lua-cli 3.53.0 → 3.55.0

package/dist/api-exports.js

@@ -853,6 +853,10 @@ import { z as z3 } from "zod";
 import { z as z4 } from "zod";
 import { z as z5 } from "zod";
 import { z as z6 } from "zod";
+import { z as z7 } from "zod";
+import { z as z8 } from "zod";
+import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function isChannelConversationChannel(channel) {
   return !!channel && CHANNEL_CONVERSATION_CHANNELS.includes(channel);
 }
@@ -3203,6 +3207,20 @@ function sanitizeProgressUpdateInput(input) {
   if (percent2 !== void 0) out.percent = percent2;
   return out;
 }
+function agentIdentityError(code, message, statusCode) {
+  return Object.assign(new Error(message), {
+    name: "AgentIdentityError",
+    code,
+    ...typeof statusCode === "number" ? {
+      statusCode
+    } : {}
+  });
+}
+function readAgentIdentityAudience(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const audience = input.audience;
+  return typeof audience === "string" && audience.length > 0 && audience.length <= 200 ? audience : null;
+}
 function toEpochMs(value3) {
   if (value3 === null || value3 === void 0) return void 0;
   const ms = value3 instanceof Date ? value3.getTime() : typeof value3 === "number" ? value3 : Date.parse(value3);
@@ -4050,6 +4068,10 @@ function removeHiddenBlocks(input) {
     "hide"
   ]).trim();
 }
+function stripBlocksKeepingEdges(input, names) {
+  const stripped = stripBlocks(input, names);
+  return stripped === input ? input : stripped.trim();
+}
 function startsWithHiddenBlock(input) {
   const [first] = splitBlocks(input);
   return first?.type === "block" && first.name === "hide";
@@ -4139,8 +4161,10 @@ function transformChatHistoryContentParts(parts) {
     }
     if (part?.type !== "text" && part?.type !== "file") continue;
     if (part.type === "text" && typeof part.text === "string") {
-      const rawText = removeHiddenBlocks(part.text || "");
-      if (!rawText) continue;
+      const rawText = stripBlocksKeepingEdges(part.text || "", [
+        "hide"
+      ]);
+      if (!rawText.trim()) continue;
       const audioMatch = rawText.match(/::: audio\s*!\[(.*?)\]\((.*?)\)\s*:::/);
       const videoMatch = rawText.match(/::: video\s*!\[(.*?)\]\((.*?)\)\s*:::/);
       if (audioMatch) {
@@ -4157,7 +4181,9 @@ function transformChatHistoryContentParts(parts) {
         });
       } else {
         let text2 = rawText.replace(/\\\\\\n/g, "\n");
-        text2 = removeNavigateBlock(text2);
+        text2 = stripBlocksKeepingEdges(text2, [
+          "navigate"
+        ]);
         content.push({
           type: "text",
           text: text2
@@ -4232,6 +4258,15 @@ function mergeRichPartMirrorMessages(messages, sameTurnGroup) {
         break;
       }
       if (folded) continue;
+      const content = message.content.filter((part) => part.type !== "data-lua-tool-step" && part.type !== "data-lua-reasoning-time" && part.type !== "data-lua-reply-timing");
+      if (content.length === 0) continue;
+      if (content.length !== message.content.length) {
+        merged.push({
+          ...message,
+          content
+        });
+        continue;
+      }
     }
     merged.push(message);
   }
@@ -4279,6 +4314,57 @@ function foldRichPartsIntoMessages(messages, records, makeMessage, sameTurnGroup
   while (next < synthetic.length) combined.push(synthetic[next++].message);
   return mergeRichPartMirrorMessages(combined, sameTurnGroup);
 }
+function readStoredReplyVersion(metadata) {
+  const md = metadata && typeof metadata === "object" ? metadata : void 0;
+  const value3 = md?.replyVersion;
+  const stamp = value3 && typeof value3.group === "string" && value3.group && typeof value3.index === "number" && Number.isInteger(value3.index) && value3.index >= 1 ? {
+    group: value3.group,
+    index: value3.index
+  } : null;
+  return {
+    stamp,
+    inactive: md?.inactiveVersion === true
+  };
+}
+function applyReplyVersions(messages, markOf, includeVersions) {
+  const blocks = [];
+  const indicesByGroup = /* @__PURE__ */ new Map();
+  let current = null;
+  for (const message of messages) {
+    const mark = markOf(message);
+    if (message.role === "user") {
+      current = mark?.stamp ? {
+        ...mark.stamp,
+        inactive: mark.inactive
+      } : null;
+      if (current) {
+        const seen = indicesByGroup.get(current.group) ?? /* @__PURE__ */ new Set();
+        seen.add(current.index);
+        indicesByGroup.set(current.group, seen);
+      }
+    }
+    blocks.push(current);
+  }
+  const out = [];
+  messages.forEach((message, i) => {
+    const block = blocks[i];
+    if (!block) {
+      out.push(message);
+      return;
+    }
+    if (block.inactive && !includeVersions) return;
+    out.push({
+      ...message,
+      replyVersion: {
+        group: block.group,
+        index: block.index,
+        total: indicesByGroup.get(block.group)?.size ?? 1,
+        active: !block.inactive
+      }
+    });
+  });
+  return out;
+}
 function text(item, field, index, required) {
   const value3 = item[field];
   if (value3 === void 0 && !required) return void 0;
@@ -6721,6 +6807,33 @@ function composeAgentPaneRuntimeContext(input) {
   }
   return lines.join("\n");
 }
+function webAppHealthMinute(atMs) {
+  return Math.floor(atMs / 6e4);
+}
+function webAppHealthKey(webAppId, minute) {
+  return `webapp:health:${webAppId}:${minute}`;
+}
+function webAppHealthVerdict(minutes) {
+  let requests = 0;
+  let failures = 0;
+  let firstFailingMinute;
+  for (const m of minutes) {
+    const r = Math.max(0, m.requests || 0);
+    const f = Math.max(0, Math.min(m.failures || 0, r));
+    requests += r;
+    failures += f;
+    if (f > 0 && (firstFailingMinute === void 0 || m.minute < firstFailingMinute)) firstFailingMinute = m.minute;
+  }
+  if (failures >= WEB_APP_HEALTH_MIN_FAILURES && failures >= requests * WEB_APP_HEALTH_MIN_FAILURE_RATIO) {
+    return {
+      state: "needs_attention",
+      since: new Date(firstFailingMinute * 6e4)
+    };
+  }
+  return {
+    state: "ok"
+  };
+}
 function evidenceDisplayText(text2) {
   const raw = typeof text2 === "string" ? text2 : "";
   if (!raw.trim()) return "";
@@ -7575,7 +7688,8 @@ function isPaymentRequiredChatErrorEnvelope(data) {
   if (!data || typeof data !== "object") return false;
   const d = data;
   if (d.type !== "error") return false;
-  return d.textDelta === BILLING_REJECTION_TEXT_CREDITS || d.textDelta === BILLING_REJECTION_TEXT_SEAT || d.textDelta === BILLING_REJECTION_TEXT_USER_QUOTA;
+  if (d.code === "OUT_OF_ACTIONS") return true;
+  return d.textDelta === BILLING_REJECTION_TEXT_CREDITS || d.textDelta === BILLING_REJECTION_TEXT_OUT_OF_ACTIONS || d.textDelta === BILLING_REJECTION_TEXT_SEAT || d.textDelta === BILLING_REJECTION_TEXT_USER_QUOTA;
 }
 function isCustomMcpConnectionId(id2) {
   return typeof id2 === "string" && id2.startsWith(CUSTOM_MCP_CONNECTION_ID_PREFIX);
