lua-cli 3.50.0 → 3.52.0

package/dist/index.js

@@ -4317,8 +4317,8 @@ function normalizeWorkItems(items) {
     if (item.needsAction !== void 0 && typeof item.needsAction !== "boolean") {
       throw new Error(`Work item ${index}: \`needsAction\` must be a boolean`);
     }
-    const when3 = item.updatedAt;
-    const date = when3 instanceof Date ? when3 : typeof when3 === "string" ? new Date(when3) : null;
+    const when4 = item.updatedAt;
+    const date = when4 instanceof Date ? when4 : typeof when4 === "string" ? new Date(when4) : null;
     if (!date || Number.isNaN(date.getTime())) {
       throw new Error(`Work item ${index}: \`updatedAt\` must be a valid date`);
     }
@@ -5790,6 +5790,13 @@ function luaClientMetricLabels(client2) {
     client_attribution: canonical2?.attribution ?? "unknown"
   };
 }
+function webAppPreviewSessionBinding(webAppId, previewId) {
+  const binding = `${webAppId}--p-${previewId}`;
+  if (!WEB_APP_ID_PATTERN.test(binding)) {
+    throw new Error(`Web app preview session binding does not fit WEB_APP_ID_PATTERN: ${binding.length} characters`);
+  }
+  return binding;
+}
 function parseEffectiveAuthorization(value3) {
   const parsed = EffectiveAuthorizationSchema.safeParse(value3);
   return parsed.success ? parsed.data : void 0;
@@ -6656,6 +6663,9 @@ function isWebRouteInput(value3) {
   if (!app || typeof app.id !== "string" || typeof app.name !== "string" || typeof app.origin !== "string") return false;
   return true;
 }
+function agentPaneEnabled(version) {
+  return version?.agentPane !== false;
+}
 function evidenceDisplayText(text2) {
   const raw = typeof text2 === "string" ? text2 : "";
   if (!raw.trim()) return "";
@@ -7622,7 +7632,7 @@ function sharedDataOwnerKey(collectionId) {
 function isSharedDataOwnerKey(agentId2) {
   return typeof agentId2 === "string" && agentId2.startsWith(SHARED_DATA_OWNER_PREFIX);
 }
-var __defProp3, __name3, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_FALLBACK_PROVIDERS, OPENROUTER_DIRECT_VENDORS, OPENROUTER_NEEDS_MODEL_MESSAGE, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_SANDBOX_SITE_HEADER, DECISION_SANDBOX_PRIMITIVE_HEADER, DECISION_SANDBOX_TOOL_SEPARATOR, DECISION_LIMITS, DECISION_ERROR_CODES, DECISION_INACTIVE_CODE, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, DecisionDefinitionWriteSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, MESSAGING_CHANNELS, VOICE_CHANNELS, TURN_CATEGORIES, AGENT_TOOL_CATEGORIES, count, AnthropicSseUsageReader, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, SCRUB_DEEP_MAX_DEPTH, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, SUPERVISED_SECRET_LIMITS, SUPERVISED_SECRET_NAME_RE, SUPERVISED_SECRET_FIELD_RE, SUPERVISED_SECRET_KEY_FIELD, SUPERVISED_SECRET_ERRORS, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, SERVER_TRIGGERED_BROWSER_SOURCES, BROWSER_FALLBACKS, DEFAULT_BROWSER_FALLBACK, PROXY_COUNTRY_CODE, BROWSER_LOG_CONTENT_MODES, DEFAULT_BROWSER_LOG_CONTENT, BROWSER_SCREENSHOT_POLICIES, DEFAULT_BROWSER_SCREENSHOT_POLICY, BROWSER_ENGINES, BROWSER_PROFILE_NAME_PATTERN, BROWSER_LIMIT_KEYS, BROWSER_LIMIT_MAX, BROWSER_EXECUTE_METHOD, BROWSER_GLOBAL_METHODS, BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS, BROWSER_EXECUTE_MAX_TIMEOUT_MS, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, BROWSER_READ_FORMATS, BROWSER_READ_DEFAULT_TIMEOUT_MS, BROWSER_READ_MIN_TIMEOUT_MS, BROWSER_READ_MAX_TIMEOUT_MS, BROWSER_READ_MAX_CONTENT_CHARS, BROWSER_READ_DEFAULT_SELECTOR, BROWSER_READ_MATCH_SEPARATOR, BROWSER_READ_LOGIN_BLOCKER, BROWSER_ERROR_NAME, HTTP_STATUS_FAILURE, LOGIN_PATH_SEGMENTS, LOGIN_HOST_LABELS, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, BROWSER_LOG_EVENT_KINDS, BROWSER_LOG_ENGINES, BROWSER_SESSION_OPEN_REASONS, BROWSER_BLOCK_KINDS, BROWSER_WALL_KINDS, BROWSER_WALL_NEXT_ACTIONS, BROWSER_CONFIRM_DECISIONS, BROWSER_SESSION_CLOSE_REASONS, BROWSER_LOG_CONTEXT_KEYS, BROWSER_LOG_ID_MAX_CHARS, BROWSER_LOG_TEXT_MAX_CHARS, isString, isBoolean, isCount, isPlainObject3, oneOf, isLimits, EVENT_SHAPES, BASE_KEYS, BROWSER_WORKER_SESSION_ID_SEPARATOR, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_WALL_MS, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSETS, WEB_APP_ASSET_PATH_PATTERN, WEB_APP_ASSET_PATH_MAX_CHARS, WEB_APP_MAX_ROUTES, WEB_APP_MAX_ASSET_BYTES, WEB_APP_CSP_NONCE_PLACEHOLDER, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema, SHARED_DATA_NAME_RE, SHARED_DATA_OWNER_PREFIX, SHARED_DATA_ERRORS;
