@desplega.ai/agent-swarm 1.150.0 → 1.151.0

package/dist/cli-rnsr8asm.js

@@ -1,4323 +0,0 @@
-import {
-  DEFAULT_MODEL,
-  resolveCredential
-} from "./cli-mzb0n642.js";
-import {
-  getOpenRouterBaseUrl
-} from "./cli-3dpj7atn.js";
-import {
-  DEFAULT_SCRIPT_RESOURCES,
-  MAX_SCRIPT_WALL_CLOCK_MS,
-  MIN_SCRIPT_WALL_CLOCK_MS,
-  buildSandboxedCommand,
-  buildScriptCredentialBindingsWithFailures,
-  createCappedStreamState,
-  findEntryNodes,
-  getNextTargets,
-  getScript,
-  getScriptApiConnectionDescriptors,
-  getScriptMcpConnectionDescriptors,
-  getScriptVersion,
-  getSuccessors,
-  readStreamCapped,
-  restoreScratchScriptLastUsedIfUnchanged,
-  runScript,
-  sandboxSpawnEnv,
-  snapshotCapped,
-  touchScratchScriptLastUsed
-} from "./cli-zd21jrrc.js";
-import {
-  detachedProcessGroup,
-  registerProcessGroup,
-  terminateProcessGroup
-} from "./cli-y89t4nca.js";
-import {
-  getOAuthApp,
-  getOAuthTokens
-} from "./cli-vr6qj104.js";
-import {
-  withSiblingAwareness
-} from "./cli-n1yj5fd5.js";
-import {
-  getSlackApp
-} from "./cli-kt7wevqh.js";
-import {
-  FollowUpConfigSchema,
-  ModelTierSchema,
-  ReasoningEffortSchema,
-  RoutingReasonSchema,
-  cancelPendingApprovalRequestsForRun,
-  cancelTask,
-  claimApprovalCancellationNotification,
-  completeApprovalCancellationNotificationClaim,
-  createWorkflowRun,
-  createWorkflowRunStep,
-  createWorkflowVersion,
-  exports_db,
-  getCompletedStepNodeIds,
-  getDbClient,
-  getDueWaitStates,
-  getLastRunStart,
-  getLastSuccessfulRun,
-  getLatestStepForNode,
-  getPendingEventWaitNames,
-  getPendingWaitsByEvent,
-  getRetryableSteps,
-  getStepByIdempotencyKey,
-  getStepCountForNode,
-  getStuckApprovalRuns,
-  getStuckWaitRuns,
-  getStuckWorkflowRuns,
-  getSwarmConfigs,
-  getTaskByWorkflowRunStepId,
-  getWaitStateById,
-  getWorkflow,
-  getWorkflowRun,
-  getWorkflowRunStep,
-  getWorkflowRunStepsByRunId,
-  getWorkflowVersions,
-  getWorkflowsByScheduleId,
-  init_context_key,
-  init_db,
-  init_telemetry,
-  init_types,
-  listCancelledApprovalRequestsForRun,
-  listWorkflows,
-  releaseApprovalCancellationNotificationClaim,
-  resolveApprovalRequest,
-  resolveWaitState,
-  splitLegacyModelAlias,
-  telemetry,
-  updateWorkflow,
-  updateWorkflowRun,
-  updateWorkflowRunStep,
-  workflowContextKey
-} from "./cli-qp69dd5d.js";
-import {
-  deepInterpolate,
-  findInterpolationTokens,
-  init_template,
-  interpolate
-} from "./cli-n75jt793.js";
-import {
-  getAppUrl,
-  getMcpBaseUrl,
-  init_constants
-} from "./cli-dv6cdjs2.js";
-import {
-  init_zod
-} from "./cli-sd0mxa3c.js";
-import {
-  exports_external
-} from "./cli-w5e1d1vv.js";
-import {
-  init_secret_scrubber,
-  isSensitiveKey,
-  scrubSecrets
-} from "./cli-r2ap2czm.js";
-import {
-  init_event_bus,
-  workflowEventBus
-} from "./cli-f7kvq46p.js";
-import {
-  __require
-} from "./cli-bc05qbss.js";
-// src/automation-preflight-alert.ts
-init_constants();
-init_secret_scrubber();
-async function notifyAutomationPreflightFailure(preflight) {
-  const channel = process.env.SLACK_ALERTS_CHANNEL?.trim();
-  if (!channel) {
-    console.warn("[Automation Preflight] SLACK_ALERTS_CHANNEL not set; skipping alert");
-    return;
-  }
-  try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-dty7p9hg.js");
-    const app = getSlackApp2();
-    if (!app) {
-      console.warn("[Automation Preflight] Slack not available, cannot send notification");
-      return;
-    }
-    await app.client.chat.postMessage({
-      channel,
-      text: scrubSecrets(`⚠️ Automation needs setup
-` + `Automation: ${preflight.kind} "${preflight.name}"
-Missing params: ${preflight.missing.params.join(", ") || "none"}
-Missing integrations: ${preflight.missing.integrations.join(", ") || "none"}
-Fire SKIPPED. It was not retried or queued.
-Fix setup: ${getAppUrl()}${preflight.fixUrl}`),
-      unfurl_links: false,
-      unfurl_media: false
-    });
-  } catch (error) {
-    console.error("[Automation Preflight] Failed to send Slack notification:", scrubSecrets(error instanceof Error ? error.message : String(error)));
-  }
-}
-
-// src/be/automation-preflight.ts
-init_db();
-var NEEDS_SETUP_PREFIX = "needs_setup:";
-function hasValue(value) {
-  if (value == null)
-    return false;
-  if (typeof value === "string")
-    return value.trim().length > 0;
-  if (Array.isArray(value))
-    return value.length > 0;
-  return true;
-}
-var GITHUB_REPOSITORY_SLUG = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}(?:\.git)?$/;
-var SAFE_SHELL_DATA = /^[A-Za-z0-9._~%/:@ -]+$/;
-var DNS_NAME = /^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$/;
-var SAFE_EXTERNAL_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
-var SAFE_GIT_REF = /^(?!-)(?!.*(?:\.\.|@\{|\/\/))[A-Za-z0-9._/-]+$/;
-var SAFE_TAG_PATTERN = /^(?!-)(?!.*(?:\.\.|\/\/))[A-Za-z0-9._*?/-]+$/;
-var SAFE_RELATIVE_PATH = /^(?![-/])(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]+$/;
-var SAFE_REPORT_NAME = /^(?!\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._ -]{0,127}$/;
-function isSafeRepository(value) {
-  if (!SAFE_SHELL_DATA.test(value) || value.trim() !== value || value.includes(" "))
-    return false;
-  const slug = value.replace(/^https:\/\/github\.com\//, "").replace(/^git@github\.com:/, "").replace(/\/$/, "");
-  return GITHUB_REPOSITORY_SLUG.test(slug);
-}
-function isSafeGscProperty(value) {
-  if (!SAFE_SHELL_DATA.test(value) || value.trim() !== value)
-    return false;
-  return value.split(" ").every((property) => {
-    if (!property)
-      return false;
-    if (property.startsWith("sc-domain:"))
-      return DNS_NAME.test(property.slice(10));
-    if (DNS_NAME.test(property))
-      return true;
-    try {
-      const url = new URL(property);
-      return url.protocol === "https:" && !url.username && !url.password && !url.port && !url.search && !url.hash && DNS_NAME.test(url.hostname);
-    } catch {
-      return false;
-    }
-  });
-}
-var PARAM_VALIDATORS = {
-  REPO_URL: (value) => typeof value === "string" && isSafeRepository(value),
-  GSC_PROPERTY: (value) => typeof value === "string" && isSafeGscProperty(value),
-  BRANCH: (value) => typeof value === "string" && SAFE_GIT_REF.test(value),
-  SCOPE_PATH: (value) => typeof value === "string" && SAFE_RELATIVE_PATH.test(value),
-  REPORT_NAME: (value) => typeof value === "string" && value.trim() === value && SAFE_REPORT_NAME.test(value),
-  TAG_PATTERN: (value) => typeof value === "string" && SAFE_TAG_PATTERN.test(value),
-  AGENT_FS_ORG_ID: (value) => typeof value === "string" && SAFE_EXTERNAL_ID.test(value),
-  ORG_ID: (value) => typeof value === "string" && SAFE_EXTERNAL_ID.test(value)
-};
-function isUsableParam(key, value) {
-  if (!hasValue(value))
-    return false;
-  return PARAM_VALIDATORS[key]?.(value) ?? true;
-}
-function uniqueSorted(values) {
-  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
-}
-function automationUrl(input) {
-  return input.kind === "schedule" ? `/schedules/${input.id}` : `/workflows/${input.id}`;
-}
-var INTEGRATION_FIX_URL = {
-  slack: "/settings/integrations/slack",
-  github: "/settings/integrations/github",
-  linear: "/settings/integrations/linear",
-  jira: "/settings/integrations/jira",
-  agentmail: "/settings/integrations/agentmail",
-  gsc: "/settings/integrations/gsc",
-  agentfs: "/settings/integrations/agentfs"
-};
-var INTEGRATION_FIRST_REQUIREMENTS = new Set([
-  "gsc",
-  "linear",
-  "agentmail"
-]);
-function automationIntegrationFixUrl(id) {
-  return INTEGRATION_FIX_URL[id];
-}
-function isNeedsSetupFailure(reason) {
-  return reason?.startsWith(NEEDS_SETUP_PREFIX) ?? false;
-}
-function preflightAutomation(input, setup) {
-  const params = input.params ?? {};
-  const guardedParams = Object.keys(params).filter((key) => (key in PARAM_VALIDATORS));
-  const missingParams = uniqueSorted([...input.requiredParams ?? [], ...guardedParams].filter((key) => !isUsableParam(key, params[key])));
-  const missingIntegrations = uniqueSorted((input.requires ?? []).filter((id) => setup[id] === "unverified"));
-  const missing = { params: missingParams, integrations: missingIntegrations };
-  const baseUrl = automationUrl(input);
-  const fixes = [
-    ...missingParams.map((key) => ({
-      type: "param",
-      key,
-      url: `${baseUrl}?param=${encodeURIComponent(key)}`
-    })),
-    ...missingIntegrations.map((key) => ({
-      type: "integration",
-      key,
-      url: automationIntegrationFixUrl(key)
-    }))
-  ];
-  if (missingParams.length === 0 && missingIntegrations.length === 0) {
-    return {
-      id: input.id,
-      name: input.name,
-      kind: input.kind,
-      state: "running",
-      missing,
-      fixes,
-      fixUrl: baseUrl
-    };
-  }
-  const firstParam = missingParams[0];
-  const firstIntegration = (input.requires ?? []).find((id) => missingIntegrations.includes(id));
-  const integrationFirst = (input.requires ?? []).some((id) => INTEGRATION_FIRST_REQUIREMENTS.has(id));
-  const fixUrl = integrationFirst && firstIntegration ? automationIntegrationFixUrl(firstIntegration) : firstParam ? `${baseUrl}?param=${encodeURIComponent(firstParam)}` : firstIntegration ? automationIntegrationFixUrl(firstIntegration) : baseUrl;
-  const failureReason = `${NEEDS_SETUP_PREFIX} params=[${missingParams.join(",")}] integrations=[${missingIntegrations.join(",")}]`;
-  return {
-    id: input.id,
-    name: input.name,
-    kind: input.kind,
-    state: "needs_setup",
-    missing,
-    fixes,
-    fixUrl,
-    failureReason
-  };
-}
-var EXACT_TOKEN = /^\{\{\s*([^}]+?)\s*\}\}$/;
-var TOKEN = /\{\{\s*([^}]+?)\s*\}\}/g;
-function renderAutomationTokens(value, params) {
-  function render(current) {