@@ -7687,7 +7801,56 @@ function sharedDataOwnerKey(collectionId) {
 function isSharedDataOwnerKey(agentId2) {
   return typeof agentId2 === "string" && agentId2.startsWith(SHARED_DATA_OWNER_PREFIX);
 }
-var __defProp4, __name4, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_FALLBACK_PROVIDERS, OPENROUTER_DIRECT_VENDORS, OPENROUTER_NEEDS_MODEL_MESSAGE, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_SANDBOX_SITE_HEADER, DECISION_SANDBOX_PRIMITIVE_HEADER, DECISION_SANDBOX_TOOL_SEPARATOR, DECISION_LIMITS, DECISION_ERROR_CODES, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, DecisionDefinitionWriteSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, MESSAGING_CHANNELS, VOICE_CHANNELS, TURN_CATEGORIES, AGENT_TOOL_CATEGORIES, count, AnthropicSseUsageReader, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, SCRUB_DEEP_MAX_DEPTH, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, SUPERVISED_SECRET_LIMITS, SUPERVISED_SECRET_NAME_RE, SUPERVISED_SECRET_FIELD_RE, SUPERVISED_SECRET_KEY_FIELD, SUPERVISED_SECRET_ERRORS, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, CHANNEL_SEND_CHANNELS, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, SERVER_TRIGGERED_BROWSER_SOURCES, BROWSER_FALLBACKS, DEFAULT_BROWSER_FALLBACK, PROXY_COUNTRY_CODE, BROWSER_LOG_CONTENT_MODES, DEFAULT_BROWSER_LOG_CONTENT, BROWSER_SCREENSHOT_POLICIES, DEFAULT_BROWSER_SCREENSHOT_POLICY, BROWSER_PROFILE_NAME_PATTERN, BROWSER_LIMIT_KEYS, BROWSER_LIMIT_MAX, BROWSER_EXECUTE_METHOD, BROWSER_GLOBAL_METHODS, BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS, BROWSER_EXECUTE_MAX_TIMEOUT_MS, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, BROWSER_READ_FORMATS, BROWSER_READ_DEFAULT_TIMEOUT_MS, BROWSER_READ_MIN_TIMEOUT_MS, BROWSER_READ_MAX_TIMEOUT_MS, BROWSER_READ_MAX_CONTENT_CHARS, BROWSER_READ_DEFAULT_SELECTOR, BROWSER_READ_MATCH_SEPARATOR, BROWSER_READ_LOGIN_BLOCKER, BROWSER_ERROR_NAME, HTTP_STATUS_FAILURE, LOGIN_PATH_SEGMENTS, LOGIN_HOST_LABELS, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, BROWSER_LOG_EVENT_KINDS, BROWSER_LOG_ENGINES, BROWSER_SESSION_OPEN_REASONS, BROWSER_BLOCK_KINDS, BROWSER_WALL_KINDS, BROWSER_WALL_NEXT_ACTIONS, BROWSER_CONFIRM_DECISIONS, BROWSER_SESSION_CLOSE_REASONS, BROWSER_LOG_CONTEXT_KEYS, BROWSER_LOG_ID_MAX_CHARS, BROWSER_LOG_TEXT_MAX_CHARS, isString, isBoolean, isCount, isPlainObject3, oneOf, isLimits, EVENT_SHAPES, BASE_KEYS, BROWSER_WORKER_SESSION_ID_SEPARATOR, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, WEB_APP_ID_PATTERN, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, label, labels, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingMatchScreenSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_TITLE_MAX_CHARS, WEB_APP_CHAT_TEXT_MAX_CHARS, WEB_APP_CHAT_CONTEXT_MAX_BYTES, WEB_APP_CHAT_PATH_MAX_CHARS, WEB_APP_CHAT_CONTROL_CHARS, WEB_APP_CHAT_APP_NAME_MAX_CHARS, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSET_BYTES, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema, SHARED_DATA_NAME_RE, SHARED_DATA_OWNER_PREFIX, SHARED_DATA_ERRORS;
+function resolvePlanEntitlements(plan) {
+  const limits = {};
+  for (const k of PLAN_LIMIT_KEYS) {
+    const v = plan.limits[k];
+    limits[k] = v === void 0 ? PLAN_KEYS[k].default : v;
+  }
+  const features = {};
+  for (const k of PLAN_FEATURE_KEYS) {
+    const v = plan.features[k];
+    features[k] = v === void 0 ? PLAN_KEYS[k].default : v;
+  }
+  return {
+    limits,
+    features
+  };
+}
+function isPlanRefusal(body) {
+  if (!body || typeof body !== "object") return false;
+  const code = body.code;
+  return typeof code === "string" && PLAN_REFUSAL_CODES.includes(code);
+}
+function planKeyList() {
+  return Object.keys(PLAN_KEYS).map((key) => ({
+    key,
+    kind: PLAN_KEYS[key].kind,
+    label: PLAN_KEYS[key].label,
+    default: PLAN_KEYS[key].default
+  }));
+}
+function parseWith(schema, body) {
+  const r = schema.safeParse(body);
+  return r.success ? {
+    ok: true,
+    data: r.data
+  } : {
+    ok: false,
+    problems: r.error.issues.map((i) => `${i.path.join(".")} ${i.message}`)
+  };
+}
+function parseWith2(schema, body) {
+  const r = schema.safeParse(body);
+  return r.success ? {
+    ok: true,
+    data: r.data
+  } : {
+    ok: false,
+    problems: r.error.issues.map((i) => `${i.path.join(".")} ${i.message}`)
+  };
+}
+var __defProp4, __name4, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHOICE_PERSON_TURN_CHANNELS, CHOICE_REPLAY_CLIENT_CAPABILITIES, CHOICE_REPLAY_CLIENT_SURFACES, DECISION_PROVIDERS, DECISION_FALLBACK_PROVIDERS, OPENROUTER_DIRECT_VENDORS, OPENROUTER_NEEDS_MODEL_MESSAGE, DECISION_QUESTION_TYPES, DECISION_NAME_PATTERN, DECISION_SANDBOX_SITE_HEADER, DECISION_SANDBOX_PRIMITIVE_HEADER, DECISION_SANDBOX_TOOL_SEPARATOR, DECISION_LIMITS, DECISION_ERROR_CODES, MAX_NAME_CHARS, InstructionsSchema, NameSchema, OddsQuestionSchema, ChoiceQuestionSchema, ScoreQuestionSchema, DecisionQuestionSchema, DecisionOptionsSchema, DecisionQuestionsSchema, DecisionDefinitionSchema, DecisionDefinitionWriteSchema, INTEGRATION_PASSTHROUGH_READ_METHODS, INTEGRATION_PASSTHROUGH_MAX_BASE64_RESPONSE_BYTES, URL_REINTERPRETED_PATH_CHARACTERS, PERCENT_ENCODED_DOT, PERCENT_ESCAPE, DECODED_PATH_SEPARATORS, DECODED_LEADING_SEPARATOR, MAX_PERCENT_DECODE_ROUNDS, URL_RESOLUTION_PROBE_BASE, PLATFORM_INVOCATION_CALLERS, MESSAGING_CHANNELS, VOICE_CHANNELS, TURN_CATEGORIES, AGENT_TOOL_CATEGORIES, count, AnthropicSseUsageReader, SUPERVISION_OPS, SUPERVISION_OPS_WAVE2, SUPERVISION_WATCHDOG_OPS, SUPERVISION_WATCHDOG_ERRORS, SUPERVISION_ROLLBACK_REFUSAL_CODES, SUPERVISION_ROLLBACK_LINEAGE_MAX, SUPERVISION_UNTARGETED_OPS, SUPERVISED_WORKFLOW_VERSIONS_MAX, SUPERVISION_EVENT_KINDS, AGENT_PROVISIONING_LIMITS, AGENT_PROVISIONING_APPROVAL_PAYLOAD_KEY, AGENT_PROVISIONING_ERRORS, PROVISIONED_SUPERVISION_ACTIONS, isNonEmptyString, uniqueStrings, sameSet, AGENT_PROVISIONING_APPROVAL_CARD_MAX_CHARS, APPROVAL_PAYLOAD_MEMBERS, AGENT_CONNECTION_POLICIES, AGENT_CONNECTION_POLICY_DEFAULT, AGENT_CONNECTION_MOUNT_MODES, AGENT_CONNECTION_GOVERNANCE_ERRORS, AGENT_CONNECTION_OPERATION_RULES_MAX, AGENT_CONNECTION_OPERATION_PATTERN_MAX_LENGTH, OPERATION_RULE_METHODS, PATH_SEPARATOR, PATH_SINGLE_SEGMENT_WILDCARD, PATH_REST_WILDCARD, METHOD_OVERRIDE_HEADER_NAMES, METHOD_OVERRIDE_QUERY_NAMES, ODATA_BATCH_SEGMENT, GOOGLE_BATCH_FIRST_SEGMENT, CONNECTION_CHECK_RESULTS, CONNECTION_CHECK_CATALOGUE_V1, CONNECTION_CHECK_NAME_PATTERN, CONNECTION_CHECK_NAME_MAX, CONNECT_OUTCOME_STATUSES, SECRET_TEST_RESULTS, SECRET_DATADOG_REGIONS, SECRET_PROVIDER_CATALOGUE_V1, SECRET_TEST_MAX_RESPONSE_BYTES, SECRET_ENV_KEY_PATTERN, SECRET_REQUEST_ERRORS, SECRET_OUTCOME_STATUSES, CLIENT_OUTCOME_TURNS_MAX, SHORT_TEXT_MAX, SLUG_MAX, shortText, optionalShortText, CONNECTION_REQUEST_TERMINAL_STATES, CONNECTION_USE_ORIGINS, AGENT_CONNECTION_OPERATION_LIMITS_BOUNDS, CURRENCY_CODE, LIMITS_KEYS, CAPS_KEYS, EXCLUSIONS_KEYS, EMAIL_IN_TEXT, MAX_EXCLUSION_DEPTH, PROJECTION_PARAMETER_KEYS, CHANNEL_PARAMETER_KEYS, GMAIL_SYSTEM_LABEL_IDS, ZERO_DECIMAL_CURRENCIES, THREE_DECIMAL_CURRENCIES, DECIMAL_AMOUNT, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, SCRUB_DEEP_MAX_DEPTH, TEST_SESSION_ID_PATTERN, TEST_SESSION_COLLECTION_PREFIX, TEST_EFFECT_BODY_MAX_BYTES, TEST_EFFECT_DROPPED_HEADERS, EVAL_CREDITS_PER_1K_TOKENS, EVAL_RESERVED_TOOL_ID_PREFIXES, SUPERVISED_SECRET_LIMITS, SUPERVISED_SECRET_NAME_RE, SUPERVISED_SECRET_FIELD_RE, SUPERVISED_SECRET_KEY_FIELD, SUPERVISED_SECRET_ERRORS, CONNECTION_HANDOVER_APPROVAL_PAYLOAD_KEY, CONNECTION_HANDOVER_APPROVAL_CARD_MAX_CHARS, CONNECTION_HANDOVER_LIMITS, MEMBERS, FORMAT_CHARS, oneLine, boundedString, AGENT_METRIC_NAME_PATTERN, AGENT_METRIC_LIMITS, AGENT_OBJECTIVE_ERRORS, CHANGE_LEASE_TTL_MINUTES_MIN, CHANGE_LEASE_TTL_MINUTES_MAX, CHANGE_LEASE_REASON_MAX, CHANGE_LEASE_ERRORS, AGENT_CONFIG_SET_LIMITS, SECRET_ENV_KEY_SUFFIXES, DEFAULT_OWNER_DEPARTURE_POLICY, AGENT_LIFECYCLE_ERRORS, USER_COST_COUNTER_TTL_SECONDS, USER_COST_ATTRIBUTION_CHANNELS, CALLER_DEDUPE_KEY_MAX, FOLLOW_UP_IDEMPOTENCY_TTL_SECONDS, THREAD_FOLLOW_UP_LIMITS, THREAD_FOLLOW_UP_ERRORS, PROGRESS_UPDATE_LIMITS, AGENT_IDENTITY_ERRORS, PAUSABLE_CAPABILITY_KINDS, UNIFIED_CATCH_UP_MAX_WINDOW_HOURS, UNIFIED_CATCH_UP_EVENTS, UNIFIED_CATCH_UP_FILTERABLE_OBJECT_TYPES, AGENT_NEVER_RULES_MAX, AGENT_NEVER_RULE_FIELD_MAX, AGENT_NEVER_RULE_INPUT_MATCH_MAX, NEVER_RULE_ID_PATTERN, NEVER_RULE_HTTP_METHODS, TEMPLATE_DISTRIBUTION_MODES, CHANNEL_SEND_CHANNELS, TAKEOVER_MAX_IDLE_MINUTES, MINUTES_PER_DAY, DEFAULT_IDLE_RELEASE_MINUTES, FALLBACK_IDLE_RELEASE_MINUTES, VARIATION_SELECTORS, SLACK_EMOJI_NAMES, SLACK_SHORTCODE, PLAIN_EMAIL_ADDRESS, DOMAIN, UNSAFE_TEXT, SLACK_CONVERSATION_ID, CHANNEL_SETTING_GROUPS, THREAD_SCOPING_NOUN, TAKEOVER_CHANNEL_TYPES, EMAIL_SETTINGS, SLACK_SETTING_DEFAULTS, SLACK_REACTION_MAX, SLACK_INTRO_MAX, SLACK_EXAMPLE_PROMPTS_MAX, SLACK_EXAMPLE_PROMPT_MAX, SLACK_SUPPORT_CONTACT_MAX, SLACK_SETTINGS, CHANNEL_SETTINGS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, WORK_ITEMS_KEY, MAX_WORK_ITEMS, LIMITS, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, SERVER_TRIGGERED_BROWSER_SOURCES, BROWSER_FALLBACKS, DEFAULT_BROWSER_FALLBACK, PROXY_COUNTRY_CODE, BROWSER_LOG_CONTENT_MODES, DEFAULT_BROWSER_LOG_CONTENT, BROWSER_SCREENSHOT_POLICIES, DEFAULT_BROWSER_SCREENSHOT_POLICY, BROWSER_PROFILE_NAME_PATTERN, BROWSER_LIMIT_KEYS, BROWSER_LIMIT_MAX, BROWSER_EXECUTE_METHOD, BROWSER_GLOBAL_METHODS, BROWSER_EXECUTE_DEFAULT_TIMEOUT_MS, BROWSER_EXECUTE_MAX_TIMEOUT_MS, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, BROWSER_READ_FORMATS, BROWSER_READ_DEFAULT_TIMEOUT_MS, BROWSER_READ_MIN_TIMEOUT_MS, BROWSER_READ_MAX_TIMEOUT_MS, BROWSER_READ_MAX_CONTENT_CHARS, BROWSER_READ_DEFAULT_SELECTOR, BROWSER_READ_MATCH_SEPARATOR, BROWSER_READ_LOGIN_BLOCKER, BROWSER_ERROR_NAME, HTTP_STATUS_FAILURE, LOGIN_PATH_SEGMENTS, LOGIN_HOST_LABELS, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, BROWSER_LOG_EVENT_KINDS, BROWSER_LOG_ENGINES, BROWSER_SESSION_OPEN_REASONS, BROWSER_BLOCK_KINDS, BROWSER_WALL_KINDS, BROWSER_WALL_NEXT_ACTIONS, BROWSER_CONFIRM_DECISIONS, BROWSER_SESSION_CLOSE_REASONS, BROWSER_LOG_CONTEXT_KEYS, BROWSER_LOG_ID_MAX_CHARS, BROWSER_LOG_TEXT_MAX_CHARS, isString, isBoolean, isCount, isPlainObject3, oneOf, isLimits, EVENT_SHAPES, BASE_KEYS, BROWSER_WORKER_SESSION_ID_SEPARATOR, BROWSER_WORKER_BLOCK_REASON_MAX_CHARS, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, WEB_APP_ID_PATTERN, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_AGENT_APP_CONNECTION_PREFIX, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_SIGNAL_NAME_RE, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, APPROVAL_ARGS_MAX_CHARS, APPROVAL_ARG_STRING_MAX_CHARS, APPROVAL_ARGS_SUMMARY_MAX_CHARS, MAX_DEPTH, MAX_KEYS, MAX_ITEMS, MAX_NODES, MAX_KEY_CHARS, KEY_SCRUB_INPUT_MAX_CHARS, STRING_SCRUB_INPUT_MAX_CHARS, ELLIPSIS, SKIP, SCRUB_SECRETS_BEFORE_PERSIST_ENV, PERSIST_SCRUB_MAX_CHARS, PERSIST_SCRUB_REF_MAX_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, label, labels, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingMatchScreenSchema, onboardingTemplateSectionSchema, onboardingInstallScreenSchema, onboardingResultScreenSchema, onboardingConnectScreenSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, WEB_APP_NAME_PATTERN, WEB_APP_TITLE_MAX_CHARS, WEB_APP_CHAT_TEXT_MAX_CHARS, WEB_APP_CHAT_CONTEXT_MAX_BYTES, WEB_APP_CHAT_PATH_MAX_CHARS, WEB_APP_CHAT_CONTROL_CHARS, WEB_APP_CHAT_APP_NAME_MAX_CHARS, WEB_APP_ENTRY_HTML_MAX_CHARS, WEB_APP_MAX_ASSETS, WEB_APP_MAX_ASSET_BYTES, WEB_APP_HEALTH_KEY_TTL_SECONDS, WEB_APP_HEALTH_MIN_FAILURES, WEB_APP_HEALTH_MIN_FAILURE_RATIO, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER, ENV_TEMPLATE_SECRET_KEY_RE, CONNECTION_SEND_NOT_ALLOWED, CONNECTION_RECIPIENT_NOT_ALLOWED, NOT_SEND, PLAIN_ADDRESS, RecipientSet, MCP_MESSAGING_CREATE, MCP_CALENDAR_EVENT_WRITE, REPLY_KEYS, DEDICATED_MAIL_SLUGS, FULL_SUITE_SLUGS, WELL_KNOWN_MAIL_FOLDERS, MEMBER_KEYS, CANONICAL_ORIGIN, CANONICAL_PREFIX, STRICT_BASE64, GMAIL_PREFIX, GMAIL_MESSAGES_SEND, GMAIL_DRAFTS_SEND, GOOGLE_BATCH, GRAPH_VERSION, GRAPH_PRINCIPAL, GRAPH_SEND_MAIL, GRAPH_MESSAGE_ACTION, GRAPH_OWNER, GRAPH_EVENTS, GRAPH_EVENT_COLLECTION, GRAPH_EVENT_ID, GRAPH_EVENT_ITEM, GRAPH_EVENT_ACTION, GRAPH_BATCH, GRAPH_TEAMS_MESSAGE, GRAPH_ACTIVITY_NOTIFICATION, GRAPH_GROUP_CONVERSATION, GCAL_EVENTS, GRAPH_READ_KEYS, MALFORMED_POLICY, BILLING_REJECTION_TEXT_CREDITS, BILLING_REJECTION_TEXT_OUT_OF_ACTIONS, BILLING_REJECTION_TEXT_SEAT, BILLING_REJECTION_TEXT_USER_QUOTA, CUSTOM_MCP_CONNECTION_ID_PREFIX, CUSTOM_MCP_SOURCE, CUSTOM_MCP_TRANSPORT, CUSTOM_MCP_CONNECTION_ID_PATTERN, customMcpConnectionIdSchema, CONNECTION_BACKED_MCP_SOURCES, CUSTOM_MCP_REFERENCE_ID_PATTERN, customMcpReferenceIdSchema, CUSTOM_MCP_AUTH_KINDS, customMcpAuthKindSchema, CUSTOM_MCP_OAUTH_REGISTRATIONS, customMcpOAuthRegistrationSchema, CUSTOM_MCP_HEALTH_STATES, customMcpHealthStateSchema, CUSTOM_MCP_FAILURE_STEPS, customMcpFailureStepSchema, CUSTOM_MCP_CONNECT_STEPS, customMcpConnectStepSchema, customMcpFailureCodeSchema, WORKFLOW_KEY_MAX_LENGTH, CUSTOM_MCP_URL_MAX_LENGTH, CUSTOM_MCP_DISPLAY_NAME_MAX_LENGTH, CUSTOM_MCP_MAX_HEADERS, CUSTOM_MCP_HEADER_NAME_MAX_LENGTH, CUSTOM_MCP_HEADER_VALUE_MAX_LENGTH, CUSTOM_MCP_MAX_TOOLS, CUSTOM_MCP_TOOL_NAME_MAX_LENGTH, CUSTOM_MCP_TOOL_TEXT_MAX_LENGTH, CUSTOM_MCP_MIN_TIMEOUT_MS, CUSTOM_MCP_MAX_TIMEOUT_MS, CUSTOM_MCP_OAUTH_PENDING_TTL_MS, isoDateTime, agentId, nonNegativeInt, customMcpUrlInputSchema, customMcpDisplayNameSchema, customMcpTimeoutSchema, CUSTOM_MCP_RESERVED_HEADER_NAMES, HEADER_NAME, HEADER_VALUE_FORBIDDEN, customMcpHeaderNameSchema, headerValue, customMcpHeadersSchema, customMcpHeadersPatchSchema, customMcpToolNameSchema, customMcpToolSchema, customMcpServerInfoSchema, customMcpToolSelectionSchema, customMcpToolsResponseSchema, customMcpFailureSchema, customMcpHealthSchema, customMcpErrorBodySchema, customMcpConnectionBlockSchema, customMcpConnectionViewSchema, customMcpConnectionResponseSchema, customMcpProbeBodySchema, customMcpOAuthDiscoverySchema, customMcpProbeResponseSchema, createFields, mountAgentField, customMcpCreateAgentBodySchema, customMcpCreateUserBodySchema, customMcpOAuthClientSchema, startFields, customMcpOAuthStartAgentBodySchema, customMcpOAuthStartUserBodySchema, customMcpOAuthStartResponseSchema, nonce, customMcpOAuthSuccessRedirectQuerySchema, CUSTOM_MCP_OAUTH_CALLBACK_ERRORS, customMcpOAuthFailureRedirectQuerySchema, customMcpOAuthFinalizeBodySchema, customMcpCimdDocumentSchema, customMcpPatchBodySchema, customMcpCredentialRequestSchema, customMcpCredentialAuthSchema, customMcpCredentialResponseSchema, CUSTOM_MCP_CREDENTIAL_ERRORS, customMcpCredentialErrorBodySchema, customMcpHealthReportSchema, customMcpProbeRequestSchema, customMcpProbeResultSchema, customMcpOriginUrlSchema, customMcpServerProjectionSchema, customMcpMountUpsertBodySchema, opaque, summaryHash, defaultWebAppBriefRequestSchema, DEFAULT_WEB_APP_BRIEF_SOURCES, defaultWebAppBriefUsageSchema, briefResponseBase, defaultWebAppBriefResponseSchema, defaultWebAppBriefKeyRequestSchema, defaultWebAppBriefKeyResponseSchema, DEFAULT_WEB_APP_BRIEF_ERROR_CODES, defaultWebAppBriefErrorSchema, SHARED_DATA_NAME_RE, SHARED_DATA_OWNER_PREFIX, SHARED_DATA_ERRORS, PLAN_KEYS, PLAN_LIMIT_KEYS, PLAN_FEATURE_KEYS, BILLING_ENGINES, BILLING_VERSION_KINDS, planKeyString, planPriceSchema, limitsShape, featuresShape, billingPlanSchema, topUpPackSchema, PLAN_REFUSAL_CODES, billingSignupConfigSchema, billingVersionDraftPatchSchema, billingVersionDraftCreateSchema, EXISTING_SUBSCRIPTION_POLICIES, billingVersionEditSchema, assignBillingPlanSchema, billingActionRatesSchema, BILLING_MOVE_DEFAULT_NOTICE_DAYS, BILLING_MOVE_NOTICE_KINDS, BILLING_MOVE_WHEN, keyString, emailTextSchema, billingMoveDraftSchema, billingMovePatchSchema, billingMoveOrgDateSchema, billingMoveEmailPreviewSchema, DWA_BUILD_MAX_BUNDLE_BYTES, sha256Hex, defaultWebAppBundleAssetSchema, defaultWebAppBundleToolSchema, defaultWebAppBundleSchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -7908,6 +8071,7 @@ var init_dist = __esm({
       "GET",
       "HEAD"
     ];
+    INTEGRATION_PASSTHROUGH_MAX_BASE64_RESPONSE_BYTES = 25 * 1024 * 1024;
     __name(isIntegrationPassthroughReadMethod, "isIntegrationPassthroughReadMethod");
     __name4(isIntegrationPassthroughReadMethod, "isIntegrationPassthroughReadMethod");
     __name(connectionPermissionsAllowWrite, "connectionPermissionsAllowWrite");
@@ -9456,6 +9620,20 @@ var init_dist = __esm({
     __name4(capText, "capText");
     __name(sanitizeProgressUpdateInput, "sanitizeProgressUpdateInput");
     __name4(sanitizeProgressUpdateInput, "sanitizeProgressUpdateInput");
+    AGENT_IDENTITY_ERRORS = {
+      /** `input` is not `{ audience: string }`. */
+      INPUT_INVALID: "agent_identity_input_invalid",
+      /** The audience is not on the platform allowlist. */
+      AUDIENCE_NOT_ALLOWED: "agent_identity_audience_not_allowed",
+      /** No live execution of an agent backs this call (offline `lua test` / `lua dev`, a finished execution). */
+      REQUIRES_LIVE_EXECUTION: "agent_identity_requires_live_execution",
+      /** The platform could not mint one right now (signing not configured, lua-auth unreachable, agent has no org). */
+      UNAVAILABLE: "agent_identity_unavailable"
+    };
+    __name(agentIdentityError, "agentIdentityError");
+    __name4(agentIdentityError, "agentIdentityError");
+    __name(readAgentIdentityAudience, "readAgentIdentityAudience");
+    __name4(readAgentIdentityAudience, "readAgentIdentityAudience");
     __name(toEpochMs, "toEpochMs");
     __name4(toEpochMs, "toEpochMs");
     __name(effectiveAgentPause, "effectiveAgentPause");
@@ -9993,6 +10171,8 @@ var init_dist = __esm({
     __name4(removeNavigateBlock, "removeNavigateBlock");
     __name(removeHiddenBlocks, "removeHiddenBlocks");
     __name4(removeHiddenBlocks, "removeHiddenBlocks");
+    __name(stripBlocksKeepingEdges, "stripBlocksKeepingEdges");
+    __name4(stripBlocksKeepingEdges, "stripBlocksKeepingEdges");
     __name(startsWithHiddenBlock, "startsWithHiddenBlock");
     __name4(startsWithHiddenBlock, "startsWithHiddenBlock");
     __name(transformChatHistoryContentParts, "transformChatHistoryContentParts");
@@ -10007,6 +10187,10 @@ var init_dist = __esm({
     __name4(citationDedupeKeys, "citationDedupeKeys");
     __name(foldRichPartsIntoMessages, "foldRichPartsIntoMessages");
     __name4(foldRichPartsIntoMessages, "foldRichPartsIntoMessages");
+    __name(readStoredReplyVersion, "readStoredReplyVersion");
+    __name4(readStoredReplyVersion, "readStoredReplyVersion");
+    __name(applyReplyVersions, "applyReplyVersions");
+    __name4(applyReplyVersions, "applyReplyVersions");
     WORK_ITEMS_KEY = "_luaWorkItems";
     MAX_WORK_ITEMS = 100;
     LIMITS = {
@@ -12700,7 +12884,17 @@ listed here; never invent a target.`;
     __name(composeAgentPaneRuntimeContext, "composeAgentPaneRuntimeContext");
     __name4(composeAgentPaneRuntimeContext, "composeAgentPaneRuntimeContext");
     WEB_APP_ENTRY_HTML_MAX_CHARS = 256 * 1024;
+    WEB_APP_MAX_ASSETS = 1e3;
     WEB_APP_MAX_ASSET_BYTES = 8 * 1024 * 1024;
+    WEB_APP_HEALTH_KEY_TTL_SECONDS = 15 * 60;
+    WEB_APP_HEALTH_MIN_FAILURES = 3;
+    WEB_APP_HEALTH_MIN_FAILURE_RATIO = 0.5;
+    __name(webAppHealthMinute, "webAppHealthMinute");
+    __name4(webAppHealthMinute, "webAppHealthMinute");
+    __name(webAppHealthKey, "webAppHealthKey");
+    __name4(webAppHealthKey, "webAppHealthKey");
+    __name(webAppHealthVerdict, "webAppHealthVerdict");
+    __name4(webAppHealthVerdict, "webAppHealthVerdict");
     EVIDENCE_SESSION_IDLE_MS = 30 * 6e4;
     EVIDENCE_MIN_CONVERSATIONS = 20;
     EVIDENCE_LOW_CONFIDENCE_N = 5;
@@ -13012,6 +13206,7 @@ listed here; never invent a target.`;
     __name(parseConnectionSendPolicy, "parseConnectionSendPolicy");
     __name4(parseConnectionSendPolicy, "parseConnectionSendPolicy");
     BILLING_REJECTION_TEXT_CREDITS = "This agent has run out of credits. Please top up to continue chatting.";
+    BILLING_REJECTION_TEXT_OUT_OF_ACTIONS = "This workspace is out of actions. A workspace owner or billing admin can top up or upgrade the plan to continue.";
     BILLING_REJECTION_TEXT_SEAT = "You don't have access to this agent in this workspace. Ask a workspace admin to add you.";
     BILLING_REJECTION_TEXT_USER_QUOTA = "You've reached your monthly usage limit in this workspace. Ask a workspace admin to raise it.";
     __name(isPaymentRequiredChatErrorEnvelope, "isPaymentRequiredChatErrorEnvelope");
@@ -13505,6 +13700,74 @@ listed here; never invent a target.`;
       }).strict().optional(),
       timeout: customMcpTimeoutSchema.optional()
     }).strict();
+    opaque = z7.record(z7.unknown());
+    summaryHash = z7.string().regex(/^[0-9a-f]{64}$/);
