __name8 = /* @__PURE__ */ __name((target, value3) => __defProp8(target, "name", { value: value3, configurable: true }), "__name");
-    DECISION_ERROR_NAME = "DecisionError";
-    SINGLE_DECISION_KEY = "answer";
-    DecisionError = class extends Error {
-      static {
-        __name(this, "DecisionError");
-      }
-      static {
-        __name8(this, "DecisionError");
-      }
-      code;
-      constructor(message, fields) {
-        super(message);
-        this.name = DECISION_ERROR_NAME;
-        this.code = fields.code;
-        if (fields.provider !== void 0) this.provider = fields.provider;
-        if (fields.upstreamStatus !== void 0) this.upstreamStatus = fields.upstreamStatus;
-        if (fields.decisionId !== void 0) this.decisionId = fields.decisionId;
-      }
-    };
-    __name(isRecord5, "isRecord");
-    __name8(isRecord5, "isRecord");
-    __name(isProvider, "isProvider");
-    __name8(isProvider, "isProvider");
-    __name(invalid, "invalid");
-    __name8(invalid, "invalid");
-    __name(assertInstructions, "assertInstructions");
-    __name8(assertInstructions, "assertInstructions");
-    __name(assertCount, "assertCount");
-    __name8(assertCount, "assertCount");
-    __name(odds, "odds");
-    __name8(odds, "odds");
-    __name(choice, "choice");
-    __name8(choice, "choice");
-    __name(score, "score");
-    __name8(score, "score");
-    __name(assertDecisionQuestion, "assertDecisionQuestion");
-    __name8(assertDecisionQuestion, "assertDecisionQuestion");
-    __name(checkDecisionRequest, "checkDecisionRequest");
-    __name8(checkDecisionRequest, "checkDecisionRequest");
-    __name(checkDecisionRunRequest, "checkDecisionRunRequest");
-    __name8(checkDecisionRunRequest, "checkDecisionRunRequest");
-    __name(toDecisionError, "toDecisionError");
-    __name8(toDecisionError, "toDecisionError");
-    __name(buildDecisionsApi, "buildDecisionsApi");
-    __name8(buildDecisionsApi, "buildDecisionsApi");
-  }
-});
-
 // src/compiler/plugins/decision.plugin.ts
 import fs8 from "fs/promises";
 import { Node as Node20 } from "ts-morph";
@@ -34519,7 +34694,7 @@ var init_decision_plugin = __esm({
           line
         }));
         if (extractionErrors.length === 0) {
-          const parsed = DecisionDefinitionSchema.safeParse(definitionOf(metadata.name, metadata.description, metadata.metadata));
+          const parsed = DecisionDefinitionWriteSchema.safeParse(definitionOf(metadata.name, metadata.description, metadata.metadata));
           if (!parsed.success) {
             for (const issue of parsed.error.issues) {
               const path32 = issue.path.length > 0 ? issue.path.join(".") : "<root>";
@@ -34666,7 +34841,13 @@ import { build } from "esbuild";
 function nodeCapabilityUnavailableMessage(specifier) {
   return `${NODE_CAPABILITY_UNAVAILABLE}: \`${specifier}\` is not available to a workflow code step \u2014 on the Job tier run a command through \`ctx.exec(['git', 'status'])\` or \`ctx.$\`git status\`\` (allow-listed binaries, argv only, no shell; see docs/workflows/workspaces-and-long-steps.md); a worker-tier step has no process access at all`;
 }
-var WORKFLOW_BUILDER_SUBPATH, WORKFLOW_BUILDER_INJECT_FILE, WEB_APP_RUNTIME_INJECT_FILE, WEB_APP_RUNTIME_INJECT_SOURCE, NODE_CAPABILITY_UNAVAILABLE, NODE_CAPABILITY_GUARDED, Bundler;
+function workflowConstantUnavailableMessage(name, specifier) {
+  return `${WORKFLOW_CONSTANT_UNAVAILABLE}: \`${name}\` (from '${specifier}') is workflow-only and is not available outside a workflow \u2014 inside a workflow import it from 'lua-cli/workflow-builder'; in a tool, job or webhook inline the number instead`;
+}
+function isLuaCliSpecifier(spec) {
+  return spec === "lua-cli" || spec === "lua-cli/skill" || spec === "lua-cli/voice" || spec.includes("api-exports");
+}
+var WORKFLOW_BUILDER_SUBPATH, WORKFLOW_BUILDER_INJECT_FILE, WEB_APP_RUNTIME_INJECT_FILE, WEB_APP_RUNTIME_INJECT_SOURCE, INERT_WORKFLOW_BUILDER_SPECIFIER, INERT_WORKFLOW_BUILDER_NAMESPACE, WORKFLOW_SHIM_NAME_SET, INERT_WORKFLOW_BUILDER_SOURCE, NODE_CAPABILITY_UNAVAILABLE, NODE_CAPABILITY_GUARDED, WORKFLOW_CONSTANT_UNAVAILABLE, WORKFLOW_CONSTANT_NAMES, COMPILE_GUARD_CODES, Bundler;
 var init_bundler = __esm({
   "src/compiler/bundler.ts"() {
     "use strict";
@@ -34694,9 +34875,34 @@ export function defineWebApp(config) {
   return config;
 }
 `;
+    INERT_WORKFLOW_BUILDER_SPECIFIER = "lua-cli-inert-workflow-builder";
+    INERT_WORKFLOW_BUILDER_NAMESPACE = "lua-inert-workflow-builder";
+    WORKFLOW_SHIM_NAME_SET = new Set(WORKFLOW_SHIM_NAMES);
+    INERT_WORKFLOW_BUILDER_SOURCE = `function inert() {
+  return new Proxy(function () {}, {
+    get: (_target, key) => (typeof key === 'symbol' ? undefined : inert()),
+    apply: () => inert(),
+    construct: () => inert(),
+  });
+}
+` + WORKFLOW_SHIM_NAMES.map((name) => `export function ${name}() {
+  return inert();
+}
+`).join("");
     NODE_CAPABILITY_UNAVAILABLE = "node-capability-unavailable";
     NODE_CAPABILITY_GUARDED = /^(node:)?(child_process|worker_threads|cluster)$/;
     __name(nodeCapabilityUnavailableMessage, "nodeCapabilityUnavailableMessage");
+    WORKFLOW_CONSTANT_UNAVAILABLE = "workflow-constant-unavailable";
+    WORKFLOW_CONSTANT_NAMES = [
+      "WORKFLOW_DEFAULT_MAX_DURATION_SECONDS",
+      "WORKFLOW_HITL_MAX_DURATION_SECONDS"
+    ];
+    COMPILE_GUARD_CODES = [
+      NODE_CAPABILITY_UNAVAILABLE,
+      WORKFLOW_CONSTANT_UNAVAILABLE
+    ];
+    __name(workflowConstantUnavailableMessage, "workflowConstantUnavailableMessage");
+    __name(isLuaCliSpecifier, "isLuaCliSpecifier");
     Bundler = class {
       static {
         __name(this, "Bundler");
@@ -34738,18 +34944,40 @@ export function defineWebApp(config) {
       *
       * Replaces the prior `buildLuaCliStubBlock` runtime-stub approach (BAC-234).