+var __defProp3, __name3, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_FALLBACK_PROVIDERS, OPENROUTER_DIRECT_VENDORS, OPENROUTER_NEEDS_MODEL_MESSAGE, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_SANDBOX_SITE_HEADER, DECISION_SANDBOX_PRIMITIVE_HEADER, DECISION_SANDBOX_TOOL_SEPARATOR, DECISION_LIMITS, DECISION_ERROR_CODES, DECISION_INACTIVE_CODE, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, DecisionDefinitionWriteSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, MESSAGING_CHANNELS, VOICE_CHANNELS, TURN_CATEGORIES, AGENT_TOOL_CATEGORIES, count, AnthropicSseUsageReader, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, SCRUB_DEEP_MAX_DEPTH, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, SUPERVISED_SECRET_LIMITS, SUPERVISED_SECRET_NAME_RE, SUPERVISED_SECRET_FIELD_RE, SUPERVISED_SECRET_KEY_FIELD, SUPERVISED_SECRET_ERRORS, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, SERVER_TRIGGERED_BROWSER_SOURCES, BROWSER_FALLBACKS, DEFAULT_BROWSER_FALLBACK, PROXY_COUNTRY_CODE, BROWSER_LOG_CONTENT_MODES, DEFAULT_BROWSER_LOG_CONTENT, BROWSER_SCREENSHOT_POLICIES, DEFAULT_BROWSER_SCREENSHOT_POLICY, BROWSER_ENGINES, BROWSER_PROFILE_NAME_PATTERN, BROWSER_LIMIT_KEYS, BROWSER_LIMIT_MAX, BROWSER_EXECUTE_METHOD, BROWSER_GLOBAL_METHODS, BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS, BROWSER_EXECUTE_MAX_TIMEOUT_MS, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, BROWSER_READ_FORMATS, BROWSER_READ_DEFAULT_TIMEOUT_MS, BROWSER_READ_MIN_TIMEOUT_MS, BROWSER_READ_MAX_TIMEOUT_MS, BROWSER_READ_MAX_CONTENT_CHARS, BROWSER_READ_DEFAULT_SELECTOR, BROWSER_READ_MATCH_SEPARATOR, BROWSER_READ_LOGIN_BLOCKER, BROWSER_ERROR_NAME, HTTP_STATUS_FAILURE, LOGIN_PATH_SEGMENTS, LOGIN_HOST_LABELS, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, BROWSER_LOG_EVENT_KINDS, BROWSER_LOG_ENGINES, BROWSER_SESSION_OPEN_REASONS, BROWSER_BLOCK_KINDS, BROWSER_WALL_KINDS, BROWSER_WALL_NEXT_ACTIONS, BROWSER_CONFIRM_DECISIONS, BROWSER_SESSION_CLOSE_REASONS, BROWSER_LOG_CONTEXT_KEYS, BROWSER_LOG_ID_MAX_CHARS, BROWSER_LOG_TEXT_MAX_CHARS, isString, isBoolean, isCount, isPlainObject3, oneOf, isLimits, EVENT_SHAPES, BASE_KEYS, BROWSER_WORKER_SESSION_ID_SEPARATOR, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, WEB_APP_ID_PATTERN, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_WALL_MS, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_TITLE_MAX_CHARS, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSETS, WEB_APP_ASSET_PATH_PATTERN, WEB_APP_ASSET_PATH_MAX_CHARS, WEB_APP_MAX_ROUTES, WEB_APP_MAX_ASSET_BYTES, WEB_APP_CSP_NONCE_PLACEHOLDER, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema, SHARED_DATA_NAME_RE, SHARED_DATA_OWNER_PREFIX, SHARED_DATA_ERRORS;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -11764,6 +11774,9 @@ This text is who you are for this person. As you learn them, their name, their w
     __name(luaClientMetricLabels, "luaClientMetricLabels");
     __name3(luaClientMetricLabels, "luaClientMetricLabels");
     LUA_SESSION_ID_CLAIM = "luaSessionId";
+    WEB_APP_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+    __name(webAppPreviewSessionBinding, "webAppPreviewSessionBinding");
+    __name3(webAppPreviewSessionBinding, "webAppPreviewSessionBinding");
     SESSION_REVOKED_CODE = "SESSION_REVOKED";
     AUTHZ_PROJECTION_VERSION = 1;
     ProjectedScopeSchema = z4.string().min(1).max(128);
@@ -12693,6 +12706,9 @@ listed here; never invent a target.`;
     __name(isWebRouteInput, "isWebRouteInput");
     __name3(isWebRouteInput, "isWebRouteInput");