+    defaultWebAppBriefRequestSchema = z7.object({
+      agentId: z7.string().min(1).max(200),
+      orgId: z7.string().min(1).max(200).optional(),
+      /** A rebuild: the brief the app was built from. The new brief keeps its entity, fields and statuses. */
+      previous: z7.object({
+        brief: opaque
+      }).optional(),
+      /**
+      * Another agent's brief (same template id + version) and the `summaryHash` it was made from. Used without a model
+      * call only when the hash equals this agent's, its schema version is current and it is valid here; else ignored.
+      */
+      reuse: z7.object({
+        brief: opaque,
+        summaryHash
+      }).optional()
+    });
+    DEFAULT_WEB_APP_BRIEF_SOURCES = [
+      "model",
+      "fallback",
+      "reused",
+      "previous"
+    ];
+    defaultWebAppBriefUsageSchema = z7.object({
+      inputTokens: z7.number().nonnegative(),
+      outputTokens: z7.number().nonnegative(),
+      cacheReadTokens: z7.number().nonnegative(),
+      cacheWriteTokens: z7.number().nonnegative()
+    });
+    briefResponseBase = z7.object({
+      source: z7.enum(DEFAULT_WEB_APP_BRIEF_SOURCES),
+      brief: opaque,
+      names: opaque,
+      capabilitySignature: z7.string().min(1),
+      model: z7.string().optional(),
+      usage: defaultWebAppBriefUsageSchema,
+      costUsd: z7.number().nonnegative()
+    });
+    defaultWebAppBriefResponseSchema = z7.discriminatedUnion("reusable", [
+      briefResponseBase.extend({
+        reusable: z7.literal(true),
+        summaryHash
+      }),
+      briefResponseBase.extend({
+        reusable: z7.literal(false)
+      })
+    ]);
+    defaultWebAppBriefKeyRequestSchema = z7.object({
+      agentId: z7.string().min(1).max(200)
+    });
+    defaultWebAppBriefKeyResponseSchema = z7.object({
+      summaryHash,
+      schemaVersion: z7.number().int().positive()
+    });
+    DEFAULT_WEB_APP_BRIEF_ERROR_CODES = [
+      "AGENT_NOT_FOUND",
+      "BRIEF_INVALID",
+      "BRIEF_UNAVAILABLE"
+    ];
+    defaultWebAppBriefErrorSchema = z7.object({
+      code: z7.enum(DEFAULT_WEB_APP_BRIEF_ERROR_CODES),
+      message: z7.string().optional(),
+      problems: z7.array(z7.string()).optional(),
+      model: z7.string().optional(),
+      usage: defaultWebAppBriefUsageSchema.optional(),
+      costUsd: z7.number().nonnegative().optional()
+    });
     __name(maskMcpServerHeaders, "maskMcpServerHeaders");
     __name4(maskMcpServerHeaders, "maskMcpServerHeaders");
     SHARED_DATA_NAME_RE = /^[A-Za-z0-9_.-]{1,128}$/;
@@ -13524,6 +13787,330 @@ listed here; never invent a target.`;
       RESERVED_OWNER_KEY: "shared_data_reserved_owner_key",
       INVALID_NAME: "shared_data_invalid_name"
     };
+    PLAN_KEYS = {
+      agents: {
+        kind: "limit",
+        default: null,
+        label: "Agents"
+      },
+      members: {
+        kind: "limit",
+        default: null,
+        label: "Members"
+      },
+      rooms: {
+        kind: "limit",
+        default: null,
+        label: "Rooms"
+      },
+      externalShares: {
+        kind: "limit",
+        default: null,
+        label: "Shares outside the workspace"
+      },
+      viewsPerAgent: {
+        kind: "limit",
+        default: null,
+        label: "Views per agent"
+      },
+      freeWorkspacesPerPerson: {
+        kind: "limit",
+        default: null,
+        label: "Free workspaces per person"
+      },
+      shareOutsideWorkspace: {
+        kind: "feature",
+        default: true,
+        label: "Share outside the workspace"
+      },
+      roomsEnabled: {
+        kind: "feature",
+        default: true,
+        label: "Rooms with agents"
+      },
+      comments: {
+        kind: "feature",
+        default: true,
+        label: "Comments"
+      },
+      snapshots: {
+        kind: "feature",
+        default: true,
+        label: "Snapshots"
+      },
+      topUps: {
+        kind: "feature",
+        default: true,
+        label: "Top-ups"
+      },
+      deployAgents: {
+        kind: "feature",
+        default: true,
+        label: "Deploy agents to production"
+      }
+    };
+    PLAN_LIMIT_KEYS = Object.keys(PLAN_KEYS).filter((k) => PLAN_KEYS[k].kind === "limit");
+    PLAN_FEATURE_KEYS = Object.keys(PLAN_KEYS).filter((k) => PLAN_KEYS[k].kind === "feature");
+    BILLING_ENGINES = [
+      "actions",
+      "credits"
+    ];
+    BILLING_VERSION_KINDS = [
+      "catalog",
+      "custom"
+    ];
+    planKeyString = z8.string().regex(/^[a-z0-9][a-z0-9-]{0,47}$/, "lowercase letters, digits and dashes");
+    planPriceSchema = z8.object({
+      amountUsd: z8.number().nonnegative(),
+      interval: z8.enum([
+        "month",
+        "year"
+      ]),
+      per: z8.enum([
+        "workspace",
+        "seat"
+      ])
+    }).strict();
+    limitsShape = Object.fromEntries(PLAN_LIMIT_KEYS.map((k) => [
+      k,
+      z8.number().int().nonnegative().nullable().optional()
+    ]));
+    featuresShape = Object.fromEntries(PLAN_FEATURE_KEYS.map((k) => [
+      k,
+      z8.boolean().optional()
+    ]));
+    billingPlanSchema = z8.object({
+      key: planKeyString,
+      name: z8.string().min(1).max(80),
+      /** Absent = a workspace plan. An agent-team plan prices a hired team; it sets no limits or features. */
+      kind: z8.enum([
+        "workspace",
+        "agent-team"
+      ]).optional(),
+      tagline: z8.string().max(200).optional(),
+      visible: z8.boolean(),
+      order: z8.number().int(),
+      price: planPriceSchema.nullable(),
+      stripeProductId: z8.string().optional(),
+      stripePriceId: z8.string().optional(),
+      actionsPerPeriod: z8.number().int().nonnegative(),
+      trialDays: z8.number().int().nonnegative().optional(),
+      limits: z8.object(limitsShape).strict(),
+      features: z8.object(featuresShape).strict(),
+      invoice: z8.object({
+        collectionMode: z8.enum([
+          "card",
+          "invoice"
+        ]),
+        dueDays: z8.number().int().nonnegative(),
+        lines: z8.array(z8.object({
+          description: z8.string().min(1),
+          amountUsd: z8.number().nonnegative()
+        }).strict())
+      }).strict().optional()
+    }).strict();
+    topUpPackSchema = z8.object({
+      key: planKeyString,
+      name: z8.string().min(1).max(80),
+      priceUsd: z8.number().positive(),
+      actions: z8.number().int().positive(),
+      stripeProductId: z8.string().optional(),
+      stripePriceId: z8.string().optional()
+    }).strict();
+    __name(resolvePlanEntitlements, "resolvePlanEntitlements");
+    __name4(resolvePlanEntitlements, "resolvePlanEntitlements");
+    PLAN_REFUSAL_CODES = [
+      "PLAN_LIMIT_REACHED",
+      "PLAN_FEATURE_LOCKED",
+      "OUT_OF_ACTIONS"
+    ];
+    __name(isPlanRefusal, "isPlanRefusal");
+    __name4(isPlanRefusal, "isPlanRefusal");
+    billingSignupConfigSchema = z8.object({