       */
-      stripLuaCliImportsAST(code, filename = "temp.ts") {
+      stripLuaCliImportsAST(code, filename, stubWorkflowBuilders) {
         try {
           const tempFile = this.project.createSourceFile(`__strip_${filename}`, code, {
             overwrite: true
           });
           rewriteCrossFileCallsInSourceFile(tempFile, this.crossFileSpecs, this.sdkBaseClassNames);
+          const inertBindings = /* @__PURE__ */ new Map();
           tempFile.getImportDeclarations().forEach((imp) => {
             const spec = imp.getModuleSpecifierValue();
             if (spec === "lua-cli" || spec === "lua-cli/skill" || spec === "lua-cli/voice" || spec.includes("api-exports")) {
+              if (stubWorkflowBuilders && !imp.isTypeOnly()) {
+                for (const named of imp.getNamedImports()) {
+                  const name = named.getName();
+                  if (named.isTypeOnly() || !WORKFLOW_SHIM_NAME_SET.has(name)) continue;
+                  const alias = named.getAliasNode()?.getText();
+                  inertBindings.set(alias ?? name, alias ? {
+                    name,
+                    alias
+                  } : {
+                    name
+                  });
+                }
+              }
               imp.remove();
             }
           });
+          if (inertBindings.size > 0) {
+            tempFile.insertImportDeclaration(0, {
+              namedImports: [
+                ...inertBindings.values()
+              ],
+              moduleSpecifier: INERT_WORKFLOW_BUILDER_SPECIFIER
+            });
+          }
           const result = tempFile.getText();
           this.project.removeSourceFile(tempFile);
           return result;
@@ -34769,8 +34997,9 @@ export function defineWebApp(config) {
           this.verbose(`      Source: ${metadata.sourcePath}`);
           this.verbose(`      Output: ${outfile}`);
         }
-        const virtualSourcePlugin = this.createVirtualSourcePlugin(metadata);
-        const luaCliShimPlugin = this.createLuaCliShimPlugin();
+        const stubWorkflowBuilders = metadata.kind !== "workflow";
+        const virtualSourcePlugin = this.createVirtualSourcePlugin(metadata, stubWorkflowBuilders);
+        const luaCliShimPlugin = this.createLuaCliShimPlugin(metadata.kind, stubWorkflowBuilders);
         const selfContainedWorkflow = metadata.kind === "workflow";
         const inject = selfContainedWorkflow ? [
           await this.writeWorkflowBuilderInject(tempDir)
@@ -34810,10 +35039,11 @@ export function defineWebApp(config) {
           });
         } catch (err) {
           const failure2 = err;
-          const guard = failure2?.errors?.find((e) => typeof e.text === "string" && e.text.startsWith(NODE_CAPABILITY_UNAVAILABLE));
+          const guardText = /* @__PURE__ */ __name((e) => typeof e.text === "string" ? e.text.replace(/^\[plugin [^\]]*\]\s*/, "") : "", "guardText");
+          const guard = failure2?.errors?.find((e) => COMPILE_GUARD_CODES.some((c) => guardText(e).startsWith(c)));
           if (guard) {
             const at = guard.location ? ` (${guard.location.file}:${guard.location.line}:${guard.location.column + 1})` : "";
-            throw new Error(`${guard.text}${at}`);
+            throw new Error(`${guardText(guard)}${at}`);
           }
           throw err;
         }
@@ -34930,10 +35160,56 @@ export { ${WORKFLOW_SHIM_NAMES.join(", ")} } from ${JSON.stringify(this.workflow
         };
       }
       /**
+      * BAC-2490: throw `workflow-constant-unavailable` when `code` value-imports or re-exports a workflow-only
+      * constant from a lua-cli specifier. Type-only forms, comments and strings are fine. Best-effort: dynamic
+      * `import()` / `require` are not covered.