-    if (typeof current === "string") {
-      const exact = EXACT_TOKEN.exec(current);
-      if (exact?.[1] && Object.hasOwn(params, exact[1]))
-        return params[exact[1]];
-      return current.replace(TOKEN, (token, key) => {
-        if (!Object.hasOwn(params, key))
-          return token;
-        const replacement = params[key];
-        return typeof replacement === "object" ? JSON.stringify(replacement) : String(replacement);
-      });
-    }
-    if (Array.isArray(current))
-      return current.map(render);
-    if (current != null && typeof current === "object") {
-      return Object.fromEntries(Object.entries(current).map(([key, nested]) => [key, render(nested)]));
-    }
-    return current;
-  }
-  return render(value);
-}
-function enabled(flag) {
-  return flag !== "true" && flag !== "1";
-}
-function present(value) {
-  return !!value?.trim();
-}
-async function getAutomationSetupStates() {
-  const [linearTokens, jiraTokens, jiraApp] = await Promise.all([
-    getOAuthTokens("linear"),
-    getOAuthTokens("jira"),
-    getOAuthApp("jira")
-  ]);
-  let jiraCloudId = false;
-  try {
-    const metadata = jiraApp?.metadata ? JSON.parse(jiraApp.metadata) : null;
-    jiraCloudId = !!(metadata && typeof metadata === "object" && metadata.cloudId);
-  } catch {
-    jiraCloudId = false;
-  }
-  const agentFsKey = process.env.API_AGENT_FS_API_KEY ?? process.env.AGENT_FS_API_KEY;
-  const agentFsOrg = process.env.AGENT_FS_DEFAULT_ORG_ID ?? process.env.AGENT_FS_SHARED_ORG_ID;
-  const gscConfigured = present(process.env.GSC_SERVICE_ACCOUNT_BASE64) || present(process.env.GSC_SERVICE_ACCOUNT_JSON);
-  return {
-    slack: enabled(process.env.SLACK_DISABLE) && present(process.env.SLACK_BOT_TOKEN) && present(process.env.SLACK_APP_TOKEN) ? "verified" : "unverified",
-    github: present(process.env.GITHUB_WEBHOOK_SECRET) && present(process.env.GITHUB_APP_ID) && present(process.env.GITHUB_APP_PRIVATE_KEY) ? "verified" : "unverified",
-    linear: linearTokens ? "verified" : "unverified",
-    jira: jiraTokens && jiraCloudId ? "verified" : "unverified",
-    gsc: gscConfigured ? "verified" : "unverified",
-    agentmail: enabled(process.env.AGENTMAIL_DISABLE) && present(process.env.AGENTMAIL_API_KEY) ? "verified" : "unverified",
-    agentfs: present(process.env.AGENT_FS_API_URL) && present(agentFsKey) && present(agentFsOrg) && present(process.env.AGENT_FS_DEFAULT_DRIVE_ID) ? "verified" : "unverified"
-  };
-}
-function schedulePreflightInput(schedule) {
-  return { ...schedule, kind: "schedule" };
-}
-function workflowPreflightInput(workflow) {
-  return { ...workflow, kind: "workflow" };
-}
-async function listEnabledAutomationPreflightInputs() {
-  const rows = await getDbClient().query(`SELECT id, name, 'schedule' AS kind, params, requiredParams, requires
-     FROM scheduled_tasks
-     WHERE enabled = 1
-     UNION ALL
-     SELECT id, name, 'workflow' AS kind, params, requiredParams, requires
-     FROM workflows
-     WHERE enabled = 1`);
-  return rows.map((row) => ({
-    id: row.id,
-    name: row.name,
-    kind: row.kind,
-    params: JSON.parse(row.params),
-    requiredParams: JSON.parse(row.requiredParams),
-    requires: JSON.parse(row.requires)
-  }));
-}
-function utcDayBounds(now) {
-  const start = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
-  return { start: start.toISOString(), end: new Date(start.getTime() + 86400000).toISOString() };
-}
-async function recordSchedulePreflightFailure(scheduleId, failureReason, now = new Date) {
-  return await getDbClient().transaction(async (tx) => {
-    const row = await tx.get("SELECT lastErrorAt, lastErrorMessage FROM scheduled_tasks WHERE id = ?", [scheduleId]);
-    if (!row)
-      return false;
-    if (row.lastErrorMessage === failureReason && row.lastErrorAt?.slice(0, 10) === now.toISOString().slice(0, 10)) {
-      return false;
-    }
-    await tx.run(`UPDATE scheduled_tasks
-       SET lastErrorAt = ?, lastErrorMessage = ?, lastUpdatedAt = ?
-       WHERE id = ?`, [now.toISOString(), failureReason, now.toISOString(), scheduleId]);
-    return true;
-  });
-}
-async function recordWorkflowPreflightFailure(input) {
-  const now = input.now ?? new Date;
-  const bounds = utcDayBounds(now);
-  return await getDbClient().transaction(async (tx) => {
-    const existing = await tx.get(`SELECT id FROM workflow_runs
-       WHERE workflowId = ? AND status = 'failed'
-         AND error LIKE 'needs_setup:%'
-         AND startedAt >= ? AND startedAt < ?
-       ORDER BY startedAt ASC LIMIT 1`, [input.workflowId, bounds.start, bounds.end]);
-    if (existing)
-      return { runId: existing.id, recorded: false };
-    const runId = crypto.randomUUID();
-    const timestamp = now.toISOString();
-    await tx.run(`INSERT INTO workflow_runs
-         (id, workflowId, status, triggerType, triggerData, error, created_by,
-          startedAt, lastUpdatedAt, finishedAt)
-       VALUES (?, ?, 'failed', ?, ?, ?, ?, ?, ?, ?)`, [
-      runId,
-      input.workflowId,
-      input.triggerType,
-      input.triggerData === undefined ? null : JSON.stringify(input.triggerData),
-      input.failureReason,
-      input.createdBy ?? null,
-      timestamp,
-      timestamp,
-      timestamp
-    ]);
-    return { runId, recorded: true };
-  });
-}
-
-// src/workflows/engine.ts
-init_db();
-init_telemetry();
-
-// src/workflows/checkpoint.ts
-init_db();
-async function checkpointStep(runId, stepId, nodeId, result, ctx) {
-  await getDbClient().transaction(async () => {
-    await updateWorkflowRunStep(stepId, {
-      status: "completed",
-      output: result.output,
-      nextPort: result.nextPort || undefined,
-      finishedAt: new Date().toISOString()
-    });
-    ctx[nodeId] = result.output;
-    await updateWorkflowRun(runId, {
-      context: ctx
-    });
-  });
-}
-async function checkpointStepFailure(runId, stepId, error, retryCount, retryPolicy, options) {
-  const now = new Date().toISOString();
-  if (retryPolicy && retryCount < retryPolicy.maxRetries) {
-    const delay = calculateBackoff(retryPolicy, retryCount);
-    const nextRetryAt = new Date(Date.now() + delay).toISOString();
-    await updateWorkflowRunStep(stepId, {
-      status: "failed",
-      error,
-      retryCount: retryCount + 1,
-      maxRetries: retryPolicy.maxRetries,
-      nextRetryAt
-    });
-    return { shouldRetry: true };
-  }
-  await updateWorkflowRunStep(stepId, {
-    status: "failed",
-    error,
-    finishedAt: now,
-    nextRetryAt: null
-  });
-  const markRunFailed = options?.markRunFailed ?? true;
-  if (markRunFailed) {
-    await updateWorkflowRun(runId, {
-      status: "failed",
-      error: `Step failed: ${error}`,
-      finishedAt: now
-    });
-  }
-  return { shouldRetry: false };
-}
-async function checkpointStepWaiting(runId, stepId, ctx) {
-  return getDbClient().transaction(async () => {
-    const step = await getDbClient().get(`UPDATE workflow_run_steps
-         SET status = 'waiting'
-       WHERE id = ? AND runId = ? AND status = 'running'
-         AND EXISTS (
-           SELECT 1 FROM workflow_runs
-           WHERE id = ? AND status IN ('running', 'waiting')
-         )
-       RETURNING id`, [stepId, runId, runId]);
-    if (!step)
-      return false;
-    await updateWorkflowRun(runId, { status: "waiting", context: ctx });
-    return true;
-  });
-}
-function calculateBackoff(policy, attempt) {
-  let delay;
-  switch (policy.strategy) {
-    case "exponential": {
-      const base = policy.baseDelayMs * 2 ** attempt;
-      delay = Math.random() * Math.min(base, policy.maxDelayMs);
-      break;
-    }
-    case "linear":
-      delay = policy.baseDelayMs * (attempt + 1);
-      break;
-    case "static":
-      delay = policy.baseDelayMs;
-      break;
-    default:
-      delay = policy.baseDelayMs;
-  }
-  return Math.min(delay, policy.maxDelayMs);
-}
-
-// src/workflows/completed-step-routing.ts
-init_db();
-
-// src/workflows/foreach-join.ts
-init_db();
-var FOREACH_TERMINAL_STEP_STATUSES = new Set([
-  "completed",
-  "failed",
-  "cancelled",
-  "skipped"
-]);
-function parseSyntheticNodeId(nodeId) {
-  const separatorIndex = nodeId.indexOf("#");
-  if (separatorIndex <= 0 || separatorIndex === nodeId.length - 1)
-    return null;
-  return {
-    parentNodeId: nodeId.slice(0, separatorIndex),
-    itemKey: nodeId.slice(separatorIndex + 1)
-  };
-}
-function resolveForeachParent(def, nodeId) {
-  const parsed = parseSyntheticNodeId(nodeId);
-  if (!parsed)
-    return null;
-  const parent = def.nodes.find((node) => node.id === parsed.parentNodeId);
-  return parent?.type === "foreach" ? parent : null;
-}
-async function joinForeach(def, runId, childStep, ctx) {
-  const parent = resolveForeachParent(def, childStep.nodeId);
-  if (!parent) {
-    throw new Error(`Step "${childStep.nodeId}" is not a foreach child`);
-  }
-  const children = (await getWorkflowRunStepsByRunId(runId)).filter((step) => resolveForeachParent(def, step.nodeId)?.id === parent.id).sort((a, b) => childIndex(a) - childIndex(b));
-  if (children.some((step) => !FOREACH_TERMINAL_STEP_STATUSES.has(step.status))) {
-    return { joined: false, parentNodeId: parent.id, successors: [] };
-  }
-  const parentStep = await getLatestStepForNode(runId, parent.id);
-  if (!parentStep) {
-    throw new Error(`Waiting foreach parent step "${parent.id}" was not found`);
-  }
-  if (parentStep.status === "completed") {
-    return { joined: false, parentNodeId: parent.id, successors: [] };
-  }
-  const aggregate = buildForeachAggregate(children);
-  await checkpointStep(runId, parentStep.id, parent.id, { output: aggregate }, ctx);
-  return {
-    joined: true,
-    parentNodeId: parent.id,
