lua-cli 3.53.0 → 3.54.0

package/dist/api-exports.js

@@ -853,6 +853,8 @@ import { z as z3 } from "zod";
 import { z as z4 } from "zod";
 import { z as z5 } from "zod";
 import { z as z6 } from "zod";
+import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 function isChannelConversationChannel(channel) {
   return !!channel && CHANNEL_CONVERSATION_CHANNELS.includes(channel);
 }
@@ -3203,6 +3205,20 @@ function sanitizeProgressUpdateInput(input) {
   if (percent2 !== void 0) out.percent = percent2;
   return out;
 }
+function agentIdentityError(code, message, statusCode) {
+  return Object.assign(new Error(message), {
+    name: "AgentIdentityError",
+    code,
+    ...typeof statusCode === "number" ? {
+      statusCode
+    } : {}
+  });
+}
+function readAgentIdentityAudience(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const audience = input.audience;
+  return typeof audience === "string" && audience.length > 0 && audience.length <= 200 ? audience : null;
+}
 function toEpochMs(value3) {
   if (value3 === null || value3 === void 0) return void 0;
   const ms = value3 instanceof Date ? value3.getTime() : typeof value3 === "number" ? value3 : Date.parse(value3);
@@ -4050,6 +4066,10 @@ function removeHiddenBlocks(input) {
     "hide"
   ]).trim();
 }
+function stripBlocksKeepingEdges(input, names) {
+  const stripped = stripBlocks(input, names);
+  return stripped === input ? input : stripped.trim();
+}
 function startsWithHiddenBlock(input) {
   const [first] = splitBlocks(input);
   return first?.type === "block" && first.name === "hide";
@@ -4139,8 +4159,10 @@ function transformChatHistoryContentParts(parts) {
     }
     if (part?.type !== "text" && part?.type !== "file") continue;
     if (part.type === "text" && typeof part.text === "string") {
-      const rawText = removeHiddenBlocks(part.text || "");
-      if (!rawText) continue;
+      const rawText = stripBlocksKeepingEdges(part.text || "", [
+        "hide"
+      ]);
+      if (!rawText.trim()) continue;
       const audioMatch = rawText.match(/::: audio\s*!\[(.*?)\]\((.*?)\)\s*:::/);
       const videoMatch = rawText.match(/::: video\s*!\[(.*?)\]\((.*?)\)\s*:::/);
       if (audioMatch) {
@@ -4157,7 +4179,9 @@ function transformChatHistoryContentParts(parts) {
         });
       } else {
         let text2 = rawText.replace(/\\\\\\n/g, "\n");
-        text2 = removeNavigateBlock(text2);
+        text2 = stripBlocksKeepingEdges(text2, [
+          "navigate"
+        ]);
         content.push({
           type: "text",
           text: text2
@@ -4232,6 +4256,15 @@ function mergeRichPartMirrorMessages(messages, sameTurnGroup) {
         break;
       }
       if (folded) continue;
+      const content = message.content.filter((part) => part.type !== "data-lua-tool-step");
+      if (content.length === 0) continue;
+      if (content.length !== message.content.length) {
+        merged.push({
+          ...message,
+          content
+        });
+        continue;
+      }
     }
     merged.push(message);
   }
@@ -6721,6 +6754,33 @@ function composeAgentPaneRuntimeContext(input) {
   }
   return lines.join("\n");
 }
+function webAppHealthMinute(atMs) {
+  return Math.floor(atMs / 6e4);
+}
+function webAppHealthKey(webAppId, minute) {
+  return `webapp:health:${webAppId}:${minute}`;
+}
+function webAppHealthVerdict(minutes) {
+  let requests = 0;
+  let failures = 0;
+  let firstFailingMinute;
+  for (const m of minutes) {
+    const r = Math.max(0, m.requests || 0);
+    const f = Math.max(0, Math.min(m.failures || 0, r));
+    requests += r;
+    failures += f;