+      */
+      assertNoWorkflowConstants(code, filename) {
+        if (!WORKFLOW_CONSTANT_NAMES.some((n2) => code.includes(n2)) && !/export\s*\*/.test(code)) return;
+        const tempFile = this.project.createSourceFile(`__guard_${path10.basename(filename)}`, code, {
+          overwrite: true
+        });
+        const fail = /* @__PURE__ */ __name((name, spec, pos) => {
+          const { line, column } = tempFile.getLineAndColumnAtPos(pos);
+          throw new Error(`${workflowConstantUnavailableMessage(name, spec)} (${filename}:${line}:${column})`);
+        }, "fail");
+        try {
+          for (const imp of tempFile.getImportDeclarations()) {
+            const spec = imp.getModuleSpecifierValue();
+            if (!isLuaCliSpecifier(spec) || imp.isTypeOnly()) continue;
+            for (const n2 of imp.getNamedImports()) {
+              if (n2.isTypeOnly()) continue;
+              if (WORKFLOW_CONSTANT_NAMES.includes(n2.getName())) fail(n2.getName(), spec, n2.getStart());
+            }
+            const ns = imp.getNamespaceImport();
+            if (ns) {
+              for (const c of WORKFLOW_CONSTANT_NAMES) {
+                const idx = code.search(new RegExp(`\\b${ns.getText()}\\.${c}\\b`));
+                if (idx >= 0) fail(c, spec, idx);
+              }
+            }
+          }
+          for (const exp of tempFile.getExportDeclarations()) {
+            const spec = exp.getModuleSpecifierValue();
+            if (!spec || !isLuaCliSpecifier(spec) || exp.isTypeOnly()) continue;
+            const named = exp.getNamedExports();
+            if (named.length === 0 && !exp.getNamespaceExport()) {
+              fail(WORKFLOW_CONSTANT_NAMES.join(" / "), spec, exp.getStart());
+            }
+            for (const n2 of named) {
+              if (n2.isTypeOnly()) continue;
+              if (WORKFLOW_CONSTANT_NAMES.includes(n2.getName())) fail(n2.getName(), spec, n2.getStart());
+            }
+          }
+        } finally {
+          this.project.removeSourceFile(tempFile);
+        }
+      }
+      /**
       * Create esbuild plugin that serves the source file as a virtual module
       * with an appended named export for the primitive.
       */
-      createVirtualSourcePlugin(metadata) {
+      createVirtualSourcePlugin(metadata, stubWorkflowBuilders) {
         const bundler = this;
         const sourcePath = metadata.sourcePath;
         const exportName = metadata.exportName;
@@ -34961,7 +35237,10 @@ export { ${WORKFLOW_SHIM_NAMES.join(", ")} } from ${JSON.stringify(this.workflow
             }, async () => {
               const sourceFile = bundler.project.getSourceFile(sourcePath);
               let content = sourceFile?.getText() ?? await fs9.readFile(sourcePath, "utf-8");
-              content = bundler.stripLuaCliImportsAST(content, path10.basename(sourcePath));
+              if (metadata.kind !== "workflow") {
+                bundler.assertNoWorkflowConstants(content, sourcePath);
+              }
+              content = bundler.stripLuaCliImportsAST(content, path10.basename(sourcePath), stubWorkflowBuilders);
               const virtualContent = metadata.isDefaultExport ? content : `${content}
 export { ${exportName} as __lua_target__ };
 `;
@@ -34979,8 +35258,9 @@ export { ${exportName} as __lua_target__ };
       * Uses ts-morph to properly parse and remove import declarations, handling all edge cases
       * including multiline imports, comments, and complex syntax that regex can't handle.
       */
-      createLuaCliShimPlugin() {
-        const stripImports = this.stripLuaCliImportsAST.bind(this);
+      createLuaCliShimPlugin(kind, stubWorkflowBuilders) {
+        const assertNoConstants = this.assertNoWorkflowConstants.bind(this);
+        const stripImports = /* @__PURE__ */ __name((code, filename) => this.stripLuaCliImportsAST(code, filename, stubWorkflowBuilders), "stripImports");
         const isWorkflowBuilderSource = this.isWorkflowBuilderSource.bind(this);
         return {
           name: "lua-cli-import-stripper",
@@ -34995,6 +35275,7 @@ export { ${exportName} as __lua_target__ };
               if (!contents.includes("lua-cli") && !contents.includes("api-exports")) {
                 return null;
               }
+              if (kind !== "workflow") assertNoConstants(contents, args2.path);
               try {
                 const modifiedContents = stripImports(contents, path10.basename(args2.path));
                 if (modifiedContents !== contents) {
@@ -35029,6 +35310,19 @@ export { ${exportName} as __lua_target__ };
               contents: "/* lua-cli stripped - APIs provided by VM sandbox */",
               loader: "js"
             }));
+            build2.onResolve({
+              filter: /^lua-cli-inert-workflow-builder$/
+            }, () => ({
+              path: INERT_WORKFLOW_BUILDER_SPECIFIER,
+              namespace: INERT_WORKFLOW_BUILDER_NAMESPACE
+            }));
+            build2.onLoad({
+              filter: /.*/,
+              namespace: INERT_WORKFLOW_BUILDER_NAMESPACE
+            }, () => ({
+              contents: INERT_WORKFLOW_BUILDER_SOURCE,
+              loader: "js"
+            }));
           }
         };
       }
@@ -38783,13 +39077,20 @@ function resultOf(response) {
   }
   return response.data;
 }
-function buildOfflineDecisionsApi(getService) {
+function decisionTestSiteHeaders(site) {
+  return {
+    [DECISION_SANDBOX_SITE_HEADER]: DECISION_LUA_TEST_SITE,
+    [DECISION_SANDBOX_PRIMITIVE_HEADER]: formatDecisionSandboxPrimitive(`${site.kind}:${site.name}`, site.tool)
+  };
+}
+function buildOfflineDecisionsApi(getService, testSite) {
+  const headers = testSite ? decisionTestSiteHeaders(testSite) : void 0;
   return buildDecisionsApi({
-    ask: /* @__PURE__ */ __name(async (request2) => (await getService()).askForSandbox(request2), "ask"),
-    run: /* @__PURE__ */ __name(async (request2) => (await getService()).runForSandbox(request2), "run")