-    successors: getSuccessors(def, parent.id)
-  };
-}
-function buildForeachAggregate(children) {
-  const orderedChildren = [...children].sort((a, b) => childIndex(a) - childIndex(b));
-  const results = orderedChildren.map((step) => {
-    const parsed = parseSyntheticNodeId(step.nodeId);
-    const status = resultStatus(step);
-    return {
-      itemKey: parsed.itemKey,
-      status,
-      output: step.output
-    };
-  });
-  const failedCount = results.filter((result) => result.status !== "completed").length;
-  const aggregate = {
-    results,
-    okCount: results.length - failedCount,
-    failedCount
-  };
-  return aggregate;
-}
-function childIndex(step) {
-  if (typeof step.input !== "object" || step.input === null)
-    return Number.MAX_SAFE_INTEGER;
-  const index = step.input.index;
-  return typeof index === "number" ? index : Number.MAX_SAFE_INTEGER;
-}
-function resultStatus(step) {
-  if (step.status !== "completed")
-    return step.status;
-  return step.error ? "failed" : "completed";
-}
-
-// src/workflows/completed-step-routing.ts
-async function loadCompletedStepRouting(def, runId, completedNodeIds) {
-  const activeEdges = new Set;
-  const stepsByNodeId = new Map;
-  for (const nodeId of completedNodeIds) {
-    if (resolveForeachParent(def, nodeId))
-      continue;
-    const step = await getLatestStepForNode(runId, nodeId);
-    if (step)
-      stepsByNodeId.set(nodeId, step);
-    const successors = step?.nextPort ? getSuccessors(def, nodeId, step.nextPort) : getSuccessors(def, nodeId);
-    for (const successor of successors) {
-      activeEdges.add(`${nodeId}→${successor.id}`);
-    }
-  }
-  return { activeEdges, stepsByNodeId };
-}
-
-// src/workflows/cooldown.ts
-init_db();
-function cooldownToMs(cooldown) {
-  let ms = 0;
-  if (cooldown.hours)
-    ms += cooldown.hours * 60 * 60 * 1000;
-  if (cooldown.minutes)
-    ms += cooldown.minutes * 60 * 1000;
-  if (cooldown.seconds)
-    ms += cooldown.seconds * 1000;
-  return ms;
-}
-async function shouldSkipCooldown(workflowId, cooldown) {
-  const cooldownMs = cooldownToMs(cooldown);
-  const now = Date.now();
-  const lastSuccess = await getLastSuccessfulRun(workflowId);
-  if (lastSuccess?.finishedAt) {
-    const lastFinished = new Date(lastSuccess.finishedAt).getTime();
-    if (now - lastFinished < cooldownMs)
-      return true;
-  }
-  const lastAttempt = await getLastRunStart(workflowId);
-  if (lastAttempt?.startedAt) {
-    const lastStarted = new Date(lastAttempt.startedAt).getTime();
-    if (now - lastStarted < cooldownMs)
-      return true;
-  }
-  return false;
-}
-
-// src/workflows/input.ts
-init_db();
-init_secret_scrubber();
-async function resolveInputs(input) {
-  const resolved = {};
-  for (const [key, value] of Object.entries(input)) {
-    resolved[key] = await resolveInputValue(value);
-  }
-  return resolved;
-}
-async function resolveInputValue(value) {
-  const envMatch = /^\$\{(.+)\}$/.exec(value);
-  if (envMatch?.[1]) {
-    const envName = envMatch[1];
-    const envValue = process.env[envName];
-    if (envValue === undefined) {
-      throw new Error(`Environment variable "${envName}" is not set`);
-    }
-    return envValue;
-  }
-  if (value.startsWith("secret.")) {
-    const secretName = value.slice("secret.".length);
-    const configs = await getSwarmConfigs({ scope: "global", key: secretName });
-    const secretConfig = configs.find((c) => c.isSecret);
-    if (!secretConfig) {
-      throw new Error(`Secret "${secretName}" not found in config store`);
-    }
-    return secretConfig.value;
-  }
-  return value;
-}
-var REDACTED_SECRET_VALUE = "***REDACTED***";
-function getSecretInputKeys(input) {
-  const keys = new Set;
-  if (!input)
-    return keys;
-  for (const [key, value] of Object.entries(input)) {
-    if (typeof value !== "string")
-      continue;
-    if (value.startsWith("secret.")) {
-      keys.add(key);
-      continue;
-    }
-    const envMatch = /^\$\{(.+)\}$/.exec(value);
-    if (envMatch?.[1] && isSensitiveKey(envMatch[1])) {
-      keys.add(key);
-    }
-  }
-  return keys;
-}
-function redactSecretsForStorage(ctx, secretKeys) {
-  if (secretKeys.size === 0)
-    return ctx;
-  const inputBlock = ctx.input;
-  if (!inputBlock || typeof inputBlock !== "object")
-    return ctx;
-  const redactedInput = { ...inputBlock };
-  let touched = false;
-  for (const key of secretKeys) {
-    if (key in redactedInput) {
-      redactedInput[key] = REDACTED_SECRET_VALUE;
-      touched = true;
-    }
-  }
-  if (!touched)
-    return ctx;
-  return { ...ctx, input: redactedInput };
-}
-
-// src/workflows/json-schema-validator.ts
-function validateJsonSchema(schema, data) {
-  const errors = [];
-  validate(schema, data, "", errors);
-  return errors;
-}
-function validate(schema, data, path, errors) {
-  const prefix = path || "root";
-  if (schema.type !== undefined) {
-    const expected = schema.type;
-    if (!matchesType(expected, data)) {
-      errors.push(`${prefix}: expected type "${expected}", got ${typeOf(data)}`);
-      return;
-    }
-  }
-  if (Array.isArray(schema.required) && typeof data === "object" && data !== null) {
-    const obj = data;
-    for (const key of schema.required) {
-      if (!(key in obj)) {
-        errors.push(`${prefix}: missing required property "${key}"`);
-      }
-    }
-  }
-  if (Array.isArray(schema.enum)) {
-    const allowed = schema.enum;
-    if (!allowed.some((v) => JSON.stringify(v) === JSON.stringify(data))) {
-      errors.push(`${prefix}: value ${JSON.stringify(data)} not in enum [${allowed.map((v) => JSON.stringify(v)).join(", ")}]`);
-      return;
-    }
-  }
-  if ("const" in schema) {
-    if (JSON.stringify(data) !== JSON.stringify(schema.const)) {
-      errors.push(`${prefix}: value ${JSON.stringify(data)} does not match const ${JSON.stringify(schema.const)}`);
-      return;
-    }
-  }
-  if (schema.properties !== undefined && typeof schema.properties === "object" && schema.properties !== null && typeof data === "object" && data !== null) {
-    const props = schema.properties;
-    const obj = data;
-    for (const [key, subSchema] of Object.entries(props)) {
-      if (key in obj) {
-        validate(subSchema, obj[key], path ? `${path}.${key}` : key, errors);
-      }
-    }
-  }
-  if (schema.items !== undefined && typeof schema.items === "object" && schema.items !== null && Array.isArray(data)) {
-    const itemSchema = schema.items;
-    for (let i = 0;i < data.length; i++) {
-      validate(itemSchema, data[i], `${prefix}[${i}]`, errors);
-    }
-  }
-}
-function matchesType(expected, data) {
-  switch (expected) {
-    case "string":
-      return typeof data === "string";
-    case "number":
-      return typeof data === "number";
-    case "boolean":
-      return typeof data === "boolean";
-    case "array":
-      return Array.isArray(data);
-    case "object":
-      return typeof data === "object" && data !== null && !Array.isArray(data);
-    default:
-      return true;
-  }
-}
-function typeOf(data) {
-  if (data === null)
-    return "null";
-  if (data === undefined)
-    return "undefined";
-  if (Array.isArray(data))
-    return "array";
-  return typeof data;
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function findJsonSchemaShapeErrors(schema, path = "outputSchema") {
-  const errors = [];
-  if (!isPlainObject(schema)) {
-    errors.push(`${path}: must be a JSON Schema object, got ${typeOf(schema)}`);
-    return errors;
-  }
-  if (schema.type !== undefined && typeof schema.type !== "string") {
-    errors.push(`${path}.type: must be a string, got ${typeOf(schema.type)}`);
-  }
-  if (schema.required !== undefined && (!Array.isArray(schema.required) || !schema.required.every((v) => typeof v === "string"))) {
-    errors.push(`${path}.required: must be an array of strings`);
-  }
-  if (schema.enum !== undefined && !Array.isArray(schema.enum)) {
-    errors.push(`${path}.enum: must be an array`);
-  }
-  if (schema.properties !== undefined) {
-    if (!isPlainObject(schema.properties)) {
-      errors.push(`${path}.properties: must be an object mapping property names to schemas`);
-    } else {
-      for (const [key, value] of Object.entries(schema.properties)) {
-        errors.push(...findJsonSchemaShapeErrors(value, `${path}.properties.${key}`));
-      }
-    }
-  }
-  if (schema.items !== undefined) {
-    errors.push(...findJsonSchemaShapeErrors(schema.items, `${path}.items`));
-  }
-  return errors;
-}
-
-// src/workflows/limits.ts
-var DEFAULT_MAX_STEPS_PER_RUN = 500;
-function getMaxWorkflowStepsPerRun() {
-  return Number(process.env.WORKFLOW_MAX_STEPS_PER_RUN) || DEFAULT_MAX_STEPS_PER_RUN;
-}
-
-// src/workflows/template.ts
-init_template();
-
-// src/workflows/validation.ts
-function extractPassResult(executorType, output) {
-  if (!output || typeof output !== "object")
-    return false;
-  const o = output;
-  switch (executorType) {
-    case "validate":
-      return o.pass === true;
-    case "script":
-      return o.exitCode === 0;
-    case "property-match":
-      return o.passed === true;
-    case "raw-llm":
-      if (typeof o.result === "object" && o.result !== null) {
-        return o.result.pass === true;
-      }
-      return false;
-    default:
-      return o.pass === true || o.passed === true || o.exitCode === 0;
-  }
-}
-async function runStepValidation(registry, stepNode, stepOutput, context, meta) {
-  if (!stepNode.validation) {
-    return { outcome: "pass" };
-  }
-  const validation = stepNode.validation;
-  const executorType = validation.executor || "validate";
-  const executor = registry.get(executorType);
-  const validationConfig = {
-    targetNodeId: meta.nodeId,