+      enabled: z8.boolean(),
+      defaultVersionKey: z8.string().min(1).nullable(),
+      allowlistEmails: z8.array(z8.string().email().toLowerCase()).max(500),
+      friendsPlan: z8.object({
+        versionKey: z8.string().min(1),
+        planKey: planKeyString
+      }).strict().nullable()
+    }).strict();
+    billingVersionDraftPatchSchema = z8.object({
+      revision: z8.number().int().nonnegative().optional(),
+      name: z8.string().min(1).max(80).optional(),
+      kind: z8.enum(BILLING_VERSION_KINDS).optional(),
+      engine: z8.enum(BILLING_ENGINES).optional(),
+      defaultPlanKey: z8.string().optional(),
+      plans: z8.array(billingPlanSchema).optional(),
+      topUpPacks: z8.array(topUpPackSchema).optional(),
+      forOrgIds: z8.array(z8.string().min(1)).optional(),
+      legacyCheckout: z8.boolean().optional(),
+      voiceAndDelegationAsActions: z8.boolean().optional(),
+      notes: z8.string().max(2e3).optional()
+    }).strict();
+    billingVersionDraftCreateSchema = billingVersionDraftPatchSchema.extend({
+      key: z8.string().min(2),
+      copyFrom: z8.string().optional()
+    }).strict();
+    EXISTING_SUBSCRIPTION_POLICIES = [
+      "keep",
+      "next-renewal"
+    ];
+    billingVersionEditSchema = billingVersionDraftPatchSchema.extend({
+      existingSubscriptions: z8.enum(EXISTING_SUBSCRIPTION_POLICIES).optional()
+    }).strict();
+    assignBillingPlanSchema = z8.object({
+      versionKey: z8.string().min(1),
+      planKey: z8.string().optional()
+    }).strict();
+    __name(planKeyList, "planKeyList");
+    __name4(planKeyList, "planKeyList");
+    __name(parseWith, "parseWith");
+    __name4(parseWith, "parseWith");
+    billingActionRatesSchema = z8.object({
+      voiceActionsPerMinute: z8.number().nonnegative()
+    }).strict();
+    BILLING_MOVE_DEFAULT_NOTICE_DAYS = 90;
+    BILLING_MOVE_NOTICE_KINDS = [
+      "scheduled",
+      "reminder",
+      "done"
+    ];
+    BILLING_MOVE_WHEN = [
+      "notice",
+      "now"
+    ];
+    keyString = z9.string().regex(/^[a-z0-9][a-z0-9-]{1,63}$/, "lowercase letters, digits and dashes");
+    emailTextSchema = z9.object({
+      subject: z9.string().trim().min(1).max(200).optional(),
+      title: z9.string().trim().min(1).max(200).optional(),
+      body: z9.string().trim().min(1).max(2e3).optional()
+    }).strict();
+    billingMoveDraftSchema = z9.object({
+      key: keyString,
+      name: z9.string().min(1).max(120),
+      fromVersionKey: keyString,
+      toVersionKey: keyString,
+      /** Every plan of the source version → a plan of the target version. */
+      planMap: z9.record(z9.string().min(1), z9.string().min(1)),
+      noticeDays: z9.number().int().min(0).max(730).default(BILLING_MOVE_DEFAULT_NOTICE_DAYS),
+      /** Absent ⇒ every org on the source version. */
+      orgIds: z9.array(z9.string().min(1)).max(1e4).optional(),
+      excludeOrgIds: z9.array(z9.string().min(1)).max(1e4).default([]),
+      notes: z9.string().max(2e3).optional(),
+      /** Actions per leftover credit when a credits version moves to an actions version; required then. */
+      creditsToActionsRate: z9.number().positive().max(1e4).optional(),
+      when: z9.enum(BILLING_MOVE_WHEN).default("notice"),
+      /** Which owner emails this move sends; all off sends nothing. */
+      emails: z9.object({
+        scheduled: z9.boolean(),
+        reminder: z9.boolean(),
+        done: z9.boolean()
+      }).strict().default({
+        scheduled: true,
+        reminder: true,
+        done: true
+      }),
+      /** Staff wording per email, replacing ours; the list of what changes is always added. */
+      emailText: z9.object({
+        scheduled: emailTextSchema.optional(),
+        reminder: emailTextSchema.optional(),
+        done: emailTextSchema.optional()
+      }).strict().optional()
+    }).strict().refine((m) => m.fromVersionKey !== m.toVersionKey, {
+      message: "source and target version must differ"
+    });
+    billingMovePatchSchema = z9.object({
+      name: z9.string().min(1).max(120).optional(),
+      noticeDays: z9.number().int().min(0).max(730).optional(),
+      when: z9.enum(BILLING_MOVE_WHEN).optional(),
+      emails: z9.object({
+        scheduled: z9.boolean(),
+        reminder: z9.boolean(),
+        done: z9.boolean()
+      }).strict().optional(),
+      emailText: z9.object({
+        scheduled: emailTextSchema.optional(),
+        reminder: emailTextSchema.optional(),
+        done: emailTextSchema.optional()
+      }).strict().optional(),
+      notes: z9.string().max(2e3).optional()
+    }).strict();
+    billingMoveOrgDateSchema = z9.object({
+      effectiveAt: z9.coerce.date()
+    }).strict();
+    billingMoveEmailPreviewSchema = z9.object({
+      orgId: z9.string().min(1).optional(),
+      kind: z9.enum(BILLING_MOVE_NOTICE_KINDS),
+      /** Unsaved wording to try, so the dialog shows the email before the move is created. */
+      subject: z9.string().max(200).optional(),
+      title: z9.string().max(200).optional(),
+      body: z9.string().max(2e3).optional()
+    }).strict();
+    __name(parseWith2, "parseWith2");
+    __name4(parseWith2, "parseWith");
+    DWA_BUILD_MAX_BUNDLE_BYTES = 12 * 1024 * 1024;
+    sha256Hex = z10.string().regex(/^[a-f0-9]{64}$/);
+    defaultWebAppBundleAssetSchema = z10.object({
+      path: z10.string().min(1).max(512),
+      hash: sha256Hex,
+      size: z10.number().int().nonnegative().max(WEB_APP_MAX_ASSET_BYTES),
+      contentType: z10.string().min(1).max(200),
+      base64: z10.string()
+    });
+    defaultWebAppBundleToolSchema = z10.object({
+      name: z10.string().min(1).max(64),
+      description: z10.string().max(2e3),
+      inputSchema: z10.unknown().optional(),
+      outputSchema: z10.unknown().optional(),
+      /** gzip + base64, as `lua push skill` sends a tool. */
+      code: z10.string().min(1)
+    });
+    defaultWebAppBundleSchema = z10.object({
+      format: z10.literal(1),
+      templateVersion: z10.string().regex(/^\d+\.\d+\.\d+$/),
+      webApp: z10.object({
+        name: z10.string().regex(/^[a-z][a-z0-9-]{1,39}$/),
+        title: z10.string().max(200).optional(),
+        description: z10.string().max(1e3).optional(),
+        routes: z10.array(z10.object({
+          key: z10.string(),
+          method: z10.string(),
+          path: z10.string(),
+          description: z10.string().optional()
+        }).passthrough()).min(1),
+        hasFetch: z10.boolean(),
+        nav: z10.array(z10.object({
+          path: z10.string(),
+          label: z10.string(),
+          icon: z10.string().optional()
+        }).passthrough()),
+        csp: z10.record(z10.array(z10.string())).optional(),
+        branding: z10.record(z10.unknown()).optional(),
+        bundlesAgentPane: z10.boolean(),
+        uiVersion: z10.string().max(64).optional(),
+        entryHtml: z10.string().min(1).max(WEB_APP_ENTRY_HTML_MAX_CHARS),