+    ask: /* @__PURE__ */ __name(async (request2) => (await getService()).askForSandbox(request2, headers), "ask"),
+    run: /* @__PURE__ */ __name(async (request2) => (await getService()).runForSandbox(request2, headers), "run")
   });
 }
-var DecisionsApiService;
+var DECISION_LUA_TEST_SITE, DecisionsApiService;
 var init_decisions_api_service = __esm({
   "src/api/decisions.api.service.ts"() {
     "use strict";
@@ -38797,6 +39098,8 @@ var init_decisions_api_service = __esm({
     init_decisions_api();
     init_http_client();
     __name(resultOf, "resultOf");
+    DECISION_LUA_TEST_SITE = "lua-test";
+    __name(decisionTestSiteHeaders, "decisionTestSiteHeaders");
     DecisionsApiService = class extends HttpClient {
       static {
         __name(this, "DecisionsApiService");
@@ -38805,17 +39108,17 @@ var init_decisions_api_service = __esm({
       constructor(baseUrl, credential, agentId2) {
         super(baseUrl, credential), this.agentId = agentId2;
       }
-      async ask(body) {
-        return this.httpPostOnce(`/developer/decisions/${this.agentId}/ask`, body, {});
+      async ask(body, headers = {}) {
+        return this.httpPostOnce(`/developer/decisions/${this.agentId}/ask`, body, headers);
       }
-      async run({ name, ...body }) {
-        return this.httpPostOnce(`/developer/decisions/${this.agentId}/run/${encodeURIComponent(name)}`, body, {});
+      async run({ name, ...body }, headers = {}) {
+        return this.httpPostOnce(`/developer/decisions/${this.agentId}/run/${encodeURIComponent(name)}`, body, headers);
       }
-      async askForSandbox(request2) {
-        return resultOf(await this.ask(request2));
+      async askForSandbox(request2, headers) {
+        return resultOf(await this.ask(request2, headers));
       }
-      async runForSandbox(request2) {
-        return resultOf(await this.run(request2));
+      async runForSandbox(request2, headers) {
+        return resultOf(await this.run(request2, headers));
       }
       async getDecisions() {
         return this.httpGet(`/developer/decisions/${this.agentId}/definitions`, {});
@@ -51237,7 +51540,7 @@ function createSandbox(options) {
     Decisions: buildOfflineDecisionsApi(async () => {
       const { getDecisionsInstance: getDecisionsInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
       return getDecisionsInstance2();
-    }),
+    }, options.testSite),
     DecisionError,
     Agents: {
       invoke: /* @__PURE__ */ __name(async (targetAgentId, promptOrInput) => {
@@ -52539,6 +52842,9 @@ var DecisionHandler = class extends BaseVersionedHandler {
     yamlKey: "decisions",
     idField: "decisionId"
   };
+  serverDeleteCommand(name) {
+    return `lua decisions delete ${name}`;
+  }
   getApi(apiKey, agentId2) {
     return new DecisionsApiService(BASE_URLS.API, apiKey, agentId2);
   }
@@ -52873,6 +53179,7 @@ __name(printToolOutput, "printToolOutput");
 
 // src/commands/test.ts
 init_cli();
+init_write_info();
 init_command_utils();
 
 // src/utils/web-app-route.ts
@@ -55609,7 +55916,7 @@ async function selectEntityOrPrompt(options) {
 __name(selectEntityOrPrompt, "selectEntityOrPrompt");
 function progress(asJson, message) {
   if (asJson) {
-    process.stderr.write("\r\x1B[K" + message + "\n");
+    process.stderr.write(clearLineFor(process.stderr) + message + "\n");
   } else {
     writeProgress(message);
   }
@@ -55617,7 +55924,7 @@ function progress(asJson, message) {
 __name(progress, "progress");
 function success(asJson, message) {
   if (asJson) {
-    process.stderr.write("\r\x1B[K" + message + "\n");
+    process.stderr.write(clearLineFor(process.stderr) + message + "\n");
   } else {
     writeSuccess(message);
   }
@@ -55825,7 +56132,12 @@ async function testSkill(entityName, inputJson, asJson = false) {
         inputs: inputValues,
         apiKey,
         agentId: agentId2,
-        channel: "dev"
+        channel: "dev",
+        testSite: {
+          kind: "skill",
+          name: selectedTool.skillName,
+          tool: selectedTool.name
+        }
       });
       success(asJson, "\u2705 Tool execution successful!");
       printToolOutput("Tool", result, asJson);
@@ -55938,7 +56250,11 @@ async function testWebhook(entityName, inputJson, asJson = false) {
         body,
         rawBody,
         apiKey,
-        agentId: agentId2
+        agentId: agentId2,
+        testSite: {
+          kind: "webhook",
+          name: selectedWebhook.name
+        }
       });
       success(asJson, "\n\u2705 Webhook execution successful!");
       printToolOutput("Webhook", result, asJson);
@@ -56066,7 +56382,11 @@ async function testWebApp(entityName, routeSpec, inputJson, asJson = false) {
         appCode,
         input: webRouteInput,
         apiKey,
-        agentId: agentId2
+        agentId: agentId2,
+        testSite: {
+          kind: "web-route",
+          name: app.name
+        }
       });
       if (asJson) {
         console.log(JSON.stringify(result, null, 2));
@@ -56126,6 +56446,10 @@ async function testJob(entityName, asJson = false) {
         jobCode,
         apiKey,
         agentId: agentId2,
+        testSite: {
+          kind: "job",
+          name: selectedJob.name
+        },
         jobData: {
           id: jobId,
           jobId,
@@ -56234,35 +56558,25 @@ async function testPreProcessor(entityName, inputJson, asJson = false) {
   const { apiKey, agentId: agentId2 } = await loadAuthOrFail();
   const preprocessorCode = loadArtifact(selected, process.cwd());
   await withSandboxEnv(async () => {
+    const messages = [
+      {
+        type: "text",
+        text: message
+      }
+    ];
     try {
-      const messages = [
-        {
-          type: "text",
-          text: message
-        }
-      ];
       const result = await executePreProcessor({
         processorCode: preprocessorCode,
         messages,
         channel,
         apiKey,
-        agentId: agentId2
+        agentId: agentId2,
+        testSite: {
+          kind: "preprocessor",
+          name: preprocessorName
+        }
       });