     WEB_APP_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+    WEB_APP_TITLE_MAX_CHARS = 80;
+    __name(agentPaneEnabled, "agentPaneEnabled");
+    __name3(agentPaneEnabled, "agentPaneEnabled");
     WEB_APP_ENTRY_HTML_MAX_CHARS = 256 * 1024;
     WEB_APP_MAX_ASSETS = 1e3;
     WEB_APP_ASSET_PATH_PATTERN = /^assets\/(?!.*\.\.)[A-Za-z0-9._\-/]+$/;
@@ -23931,9 +23947,9 @@ function writeTip(message) {
 }
 function writeNextStep(opts) {
   if (hintsDisabled()) return;
-  const when3 = opts.when ?? "success";
-  const icon = when3 === "error" ? "\u{1F4A1}" : when3 === "partial" ? "\u26A0\uFE0F " : "\u2728";
-  const label2 = when3 === "success" ? "Tip" : "Diagnose";
+  const when4 = opts.when ?? "success";
+  const icon = when4 === "error" ? "\u{1F4A1}" : when4 === "partial" ? "\u26A0\uFE0F " : "\u2728";
+  const label2 = when4 === "success" ? "Tip" : "Diagnose";
   const rationale = opts.rationale?.trim();
   const tail = rationale ? ` ${rationale}${/[.!?]$/.test(rationale) ? "" : "."}` : "";
   writeInfo(`${icon} ${label2}: run \`${opts.command}\`${tail}`);
@@ -23941,8 +23957,8 @@ function writeNextStep(opts) {
 function writeHintBlock(opts) {
   if (hintsDisabled()) return;
   const validLines = opts.lines.filter((l) => l.command && l.command.trim().length > 0);
-  const when3 = opts.when ?? "success";
-  const icon = when3 === "error" ? "\u{1F4A1}" : when3 === "partial" ? "\u26A0\uFE0F " : "\u2728";
+  const when4 = opts.when ?? "success";
+  const icon = when4 === "error" ? "\u{1F4A1}" : when4 === "partial" ? "\u26A0\uFE0F " : "\u2728";
   if (validLines.length === 0) {
     writeInfo(`${icon} ${opts.headline}`);
     return;
@@ -34338,11 +34354,17 @@ var init_web_app_plugin = __esm({
         const pagesRoot = typeof pages?.root === "string" ? pages.root : pagesNode && Node19.isObjectLiteralExpression(pagesNode) ? extractStringProperty(pagesNode, "root") : void 0;
         const { routes, unreadable, duplicates, files } = readRoutes(config);
         const sourceFile = config.getSourceFile();
+        const title = extractStringProperty(config, "title");
+        const agentPane = extractBooleanProperty(config, "agentPane");
         return {
           kind: this.kind,
           ...common,
           metadata: {
             pattern,
+            title,
+            titleUnreadable: hasProperty(config, "title") && title === void 0,
+            agentPane,
+            agentPaneUnreadable: hasProperty(config, "agentPane") && agentPane === void 0,
             pagesRoot,
             spa: typeof pages?.spa === "boolean" ? pages.spa : void 0,
             nav: Array.isArray(pages?.nav) ? pages.nav : void 0,
@@ -34383,6 +34405,14 @@ var init_web_app_plugin = __esm({
         if (metadata.name && !WEB_APP_NAME_PATTERN.test(metadata.name)) {
           errors.push(validationError(`Web app name must match ${WEB_APP_NAME_PATTERN} (lower-case letters, digits, dashes)`, at));
         }
+        if (meta.titleUnreadable) {
+          errors.push(validationError("Web app `title` must be a compile-time string (the display name the shells show)", at));
+        } else if (meta.title !== void 0 && (!meta.title.trim() || meta.title.length > WEB_APP_TITLE_MAX_CHARS)) {
+          errors.push(validationError(`Web app \`title\` must be non-empty and at most ${WEB_APP_TITLE_MAX_CHARS} characters`, at));
+        }
+        if (meta.agentPaneUnreadable) {
+          errors.push(validationError("Web app `agentPane` must be a compile-time boolean (`true` or `false`)", at));
+        }
         if (!meta.pagesRoot) {
           errors.push(validationError("Web app `pages.root` must be a string literal naming the Vite project directory", at));
         }
@@ -34489,6 +34519,13 @@ var init_web_app_plugin = __esm({
         return {
           ...this.baseManifestFields(compiled),
           kind: "web-app",
+          ...meta.title?.trim() ? {
+            title: meta.title.trim()
+          } : {},
+          // Only the opt-out is written, so an app that never sets it compiles exactly as before.