-    ...validation.config
-  };
-  const validationContext = {
-    ...context,
-    [meta.nodeId]: stepOutput
-  };
-  const result = await executor.run({
-    config: validationConfig,
-    context: validationContext,
-    meta: {
-      ...meta,
-      stepId: crypto.randomUUID()
-    }
-  });
-  const passed = result.status === "success" && extractPassResult(executorType, result.output);
-  if (passed) {
-    return { outcome: "pass", passed: true };
-  }
-  if (validation.mustPass) {
-    if (validation.retry) {
-      return {
-        outcome: "retry",
-        passed: false,
-        retryContext: {
-          previousOutput: stepOutput,
-          validationResult: result.output
-        }
-      };
-    }
-    return { outcome: "halt", passed: false };
-  }
-  return { outcome: "pass", passed: false };
-}
-
-// src/workflows/engine.ts
-var DEFAULT_TIMEOUT_MS = 30000;
-function maxIterations() {
-  return Number(process.env.WORKFLOW_MAX_ITERATIONS) || 100;
-}
-
-class TriggerSchemaError extends Error {
-  validationErrors;
-  constructor(validationErrors) {
-    super(`Trigger schema validation failed: ${validationErrors.join("; ")}`);
-    this.validationErrors = validationErrors;
-    this.name = "TriggerSchemaError";
-  }
-}
-async function resolveRenderedWorkflowInputs(input) {
-  const stringInputs = {};
-  const resolved = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (typeof value === "string")
-      stringInputs[key] = value;
-    else
-      resolved[key] = value;
-  }
-  return { ...resolved, ...await resolveInputs(stringInputs) };
-}
-async function startWorkflowExecution(workflow, triggerData, registry, options = {}) {
-  const preflight = preflightAutomation(workflowPreflightInput(workflow), await getAutomationSetupStates());
-  if (preflight.state === "needs_setup") {
-    const { runId: runId2, recorded } = await recordWorkflowPreflightFailure({
-      workflowId: workflow.id,
-      triggerType: options.triggerType ?? "manual",
-      triggerData,
-      failureReason: preflight.failureReason,
-      createdBy: options.requestedByUserId
-    });
-    if (recorded)
-      await notifyAutomationPreflightFailure(preflight);
-    return runId2;
-  }
-  workflow = renderAutomationTokens(workflow, workflow.params ?? {});
-  if (workflow.triggerSchema) {
-    const validationErrors = validateJsonSchema(workflow.triggerSchema, triggerData);
-    if (validationErrors.length > 0) {
-      throw new TriggerSchemaError(validationErrors);
-    }
-  }
-  if (workflow.cooldown && await shouldSkipCooldown(workflow.id, workflow.cooldown)) {
-    const runId2 = crypto.randomUUID();
-    await createWorkflowRun({
-      id: runId2,
-      workflowId: workflow.id,
-      triggerType: options.triggerType ?? "manual",
-      triggerData,
-      createdBy: options.requestedByUserId
-    });
-    await updateWorkflowRun(runId2, {
-      status: "skipped",
-      error: "cooldown",
-      finishedAt: new Date().toISOString()
-    });
-    return runId2;
-  }
-  const runId = crypto.randomUUID();
-  await createWorkflowRun({
-    id: runId,
-    workflowId: workflow.id,
-    triggerType: options.triggerType ?? "manual",
-    triggerData,
-    createdBy: options.requestedByUserId
-  });
-  telemetry.workflow("started", {
-    workflowId: workflow.id,
-    nodeCount: workflow.definition.nodes.length,
-    triggerType: options.triggerType ?? "manual"
-  });
-  const ctx = { trigger: triggerData };
-  if (options.requestedByUserId) {
-    ctx.swarm = { requestedByUserId: options.requestedByUserId };
-  }
-  if (workflow.dir || workflow.vcsRepo) {
-    ctx.workflow = { dir: workflow.dir, vcsRepo: workflow.vcsRepo };
-  }
-  if (workflow.input) {
-    try {
-      const resolved = await resolveRenderedWorkflowInputs(workflow.input);
-      Object.assign(ctx, { input: resolved });
-    } catch (err) {
-      await updateWorkflowRun(runId, {
-        status: "failed",
-        error: `Input resolution failed: ${err}`,
-        finishedAt: new Date().toISOString()
-      });
-      return runId;
-    }
-  }
-  const entryNodes = findEntryNodes(workflow.definition);
-  const secretKeys = getSecretInputKeys(workflow.input);
-  await walkGraph(workflow.definition, runId, ctx, entryNodes, registry, workflow.id, secretKeys, options);
-  return runId;
-}
-async function walkGraph(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
-  if (!options.requestedByUserId) {
-    options = {
-      ...options,
-      requestedByUserId: (await getWorkflowRun(runId))?.createdBy
-    };
-  }
-  let nodeExecutionCount = 0;
-  if (!("run" in ctx)) {
-    ctx.run = { id: runId };
-  }
-  const { completedNodeIds } = await rehydrateCompletedStepOutputs(def, runId, ctx, registry);
-  const { activeEdges } = await loadCompletedStepRouting(def, runId, completedNodeIds);
-  const allSteps = await getWorkflowRunStepsByRunId(runId);
-  if (allSteps.length >= getMaxWorkflowStepsPerRun()) {
-    await updateWorkflowRun(runId, {
-      status: "failed",
-      error: `Circuit breaker: run exceeded ${getMaxWorkflowStepsPerRun()} total steps (WORKFLOW_MAX_STEPS_PER_RUN)`,
-      finishedAt: new Date().toISOString()
-    });
-    return;
-  }
-  for (const step of allSteps) {
-    if (step.status !== "waiting")
-      continue;
-    const successors = getSuccessors(def, step.nodeId);
-    for (const succ of successors) {
-      activeEdges.add(`${step.nodeId}→${succ.id}`);
-    }
-  }
-  let pendingNodes = startNodes.filter((n) => {
-    const preds = getAllPredecessors(def, n.id);
-    if (preds.length === 0) {
-      return !completedNodeIds.has(n.id);
-    }
-    const activePreds = preds.filter((predId) => activeEdges.has(`${predId}→${n.id}`));
-    const predsToCheck = activePreds.length > 0 ? activePreds : preds;
-    return predsToCheck.every((p) => completedNodeIds.has(p));
-  });
-  const executedInThisWalk = new Set;
-  while (pendingNodes.length > 0) {
-    nodeExecutionCount += pendingNodes.length;
-    if (nodeExecutionCount > maxIterations()) {
-      await updateWorkflowRun(runId, {
-        status: "failed",
-        error: `Max node executions (${maxIterations()}) exceeded — possible infinite loop`,
-        finishedAt: new Date().toISOString()
-      });
-      return;
-    }
-    const results = await Promise.all(pendingNodes.map((node) => executeStep(def, runId, ctx, node, registry, workflowId, secretKeys, options).catch((_err) => ({
-      outcome: "failed",
-      successors: []
-    }))));
-    const nextBatch = new Map;
-    let hasWaiting = false;
-    for (let i = 0;i < results.length; i++) {
-      const result = results[i];
-      if (result.outcome === "failed") {
-        const currentRun = await getWorkflowRun(runId);
-        if (currentRun?.status === "failed")
-          return;
-        continue;
-      }
-      if (result.outcome === "waiting") {
-        hasWaiting = true;
-        continue;
-      }
-      const sourceNodeId = pendingNodes[i].id;
-      completedNodeIds.add(sourceNodeId);
-      executedInThisWalk.add(sourceNodeId);
-      for (const succ of result.successors) {
-        activeEdges.add(`${sourceNodeId}→${succ.id}`);
-        nextBatch.set(succ.id, succ);
-      }
-    }
-    if (hasWaiting)
-      return;
-    const readyNext = [];
-    for (const [nodeId, node] of nextBatch) {
-      if (executedInThisWalk.has(nodeId))
-        continue;
-      const allPreds = getAllPredecessors(def, nodeId);
-      const activePreds = allPreds.filter((predId) => activeEdges.has(`${predId}→${nodeId}`));
-      const allActivePredsCompleted = activePreds.every((p) => completedNodeIds.has(p));
-      if (allActivePredsCompleted) {
-        readyNext.push(node);
-      }
-    }
-    pendingNodes = readyNext;
-  }
-  await getDbClient().transaction(async () => {
-    const run = await getWorkflowRun(runId);
-    if (!run || run.status !== "running")
-      return;
-    const finalSteps = await getWorkflowRunStepsByRunId(runId);
-    const hasWaitingSteps = finalSteps.some((s) => s.status === "waiting");
-    const hasPendingRetries = finalSteps.some((s) => s.status === "failed" && s.nextRetryAt != null);
-    const failedSteps = finalSteps.filter((s) => s.status === "failed" && s.nextRetryAt == null);
-    const entryNodeIds = new Set(findEntryNodes(def).map((n) => n.id));
-    const hasCompletedSteps = finalSteps.some((s) => s.status === "completed" && !entryNodeIds.has(s.nodeId));
-    if (hasWaitingSteps) {
-      await updateWorkflowRun(runId, { status: "waiting" });
-    } else if (!hasPendingRetries) {
-      if (failedSteps.length > 0 && !hasCompletedSteps) {
-        const failedNodeIds = failedSteps.map((s) => s.nodeId).join(", ");
-        await updateWorkflowRun(runId, {
-          status: "failed",
-          error: `All branches failed. Failed nodes: ${failedNodeIds}`,
-          context: ctx,
-          finishedAt: new Date().toISOString()
-        });
-      } else if (failedSteps.length > 0) {
-        const failedNodeIds = failedSteps.map((s) => s.nodeId).join(", ");
-        await updateWorkflowRun(runId, {
-          status: "completed",
-          error: `Partial failure: nodes [${failedNodeIds}] failed (mustPass validation), but other branches completed successfully`,
-          context: ctx,
-          finishedAt: new Date().toISOString()
-        });
-      } else {
-        await updateWorkflowRun(runId, {
-          status: "completed",
-          context: ctx,
-          finishedAt: new Date().toISOString()
-        });
-      }
-    }
-  });
-}
-async function rehydrateCompletedStepOutputs(def, runId, ctx, registry) {
-  const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
-  const latestSteps = new Map;