       success(asJson, "\n\u2705 PreProcessor execution successful!");
-      const displayMessages = /* @__PURE__ */ __name((outputMessages) => {
-        console.log(`Processed messages (${outputMessages.length}):`);
-        outputMessages.forEach((msg, idx) => {
-          if (msg.type === "text") {
-            console.log(`  ${idx + 1}. [TEXT] ${msg.text}`);
-          } else if (msg.type === "image") {
-            console.log(`  ${idx + 1}. [IMAGE] ${msg.mimeType}`);
-          } else if (msg.type === "file") {
-            console.log(`  ${idx + 1}. [FILE] ${msg.mimeType}`);
-          } else {
-            console.log(`  ${idx + 1}. [${msg.type}]`, msg);
-          }
-        });
-      }, "displayMessages");
       if (asJson) {
         printToolOutput("PreProcessor", result, true);
       } else if (result.action === "block") {
@@ -56305,7 +56619,7 @@ Raw result:`);
         });
       }
     } catch (error) {
-      handleExecutionError(error, "PreProcessor", asJson);
+      reportPreprocessorFailOpen(error, messages, asJson);
       if (!asJson) {
         writeHintBlock({
           headline: "Preprocessor ran locally \u2014 no server logs exist for this execution.",
@@ -56326,6 +56640,37 @@ Raw result:`);
   });
 }
 __name(testPreProcessor, "testPreProcessor");
+function displayMessages(outputMessages) {
+  console.log(`Processed messages (${outputMessages.length}):`);
+  outputMessages.forEach((msg, idx) => {
+    if (msg.type === "text") {
+      console.log(`  ${idx + 1}. [TEXT] ${msg.text}`);
+    } else if (msg.type === "image") {
+      console.log(`  ${idx + 1}. [IMAGE] ${msg.mimeType}`);
+    } else if (msg.type === "file") {
+      console.log(`  ${idx + 1}. [FILE] ${msg.mimeType}`);
+    } else {
+      console.log(`  ${idx + 1}. [${msg.type}]`, msg);
+    }
+  });
+}
+__name(displayMessages, "displayMessages");
+function reportPreprocessorFailOpen(error, messages, asJson) {
+  const detail = cliErrorDetail(error);
+  if (asJson) {
+    printToolOutput("PreProcessor", {
+      action: "proceed",
+      error: detail
+    }, true);
+    return;
+  }
+  console.error(`
+\u26A0\uFE0F  PreProcessor threw: ${detail.message}`);
+  console.error("   Live, a chat message goes through unchanged when its pre-processor throws, so this run proceeds.");
+  console.log("\nAction: PROCEED");
+  displayMessages(messages);
+}
+__name(reportPreprocessorFailOpen, "reportPreprocessorFailOpen");
 async function testPostProcessor(entityName, inputJson, asJson = false) {
   progress(asJson, "\u{1F4E4} Testing postprocessor...");
   progress(asJson, "\u{1F4E6} Compiling code first...");
@@ -56402,7 +56747,11 @@ async function testPostProcessor(entityName, inputJson, asJson = false) {
         response,
         channel,
         apiKey,
-        agentId: agentId2
+        agentId: agentId2,
+        testSite: {
+          kind: "postprocessor",
+          name: selected.name
+        }
       });
       success(asJson, "\n\u2705 PostProcessor execution successful!");
       if (asJson) {
@@ -65197,7 +65546,8 @@ function renderLogEntry(log, isLast) {
     }
   } else {
     if (primitiveName) {
-      console.log(chalk2.gray(`   ${capitalizedType} Name: ${primitiveName}`));
+      const label2 = logSource === "browser" ? "Called by" : `${capitalizedType} Name`;
+      console.log(chalk2.gray(`   ${label2}: ${primitiveName}`));
     }
     if (primitiveId) {
       console.log(chalk2.gray(`   ${capitalizedType} ID:   ${primitiveId}`));
@@ -68981,8 +69331,7 @@ async function gatherPrimitives(input, warnings) {
         if (localNames.has(s.name)) continue;
         if (!(handler.isActive?.(s) ?? true)) continue;
         if (!handler.shouldConsiderForOrphan(s)) continue;
-        const flagName = `--${handler.displayName.toLowerCase().replace(/\s+/g, "-")}-name`;
-        const cleanupCommand = handler.kind !== PrimitiveKind.DEVICE_TRIGGER ? `${handler.deleteCommand} ${flagName} "${s.name}"` : "";
+        const cleanupCommand = handler.kind !== PrimitiveKind.DEVICE_TRIGGER ? handler.serverDeleteCommand(`"${s.name}"`) : "";
         orphans.push({
           name: s.name,
           cleanupCommand,
@@ -72272,6 +72621,13 @@ function parseProvider2(raw) {
   return provider;
 }
 __name(parseProvider2, "parseProvider");
+function parseModel(raw) {
+  if (raw === void 0) return void 0;
+  const model = raw.trim();
+  if (!model) throw CliError.usage("--model must name a model, such as jev-latest, gpt-6-luna or liquid/d1");
+  return model;
+}
+__name(parseModel, "parseModel");
 function parseMinConfidence(raw) {
   if (raw === void 0) return void 0;
   const value3 = Number(raw);
@@ -72411,6 +72767,7 @@ async function runAction(api, name, options) {
   const decisionName = requireArg(name, "A decision name", "lua decisions run <name> --message '<text>'");
   const { state: state3, input } = parseState(options);
   const provider = parseProvider2(options.provider);
+  const model = parseModel(options.model);
   const minConfidence = parseMinConfidence(options.minConfidence);
   const request2 = {
     name: decisionName,
@@ -72418,6 +72775,9 @@ async function runAction(api, name, options) {
     ...provider !== void 0 && {
       provider
     },
+    ...model !== void 0 && {
+      model
+    },
     ...minConfidence !== void 0 && {
       minConfidence
     }
@@ -72426,6 +72786,7 @@ async function runAction(api, name, options) {
   trackEvent("cli_decisions_run", {
     input,
     provider: result.provider,
+    model: model !== void 0,
     rule: result.rule,
     fallback: !!result.fallback,
     cached: result.cached,
@@ -73151,6 +73512,19 @@ async function activateCore(ctx, name, on) {
   return WORKFLOW_EXIT.OK;
 }
 __name(activateCore, "activateCore");
+function runsInFlightLine(wfName, err) {
+  const blocking = err?.blockingRunId;
+  const cancel = `wait for it or cancel it: lua workflows cancel ${blocking ?? "<runId>"}`;
+  const head = `\u274C "${wfName}" has concurrencyPolicy:'forbid' and run \`${blocking ?? "?"}\` is in flight`;