+    if (f > 0 && (firstFailingMinute === void 0 || m.minute < firstFailingMinute)) firstFailingMinute = m.minute;
+  }
+  if (failures >= WEB_APP_HEALTH_MIN_FAILURES && failures >= requests * WEB_APP_HEALTH_MIN_FAILURE_RATIO) {
+    return {
+      state: "needs_attention",
+      since: new Date(firstFailingMinute * 6e4)
+    };
+  }
+  return {
+    state: "ok"
+  };
+}
 function evidenceDisplayText(text2) {
   const raw = typeof text2 === "string" ? text2 : "";
   if (!raw.trim()) return "";
@@ -7575,7 +7635,8 @@ function isPaymentRequiredChatErrorEnvelope(data) {
   if (!data || typeof data !== "object") return false;
   const d = data;
   if (d.type !== "error") return false;
-  return d.textDelta === BILLING_REJECTION_TEXT_CREDITS || d.textDelta === BILLING_REJECTION_TEXT_SEAT || d.textDelta === BILLING_REJECTION_TEXT_USER_QUOTA;
+  if (d.code === "OUT_OF_ACTIONS") return true;
+  return d.textDelta === BILLING_REJECTION_TEXT_CREDITS || d.textDelta === BILLING_REJECTION_TEXT_OUT_OF_ACTIONS || d.textDelta === BILLING_REJECTION_TEXT_SEAT || d.textDelta === BILLING_REJECTION_TEXT_USER_QUOTA;
 }
 function isCustomMcpConnectionId(id2) {
   return typeof id2 === "string" && id2.startsWith(CUSTOM_MCP_CONNECTION_ID_PREFIX);
@@ -7687,7 +7748,56 @@ function sharedDataOwnerKey(collectionId) {
 function isSharedDataOwnerKey(agentId2) {
   return typeof agentId2 === "string" && agentId2.startsWith(SHARED_DATA_OWNER_PREFIX);
 }
-var __defProp4, __name4, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_FALLBACK_PROVIDERS, OPENROUTER_DIRECT_VENDORS, OPENROUTER_NEEDS_MODEL_MESSAGE, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_SANDBOX_SITE_HEADER, DECISION_SANDBOX_PRIMITIVE_HEADER, DECISION_SANDBOX_TOOL_SEPARATOR, DECISION_LIMITS, DECISION_ERROR_CODES, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, DecisionDefinitionWriteSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, MESSAGING_CHANNELS, VOICE_CHANNELS, TURN_CATEGORIES, AGENT_TOOL_CATEGORIES, count, AnthropicSseUsageReader, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, SCRUB_DEEP_MAX_DEPTH, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, SUPERVISED_SECRET_LIMITS, SUPERVISED_SECRET_NAME_RE, SUPERVISED_SECRET_FIELD_RE, SUPERVISED_SECRET_KEY_FIELD, SUPERVISED_SECRET_ERRORS, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, CHANNEL_SEND_CHANNELS, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, SERVER_TRIGGERED_BROWSER_SOURCES, BROWSER_FALLBACKS, DEFAULT_BROWSER_FALLBACK, PROXY_COUNTRY_CODE, BROWSER_LOG_CONTENT_MODES, DEFAULT_BROWSER_LOG_CONTENT, BROWSER_SCREENSHOT_POLICIES, DEFAULT_BROWSER_SCREENSHOT_POLICY, BROWSER_PROFILE_NAME_PATTERN, BROWSER_LIMIT_KEYS, BROWSER_LIMIT_MAX, BROWSER_EXECUTE_METHOD, BROWSER_GLOBAL_METHODS, BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS, BROWSER_EXECUTE_MAX_TIMEOUT_MS, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, BROWSER_READ_FORMATS, BROWSER_READ_DEFAULT_TIMEOUT_MS, BROWSER_READ_MIN_TIMEOUT_MS, BROWSER_READ_MAX_TIMEOUT_MS, BROWSER_READ_MAX_CONTENT_CHARS, BROWSER_READ_DEFAULT_SELECTOR, BROWSER_READ_MATCH_SEPARATOR, BROWSER_READ_LOGIN_BLOCKER, BROWSER_ERROR_NAME, HTTP_STATUS_FAILURE, LOGIN_PATH_SEGMENTS, LOGIN_HOST_LABELS, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, BROWSER_LOG_EVENT_KINDS, BROWSER_LOG_ENGINES, BROWSER_SESSION_OPEN_REASONS, BROWSER_BLOCK_KINDS, BROWSER_WALL_KINDS, BROWSER_WALL_NEXT_ACTIONS, BROWSER_CONFIRM_DECISIONS, BROWSER_SESSION_CLOSE_REASONS, BROWSER_LOG_CONTEXT_KEYS, BROWSER_LOG_ID_MAX_CHARS, BROWSER_LOG_TEXT_MAX_CHARS, isString, isBoolean, isCount, isPlainObject3, oneOf, isLimits, EVENT_