+          ...meta.agentPane === false ? {
+            agentPane: false
+          } : {},
           pagesRoot: meta.pagesRoot ?? ".",
           spa: meta.spa !== false,
           nav: meta.nav ?? [],
@@ -35200,9 +35237,9 @@ export function defineWebApp(config) {
             logLevel: this.options.debug ? "debug" : "silent"
           });
         } catch (err) {
-          const failure2 = err;
+          const failure3 = err;
           const guardText = /* @__PURE__ */ __name((e) => typeof e.text === "string" ? e.text.replace(/^\[plugin [^\]]*\]\s*/, "") : "", "guardText");
-          const guard = failure2?.errors?.find((e) => COMPILE_GUARD_CODES.some((c) => guardText(e).startsWith(c)));
+          const guard = failure3?.errors?.find((e) => COMPILE_GUARD_CODES.some((c) => guardText(e).startsWith(c)));
           if (guard) {
             const at = guard.location ? ` (${guard.location.file}:${guard.location.line}:${guard.location.column + 1})` : "";
             throw new Error(`${guardText(guard)}${at}`);
@@ -50498,9 +50535,9 @@ async function runWorkflowLocallyInner(rawOpts) {
         fn(controller.signal),
         new Promise((_, reject) => {
           timer = setTimeout(() => {
-            const failure2 = new StepFailure("TIMEOUT", `step "${stepId}" exceeded its ${wallMs / 1e3} s wall`);
-            controller.abort(failure2);
-            reject(failure2);
+            const failure3 = new StepFailure("TIMEOUT", `step "${stepId}" exceeded its ${wallMs / 1e3} s wall`);
+            controller.abort(failure3);
+            reject(failure3);
           }, wallMs);
         })
       ]);
@@ -51445,7 +51482,7 @@ async function runWorkflowLocallyInner(rawOpts) {
     ...rows3.values()
   ].filter((r) => r.status === "pending");
   if (stuck.length) {
-    const failure2 = {
+    const failure3 = {
       code: "FRONTIER_STALLED",
       message: `no ready step; pending: ${stuck.map((r) => r.stepId).join(", ")}`
     };
@@ -51454,7 +51491,7 @@ async function runWorkflowLocallyInner(rawOpts) {
     return {
       status: "failed",
       exitCode: 4,
-      error: failure2,
+      error: failure3,
       ledger,
       timeline
     };
@@ -51468,7 +51505,7 @@ async function runWorkflowLocallyInner(rawOpts) {
   if (opts.schemas?.output) {
     const issues = validateJsonSchema(opts.schemas.output, output);
     if (issues.length) {
-      const failure2 = {
+      const failure3 = {
         code: "OUTPUT_SCHEMA_INVALID",
         message: `run output does not match outputSchema: ${issues.join("; ")}`
       };
@@ -51477,7 +51514,7 @@ async function runWorkflowLocallyInner(rawOpts) {
       return {
         status: "failed",
         exitCode: 4,
-        error: failure2,
+        error: failure3,
         ledger,
         timeline
       };
@@ -52771,6 +52808,22 @@ var WebAppApi = class extends HttpClient {
       code
     }, {});
   }
+  /** Open a preview of one pushed version (`latest` by default), or get the open one for that version. */
+  async openPreview(webAppId, input) {
+    return this.httpPostOnce(`/developer/web-apps/${this.agentId}/${webAppId}/previews`, input, {});
+  }
+  async listPreviews(webAppId) {
+    const query = webAppId ? `?webAppId=${encodeURIComponent(webAppId)}` : "";
+    return this.httpGet(`/developer/web-apps/${this.agentId}/previews${query}`, {});
+  }
+  /** End a preview: its copy of the data and its recorded effects are deleted. */
+  async closePreview(previewId) {
+    return this.httpPost(`/developer/web-apps/${this.agentId}/previews/${encodeURIComponent(previewId)}/close`, {}, {});
+  }
+  async previewEffects(previewId, after) {
+    const query = after !== void 0 ? `?after=${after}` : "";
+    return this.httpGet(`/developer/web-apps/${this.agentId}/previews/${encodeURIComponent(previewId)}/effects${query}`, {});
+  }
 };
 
 // src/primitives/web-app.handler.ts
@@ -52998,6 +53051,13 @@ var WebAppHandler = class extends BaseVersionedHandler {
     const app = primitive;
     return {
       name: app.name,
+      ...app.title ? {
+        title: app.title
+      } : {},
+      // Sent only to turn the pane off; absent ⇒ lua-api stores the default (on).