+  if (typeof err?.correlationKey === "string" && err.correlationKey !== "") {
+    return `${head} for correlationKey ${JSON.stringify(err.correlationKey)} \u2014 ${cancel}`;
+  }
+  if (err?.concurrencyKey === "correlationKey") {
+    return `${head} \u2014 it was started without a correlationKey; pass --correlation-key <key> to start in parallel, or ${cancel}`;
+  }
+  return `${head} \u2014 ${cancel}`;
+}
+__name(runsInFlightLine, "runsInFlightLine");
 function startResultLine(d, requestedName) {
   if (!d.deduplicated && !d.idempotentReplay) return `\u2705 Run ${d.runId} \xB7 ${d.status}`;
   const name = d.workflowName ?? requestedName;
@@ -73194,10 +73568,7 @@ async function startCore(ctx, name, o) {
   if (!res.success || !res.data) {
     if (res.error?.statusCode === 409 && (res.error.code ?? res.error.error) === "RUNS_IN_FLIGHT") {
       emitJson(ctx, res);
-      const blocking = res.error.blockingRunId;
-      if (!ctx.json) {
-        console.error(`\u274C "${wf.name}" has concurrencyPolicy:'forbid' and run \`${blocking ?? "?"}\` is in flight \u2014 wait for it or cancel it: lua workflows cancel ${blocking ?? "<runId>"}`);
-      }
+      if (!ctx.json) console.error(runsInFlightLine(wf.name, res.error));
       return WORKFLOW_EXIT.API;
     }
     return apiFailure(ctx, res, "start");
@@ -75968,6 +76339,10 @@ async function goalsGetCore(ctx, goalId) {
   return WORKFLOW_EXIT.OK;
 }
 __name(goalsGetCore, "goalsGetCore");
+function goalUnitSuffix(g) {
+  return g.budgetUnit ? ` \xB7 unit ${g.budgetUnit}` : "";
+}
+__name(goalUnitSuffix, "goalUnitSuffix");
 function printGoalDetail(g) {
   console.log(`
 \u{1F3AF} Goal ${g.goalId} \xB7 ${goalStatusLabel(g)}`);
@@ -75976,7 +76351,7 @@ function printGoalDetail(g) {
   console.log(`   Judge:     ${judgeLabel(g.judge)}`);
   console.log(`   Cadence:   ${cadenceLabel(g.cadence)} \xB7 mode ${g.evaluation?.mode ?? "immediate"}${g.evaluation?.delaySeconds ? ` \xB7 delay ${g.evaluation.delaySeconds}s` : ""}`);
   console.log(`   Runs:      ${g.runsUsed}/${g.maxRuns} used \xB7 iteration ${g.iteration ?? 0}${g.consecutiveContinues ? ` \xB7 ${g.consecutiveContinues} consecutive continue(s)` : ""}${g.currentRunId ? ` \xB7 current ${g.currentRunId}` : ""}`);
-  if (g.budget?.maxCredits || g.maxTotalCredits) console.log(`   Budget:    ${g.budget?.maxCredits ? `per-run ${g.budget.maxCredits} credits` : ""}${g.budget?.maxCredits && g.maxTotalCredits ? " \xB7 " : ""}${g.maxTotalCredits ? `lineage cap ${g.maxTotalCredits} credits` : ""}`);
+  if (g.budget?.maxCredits || g.maxTotalCredits) console.log(`   Budget:    ${g.budget?.maxCredits ? `per-run ${g.budget.maxCredits} credits` : ""}${g.budget?.maxCredits && g.maxTotalCredits ? " \xB7 " : ""}${g.maxTotalCredits ? `lineage cap ${g.maxTotalCredits} credits` : ""}${goalUnitSuffix(g)}`);
   if (g.status === "paused" && (g.pauseReason === "budget" || g.pauseReason === "max_runs")) console.log(`   \u23F8  parked at its ${g.pauseReason === "budget" ? "credit" : "run"} cap \u2014 ${goalRaiseHint(g.goalId, g.pauseReason)}`);
   if (g.note) console.log(`   Note:      ${g.note}`);
   if (g.closeNote) console.log(`   Closed:    ${g.closeNote}`);
@@ -76042,7 +76417,7 @@ function parseEveryFlag(raw) {
 }
 __name(parseEveryFlag, "parseEveryFlag");
 function printGoalWriteSummary(g, past) {
-  writeSuccess(`\u2705 goal ${g.goalId} ${past} \xB7 ${goalStatusLabel(g)} \xB7 runs ${g.runsUsed}/${g.maxRuns}${g.maxTotalCredits ? ` \xB7 lineage cap ${g.maxTotalCredits} credits` : ""}${g.jobId ? ` \xB7 schedule ${g.jobId}${goalJobStateLabel(g)}` : ""}`);
+  writeSuccess(`\u2705 goal ${g.goalId} ${past} \xB7 ${goalStatusLabel(g)} \xB7 runs ${g.runsUsed}/${g.maxRuns}${g.maxTotalCredits ? ` \xB7 lineage cap ${g.maxTotalCredits} credits${goalUnitSuffix(g)}` : ""}${g.jobId ? ` \xB7 schedule ${g.jobId}${goalJobStateLabel(g)}` : ""}`);
   if (g.rearmed) writeInfo("   \u21BA re-armed \u2014 the cap park cleared and the goal is active again (no backfill)");
   if (g.resumed === false) writeInfo(`   \u26A0\uFE0F  the goal parked again (${g.pauseReason ?? "strikes"}) \u2014 see: lua workflows goals get ${g.goalId}`);
   if (!g.rearmed && g.status === "paused" && (g.pauseReason === "budget" || g.pauseReason === "max_runs")) writeInfo(`   still parked (${g.pauseReason}) \u2014 ${goalRaiseHint(g.goalId, g.pauseReason)}`);
@@ -88131,11 +88506,12 @@ function currentVersionOf(row2) {
 __name(currentVersionOf, "currentVersionOf");
 function buildVersionStatusRows(inputs) {
   const rows3 = [];
-  for (const { type, localItems, pinned, live } of inputs) {
+  for (const { type, localItems, pinned, live, idsAreAuthoritative } of inputs) {
     for (const item of localItems) {
-      const match = (item.id ? pinned.find((p) => p.id === item.id) : void 0) ?? pinned.find((p) => p.name != null && p.name === item.name);
+      const byName = !item.id || !idsAreAuthoritative;
+      const match = (item.id ? pinned.find((p) => p.id === item.id) : void 0) ?? (byName ? pinned.find((p) => p.name != null && p.name === item.name) : void 0);
       const pinnedVersion = match ? match.version : null;
-      const server = (item.id ? live?.find((l) => l.id === item.id) : void 0) ?? live?.find((l) => l.name === item.name && !l.deleted);
+      const server = (item.id ? live?.find((l) => l.id === item.id) : void 0) ?? (byName ? live?.find((l) => l.name === item.name && !l.deleted) : void 0);
       const drift = server !== void 0 && (server.deleted || server.version !== pinnedVersion);
       const row2 = {
         type,
@@ -88295,6 +88671,7 @@ function buildStatusRowInputs(config, snapshot, serverDecisions) {
         version: p.version,
         name: p.name
       })),
+      idsAreAuthoritative: true,
       ...serverDecisions && {
         live: serverDecisions.map((d) => ({
           id: d.id,
@@ -89213,14 +89590,29 @@ var REFUSAL_HINTS = {
   BROWSER_CLI_CONCURRENCY: "Wait for a run to finish, or press Ctrl-C on it to cancel it.",
   BROWSER_CLI_LIMITER_UNAVAILABLE: "Try again in a minute."