SHAPES, BASE_KEYS, BROWSER_WORKER_SESSION_ID_SEPARATOR, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, WEB_APP_ID_PATTERN, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, label, labels, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingMatchScreenSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_TITLE_MAX_CHARS, WEB_APP_CHAT_TEXT_MAX_CHARS, WEB_APP_CHAT_CONTEXT_MAX_BYTES, WEB_APP_CHAT_PATH_MAX_CHARS, WEB_APP_CHAT_CONTROL_CHARS, WEB_APP_CHAT_APP_NAME_MAX_CHARS, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSET_BYTES, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema, SHARED_DATA_NAME_RE, SHARED_DATA_OWNER_PREFIX, SHARED_DATA_ERRORS;
+function resolvePlanEntitlements(plan) {
+  const limits = {};
+  for (const k of PLAN_LIMIT_KEYS) {
+    const v = plan.limits[k];
+    limits[k] = v === void 0 ? PLAN_KEYS[k].default : v;
+  }
+  const features = {};
+  for (const k of PLAN_FEATURE_KEYS) {
+    const v = plan.features[k];
+    features[k] = v === void 0 ? PLAN_KEYS[k].default : v;
+  }
+  return {
+    limits,
+    features
+  };
+}
+function isPlanRefusal(body) {
+  if (!body || typeof body !== "object") return false;
+  const code = body.code;
+  return typeof code === "string" && PLAN_REFUSAL_CODES.includes(code);
+}
+function planKeyList() {
+  return Object.keys(PLAN_KEYS).map((key) => ({
+    key,
+    kind: PLAN_KEYS[key].kind,
+    label: PLAN_KEYS[key].label,
+    default: PLAN_KEYS[key].default
+  }));
+}
+function parseWith(schema, body) {
+  const r = schema.safeParse(body);
+  return r.success ? {
+    ok: true,
+    data: r.data
+  } : {
+    ok: false,
+    problems: r.error.issues.map((i) => `${i.path.join(".")} ${i.message}`)
+  };
+}
+function parseWith2(schema, body) {
+  const r = schema.safeParse(body);
+  return r.success ? {
+    ok: true,
+    data: r.data
+  } : {
+    ok: false,
+    problems: r.error.issues.map((i) => `${i.path.join(".")} ${i.message}`)
+  };
+}
+var __defProp4, __name4, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_FALLBACK_PROVIDERS, OPENROUTER_DIRECT_VENDORS, OPENROUTER_NEEDS_MODEL_MESSAGE, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_SANDBOX_SITE_HEADER, DECISION_SANDBOX_PRIMITIVE_HEADER, DECISION_SANDBOX_TOOL_SEPARATOR, DECISION_LIMITS, DECISION_ERROR_CODES, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, DecisionDefinitionWriteSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, MESSAGING_CHANNELS, VOICE_CHANNELS, TURN_CATEGORIES, AGENT_TOOL_CATEGORIES, count, AnthropicSseUsageReader, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, SCRUB_DEEP_MAX_DEPTH, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, SUPERVISED_SECRET_LIMITS, SUPERVISED_SECRET_NAME_RE, SUPERVISED_SECRET_FIELD_RE, SUPERVISED_SECRET_KEY_FIELD, SUPERVISED_SECRET_ERRORS, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, AGENT_IDENTITY_ERRORS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, CHANNEL_SEND_CHANNELS, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, SERVER_TRIGGERED_BROWSER_SOURCES, BROWSER_FALLBACKS, DEFAULT_BROWSER_FALLBACK, PROXY_COUNTRY_CODE, BROWSER_LOG_CONTENT_MODES, DEFAULT_BROWSER_LOG_CONTENT, BROWSER_SCREENSHOT_POLICIES, DEFAULT_BROWSER_SCREENSHOT_POLICY, BROWSER_PROFILE_NAME_PATTERN, BROWSER_LIMIT_KEYS, BROWSER_LIMIT_MAX, BROWSER_EXECUTE_METHOD, BROWSER_GLOBAL_METHODS, BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS, BROWSER_EXECUTE_MAX_TIMEOUT_MS, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, BROWSER_READ_FORMATS, BROWSER_READ_DEFAULT_TIMEOUT_MS, BROWSER_READ_MIN_TIMEOUT_MS, BROWSER_READ_MAX_TIMEOUT_MS, BROWSER_READ_MAX_CONTENT_CHARS, BROWSER_READ_DEFAULT_SELECTOR, BROWSER_READ_MATCH_SEPARATOR, BROWSER_READ_LOGIN_BLOCKER, BROWSER_ERROR_NAME, HTTP_STATUS_FAILURE, LOGIN_PATH_SEGMENTS, LOGIN_HOST_LABELS, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, BROWSER_LOG_EVENT_KINDS, BROWSER_LOG_ENGINES, BROWSER_SESSION_OPEN_REASONS, BROWSER_BLOCK_KINDS, BROWSER_WALL_KINDS, BROWSER_WALL_NEXT_ACTIONS, BROWSER_CONFIRM_DECISIONS, BROWSER_SESSION_CLOSE_REASONS, BROWSER_LOG_CONTEXT_KEYS, BROWSER_LOG_ID_MAX_CHARS, BROWSER_LOG_TEXT_MAX_CHARS, isString, isBoolean, isCount, isPlainObject3, oneOf, isLimits, EVENT_SHAPES, BASE_KEYS, BROWSER_WORKER_SESSION_ID_SEPARATOR, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, WEB_APP_ID_PATTERN, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, label, labels, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingMatchScreenSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_TITLE_MAX_CHARS, WEB_APP_CHAT_TEXT_MAX_CHARS, WEB_APP_CHAT_CONTEXT_MAX_BYTES, WEB_APP_CHAT_PATH_MAX_CHARS, WEB_APP_CHAT_CONTROL_CHARS, WEB_APP_CHAT_APP_NAME_MAX_CHARS, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSET_BYTES, WEB_APP_HEALTH_KEY_TTL_SECONDS, WEB_APP_HEALTH_MIN_FAILURES, WEB_APP_HEALTH_MIN_FAILURE_RATIO, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_OUT_OF_ACTIONS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema, SHARED_DATA_NAME_RE, SHARED_DATA_OWNER_PREFIX, SHARED_DATA_ERRORS, PLAN_KEYS, PLAN_LIMIT_KEYS, PLAN_FEATURE_KEYS, BILLING_ENGINES, BILLING_VERSION_KINDS, planKeyString, planPriceSchema, limitsShape, featuresShape, billingPlanSchema, topUpPackSchema, PLAN_REFUSAL_CODES, billingSignupConfigSchema, billingVersionDraftPatchSchema, billingVersionDraftCreateSchema, assignBillingPlanSchema, billingActionRatesSchema, BILLING_MOVE_DEFAULT_NOTICE_DAYS, keyString, billingMoveDraftSchema, billingMoveOrgDateSchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -9456,6 +9566,20 @@ var init_dist = __esm({
     __name4(capText, "capText");
     __name(sanitizeProgressUpdateInput, "sanitizeProgressUpdateInput");
     __name4(sanitizeProgressUpdateInput, "sanitizeProgressUpdateInput");
+    AGENT_IDENTITY_ERRORS = {
+      /** `input` is not `{ audience: string }`. */
+      INPUT_INVALID: "agent_identity_input_invalid",
+      /** The audience is not on the platform allowlist. */
+      AUDIENCE_NOT_ALLOWED: "agent_identity_audience_not_allowed",
+      /** No live execution of an agent backs this call (offline `lua test` / `lua dev`, a finished execution). */
+      REQUIRES_LIVE_EXECUTION: "agent_identity_requires_live_execution",
+      /** The platform could not mint one right now (signing not configured, lua-auth unreachable, agent has no org). */
+      UNAVAILABLE: "agent_identity_unavailable"
+    };
+    __name(agentIdentityError, "agentIdentityError");
+    __name4(agentIdentityError, "agentIdentityError");
+    __name(readAgentIdentityAudience, "readAgentIdentityAudience");
+    __name4(readAgentIdentityAudience, "readAgentIdentityAudience");
     __name(toEpochMs, "toEpochMs");
     __name4(toEpochMs, "toEpochMs");
     __name(effectiveAgentPause, "effectiveAgentPause");
@@ -9993,6 +10117,8 @@ var init_dist = __esm({
     __name4(removeNavigateBlock, "removeNavigateBlock");
     __name(removeHiddenBlocks, "removeHiddenBlocks");
     __name4(removeHiddenBlocks, "removeHiddenBlocks");
+    __name(stripBlocksKeepingEdges, "stripBlocksKeepingEdges");
+    __name4(stripBlocksKeepingEdges, "stripBlocksKeepingEdges");
     __name(startsWithHiddenBlock, "startsWithHiddenBlock");
     __name4(startsWithHiddenBlock, "startsWithHiddenBlock");