+      ...app.agentPane === false ? {
+        agentPane: false
+      } : {},
       ...app.description ? {
         description: app.description
       } : {},
@@ -53145,8 +53205,8 @@ var DecisionHandler = class extends BaseVersionedHandler {
     }
     return revivedLine(stale.name, record ? "was deleted on the server" : "no longer exists on the server", reused);
   }
-  async replaceStaleEntry(apiKey, agentId2, name, manifest, failure2) {
-    if (failure2.statusCode !== 409 || failure2.code !== DECISION_INACTIVE_CODE) return null;
+  async replaceStaleEntry(apiKey, agentId2, name, manifest, failure3) {
+    if (failure3.statusCode !== 409 || failure3.code !== DECISION_INACTIVE_CODE) return null;
     const api = this.getApi(apiKey, agentId2);
     const namesake = (await this.fetchFromServer(api))?.find((item) => item.name === name && isLive(item));
     const primitive = findPrimitive(manifest, name, PrimitiveKind.DECISION);
@@ -53674,10 +53734,12 @@ async function handleDevRequest(req, ctx) {
       app: {
         id: "local",
         name: ctx.app.name,
+        title: ctx.app.title || ctx.app.branding?.name || void 0,
         description: ctx.app.description,
         version: "0.0.0-dev",
         deployment: 0
       },
+      agentPane: ctx.app.agentPane !== false,
       nav: ctx.app.nav,
       user: {
         id: ctx.auth.userId,
@@ -79892,6 +79954,10 @@ async function templateDraftAction(templateApi, options) {
     } : {},
     ...result.draft.onUninstall ? {
       onUninstall: result.draft.onUninstall
+    } : {},
+    // BAC-2623 — the draft composer does not author sharedData; keep what the yaml already declares.
+    ...config.template?.sharedData ? {
+      sharedData: config.template.sharedData
     } : {}
   };
   writeYamlConfig(config);
@@ -79929,7 +79995,8 @@ var TEMPLATE_SECTION_KEYS = [
   "paramsMeta",
   "onInstall",
   "onUninstall",
-  "installPolicy"
+  "installPolicy",
+  "sharedData"
 ];
 var HOOK_KEYS = [
   "tool",
@@ -79944,6 +80011,9 @@ function sectionKeys(section2, value3) {
     const vars = value3.vars ?? [];
     return vars.map((v) => v.name);
   }
+  if (section2 === "sharedData") {
+    return (value3 ?? []).map((e) => `${e.name}:${e.access}`);
+  }
   if (section2 === "onInstall" || section2 === "onUninstall") {
     const hook = value3;
     return HOOK_KEYS.filter((key) => Boolean(hook[key]));
@@ -79965,7 +80035,8 @@ async function confirmTemplateSectionConsequences(templateApi, templateId, local
     paramsMeta: "the deploy form falls back to derived display names and string typing",
     onInstall: "new installs no longer run a post-install hook; installed agents are untouched",
     onUninstall: "uninstalls no longer run cleanup before teardown (provider-side artifacts may be left behind)",
-    installPolicy: "new installs are no longer limited to one per workspace"
+    installPolicy: "new installs are no longer limited to one per workspace",
+    sharedData: "new installs no longer join these shared collections; agents already on them keep their access"
   };
   for (const section2 of TEMPLATE_SECTION_KEYS) {
     const serverKeys = sectionKeys(section2, latest[section2]);
@@ -80007,7 +80078,9 @@ async function templatePublishAction(templateApi, config, options) {
       onInstall: templateSection.onInstall ?? null,
       onUninstall: templateSection.onUninstall ?? null,
       // BAC-466 — null clears (the personaTemplate rule): absent = no per-workspace limit.
-      installPolicy: templateSection.installPolicy ?? null
+      installPolicy: templateSection.installPolicy ?? null,
+      // BAC-2623 — [] clears (absent = joins nothing).