+        /** The route bundle, uncompressed. */
+        code: z10.string().min(1),
+        codeSha256: sha256Hex,
+        assets: z10.array(defaultWebAppBundleAssetSchema).max(WEB_APP_MAX_ASSETS),
+        compiler: z10.object({
+          vite: z10.string().optional()
+        })
+      }),
+      skill: z10.object({
+        name: z10.string().regex(/^dwa-[a-z0-9-]+$/),
+        title: z10.string().max(200).optional(),
+        description: z10.string().min(1).max(2e3),
+        context: z10.unknown(),
+        tools: z10.array(defaultWebAppBundleToolSchema).min(1).max(10)
+      }),
+      /** What the pod's smoke run answered, route by route: every one 2xx or the build failed. */
+      smoke: z10.array(z10.object({
+        route: z10.string(),
+        status: z10.number().int()
+      })).min(1)
+    });
   }
 });
 
@@ -14468,7 +15055,7 @@ var init_constants = __esm({
 });
 
 // src/services/firebase-session.ts
-import { z as z7 } from "zod";
+import { z as z11 } from "zod";
 function rejectedRefreshReason(message) {
   const normalised = message.toUpperCase();
   return REJECTED_REFRESH_REASONS.find((reason) => normalised.includes(reason));
@@ -14614,20 +15201,20 @@ var init_firebase_session = __esm({
         this.name = "FirebaseSessionRejectedError";
       }
     };
-    customTokenResponseSchema = z7.object({
-      idToken: z7.string().min(1),
-      refreshToken: z7.string().min(1),
-      expiresIn: z7.coerce.number().positive().finite(),
-      localId: z7.string().min(1).optional()
+    customTokenResponseSchema = z11.object({
+      idToken: z11.string().min(1),
+      refreshToken: z11.string().min(1),
+      expiresIn: z11.coerce.number().positive().finite(),
+      localId: z11.string().min(1).optional()
     });
-    refreshResponseSchema = z7.object({
-      id_token: z7.string().min(1),
-      refresh_token: z7.string().min(1),
-      expires_in: z7.coerce.number().positive().finite(),
-      user_id: z7.string().min(1)
+    refreshResponseSchema = z11.object({
+      id_token: z11.string().min(1),
+      refresh_token: z11.string().min(1),
+      expires_in: z11.coerce.number().positive().finite(),
+      user_id: z11.string().min(1)
     });
-    firebaseIdTokenPayloadSchema = z7.object({
-      sub: z7.string().min(1)
+    firebaseIdTokenPayloadSchema = z11.object({
+      sub: z11.string().min(1)
     });
     __name(requireFirebaseWebApiKey, "requireFirebaseWebApiKey");
     __name(claimsOfFirebaseIdToken, "claimsOfFirebaseIdToken");
@@ -14644,7 +15231,7 @@ var init_firebase_session = __esm({
 import { createHash, randomUUID } from "crypto";
 import { mkdir, open, readFile, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { join as join3 } from "path";
-import { z as z8 } from "zod";
+import { z as z12 } from "zod";
 function environmentKey(environment) {
   return createHash("sha256").update(`${environment.apiUrl}
 ${environment.authUrl}
@@ -14661,15 +15248,15 @@ var init_firebase_session_store = __esm({
   "src/services/firebase-session-store.ts"() {
     "use strict";
     init_constants();
-    storedFirebaseSessionSchema = z8.object({
-      version: z8.literal(1),
-      kind: z8.literal("firebase-session"),
-      generation: z8.string().min(1),
-      refreshToken: z8.string().min(1),
-      firebaseUid: z8.string().min(1),
-      apiUrl: z8.string().url(),
-      authUrl: z8.string().url(),
-      firebaseWebApiKey: z8.string().min(1)
+    storedFirebaseSessionSchema = z12.object({
+      version: z12.literal(1),
+      kind: z12.literal("firebase-session"),
+      generation: z12.string().min(1),
+      refreshToken: z12.string().min(1),
+      firebaseUid: z12.string().min(1),
+      apiUrl: z12.string().url(),
+      authUrl: z12.string().url(),
+      firebaseWebApiKey: z12.string().min(1)
     });
     currentFirebaseSessionEnvironment = /* @__PURE__ */ __name(() => ({
       apiUrl: BASE_URLS.API,
@@ -15892,7 +16479,7 @@ var init_workflow_job_tools = __esm({
 
 // ../workflow-graph/dist/index.mjs
 import { createHash as createHash2 } from "crypto";
-import { z as z9 } from "zod";
+import { z as z13 } from "zod";
 import { z as z22 } from "zod";
 import { createHash as createHash22 } from "crypto";
 function isMapConfigObject(v) {
@@ -19619,8 +20206,8 @@ var init_dist2 = __esm({
     fromKnowledge = /* @__PURE__ */ __name8((k) => ({
       knowledge: k
     }), "fromKnowledge");
-    SideEffectsSchema = z9.enum(WORKFLOW_SIDE_EFFECTS);
-    JobResourcesSchema = z9.enum(WORKFLOW_JOB_RESOURCES);
+    SideEffectsSchema = z13.enum(WORKFLOW_SIDE_EFFECTS);
+    JobResourcesSchema = z13.enum(WORKFLOW_JOB_RESOURCES);
     WORKFLOW_MODEL_TEMPLATE_ROOT = "initData";
     WORKFLOW_MODEL_TEMPLATE_RE = /^\$\{\s*initData\.([A-Za-z0-9_.\-[\]]+)\s*(?:\|([^}]*))?\}$/;
     PATH_SEGMENT_RE = /^[A-Za-z0-9_-]+(?:\[(?:0|[1-9]\d*)\])*$/;
@@ -21632,19 +22219,19 @@ import { gunzipSync as gunzipSync2, gzipSync as gzipSync2 } from "zlib";
 function hashContentTruncated(content) {
   return createHash3("sha256").update(content).digest("hex").slice(0, FILE_HASH_LENGTH);
 }
-function sha256Hex(content) {
+function sha256Hex2(content) {
   return createHash3("sha256").update(content).digest("hex");
 }
 function matchesFileHash(hash, plaintext) {
   if (!/^(?:[a-f0-9]{16}|[a-f0-9]{64})$/.test(hash)) return false;
-  if (sha256Hex(plaintext).startsWith(hash)) return true;
-  return sha256Hex(plaintext.toString("utf-8")).startsWith(hash);
+  if (sha256Hex2(plaintext).startsWith(hash)) return true;
+  return sha256Hex2(plaintext.toString("utf-8")).startsWith(hash);
 }
 function combineFileHashes(files) {
   const sorted = [
     ...files
   ].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-  return sha256Hex(sorted.map((f) => f.hash).join("|"));
+  return sha256Hex2(sorted.map((f) => f.hash).join("|"));
 }
 function shouldSkipDirectory(name) {
   return SKIP_DIRECTORIES.has(name);
@@ -21963,8 +22550,8 @@ var init_dist3 = __esm({
     FILE_HASH_LENGTH = 16;
     __name(hashContentTruncated, "hashContentTruncated");
     __name9(hashContentTruncated, "hashContentTruncated");
-    __name(sha256Hex, "sha256Hex");
-    __name9(sha256Hex, "sha256Hex");
+    __name(sha256Hex2, "sha256Hex");
+    __name9(sha256Hex2, "sha256Hex");
     __name(matchesFileHash, "matchesFileHash");
     __name9(matchesFileHash, "matchesFileHash");
     __name(combineFileHashes, "combineFileHashes");
@@ -22719,7 +23306,27 @@ var init_base_handler = __esm({
   }
 });
 
+// src/utils/server-refusal.ts
+function printableRefusal(error, code) {
+  if (error?.code !== code || typeof error.message !== "string") return null;
+  const message = error.message.replace(new RegExp("\\p{C}", "gu"), "").trim();
+  return message || null;
+}
+function isSystemOwned(item) {
+  return item?.systemOwned === true;
+}
+var init_server_refusal = __esm({
+  "src/utils/server-refusal.ts"() {
+    "use strict";