-  for (const nodeId of completedNodeIds) {
-    if (resolveForeachParent(def, nodeId))
-      continue;
-    const step = await getLatestStepForNode(runId, nodeId);
-    if (!step)
-      continue;
-    if (step.output !== undefined) {
-      const node = def.nodes.find((candidate) => candidate.id === nodeId);
-      if (node && registry.has(node.type)) {
-        const executor = registry.get(node.type);
-        const parseResult = executor.outputSchema.safeParse(step.output);
-        if (!parseResult.success) {
-          console.warn(`[workflow] Recovery: step ${nodeId} output failed validation: ${parseResult.error.message}`);
-          continue;
-        }
-      }
-      ctx[nodeId] = step.output;
-    }
-    latestSteps.set(nodeId, step);
-  }
-  return { completedNodeIds, latestSteps };
-}
-function getAllPredecessors(def, nodeId) {
-  const preds = [];
-  for (const node of def.nodes) {
-    if (!node.next)
-      continue;
-    if (getNextTargets(node.next).includes(nodeId)) {
-      preds.push(node.id);
-    }
-  }
-  return preds;
-}
-async function executeStep(def, runId, ctx, node, registry, workflowId, secretKeys = new Set, options = {}) {
-  const dedup = await getDbClient().transaction(async () => {
-    const run = await getWorkflowRun(runId);
-    if (!run || run.status !== "running" && run.status !== "waiting") {
-      return { halted: true };
-    }
-    const iteration = await getStepCountForNode(runId, node.id);
-    const idempotencyKey = `${runId}:${node.id}:${iteration}`;
-    const existingStep2 = await getStepByIdempotencyKey(idempotencyKey);
-    if (existingStep2 && (existingStep2.status === "completed" || existingStep2.status === "waiting")) {
-      return { existingStep: existingStep2, stepId: existingStep2.id, deduped: true };
-    }
-    const latestForeachStep = node.type === "foreach" ? await getLatestStepForNode(runId, node.id) : undefined;
-    const reusableForeachStep = latestForeachStep && !FOREACH_TERMINAL_STEP_STATUSES.has(latestForeachStep.status) ? latestForeachStep : undefined;
-    const stepId2 = reusableForeachStep?.id ?? crypto.randomUUID();
-    if (!reusableForeachStep) {
-      await createWorkflowRunStep({
-        id: stepId2,
-        runId,
-        nodeId: node.id,
-        nodeType: node.type,
-        input: redactSecretsForStorage(ctx, secretKeys),
-        idempotencyKey
-      });
-    }
-    return { existingStep: existingStep2, stepId: stepId2, deduped: false };
-  });
-  if ("halted" in dedup)
-    return { outcome: "completed", successors: [] };
-  if (dedup.deduped && dedup.existingStep) {
-    if (dedup.existingStep.status === "completed") {
-      ctx[node.id] = dedup.existingStep.output;
-      const successors2 = getSuccessors(def, node.id);
-      return { outcome: "completed", successors: successors2 };
-    }
-    return { outcome: "waiting", successors: [] };
-  }
-  const existingStep = dedup.existingStep;
-  const stepId = dedup.stepId;
-  const executor = registry.get(node.type);
-  const interpolationCtx = buildNodeInterpolationCtx(node, ctx);
-  if (node.inputSchema) {
-    const inputErrors = validateJsonSchema(node.inputSchema, interpolationCtx);
-    if (inputErrors.length > 0) {
-      const errorMsg = `Input schema validation failed: ${inputErrors.join("; ")}`;
-      await checkpointStepFailure(runId, stepId, errorMsg, 0);
-      throw new Error(errorMsg);
-    }
-  }
-  const {
-    value: interpolatedValue,
-    unresolved,
-    scriptBodyUnresolved
-  } = interpolateNodeConfig(node, interpolationCtx);
-  const interpolatedConfig = interpolatedValue;
-  const executionCtx = { ...ctx, ...interpolationCtx };
-  if (scriptBodyUnresolved && scriptBodyUnresolved.length > 0) {
-    const errorMsg = scriptBodyInterpolationError(node.id, scriptBodyUnresolved);
-    await checkpointStepFailure(runId, stepId, errorMsg, 0);
-    return { outcome: "failed", successors: [] };
-  }
-  if (unresolved.length > 0) {
-    console.warn(`[workflow] Step ${node.id}: unresolved interpolation tokens: ${unresolved.join(", ")}`);
-    await updateWorkflowRunStep(stepId, {
-      diagnostics: JSON.stringify({ unresolvedTokens: unresolved })
-    });
-  }
-  const meta = {
-    runId,
-    stepId,
-    nodeId: node.id,
-    workflowId: workflowId || "",
-    dryRun: false,
-    requestedByUserId: options.requestedByUserId,
-    inputCtx: interpolationCtx
-  };
-  const configuredTimeoutMs = typeof node.config?.timeoutMs === "number" ? node.config.timeoutMs : node.type === "script" && typeof node.config?.timeout === "number" ? node.config.timeout : undefined;
-  const timeoutMs = configuredTimeoutMs ?? DEFAULT_TIMEOUT_MS;
-  let result;
-  try {
-    result = await Promise.race([
-      executor.run({
-        config: interpolatedConfig,
-        context: executionCtx,
-        meta
-      }),
-      timeoutPromise(timeoutMs)
-    ]);
-  } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : String(err);
-    const retryPolicy = node.retry || executor.retryPolicy;
-    const currentRetryCount = existingStep?.retryCount || 0;
-    const { shouldRetry } = await checkpointStepFailure(runId, stepId, errorMsg, currentRetryCount, retryPolicy);
-    if (!shouldRetry) {
-      throw err;
-    }
-    return { outcome: "completed", successors: [] };
-  }
-  if (result.status === "failed") {
-    const retryPolicy = node.retry || executor.retryPolicy;
-    const currentRetryCount = existingStep?.retryCount || 0;
-    const { shouldRetry } = await checkpointStepFailure(runId, stepId, result.error || "Executor returned failed status", currentRetryCount, retryPolicy);
-    if (result.output !== undefined) {
-      await updateWorkflowRunStep(stepId, { output: result.output });
-    }
-    if (!shouldRetry) {
-      throw new Error(result.error || "Step execution failed");
-    }
-    return { outcome: "completed", successors: [] };
-  }
-  if ("async" in result && result.async) {
-    const waiting = await checkpointStepWaiting(runId, stepId, ctx);
-    return { outcome: waiting ? "waiting" : "completed", successors: [] };
-  }
-  if (node.outputSchema && result.status === "success") {
-    const outputErrors = validateJsonSchema(node.outputSchema, result.output);
-    if (outputErrors.length > 0) {
-      const errorMsg = `Output schema validation failed: ${outputErrors.join("; ")}`;
-      await checkpointStepFailure(runId, stepId, errorMsg, 0);
-      throw new Error(errorMsg);
-    }
-  }
-  let validationResult;
-  if (node.validation) {
-    validationResult = await runStepValidation(registry, node, result.output, executionCtx, meta);
-    if (validationResult.outcome === "halt") {
-      const errorMsg = "Validation failed (mustPass)";
-      await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, { markRunFailed: false });
-      return { outcome: "failed", successors: [] };
-    }
-    if (validationResult.outcome === "retry") {
-      if (validationResult.retryContext) {
-        const historyKey = `${node.id}_validations`;
-        const existing = ctx[historyKey] || [];
-        ctx[historyKey] = [...existing, validationResult.retryContext];
-      }
-      const retryPolicy = node.validation.retry || node.retry;
-      const currentRetryCount = existingStep?.retryCount || 0;
-      await checkpointStepFailure(runId, stepId, "Validation failed, retrying", currentRetryCount, retryPolicy);
-      return { outcome: "completed", successors: [] };
-    }
-  }
-  if (validationResult?.passed !== undefined && !result.nextPort && node.next && typeof node.next === "object" && !Array.isArray(node.next)) {
-    result.nextPort = validationResult.passed ? "pass" : "fail";
-  }
-  await checkpointStep(runId, stepId, node.id, result, ctx);
-  const successors = result.nextPort ? getSuccessors(def, node.id, result.nextPort) : getSuccessors(def, node.id);
-  return { outcome: "completed", successors };
-}
-function findReadyNodes(def, completedNodeIds, activeEdges) {
-  const predecessors = new Map;
-  for (const node of def.nodes) {
-    if (!predecessors.has(node.id)) {
-      predecessors.set(node.id, new Set);
-    }
-  }
-  for (const node of def.nodes) {
-    if (!node.next)
-      continue;
-    for (const target of getNextTargets(node.next)) {
-      if (!predecessors.has(target)) {
-        predecessors.set(target, new Set);
-      }
-      predecessors.get(target).add(node.id);
-    }
-  }
-  return def.nodes.filter((node) => {
-    if (completedNodeIds.has(node.id))
-      return false;
-    const preds = predecessors.get(node.id);
-    if (!preds || preds.size === 0)
-      return true;
-    if (activeEdges) {
-      const activePreds = [...preds].filter((predId) => activeEdges.has(`${predId}→${node.id}`));
-      if (activePreds.length === 0)
-        return false;
-      return activePreds.every((pred) => completedNodeIds.has(pred));
-    }
-    for (const pred of preds) {
-      if (!completedNodeIds.has(pred))
-        return false;
-    }
-    return true;
-  });
-}
-function buildNodeInterpolationCtx(node, ctx) {
-  const interpolationCtx = {};
-  if (ctx.trigger !== undefined)
-    interpolationCtx.trigger = ctx.trigger;
-  if (ctx.input !== undefined)
-    interpolationCtx.input = ctx.input;
-  if (ctx.workflow !== undefined)
-    interpolationCtx.workflow = ctx.workflow;
-  if (ctx.swarm !== undefined)
-    interpolationCtx.swarm = ctx.swarm;
-  if (ctx.run !== undefined)
-    interpolationCtx.run = ctx.run;
-  if (!node.inputs)
-    return interpolationCtx;
-  for (const [localName, sourcePath] of Object.entries(node.inputs)) {
-    const keys = sourcePath.split(".");
-    let value = ctx;
-    for (const key of keys) {
-      if (value == null || typeof value !== "object") {
-        value = undefined;