     __name(transformChatHistoryContentParts, "transformChatHistoryContentParts");
@@ -12701,6 +12827,15 @@ listed here; never invent a target.`;
     __name4(composeAgentPaneRuntimeContext, "composeAgentPaneRuntimeContext");
     WEB_APP_ENTRY_HTML_MAX_CHARS = 256 * 1024;
     WEB_APP_MAX_ASSET_BYTES = 8 * 1024 * 1024;
+    WEB_APP_HEALTH_KEY_TTL_SECONDS = 15 * 60;
+    WEB_APP_HEALTH_MIN_FAILURES = 3;
+    WEB_APP_HEALTH_MIN_FAILURE_RATIO = 0.5;
+    __name(webAppHealthMinute, "webAppHealthMinute");
+    __name4(webAppHealthMinute, "webAppHealthMinute");
+    __name(webAppHealthKey, "webAppHealthKey");
+    __name4(webAppHealthKey, "webAppHealthKey");
+    __name(webAppHealthVerdict, "webAppHealthVerdict");
+    __name4(webAppHealthVerdict, "webAppHealthVerdict");
     EVIDENCE_SESSION_IDLE_MS = 30 * 6e4;
     EVIDENCE_MIN_CONVERSATIONS = 20;
     EVIDENCE_LOW_CONFIDENCE_N = 5;
@@ -13012,6 +13147,7 @@ listed here; never invent a target.`;
     __name(parseConnectionSendPolicy, "parseConnectionSendPolicy");
     __name4(parseConnectionSendPolicy, "parseConnectionSendPolicy");
     BILLING_REJECTION_TEXT_CREDITS = "This agent has run out of credits. Please top up to continue chatting.";
+    BILLING_REJECTION_TEXT_OUT_OF_ACTIONS = "This workspace is out of actions. A workspace owner or billing admin can top up or upgrade the plan to continue.";
     BILLING_REJECTION_TEXT_SEAT = "You don't have access to this agent in this workspace. Ask a workspace admin to add you.";
     BILLING_REJECTION_TEXT_USER_QUOTA = "You've reached your monthly usage limit in this workspace. Ask a workspace admin to raise it.";
     __name(isPaymentRequiredChatErrorEnvelope, "isPaymentRequiredChatErrorEnvelope");
@@ -13524,6 +13660,206 @@ listed here; never invent a target.`;
       RESERVED_OWNER_KEY: "shared_data_reserved_owner_key",
       INVALID_NAME: "shared_data_invalid_name"
     };
+    PLAN_KEYS = {
+      agents: {
+        kind: "limit",
+        default: null,
+        label: "Agents"
+      },
+      members: {
+        kind: "limit",
+        default: null,
+        label: "Members"
+      },
+      rooms: {
+        kind: "limit",
+        default: null,
+        label: "Rooms"
+      },
+      externalShares: {
+        kind: "limit",
+        default: null,
+        label: "Shares outside the workspace"
+      },
+      viewsPerAgent: {
+        kind: "limit",
+        default: null,
+        label: "Views per agent"
+      },
+      freeWorkspacesPerPerson: {
+        kind: "limit",
+        default: null,
+        label: "Free workspaces per person"
+      },
+      shareOutsideWorkspace: {
+        kind: "feature",
+        default: true,
+        label: "Share outside the workspace"
+      },
+      roomsEnabled: {
+        kind: "feature",
+        default: true,
+        label: "Rooms with agents"
+      },
+      comments: {
+        kind: "feature",
+        default: true,
+        label: "Comments"
+      },
+      snapshots: {
+        kind: "feature",
+        default: true,
+        label: "Snapshots"
+      },
+      topUps: {
+        kind: "feature",
+        default: true,
+        label: "Top-ups"
+      },
+      deployAgents: {
+        kind: "feature",
+        default: true,
+        label: "Deploy agents to production"
+      }
+    };
+    PLAN_LIMIT_KEYS = Object.keys(PLAN_KEYS).filter((k) => PLAN_KEYS[k].kind === "limit");
+    PLAN_FEATURE_KEYS = Object.keys(PLAN_KEYS).filter((k) => PLAN_KEYS[k].kind === "feature");
+    BILLING_ENGINES = [
+      "actions",
+      "credits"
+    ];
+    BILLING_VERSION_KINDS = [