+    __name(printableRefusal, "printableRefusal");
+    __name(isSystemOwned, "isSystemOwned");
+  }
+});
+
 // src/primitives/skill.handler.ts
+function skillNameReservedMessage(error) {
+  return printableRefusal(error, "SKILL_NAME_RESERVED");
+}
 var SkillHandler, skillHandler;
 var init_skill_handler = __esm({
   "src/primitives/skill.handler.ts"() {
@@ -22729,9 +23336,11 @@ var init_skill_handler = __esm({
     init_constants();
     init_skills_api_service();
     init_base_handler();
+    init_server_refusal();
     init_artifact_loader();
     init_bundle_upload();
     init_files();
+    __name(skillNameReservedMessage, "skillNameReservedMessage");
     SkillHandler = class extends BaseVersionedHandler {
       static {
         __name(this, "SkillHandler");
@@ -22750,7 +23359,7 @@ var init_skill_handler = __esm({
       async fetchFromServer(api) {
         const response = await api.getSkills();
         if (!response.success || !response.data?.skills) return null;
-        return response.data.skills;
+        return response.data.skills.filter((skill) => !isSystemOwned(skill));
       }
       async createOnServer(api, primitive) {
         const skill = primitive;
@@ -22761,7 +23370,11 @@ var init_skill_handler = __esm({
             context: skill.context
           } : {}
         });
-        if (!response.success || !response.data?.id) return null;
+        if (!response.success || !response.data?.id) {
+          const reserved = skillNameReservedMessage(response.error);
+          if (reserved) throw new Error(reserved);
+          return null;
+        }
         return response.data.id;
       }
       isActive(serverItem) {
@@ -22899,6 +23512,7 @@ var init_skill_handler = __esm({
               toolData.condition = compressedCode;
             }
           }
+          if (tool.label) toolData.label = tool.label;
           const source = loadOriginalSource(tool.sourcePath, projectPath);
           const entryFile = normalizeEntryFile(tool.sourcePath, projectPath);
           if (source && entryFile) {
@@ -24986,13 +25600,13 @@ var init_data_entry_instance = __esm({
       /**
       * Updates the custom data entry
       * @param data - The data fields to update (partial update supported)
-      * @param searchText - Optional new search text for semantic search indexing
+      * @param optionsOrSearchText - `{ searchText?, index? }` (as `Data.update`), or a bare string (legacy `searchText`)
       * @returns Promise resolving to the updated data
       * @throws Error if the update fails
       */
-      async update(data, searchText) {
+      async update(data, optionsOrSearchText) {
         try {
-          const result = await this.customDataAPI.update(this.collectionName, this.id, data, searchText);
+          const result = await this.customDataAPI.update(this.collectionName, this.id, data, optionsOrSearchText);
           this.data = {
             ...this.data,
             ...data
@@ -25053,13 +25667,13 @@ var init_data_entry_instance = __esm({
       }
       /**
       * Saves the data entry
-      * @param searchText - Optional search text for vector search indexing
+      * @param optionsOrSearchText - `{ searchText?, index? }` (as `Data.update`), or a bare string (legacy `searchText`)
       * @returns Promise resolving to true if saving was successful
       * @throws Error if the save operation fails
       */
-      async save(searchText) {
+      async save(optionsOrSearchText) {
         try {
-          await this.customDataAPI.update(this.collectionName, this.id, this.data, searchText);
+          await this.customDataAPI.update(this.collectionName, this.id, this.data, optionsOrSearchText);
           return true;
         } catch (error) {
           throw new Error("Failed to save data entry", {
@@ -28507,6 +29121,20 @@ var offlineMetrics = {
   }
 };
 
+// src/api/identity.offline.ts
+init_dist();
+function createOfflineIdentityApi() {
+  return Object.freeze({
+    assertion: /* @__PURE__ */ __name(async (input) => {
+      if (!readAgentIdentityAudience(input)) {
+        throw agentIdentityError(AGENT_IDENTITY_ERRORS.INPUT_INVALID, "Lua.identity.assertion needs { audience: string }", 400);
+      }
+      throw agentIdentityError(AGENT_IDENTITY_ERRORS.REQUIRES_LIVE_EXECUTION, "Lua.identity.assertion only runs inside a live execution of a deployed agent, not in lua test / lua dev", 403);
+    }, "assertion")
+  });
+}
+__name(createOfflineIdentityApi, "createOfflineIdentityApi");
+
 // src/api-exports.ts
 init_shared_data_offline();
 init_connection_requests_api_service();
@@ -29277,6 +29905,7 @@ var LuaVoiceTool = class {
   inputSchema;
   execute;
   condition;
+  label;
   voice;
   constructor(config) {
     this.name = config.name;
@@ -29284,6 +29913,7 @@ var LuaVoiceTool = class {
     this.inputSchema = config.inputSchema;
     this.execute = config.execute;
     this.condition = config.condition;
+    this.label = config.label;
     if (config.flags && config.flags.length > 0) {
       this.voice = {
         flags: config.flags
@@ -29809,7 +30439,7 @@ var Data = {
   *
   * @param collectionName - Name of the collection
   * @param entryId - ID of the entry
-  * @param mutation - `{ set?, unset?, searchText? }` (`searchText: null` clears it)
+  * @param mutation - `{ set?, unset?, searchText?, index? }` (`searchText: null` clears it; `index` as create's option)
   * @param options - `{ ifVersion? }` for compare-and-swap
   * @returns Promise resolving to `{ status, message, version }` (`version` = the entry's new version)
   */
@@ -29889,7 +30519,9 @@ var Data = {
   * - Readers may `collections`, `get`, `getEntry`, `search`; writers may also `create`, `update`, `patch`,
   *   `increment`, `delete` (a writer can read). Anything else rejects with `code === 'shared_data_forbidden'`
   *   (403) — also when the name does not exist or belongs to another org.
-  * - Same limits, filters, managed indexes, compare-and-swap and vector search as `Data`. Every write is audited
+  * - Same limits, filters, managed indexes, compare-and-swap and vector search as `Data`. A writer declares indexes
+  *   (`{ index }` on create/update/patch); they belong to the shared collection (5 across its sub-collections) and
+  *   `collections()` reports their status to every reader. Every write is audited
   *   (agent, collection, entry id; never the value).
   * - A test session may read but not write (`shared_data_test_session_write_refused`, 409).
   * - Deployed agents only: under `lua test` every call rejects with `code === 'shared_data_unavailable_offline'`.
@@ -30482,7 +31114,9 @@ var Lua = {
   request: {
     channel: "unknown",
     webhook: void 0
-  }
+  },
+  // ADR 0025 — throws `agent_identity_requires_live_execution` here; deployed agents get the platform-signed one.
+  identity: createOfflineIdentityApi()
 };
 var Secrets = {
   async request(input) {