-        break;
-      }
-      value = value[key];
-    }
-    interpolationCtx[localName] = value;
-  }
-  return interpolationCtx;
-}
-var SCRIPT_BODY_ALLOWED_SOURCES = new Set(["input", "workflow", "swarm", "run"]);
-function buildScriptBodyCtx(node, interpolationCtx) {
-  const aliases = node.inputs ?? {};
-  const safe = {};
-  for (const [key, value] of Object.entries(interpolationCtx)) {
-    const sourcePath = aliases[key];
-    const root = sourcePath === undefined ? key : sourcePath.split(".")[0] ?? "";
-    if (SCRIPT_BODY_ALLOWED_SOURCES.has(root))
-      safe[key] = value;
-  }
-  return safe;
-}
-function interpolateNodeConfig(node, interpolationCtx) {
-  if (node.type === "foreach" && Object.hasOwn(node.config, "over")) {
-    const { over, body, ...configWithoutOverAndBody } = node.config;
-    const configResult2 = deepInterpolate(configWithoutOverAndBody, interpolationCtx);
-    const overResult = deepInterpolate(over, interpolationCtx, { preserveRawTokens: true });
-    return {
-      value: {
-        ...configResult2.value,
-        over: overResult.value,
-        body
-      },
-      unresolved: [...configResult2.unresolved, ...overResult.unresolved]
-    };
-  }
-  if (node.type === "script" && typeof node.config.script === "string") {
-    const { script, ...configWithoutScript } = node.config;
-    const restResult = deepInterpolate(configWithoutScript, interpolationCtx);
-    const scriptResult = deepInterpolate(script, buildScriptBodyCtx(node, interpolationCtx));
-    return {
-      value: {
-        ...restResult.value,
-        script: scriptResult.unresolved.length > 0 ? script : scriptResult.value
-      },
-      unresolved: [...restResult.unresolved, ...scriptResult.unresolved],
-      scriptBodyUnresolved: scriptResult.unresolved
-    };
-  }
-  if (node.type !== "swarm-script" || !Object.hasOwn(node.config, "args")) {
-    return deepInterpolate(node.config, interpolationCtx);
-  }
-  const { args, ...configWithoutArgs } = node.config;
-  const configResult = deepInterpolate(configWithoutArgs, interpolationCtx);
-  const argsResult = deepInterpolate(args, interpolationCtx, { preserveRawTokens: true });
-  return {
-    value: {
-      ...configResult.value,
-      args: argsResult.value
-    },
-    unresolved: [...configResult.unresolved, ...argsResult.unresolved]
-  };
-}
-function scriptBodyInterpolationError(nodeId, tokens) {
-  const renderedTokens = [...new Set(tokens)].map((token) => `{{${token}}}`).join(", ");
-  return `Script body interpolation failed for node "${nodeId}": unresolved or disallowed token(s): ${renderedTokens}. ` + "Executable source may interpolate only input, workflow, swarm, or run values. " + "Pass dynamic trigger or upstream values through config.args and read them from argv.";
-}
-function timeoutPromise(ms) {
-  return new Promise((_, reject) => {
-    setTimeout(() => reject(new Error(`Step timed out after ${ms}ms`)), ms);
-  });
-}
-
-// src/workflows/index.ts
-init_event_bus();
-
-// src/workflows/recovery.ts
-init_db();
-
-// src/workflows/constants.ts
-var FAILED_TASK_OUTPUT_PREFIX = "[FAILED:";
-
-// src/workflows/resume.ts
-init_db();
-init_secret_scrubber();
-
-// src/workflows/approval-notifications.ts
-init_db();
-init_secret_scrubber();
-async function postApprovalCancellationUpdates(approvals, reason, client = getSlackApp()?.client) {
-  if (!client)
-    return;
-  const text = `This approval is no longer actionable: ${reason}`;
-  for (const approval of approvals) {
-    const channels = approval.notificationChannels;
-    const slackThreads = (channels ?? []).filter((notification) => notification.channel === "slack" && notification.messageTs);
-    if (slackThreads.length === 0)
-      continue;
-    for (const notification of slackThreads) {
-      if (notification.channel !== "slack" || !notification.messageTs)
-        continue;
-      const notificationKey = `${notification.target}:${notification.messageTs}`;
-      const claim = await claimApprovalCancellationNotification(approval.id, notificationKey);
-      if (!claim)
-        continue;
-      try {
-        await client.chat.postMessage({
-          channel: notification.target,
-          thread_ts: notification.messageTs,
-          text,
-          unfurl_links: false,
-          unfurl_media: false
-        });
-        await completeApprovalCancellationNotificationClaim(approval.id, notificationKey, claim.leaseToken);
-      } catch (error) {
-        await releaseApprovalCancellationNotificationClaim(approval.id, notificationKey, claim.leaseToken);
-        console.error(`[HITL] Failed to post cancellation update for approval ${approval.id}:`, scrubSecrets(error instanceof Error ? error.message : String(error)));
-      }
-    }
-  }
-}
-
-// src/workflows/resume.ts
-init_event_bus();
-
-// src/workflows/executors/wait.ts
-init_zod();
-
-// src/workflows/wait-filter.ts
-var PARAM_SHADOW_KEYS = [
-  "require",
-  "process",
-  "Bun",
-  "globalThis",
-  "global",
-  "fetch",
-  "setTimeout",
-  "setInterval"
-];
-var PARAM_SHADOW_VALUES = PARAM_SHADOW_KEYS.map(() => {
-  return;
-});
-var BODY_SHADOW_KEYS = ["eval", "Function", "AsyncFunction"];
-var BODY_SHADOW_PREAMBLE = BODY_SHADOW_KEYS.map((k) => `var ${k} = undefined;`).join(" ");
-var FILTER_TIMEOUT_MS = 50;
-function getByDotPath(obj, path) {
-  if (obj === null || typeof obj !== "object") {
-    return { found: false, value: undefined };
-  }
-  const segments = path.split(".");
-  let cursor = obj;
-  for (const seg of segments) {
-    if (cursor === null || typeof cursor !== "object") {
-      return { found: false, value: undefined };
-    }
-    const rec = cursor;
-    if (!(seg in rec)) {
-      return { found: false, value: undefined };
-    }
-    cursor = rec[seg];
-  }
-  return { found: true, value: cursor };
-}
-function deepEqual(a, b) {
-  if (a === b)
-    return true;
-  if (typeof a !== typeof b)
-    return false;
-  if (a === null || b === null)
-    return false;
-  if (Array.isArray(a)) {
-    if (!Array.isArray(b))
-      return false;
-    if (a.length !== b.length)
-      return false;
-    for (let i = 0;i < a.length; i++) {
-      if (!deepEqual(a[i], b[i]))
-        return false;
-    }
-    return true;
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const aKeys = Object.keys(a);
-    const bKeys = Object.keys(b);
-    if (aKeys.length !== bKeys.length)
-      return false;
-    for (const k of aKeys) {
-      if (!deepEqual(a[k], b[k])) {
-        return false;
-      }
-    }
-    return true;
-  }
-  return false;
-}
-function matchObjectFilter(payload, filter) {
-  for (const [key, expected] of Object.entries(filter)) {
-    const { found, value } = getByDotPath(payload, key);
-    if (!found)
-      return false;
-    if (!deepEqual(value, expected))
-      return false;
-  }
-  return true;
-}
-async function runWithTimeout(fn) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const timer = setTimeout(() => {
-      if (settled)
-        return;
-      settled = true;
-      resolve(null);
-    }, FILTER_TIMEOUT_MS);
-    queueMicrotask(() => {
-      if (settled)
-        return;
-      try {
-        const v = fn();
-        if (v !== null && typeof v === "object" && typeof v.then === "function") {
-          v.catch(() => {});
-          settled = true;
-          clearTimeout(timer);
-          resolve({ __asyncRejected: true });
-          return;
-        }
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        resolve(v);
-      } catch {
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        resolve(null);
-      }
-    });
-  });
-}
-var ASYNC_SENTINEL = "__asyncRejected";
-function isAsyncSentinel(value) {
-  return value !== null && typeof value === "object" && value[ASYNC_SENTINEL] === true;
-}
-function compileStringFilter(filter) {
-  if (filter.length > 2048) {
-    throw new Error(`wait filter source exceeds 2KB cap (${filter.length} bytes)`);
-  }
-  let fn;
-  try {
-    fn = new Function(...PARAM_SHADOW_KEYS, "payload", `${BODY_SHADOW_PREAMBLE} return (${filter})(payload);`);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(`wait filter compile error: ${msg}`);
-  }
-  return (payload) => fn(...PARAM_SHADOW_VALUES, payload);
-}
-function nullifyPrototypes(value) {
-  if (value === null || typeof value !== "object")
-    return value;
-  if (Array.isArray(value)) {
-    return value.map(nullifyPrototypes);
-  }
-  const out = Object.create(null);
-  for (const [k, v] of Object.entries(value)) {
-    out[k] = nullifyPrototypes(v);
-  }
-  return out;
-}
-async function matchesFilter(payload, filter) {
-  if (filter === undefined || filter === null)
-    return true;
-  if (typeof filter === "object" && !Array.isArray(filter)) {
-    return matchObjectFilter(payload, filter);
-  }
-  if (typeof filter === "string") {
-    let userFn;
-    try {
-      userFn = compileStringFilter(filter);
-    } catch {
-      return false;
-    }
-    let cloned;
-    try {
-      const cloneOnce = structuredClone(payload);
-      cloned = nullifyPrototypes(cloneOnce);
-    } catch {
-      try {
-        cloned = nullifyPrototypes(payload);
-      } catch {
-        cloned = payload;
-      }
-    }
-    const result = await runWithTimeout(() => userFn(cloned));
-    if (result === null)
-      return false;
-    if (isAsyncSentinel(result))
-      return false;
-    return !!result;
-  }
-  return false;
-}
-
-// src/workflows/executors/base.ts
-class BaseExecutor {
-  deps;
-  retryPolicy;
-  constructor(deps) {
-    this.deps = deps;
-  }
-  async run(input) {
-    const configResult = this.configSchema.safeParse(input.config);
-    if (!configResult.success) {
-      return {