+      sharedData: templateSection.sharedData ?? []
     };
   }
   writeProgress("\u{1F504} Publishing template version...");
@@ -89677,12 +89750,22 @@ function forgetWebAppInYaml(webAppId, name) {
   return true;
 }
 __name(forgetWebAppInYaml, "forgetWebAppInYaml");
+var EXIT_1_CODES = /* @__PURE__ */ new Set([
+  "NO_EMAIL_ON_ACCOUNT",
+  "WEB_APP_DELETE_CODE_EMAIL_FAILED"
+]);
+var isExit1Code = /* @__PURE__ */ __name((code) => code !== void 0 && (code.startsWith("WEB_APP_DELETE_CODE_") || EXIT_1_CODES.has(code)), "isExit1Code");
 function failure(response, fallback) {
   const code = response.error?.code;
-  return new CliError("api", `${response.error?.message ?? fallback}${code ? ` (${code})` : ""}`, {
-    statusCode: response.error?.statusCode,
-    serverCode: code
-  });
+  const message = `${response.error?.message ?? fallback}${code ? ` (${code})` : ""}`;
+  const status = response.error?.statusCode;
+  if (isExit1Code(code) && status !== 401 && status !== 403) {
+    return new CliError("api", message, {
+      statusCode: status,
+      serverCode: code
+    });
+  }
+  return CliError.fromStatus(status, message, void 0, apiErrorDetail(response.error));
 }
 __name(failure, "failure");
 function printPreview(p) {
@@ -89801,6 +89884,192 @@ async function appsDeleteCommand(name, opts = {}) {
 }
 __name(appsDeleteCommand, "appsDeleteCommand");
 
+// src/commands/apps-preview.ts
+init_dist();
+init_cli();
+init_write_info();
+init_files();
+init_cli_error();
+init_analytics();
+init_request_credential();
+init_constants();
+var PREVIEW_ID = /^[a-z2-7]{8}$/;
+var TTL_MAX_HOURS = 168;
+var DISPLAY_MAX = 200;
+var EFFECT_PAGES_MAX = 20;
+function forTerminal(value3, max = DISPLAY_MAX) {
+  const text2 = String(value3 ?? "").replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+  return text2.length > max ? `${text2.slice(0, max - 1)}\u2026` : text2;
+}
+__name(forTerminal, "forTerminal");
+function printJson5(value3) {
+  console.log(
+    // eslint-disable-next-line no-control-regex
+    JSON.stringify(value3, null, 2).replace(/[\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`)
+  );
+}
+__name(printJson5, "printJson");
+function parseTtlHours(raw) {
+  const m = /^(\d+(?:\.\d+)?)(h|d)?$/i.exec(raw.trim());
+  const hours = m ? Number(m[1]) * (m[2]?.toLowerCase() === "d" ? 24 : 1) : NaN;
+  if (!Number.isFinite(hours) || hours <= 0 || hours > TTL_MAX_HOURS) {
+    throw CliError.usage(`--ttl takes hours (24, 24h) or days (2d), at most ${TTL_MAX_HOURS} hours; got ${JSON.stringify(raw)}.`);
+  }
+  return hours;
+}
+__name(parseTtlHours, "parseTtlHours");
+function failure2(response, fallback) {
+  const code = response.error?.code;
+  const message = forTerminal(response.error?.message ?? fallback);
+  return CliError.fromStatus(response.error?.statusCode, `${message}${code ? ` (${forTerminal(code, 80)})` : ""}`, void 0, apiErrorDetail(response.error));
+}
+__name(failure2, "failure");
+function when3(iso) {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? forTerminal(iso, 40) : d.toLocaleString("en-GB", {
+    day: "numeric",
+    month: "short",
+    hour: "2-digit",
+    minute: "2-digit"
+  });
+}
+__name(when3, "when");
+function printOpened(p) {
+  writeSuccess(`${p.created === false ? "\u2705 Open preview of" : "\u2705 Preview of"} ${forTerminal(p.name)} ${forTerminal(p.version)} (until ${when3(p.expiresAt)})`);
+  writeInfo(`   Open: ${forTerminal(p.openUrl, 500)}`);
+  writeInfo("   Data writes go to a copy that is deleted when the preview ends; emails and messages are recorded, not sent; fetch calls fail (TEST_EGRESS_BLOCKED).");
+  writeInfo("   Anyone who can edit this agent can open the link.");
+  const id2 = forTerminal(p.id, 16);
+  writeInfo(`   End it now: lua apps preview --close ${id2}   \xB7   What it recorded: lua apps preview --effects ${id2}`);
+}
+__name(printOpened, "printOpened");
+var TARGET_KEYS = [
+  "url",
+  "to",
+  "channel",
+  "tool",
+  "collection"
+];
+var RECIPIENT_KEYS = [
+  "email",
+  "phoneNumber",
+  "userId",
+  "conversationId"
+];
+function effectTarget(request2) {
+  const req = request2 && typeof request2 === "object" ? request2 : {};
+  if (typeof req.surface === "string" && req.surface) {
+    return typeof req.code === "string" && req.code ? `${req.surface} (${req.code})` : req.surface;
+  }
+  for (const key of TARGET_KEYS) {
+    const value3 = req[key];
+    if (typeof value3 === "string" && value3) return value3;
+    if (value3 && typeof value3 === "object") {
+      const to = value3;
+      const hit = RECIPIENT_KEYS.map((k) => to[k]).find((v) => typeof v === "string" && v !== "");