+      "catalog",
+      "custom"
+    ];
+    planKeyString = z7.string().regex(/^[a-z0-9][a-z0-9-]{0,47}$/, "lowercase letters, digits and dashes");
+    planPriceSchema = z7.object({
+      amountUsd: z7.number().nonnegative(),
+      interval: z7.enum([
+        "month",
+        "year"
+      ]),
+      per: z7.enum([
+        "workspace",
+        "seat"
+      ])
+    }).strict();
+    limitsShape = Object.fromEntries(PLAN_LIMIT_KEYS.map((k) => [
+      k,
+      z7.number().int().nonnegative().nullable().optional()
+    ]));
+    featuresShape = Object.fromEntries(PLAN_FEATURE_KEYS.map((k) => [
+      k,
+      z7.boolean().optional()
+    ]));
+    billingPlanSchema = z7.object({
+      key: planKeyString,
+      name: z7.string().min(1).max(80),
+      /** Absent = a workspace plan. An agent-team plan prices a hired team; it sets no limits or features. */
+      kind: z7.enum([
+        "workspace",
+        "agent-team"
+      ]).optional(),
+      tagline: z7.string().max(200).optional(),
+      visible: z7.boolean(),
+      order: z7.number().int(),
+      price: planPriceSchema.nullable(),
+      stripeProductId: z7.string().optional(),
+      stripePriceId: z7.string().optional(),
+      actionsPerPeriod: z7.number().int().nonnegative(),
+      trialDays: z7.number().int().nonnegative().optional(),
+      limits: z7.object(limitsShape).strict(),
+      features: z7.object(featuresShape).strict(),
+      invoice: z7.object({
+        collectionMode: z7.enum([
+          "card",
+          "invoice"
+        ]),
+        dueDays: z7.number().int().nonnegative(),
+        lines: z7.array(z7.object({
+          description: z7.string().min(1),
+          amountUsd: z7.number().nonnegative()
+        }).strict())
+      }).strict().optional()
+    }).strict();
+    topUpPackSchema = z7.object({
+      key: planKeyString,
+      name: z7.string().min(1).max(80),
+      priceUsd: z7.number().positive(),
+      actions: z7.number().int().positive(),
+      stripeProductId: z7.string().optional(),
+      stripePriceId: z7.string().optional()
+    }).strict();
+    __name(resolvePlanEntitlements, "resolvePlanEntitlements");
+    __name4(resolvePlanEntitlements, "resolvePlanEntitlements");
+    PLAN_REFUSAL_CODES = [
+      "PLAN_LIMIT_REACHED",
+      "PLAN_FEATURE_LOCKED",
+      "OUT_OF_ACTIONS"
+    ];
+    __name(isPlanRefusal, "isPlanRefusal");
+    __name4(isPlanRefusal, "isPlanRefusal");
+    billingSignupConfigSchema = z7.object({
+      enabled: z7.boolean(),
+      defaultVersionKey: z7.string().min(1).nullable(),
+      allowlistEmails: z7.array(z7.string().email().toLowerCase()).max(500),
+      friendsPlan: z7.object({
+        versionKey: z7.string().min(1),
+        planKey: planKeyString
+      }).strict().nullable()
+    }).strict();
+    billingVersionDraftPatchSchema = z7.object({
+      revision: z7.number().int().nonnegative().optional(),
+      name: z7.string().min(1).max(80).optional(),
+      kind: z7.enum(BILLING_VERSION_KINDS).optional(),
+      engine: z7.enum(BILLING_ENGINES).optional(),
+      defaultPlanKey: z7.string().optional(),
+      plans: z7.array(billingPlanSchema).optional(),
+      topUpPacks: z7.array(topUpPackSchema).optional(),
+      forOrgIds: z7.array(z7.string().min(1)).optional(),
+      legacyCheckout: z7.boolean().optional(),
+      voiceAndDelegationAsActions: z7.boolean().optional(),
+      notes: z7.string().max(2e3).optional()
+    }).strict();
+    billingVersionDraftCreateSchema = billingVersionDraftPatchSchema.extend({
+      key: z7.string().min(2),
+      copyFrom: z7.string().optional()