-        status: "failed",
-        error: `Input validation failed: ${configResult.error.message}`
-      };
-    }
-    let result;
-    try {
-      result = await this.execute(configResult.data, input.context, input.meta);
-    } catch (err) {
-      return {
-        status: "failed",
-        error: `Executor threw: ${err instanceof Error ? err.message : String(err)}`
-      };
-    }
-    if (result.status === "success" && result.output !== undefined) {
-      const outputResult = this.outputSchema.safeParse(result.output);
-      if (!outputResult.success) {
-        return {
-          status: "failed",
-          error: `Output validation failed: ${outputResult.error.message}`
-        };
-      }
-    }
-    return result;
-  }
-}
-
-// src/workflows/executors/wait.ts
-var WaitConfigSchema = exports_external.discriminatedUnion("mode", [
-  exports_external.object({
-    mode: exports_external.literal("time"),
-    durationMs: exports_external.number().int().min(1).max(31536000000).describe("Wait duration in milliseconds (effective resolution ~5s)")
-  }),
-  exports_external.object({
-    mode: exports_external.literal("event"),
-    eventName: exports_external.string().min(1),
-    filter: exports_external.union([exports_external.record(exports_external.string(), exports_external.unknown()), exports_external.string().max(2048)]).optional(),
-    scope: exports_external.enum(["run", "global"]).default("run"),
-    timeoutMs: exports_external.number().int().min(1).max(31536000000).optional().describe("Timeout in milliseconds (effective resolution ~5s) — when reached, routes via 'timeout' port")
-  })
-]);
-var WaitOutputSchema = exports_external.object({
-  waitId: exports_external.string().uuid(),
-  mode: exports_external.enum(["time", "event"]),
-  firedAt: exports_external.string().nullable(),
-  payload: exports_external.unknown().optional()
-});
-
-class WaitExecutor extends BaseExecutor {
-  type = "wait";
-  mode = "async";
-  configSchema = WaitConfigSchema;
-  outputSchema = WaitOutputSchema;
-  async execute(config, _context, meta) {
-    const { db } = this.deps;
-    const existing = await db.getWaitStateByStepId(meta.stepId);
-    if (existing) {
-      if (existing.status !== "pending") {
-        const nextPort = computeNextPort(existing.mode, existing.status);
-        return {
-          status: "success",
-          output: {
-            waitId: existing.id,
-            mode: existing.mode,
-            firedAt: existing.resolvedAt,
-            payload: existing.firedPayload ?? undefined
-          },
-          nextPort
-        };
-      }
-      return {
-        status: "success",
-        async: true,
-        waitFor: "wait.fired",
-        correlationId: existing.id
-      };
-    }
-    if (config.mode === "time") {
-      const waitId2 = crypto.randomUUID();
-      const wakeUpAt = new Date(Date.now() + config.durationMs).toISOString();
-      await db.createWaitState({
-        id: waitId2,
-        workflowRunId: meta.runId,
-        workflowRunStepId: meta.stepId,
-        mode: "time",
-        wakeUpAt
-      });
-      return {
-        status: "success",
-        async: true,
-        waitFor: "wait.fired",
-        correlationId: waitId2
-      };
-    }
-    if (typeof config.filter === "string") {
-      compileStringFilter(config.filter);
-    }
-    const waitId = crypto.randomUUID();
-    const expiresAt = config.timeoutMs ? new Date(Date.now() + config.timeoutMs).toISOString() : null;
-    await db.createWaitState({
-      id: waitId,
-      workflowRunId: meta.runId,
-      workflowRunStepId: meta.stepId,
-      mode: "event",
-      eventName: config.eventName,
-      eventFilter: config.filter ?? null,
-      expiresAt,
-      scope: config.scope
-    });
-    subscribeWaitToBus(waitId, config.eventName);
-    return {
-      status: "success",
-      async: true,
-      waitFor: "wait.fired",
-      correlationId: waitId
-    };
-  }
-}
-function computeNextPort(mode, status) {
-  if (mode === "time")
-    return "default";
-  return status === "timeout" ? "timeout" : "event";
-}
-
-// src/workflows/task-step-routing.ts
-init_db();
-async function failStepAndRunIfWaiting(stepId, runId, reason) {
-  const now = new Date().toISOString();
-  return await getDbClient().transaction(async () => {
-    const current = await getWorkflowRunStep(stepId);
-    if (!current || current.status !== "waiting")
-      return false;
-    await updateWorkflowRunStep(stepId, {
-      status: "failed",
-      error: reason,
-      finishedAt: now
-    });
-    await updateWorkflowRun(runId, {
-      status: "failed",
-      error: reason,
-      finishedAt: now
-    });
-    return true;
-  });
-}
-async function checkpointPortStepAndResolveSuccessors(def, runId, stepId, nodeId, output, nextPort, ctx) {
-  return await getDbClient().transaction(async () => {
-    const current = await getWorkflowRunStep(stepId);
-    if (!current || current.status !== "waiting")
-      return { claimed: false, successors: [] };
-    await checkpointStep(runId, stepId, nodeId, { output, nextPort }, ctx);
-    await updateWorkflowRun(runId, { status: "running" });
-    return { claimed: true, successors: getSuccessors(def, nodeId, nextPort) };
-  });
-}
-var UNCLAIMED = {
-  claimed: false,
-  foreachChild: false,
-  joined: false,
-  successors: []
-};
-async function completeTaskStepAndResolveSuccessors(def, runId, step, output, ctx, failureReason) {
-  return await getDbClient().transaction(async () => {
-    const current = await getWorkflowRunStep(step.id);
-    if (!current || current.status !== "waiting")
-      return UNCLAIMED;
-    const foreachParent = resolveForeachParent(def, step.nodeId);
-    if (foreachParent) {
-      await updateWorkflowRunStep(step.id, {
-        status: "completed",
-        output,
-        ...failureReason !== undefined ? { error: failureReason } : {},
-        finishedAt: new Date().toISOString()
-      });
-      const join = await joinForeach(def, runId, step, ctx);
-      await updateWorkflowRun(runId, { status: "running" });
-      return {
-        claimed: true,
-        foreachChild: true,
-        joined: join.joined,
-        successors: join.successors
-      };
-    }
-    await checkpointStep(runId, step.id, step.nodeId, { output }, ctx);
-    await updateWorkflowRun(runId, { status: "running" });
-    return {
-      claimed: true,
-      foreachChild: false,
-      joined: true,
-      successors: getSuccessors(def, step.nodeId)
-    };
-  });
-}
-
-// src/workflows/resume.ts
-function setupWorkflowResumeListener(eventBus, registry) {
-  const onTaskCompleted = async (data) => {
-    try {
-      const event = data;
-      if (!event.workflowRunId || !event.workflowRunStepId)
-        return;
-      await resumeFromTaskCompletion(event, registry);
-    } catch (err) {
-      console.error("[workflows] Resume from task completion failed:", err);
-    }
-  };
-  eventBus.on("task.completed", onTaskCompleted);
-  const onTaskFailed = async (data) => {
-    try {
-      const event = data;
-      if (!event.workflowRunId || !event.workflowRunStepId)
-        return;
-      await handleTaskFailure(event, event.failureReason ?? "Task failed", registry);
-    } catch (err) {
-      console.error("[workflows] Handle task failure error:", err);
-    }
-  };
-  eventBus.on("task.failed", onTaskFailed);
-  const onTaskCancelled = async (data) => {
-    try {
-      const event = data;
-      if (!event.workflowRunId || !event.workflowRunStepId)
-        return;
-      await handleTaskFailure(event, "Task was cancelled", registry);
-    } catch (err) {
-      console.error("[workflows] Handle task cancellation error:", err);
-    }
-  };
-  eventBus.on("task.cancelled", onTaskCancelled);
-  const onApprovalResolved = async (data) => {
-    try {
-      const event = data;
-      if (!event.workflowRunId || !event.workflowRunStepId)
-        return;
-      await resumeFromApprovalResolution(event, registry);
-    } catch (err) {
-      console.error("[workflows] Resume from approval resolution failed:", err);
-    }
-  };
-  eventBus.on("approval.resolved", onApprovalResolved);
-  return () => {
-    eventBus.off("task.completed", onTaskCompleted);
-    eventBus.off("task.failed", onTaskFailed);
-    eventBus.off("task.cancelled", onTaskCancelled);
-    eventBus.off("approval.resolved", onApprovalResolved);
-  };
-}
-async function resumeFromTaskCompletion(event, registry) {
-  const run = await getWorkflowRun(event.workflowRunId);
-  if (!run || run.status !== "waiting" && run.status !== "running")
-    return;
-  const step = await getWorkflowRunStep(event.workflowRunStepId);
-  if (!step || step.status !== "waiting")
-    return;
-  if (await isStaleTaskEvent(step.id, event))
-    return;
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    return;
-  const ctx = run.context ?? {};
-  let taskOutput = event.output;
-  if (event.output) {
-    try {
-      const parsed = JSON.parse(event.output);
-      if (typeof parsed === "object" && parsed !== null) {
-        taskOutput = parsed;
-      }
-    } catch {}
-  }
-  const stepOutput = { taskId: event.taskId, taskOutput };
-  const routing = await completeTaskStepAndResolveSuccessors(workflow.definition, run.id, step, stepOutput, ctx);
-  if (!routing.claimed)
-    return;
-  const successors = routing.successors;
-  if (successors.length > 0) {
-    const secretKeys = getSecretInputKeys(workflow.input);
-    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
-  } else {
-    await finalizeOrWait(run.id);
-  }
-}
-async function finalizeOrWait(runId) {
-  await getDbClient().transaction(async () => {
-    const steps = await getWorkflowRunStepsByRunId(runId);