+      if (hit) return hit;
+    }
+  }
+  return "";
+}
+__name(effectTarget, "effectTarget");
+function describeEffect(e) {
+  const target = effectTarget(e.request);
+  const site = e.site ? ` (${forTerminal(e.site, 40)})` : "";
+  return `  #${forTerminal(e.seq, 12)}  ${forTerminal(e.kind, 40)}${site}${target ? `  ${forTerminal(target)}` : ""}  ${when3(e.at)}`;
+}
+__name(describeEffect, "describeEffect");
+async function appsPreviewCommand(name, opts = {}) {
+  return withErrorHandling(async () => {
+    const modes = [
+      opts.list,
+      opts.close,
+      opts.effects
+    ].filter((m) => m !== void 0 && m !== false).length;
+    if (modes > 1) throw CliError.usage("Use one of --list, --close <id> or --effects <id> at a time.");
+    if (modes === 0 && !name) {
+      throw CliError.usage("Name the web app to preview.", "lua apps preview <name>   \xB7   lua apps preview --list");
+    }
+    if (name && !WEB_APP_NAME_PATTERN.test(name)) throw CliError.usage(`${JSON.stringify(name)} is not a web app name.`);
+    for (const id2 of [
+      opts.close,
+      opts.effects
+    ]) {
+      if (id2 !== void 0 && !PREVIEW_ID.test(id2)) {
+        throw CliError.usage(`${JSON.stringify(id2)} is not a preview id (8 characters, as \`--list\` shows).`);
+      }
+    }
+    const ttlHours = opts.ttl !== void 0 ? parseTtlHours(opts.ttl) : void 0;
+    const agentId2 = opts.agent ?? readYamlConfig()?.agent?.agentId;
+    if (!agentId2) throw CliError.usage("No agent: run this in an agent project, or pass --agent <agentId>.");
+    const api = new WebAppApi(BASE_URLS.API, await resolveRequestCredential(), agentId2);
+    const findApp = /* @__PURE__ */ __name(async (appName) => {
+      const list = await api.getWebApps();
+      if (!list.success) throw failure2(list, "Could not list the web apps of the agent.");
+      const app2 = list.data?.webApps.find((a) => a.name === appName);
+      if (!app2) throw CliError.notFound(`No web app named ${JSON.stringify(appName)} on agent ${agentId2}.`, `Push it first: lua push webapp --name ${appName}`);
+      return app2;
+    }, "findApp");
+    if (opts.list) {
+      const res2 = await api.listPreviews(name ? (await findApp(name)).id : void 0);
+      if (!res2.success || !res2.data) throw failure2(res2, "Could not list the previews.");
+      if (opts.json) return printJson5(res2.data.previews);
+      if (!res2.data.previews.length) return writeInfo(`No open previews ${name ? `of ${name}` : "on this agent"}.`);
+      for (const p of res2.data.previews) {
+        writeInfo(`  ${forTerminal(p.id, 16)}  ${forTerminal(p.name)} ${forTerminal(p.version)}  until ${when3(p.expiresAt)}  ${forTerminal(p.openUrl, 500)}`);
+      }
+      return;
+    }
+    if (opts.close) {
+      const res2 = await api.closePreview(opts.close);
+      if (!res2.success) throw failure2(res2, "Could not end the preview.");
+      if (opts.json) return printJson5(res2.data);
+      writeSuccess(`\u2705 Preview ${opts.close} ended; its copy of the data and its recorded effects are deleted.`);
+      trackEvent("cli_apps_preview_closed", {});
+      return;
+    }
+    if (opts.effects) {
+      const effects = [];
+      let after;
+      for (let page = 0; page < EFFECT_PAGES_MAX; page++) {
+        const res2 = await api.previewEffects(opts.effects, after);
+        if (!res2.success || !res2.data) throw failure2(res2, "Could not read what the preview recorded.");
+        effects.push(...res2.data.effects);
+        after = res2.data.nextAfter;
+        if (after === void 0) break;
+      }
+      const truncated = after !== void 0;
+      const cut2 = `Only the first ${effects.length} recorded effects are shown; the preview recorded more.`;
+      if (opts.json) {
+        if (truncated) console.error(cut2);
+        return printJson5(effects);
+      }
+      if (!effects.length) return writeInfo("The preview has recorded nothing so far: no email or message.");
+      writeInfo(`Recorded instead of sent (${effects.length}${truncated ? "+" : ""}):`);
+      for (const e of effects) writeInfo(describeEffect(e));
+      if (truncated) writeInfo(cut2);
+      return;
+    }
+    const app = await findApp(name);
+    const res = await api.openPreview(app.id, {
+      ...opts.version ? {
+        version: opts.version
+      } : {},
+      ...ttlHours !== void 0 ? {
+        ttlHours
+      } : {}
+    });
+    if (!res.success || !res.data) throw failure2(res, "Could not open the preview.");
+    if (opts.json) return printJson5(res.data);
+    printOpened(res.data);