+    }).strict();
+    assignBillingPlanSchema = z7.object({
+      versionKey: z7.string().min(1),
+      planKey: z7.string().optional()
+    }).strict();
+    __name(planKeyList, "planKeyList");
+    __name4(planKeyList, "planKeyList");
+    __name(parseWith, "parseWith");
+    __name4(parseWith, "parseWith");
+    billingActionRatesSchema = z7.object({
+      voiceActionsPerMinute: z7.number().nonnegative()
+    }).strict();
+    BILLING_MOVE_DEFAULT_NOTICE_DAYS = 90;
+    keyString = z8.string().regex(/^[a-z0-9][a-z0-9-]{1,63}$/, "lowercase letters, digits and dashes");
+    billingMoveDraftSchema = z8.object({
+      key: keyString,
+      name: z8.string().min(1).max(120),
+      fromVersionKey: keyString,
+      toVersionKey: keyString,
+      /** Every plan of the source version → a plan of the target version. */
+      planMap: z8.record(z8.string().min(1), z8.string().min(1)),
+      noticeDays: z8.number().int().min(0).max(730).default(BILLING_MOVE_DEFAULT_NOTICE_DAYS),
+      /** Absent ⇒ every org on the source version. */
+      orgIds: z8.array(z8.string().min(1)).max(1e4).optional(),
+      excludeOrgIds: z8.array(z8.string().min(1)).max(1e4).default([]),
+      notes: z8.string().max(2e3).optional(),
+      /** Actions per leftover credit when a credits version moves to an actions version; required then. */
+      creditsToActionsRate: z8.number().positive().max(1e4).optional()
+    }).strict().refine((m) => m.fromVersionKey !== m.toVersionKey, {
+      message: "source and target version must differ"
+    });
+    billingMoveOrgDateSchema = z8.object({
+      effectiveAt: z8.coerce.date()
+    }).strict();
+    __name(parseWith2, "parseWith2");
+    __name4(parseWith2, "parseWith");
   }
 });
 
@@ -14468,7 +14804,7 @@ var init_constants = __esm({
 });
 
 // src/services/firebase-session.ts
-import { z as z7 } from "zod";
+import { z as z9 } from "zod";
 function rejectedRefreshReason(message) {
   const normalised = message.toUpperCase();
   return REJECTED_REFRESH_REASONS.find((reason) => normalised.includes(reason));
@@ -14614,20 +14950,20 @@ var init_firebase_session = __esm({
         this.name = "FirebaseSessionRejectedError";
       }
     };
-    customTokenResponseSchema = z7.object({
-      idToken: z7.string().min(1),
-      refreshToken: z7.string().min(1),
-      expiresIn: z7.coerce.number().positive().finite(),
-      localId: z7.string().min(1).optional()
+    customTokenResponseSchema = z9.object({
+      idToken: z9.string().min(1),
+      refreshToken: z9.string().min(1),
+      expiresIn: z9.coerce.number().positive().finite(),
+      localId: z9.string().min(1).optional()
     });
-    refreshResponseSchema = z7.object({
-      id_token: z7.string().min(1),
-      refresh_token: z7.string().min(1),
-      expires_in: z7.coerce.number().positive().finite(),
-      user_id: z7.string().min(1)
+    refreshResponseSchema = z9.object({
+      id_token: z9.string().min(1),
+      refresh_token: z9.string().min(1),
+      expires_in: z9.coerce.number().positive().finite(),
+      user_id: z9.string().min(1)
     });
-    firebaseIdTokenPayloadSchema = z7.object({
-      sub: z7.string().min(1)
+    firebaseIdTokenPayloadSchema = z9.object({
+      sub: z9.string().min(1)
     });
     __name(requireFirebaseWebApiKey, "requireFirebaseWebApiKey");
     __name(claimsOfFirebaseIdToken, "claimsOfFirebaseIdToken");
@@ -14644,7 +14980,7 @@ var init_firebase_session = __esm({
 import { createHash, randomUUID } from "crypto";
 import { mkdir, open, readFile, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { join as join3 } from "path";