 };
+var BROWSER_RUN_MAX_STEPS = 60;
+var BROWSER_RUN_MIN_COST_USD = 0.01;
+var BROWSER_RUN_MAX_COST_USD = 10;
 function parseEnvironment2(raw) {
   if (raw === void 0) return "sandbox";
   const env = raw.toLowerCase();
-  if (env === "sandbox" || env === "staging") return "sandbox";
-  if (env === "production") return "production";
-  throw CliError.usage(`-e must be sandbox, staging or production (got '${raw}')`);
+  if (env === "sandbox" || env === "production") return env;
+  throw CliError.usage(`-e must be sandbox or production (got '${raw}')`, "Log rows are tagged sandbox or production.");
 }
 __name(parseEnvironment2, "parseEnvironment");
+function parseWebUrl(raw, flag) {
+  let parsed;
+  try {
+    parsed = new URL(raw.trim());
+  } catch {
+    throw CliError.usage(`${flag} must be a full web address like https://example.com (got '${raw}')`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw CliError.usage(`${flag} must start with http:// or https:// (got '${raw}')`);
+  }
+  return raw.trim();
+}
+__name(parseWebUrl, "parseWebUrl");
 function parseReadFormat(raw) {
   if (raw === void 0) return void 0;
   const format = BROWSER_READ_FORMATS2.find((f) => f === raw);
@@ -89241,12 +89633,20 @@ function parseMaxCost(raw) {
   if (raw === void 0) return void 0;
   const amount = raw.trim().replace(/^\$/, "");
   const n2 = Number(amount);
-  if (!/^(\d+(\.\d+)?|\.\d+)$/.test(amount) || n2 <= 0) {
-    throw CliError.usage(`--max-cost must be an amount in USD above 0, like 0.50 (got '${raw}')`);
+  if (!/^(\d+(\.\d+)?|\.\d+)$/.test(amount) || n2 < BROWSER_RUN_MIN_COST_USD || n2 > BROWSER_RUN_MAX_COST_USD) {
+    throw CliError.usage(`--max-cost must be an amount in USD from ${BROWSER_RUN_MIN_COST_USD} to ${BROWSER_RUN_MAX_COST_USD}, like 0.50 (got '${raw}')`);
   }
   return n2;
 }
 __name(parseMaxCost, "parseMaxCost");
+function parseMaxSteps(raw) {
+  const n2 = parsePositiveInt(raw, "--max-steps");
+  if (n2 !== void 0 && n2 > BROWSER_RUN_MAX_STEPS) {
+    throw CliError.usage(`--max-steps must be ${BROWSER_RUN_MAX_STEPS} or less (got '${raw}')`);
+  }
+  return n2;
+}
+__name(parseMaxSteps, "parseMaxSteps");
 function readSchemaFile(path32, read = readUtf8) {
   if (path32 === void 0) return void 0;
   let text2;
@@ -89278,16 +89678,23 @@ function readResultLines(output) {
     `URL: ${data.finalUrl || data.url || "(unknown)"}`
   ];
   if (data.url && data.finalUrl && data.url !== data.finalUrl) lines.push(`Requested: ${data.url}`);
-  lines.push(`Engine: ${output.engine}`);
-  if (data.blocked) {
-    lines.push(`Blocked: yes${data.blocker ? ` (${data.blocker}${data.blockerKind ? `, ${data.blockerKind}` : ""})` : ""}`);
-    if (data.blockerGuidance) lines.push(`Guidance: ${data.blockerGuidance}`);
-  }
-  lines.push("", data.content ?? "");
+  if (typeof data.status === "number" && data.status !== 200) lines.push(`Status: HTTP ${data.status}`);
+  if (typeof data.matches === "number") lines.push(`Matches: ${data.matches}`);
+  lines.push(`Engine: ${output.engine}`, ...blockedLines(data), "", data.content ?? "");
   if (data.truncated) lines.push("", "(content was cut short)");
   return lines;
 }
 __name(readResultLines, "readResultLines");
+function blockedLines(data) {
+  if (!data.blocked) return [];
+  const kind = data.blockerKind ? `, ${data.blockerKind}` : "";
+  const lines = [
+    `Blocked: yes${data.blocker ? ` (${data.blocker}${kind})` : ""}`
+  ];
+  if (data.blockerGuidance) lines.push(`Guidance: ${data.blockerGuidance}`);
+  return lines;
+}
+__name(blockedLines, "blockedLines");
 function runStepLine(step3) {
   const where = step3.url ? ` on ${step3.url}` : "";
   const failed = step3.ok ? "" : ` (failed${step3.error ? `: ${step3.error}` : ""})`;
@@ -89341,7 +89748,7 @@ async function guarded(agentId2, call2) {
   try {
     return await call2();
   } catch (error) {
-    if (!isAccessDeniedError(error)) throw error;
+    if (!isAccessDeniedError(error) || isEdgeBlockedError(error)) throw error;
     throw CliError.forbidden(`Your API key can't run the browser for agent ${agentId2}.`, "It needs agents:write on that agent. Check the agent id, or run `lua auth configure` with a key for it.");
   }
 }
@@ -89381,8 +89788,9 @@ function logsHint() {
 __name(logsHint, "logsHint");
 async function runBrowserRead(ctx, url, options) {
   const format = parseReadFormat(options.format);
+  const target = parseWebUrl(url, "The URL");
   const output = unwrap5(await guarded(ctx.agentId, () => ctx.api.read({
-    url,
+    url: target,
     environment: ctx.environment,
     ...options.selector ? {
       selector: options.selector
@@ -89444,22 +89852,31 @@ async function followBrowserRun(api, first, signal, out, startedAt = Date.now())
   return view;
 }
 __name(followBrowserRun, "followBrowserRun");
-async function runBrowserTask(ctx, task, options, out = {
-  write: /* @__PURE__ */ __name((line) => console.log(line), "write"),
-  progress: writeProgress
-}) {
+function terminalRunOutput(stderr = process.stderr) {