+    trackEvent("cli_apps_preview_opened", {
+      created: res.data.created !== false,
+      withVersion: Boolean(opts.version)
+    });
+  }, "apps preview");
+}
+__name(appsPreviewCommand, "appsPreviewCommand");
+
 // src/commands/browser.ts
 init_cli();
 init_hints();
@@ -90051,10 +90320,10 @@ async function browserContextOf(options) {
   };
 }
 __name(browserContextOf, "browserContextOf");
-function printJson5(value3) {
+function printJson6(value3) {
   console.log(JSON.stringify(value3, null, 2));
 }
-__name(printJson5, "printJson");
+__name(printJson6, "printJson");
 function logsHint() {
   writeNextStep({
     command: BROWSER_LOGS_HINT,
@@ -90087,7 +90356,7 @@ async function runBrowserRead(ctx, url, options) {
     json: !!options.json
   });
   if (options.json) {
-    printJson5(output);
+    printJson6(output);
     return output;
   }
   if (output.error) {
@@ -90182,7 +90451,7 @@ async function runBrowserTask(ctx, task, options, out = terminalRunOutput()) {
       environment: ctx.environment,
       json: !!options.json
     });
-    if (options.json) printJson5({
+    if (options.json) printJson6({
       id: view.id,
       status: "cancelled",
       cancelled
@@ -90208,7 +90477,7 @@ async function runBrowserTask(ctx, task, options, out = terminalRunOutput()) {
     json: !!options.json
   });
   if (options.json) {
-    printJson5(view);
+    printJson6(view);
     return {
       view,
       cancelled: false
@@ -91252,9 +91521,25 @@ Examples:
   $ lua version delete v3 --ci          Refused: needs --force (usage error, exit 2)
   $ lua version delete v3 --ci --force  Delete non-interactively
 `).action((version, opts) => versionDeleteCommand(version, opts));
-  const appsGroup = program2.command("apps").description("\u{1F5A5}\uFE0F  Create, develop and delete web apps of this agent");
+  const appsGroup = program2.command("apps").description("\u{1F5A5}\uFE0F  Create, develop, preview and delete web apps of this agent");
   appsGroup.command("new <name>").description("Scaffold a web app in src/apps/<name> (routes + a Vite/React page) and list it on the agent").action((name) => appsNewCommand(name));
   appsGroup.command("dev <name>").description("Run a web app locally: pages on Vite with hot reload, routes in the local sandbox as you").option("--port <port>", "Port for the dev server (default: Vite's)").action((name, opts) => appsDevCommand(name, opts));
+  appsGroup.command("preview [name]").description("Open a pushed web app version before it is live (a temporary copy of the data, nothing sent)").option("--version <version>", "The pushed version to open, or 'latest' (default)").option("--ttl <hours>", "How long the preview lives: hours (24, 24h) or days (2d), at most 168 hours (default 24)").option("--list", "List the previews that have not ended: of the agent, or of the web app you name").option("--close <id>", "End a preview now: its copy of the data and its recorded effects are deleted").option("--effects <id>", "What the preview recorded instead of sending (emails, messages)").option("--agent <agentId>", "The agent the web app belongs to (default: this project\u2019s agent)").option("--json", "Print JSON").addHelpText("after", `
+A preview opens in Lua Workspace from the link it prints, on its own address.
+Its routes write to a copy of the agent's data that is deleted when the
+preview ends; emails and messages are recorded, not sent, and fetch calls
+fail with TEST_EGRESS_BLOCKED. Anyone who can edit the agent can open the link. Opening a preview of a
+version that already has an open one gives you that one. --json prints the
+server's data unchanged (control characters escaped), for scripts.
+
+Examples:
+  $ lua apps preview ops-dashboard                    Preview the latest push
+  $ lua apps preview ops-dashboard --version 1.0.4 --ttl 2d
+  $ lua apps preview --list                           Every open preview on the agent
+  $ lua apps preview ops-dashboard --list             Only that app's
+  $ lua apps preview --effects p7k2m3xq
+  $ lua apps preview --close p7k2m3xq
+`).action((name, opts) => appsPreviewCommand(name, opts));
   appsGroup.command("delete <name>").description("Delete a web app for good (confirmed by a code emailed to you)").option("--agent <agentId>", "The agent the web app belongs to (default: this project\u2019s agent)").option("--code <code>", "The 6-digit code from the email (non-interactive second step)").addHelpText("after", `
 Permanent: the web app and every version of it are removed, the live agent
 version stops listing it, and no rollback brings it back. Agent data stays.