-import { z as z8 } from "zod";
+import { z as z10 } from "zod";
 function environmentKey(environment) {
   return createHash("sha256").update(`${environment.apiUrl}
 ${environment.authUrl}
@@ -14661,15 +14997,15 @@ var init_firebase_session_store = __esm({
   "src/services/firebase-session-store.ts"() {
     "use strict";
     init_constants();
-    storedFirebaseSessionSchema = z8.object({
-      version: z8.literal(1),
-      kind: z8.literal("firebase-session"),
-      generation: z8.string().min(1),
-      refreshToken: z8.string().min(1),
-      firebaseUid: z8.string().min(1),
-      apiUrl: z8.string().url(),
-      authUrl: z8.string().url(),
-      firebaseWebApiKey: z8.string().min(1)
+    storedFirebaseSessionSchema = z10.object({
+      version: z10.literal(1),
+      kind: z10.literal("firebase-session"),
+      generation: z10.string().min(1),
+      refreshToken: z10.string().min(1),
+      firebaseUid: z10.string().min(1),
+      apiUrl: z10.string().url(),
+      authUrl: z10.string().url(),
+      firebaseWebApiKey: z10.string().min(1)
     });
     currentFirebaseSessionEnvironment = /* @__PURE__ */ __name(() => ({
       apiUrl: BASE_URLS.API,
@@ -15892,7 +16228,7 @@ var init_workflow_job_tools = __esm({
 
 // ../workflow-graph/dist/index.mjs
 import { createHash as createHash2 } from "crypto";
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 import { z as z22 } from "zod";
 import { createHash as createHash22 } from "crypto";
 function isMapConfigObject(v) {
@@ -19619,8 +19955,8 @@ var init_dist2 = __esm({
     fromKnowledge = /* @__PURE__ */ __name8((k) => ({
       knowledge: k
     }), "fromKnowledge");
-    SideEffectsSchema = z9.enum(WORKFLOW_SIDE_EFFECTS);
-    JobResourcesSchema = z9.enum(WORKFLOW_JOB_RESOURCES);
+    SideEffectsSchema = z11.enum(WORKFLOW_SIDE_EFFECTS);
+    JobResourcesSchema = z11.enum(WORKFLOW_JOB_RESOURCES);
     WORKFLOW_MODEL_TEMPLATE_ROOT = "initData";
     WORKFLOW_MODEL_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*(?:\|([^}]*))?\}$/;
     PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
@@ -22899,6 +23235,7 @@ var init_skill_handler = __esm({
               toolData.condition = compressedCode;
             }
           }
+          if (tool.label) toolData.label = tool.label;
           const source = loadOriginalSource(tool.sourcePath, projectPath);
           const entryFile = normalizeEntryFile(tool.sourcePath, projectPath);
           if (source && entryFile) {
@@ -28507,6 +28844,20 @@ var offlineMetrics = {
   }
 };
 
+// src/api/identity.offline.ts
+init_dist();
+function createOfflineIdentityApi() {
+  return Object.freeze({
+    assertion: /* @__PURE__ */ __name(async (input) => {
+      if (!readAgentIdentityAudience(input)) {
+        throw agentIdentityError(AGENT_IDENTITY_ERRORS.INPUT_INVALID, "Lua.identity.assertion needs { audience: string }", 400);
+      }
+      throw agentIdentityError(AGENT_IDENTITY_ERRORS.REQUIRES_LIVE_EXECUTION, "Lua.identity.assertion only runs inside a live execution of a deployed agent, not in lua test / lua dev", 403);
+    }, "assertion")
+  });
+}
+__name(createOfflineIdentityApi, "createOfflineIdentityApi");
+
 // src/api-exports.ts
 init_shared_data_offline();
 init_connection_requests_api_service();
@@ -30482,7 +30833,9 @@ var Lua = {
   request: {
     channel: "unknown",
     webhook: void 0
-  }
+  },
+  // ADR 0025 — throws `agent_identity_requires_live_execution` here; deployed agents get the platform-signed one.
+  identity: createOfflineIdentityApi()
 };
 var Secrets = {
   async request(input) {