+  return {
+    write: /* @__PURE__ */ __name((line) => {
+      if (stderr.isTTY) stderr.write("\r\x1B[K");
+      console.log(line);
+    }, "write"),
+    progress: /* @__PURE__ */ __name((line) => {
+      if (stderr.isTTY) writeProgress(line);
+    }, "progress")
+  };
+}
+__name(terminalRunOutput, "terminalRunOutput");
+async function runBrowserTask(ctx, task, options, out = terminalRunOutput()) {
   if (!task.trim()) throw CliError.usage("A task is required", 'Usage: lua browser run "<task>"');
   const body = {
     task,
     environment: ctx.environment,
     ...options.startUrl ? {
-      startUrl: options.startUrl
+      startUrl: parseWebUrl(options.startUrl, "--start-url")
     } : {},
     ...options.schema ? {
       schema: readSchemaFile(options.schema)
     } : {},
     ...options.maxSteps !== void 0 ? {
-      maxSteps: parsePositiveInt(options.maxSteps, "--max-steps")
+      maxSteps: parseMaxSteps(options.maxSteps)
     } : {},
     ...options.maxCost !== void 0 ? {
       maxCostUsd: parseMaxCost(options.maxCost)
@@ -89732,7 +90149,7 @@ Examples:
   }));
   program2.command("test [type]").description("\u{1F9EA} Test skills, webhooks, or jobs interactively").option("--name <name>", "Entity name to test").option("--input <json>", "JSON input string for testing").option("--json", "Output result as raw JSON (useful for scripting and piping)").option("--route <route>", "Web app: the route to call, e.g. 'GET /tickets?status=open'").option("--step-output <id=json>", "Workflow: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "Workflow: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "Workflow: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "Workflow: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "Workflow: seed completed steps from a real run").option("--force", "Workflow: seed from a run whose graph differs").option("--record <dir>", "Workflow: record live agent replies as fixtures (needs --agents live; tool steps never run offline)").option("--fixtures <dir>", "Workflow: replay recorded fixtures (exit 5 when one is missing)").option("--step-wall <s>", "Workflow: per-step wall in seconds (default 600)").option("--job-wall <s>", "Workflow: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--max-ticks <n>", "Workflow (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--ledger-out <file>", "Workflow: write the in-memory ledger as JSON").option("--agents <fake|live>", "Workflow: fake agent steps (default) or call the dev API").option("--now <iso>", "Workflow: virtual clock start").option("--park <id>", "Workflow: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "Workflow: collapse retry backoff waits to 0").option("--real-time", "Workflow: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "Workflow: back ctx.artefacts.* on disk").option("--workspace <dir>", "Workflow: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").addHelpText("after", `
 Arguments:
-  type                   Optional: 'skill', 'webhook', 'job' or 'workflow' (prompts if not provided)
+  type                   Optional: ${getCanonicalValues("test.type").map((type) => `'${type}'`).join(", ")} (prompts if not provided)
 
 Options:
   --name <name>          Entity name to test (non-interactive selection)
@@ -90117,7 +90534,7 @@ Examples:
   $ lua jobs versions -i myJob                         View job versions
   $ lua jobs history -i myJob                          View execution history
 `).action(jobsCommand);
-  program2.command("decisions [action] [name] [version]").description("\u{1F9ED} See, try and roll back named decisions (list, versions, publish, run, delete)").option("--json", "Machine-readable output (list, versions, run)").option("--force", "Skip the confirmation (publish, delete)").option("--state <json>", "run: the state to decide on, as JSON").option("--message <text>", "run: a message to decide on, sent as { message: <text> }").option("--provider <provider>", "run: jev, openai or auto").option("--min-confidence <n>", "run: below this confidence an answer is marked uncertain (0 to 1)").addHelpText("after", `
+  program2.command("decisions [action] [name] [version]").description("\u{1F9ED} See, try and roll back named decisions (list, versions, publish, run, delete)").option("--json", "Machine-readable output (list, versions, run)").option("--force", "Skip the confirmation (publish, delete)").option("--state <json>", "run: the state to decide on, as JSON").option("--message <text>", "run: a message to decide on, sent as { message: <text> }").option("--provider <provider>", "run: jev, openai, openrouter or auto").option("--model <id>", "run: the model to answer with; an OpenRouter id such as liquid/d1 pins openrouter").option("--min-confidence <n>", "run: below this confidence an answer is marked uncertain (0 to 1)").addHelpText("after", `
 Arguments:
   action               Optional: list (default), versions, publish, run, delete
   name                 The decision's name