-    const hasWaiting = steps.some((s) => s.status === "waiting");
-    if (hasWaiting) {
-      await updateWorkflowRun(runId, { status: "waiting" });
-    } else {
-      await updateWorkflowRun(runId, {
-        status: "completed",
-        finishedAt: new Date().toISOString()
-      });
-    }
-  });
-}
-async function handleTaskFailure(event, reason, registry) {
-  const run = await getWorkflowRun(event.workflowRunId);
-  if (!run || run.status !== "waiting" && run.status !== "running")
-    return;
-  const step = await getWorkflowRunStep(event.workflowRunStepId);
-  if (!step || step.status !== "waiting")
-    return;
-  if (await isStaleTaskEvent(step.id, event))
-    return;
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    return;
-  const onFailure = workflow.definition.onNodeFailure ?? "fail";
-  if (onFailure === "fail") {
-    await markRunFailed(event, reason);
-    return;
-  }
-  const ctx = run.context ?? {};
-  const stepOutput = {
-    taskId: event.taskId,
-    taskOutput: `${FAILED_TASK_OUTPUT_PREFIX} ${reason}] This node failed or was cancelled.`
-  };
-  const routing = await completeTaskStepAndResolveSuccessors(workflow.definition, run.id, step, stepOutput, ctx, reason);
-  if (!routing.claimed)
-    return;
-  const successors = routing.successors;
-  if (successors.length > 0) {
-    const secretKeys = getSecretInputKeys(workflow.input);
-    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
-  } else {
-    await finalizeOrWait(run.id);
-  }
-}
-async function isStaleTaskEvent(stepId, event) {
-  if (!event.taskId)
-    return false;
-  const boundTask = await getTaskByWorkflowRunStepId(stepId);
-  return boundTask != null && boundTask.id !== event.taskId;
-}
-async function markRunFailed(event, reason) {
-  await failStepAndRunIfWaiting(event.workflowRunStepId, event.workflowRunId, reason);
-}
-async function retryFailedRun(runId, registry) {
-  const run = await getWorkflowRun(runId);
-  if (!run || run.status !== "failed")
-    throw new Error("Run is not in failed state");
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    throw new Error("Workflow not found");
-  const steps = await getWorkflowRunStepsByRunId(runId);
-  const failedStep = steps.find((s) => s.status === "failed");
-  if (!failedStep)
-    throw new Error("No failed step found");
-  const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
-  const { activeEdges } = await loadCompletedStepRouting(workflow.definition, runId, completedNodeIds);
-  const foreachParent = resolveForeachParent(workflow.definition, failedStep.nodeId);
-  const failedNode = foreachParent ?? workflow.definition.nodes.find((n) => n.id === failedStep.nodeId);
-  if (!failedNode)
-    throw new Error(`Node ${failedStep.nodeId} not found in workflow definition`);
-  const hasStructuralPredecessor = workflow.definition.nodes.some((node) => node.next && getNextTargets(node.next).includes(failedNode.id));
-  const hasActivePredecessor = [...activeEdges].some((edge) => edge.endsWith(`→${failedNode.id}`));
-  const shouldRetryFailedNode = foreachParent != null || !hasStructuralPredecessor || hasActivePredecessor;
-  const ctx = run.context ?? {};
-  const claimed = await getDbClient().transaction(async () => {
-    const current = await getWorkflowRun(runId);
-    if (!current || current.status !== "failed")
-      return false;
-    await updateWorkflowRunStep(failedStep.id, {
-      status: shouldRetryFailedNode ? "pending" : "cancelled",
-      error: shouldRetryFailedNode ? null : "Skipped on retry because its branch was not active"
-    });
-    await updateWorkflowRun(runId, { status: "running", error: null, context: ctx });
-    return true;
-  });
-  if (!claimed)
-    throw new Error("Run is not in failed state");
-  const readyNodes = findReadyNodes(workflow.definition, completedNodeIds, activeEdges);
-  const nodesToRun = !shouldRetryFailedNode || readyNodes.some((n) => n.id === failedNode.id) ? readyNodes : [failedNode, ...readyNodes];
-  const secretKeys = getSecretInputKeys(workflow.input);
-  await walkGraph(workflow.definition, runId, ctx, nodesToRun, registry, workflow.id, secretKeys);
-}
-async function cancelWorkflowRun(runId, reason) {
-  const run = await getWorkflowRun(runId);
-  if (!run)
-    throw new Error("Workflow run not found");
-  const terminalStatuses = ["completed", "failed", "cancelled", "skipped"];
-  if (terminalStatuses.includes(run.status) && run.status !== "cancelled") {
-    throw new Error(`Cannot cancel run in '${run.status}' state`);
-  }
-  const now = new Date().toISOString();
-  const cancelReason = reason ?? "Cancelled by user";
-  let applied = false;
-  await getDbClient().transaction(async () => {
-    const current = await getWorkflowRun(runId);
-    if (!current || terminalStatuses.includes(current.status))
-      return;
-    applied = true;
-    const steps = await getWorkflowRunStepsByRunId(runId);
-    for (const step of steps) {
-      if (terminalStatuses.includes(step.status))
-        continue;
-      const task = await getTaskByWorkflowRunStepId(step.id);
-      if (task) {
-        await cancelTask(task.id, cancelReason);
-      }
-      await updateWorkflowRunStep(step.id, {
-        status: "cancelled",
-        error: cancelReason,
-        finishedAt: now
-      });
-    }
-    await cancelPendingApprovalRequestsForRun(runId, cancelReason);
-    await updateWorkflowRun(runId, {
-      status: "cancelled",
-      error: cancelReason,
-      finishedAt: now
-    });
-  });
-  const cancelledApprovals = await listCancelledApprovalRequestsForRun(runId);
-  const latestRun = await getWorkflowRun(runId);
-  if (!applied && latestRun?.status !== "cancelled") {
-    throw new Error(`Cannot cancel run in '${latestRun?.status ?? "missing"}' state`);
-  }
-  await postApprovalCancellationUpdates(cancelledApprovals, applied ? cancelReason : latestRun?.error ?? cancelReason);
-}
-async function resumeFromApprovalResolution(event, registry) {
-  const run = await getWorkflowRun(event.workflowRunId);
-  if (!run || run.status !== "waiting" && run.status !== "running")
-    return;
-  const step = await getWorkflowRunStep(event.workflowRunStepId);
-  if (!step || step.status !== "waiting")
-    return;
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    return;
-  const ctx = run.context ?? {};
-  const nextPort = event.status === "timeout" ? "timeout" : event.status === "rejected" ? "rejected" : "approved";
-  const stepOutput = {
-    requestId: event.requestId,
-    status: event.status,
-    responses: event.responses
-  };
-  const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, stepOutput, nextPort, ctx);
-  if (!routing.claimed)
-    return;
-  const successors = routing.successors;
-  if (successors.length > 0) {
-    const secretKeys = getSecretInputKeys(workflow.input);
-    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
-  } else {
-    await finalizeOrWait(run.id);
-  }
-}
-async function resumeWaitState(waitId, status, payload, registry) {
-  const cappedPayload = capPayload(payload);
-  const result = await resolveWaitState(waitId, { status, firedPayload: cappedPayload });
-  if (!result.updated || !result.row)
-    return;
-  const waitRow = result.row;
-  const run = await getWorkflowRun(waitRow.workflowRunId);
-  if (!run || run.status !== "waiting" && run.status !== "running")
-    return;
-  const step = await getWorkflowRunStep(waitRow.workflowRunStepId);
-  if (!step || step.status !== "waiting")
-    return;
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    return;
-  const nextPort = computeNextPort(waitRow.mode, status);
-  const ctx = run.context ?? {};
-  const stepOutput = {
-    waitId: waitRow.id,
-    mode: waitRow.mode,
-    firedAt: waitRow.resolvedAt,
-    payload: cappedPayload === undefined ? undefined : cappedPayload
-  };
-  const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, stepOutput, nextPort, ctx);
-  if (!routing.claimed)
-    return;
-  if (waitRow.mode === "event" && waitRow.eventName) {
-    pruneWaitFromBus(waitRow.id, waitRow.eventName);
-  }
-  const successors = routing.successors;
-  if (successors.length > 0) {
-    const secretKeys = getSecretInputKeys(workflow.input);
-    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
-  } else {
-    await finalizeOrWait(run.id);
-  }
-}
-var FIRED_PAYLOAD_BYTE_CAP = 64 * 1024;
-function capPayload(payload) {
-  if (payload === undefined || payload === null)
-    return payload;
-  let encoded;
-  try {
-    encoded = JSON.stringify(payload);
-  } catch {
-    return { truncated: true, reason: "non-serializable" };
-  }
-  if (encoded.length <= FIRED_PAYLOAD_BYTE_CAP) {
-    return payload;
-  }
-  const summary = encoded.slice(0, 1024);
-  return {
-    truncated: true,
-    originalSize: encoded.length,
-    summary
-  };
-}
-var waitsByEvent = new Map;
-var listenersByEvent = new Map;
-var busRegistry = null;
-async function initWaitBusSubscriptions(registry) {
-  busRegistry = registry;
-  const pendingNames = await collectPendingEventNames();
-  for (const name of pendingNames) {
-    const pending = await getPendingWaitsByEvent(name);
-    for (const w of pending) {
-      registerWait(w.id, name);
-    }
-  }
-}
-async function collectPendingEventNames() {
-  return new Set(await getPendingEventWaitNames());
-}
-function subscribeWaitToBus(waitId, eventName) {
-  registerWait(waitId, eventName);
-}
-function registerWait(waitId, eventName) {
-  let set = waitsByEvent.get(eventName);
-  if (!set) {
-    set = new Set;
-    waitsByEvent.set(eventName, set);
-  }
-  set.add(waitId);
-  if (!listenersByEvent.has(eventName)) {
-    const listener = (data) => {
-      processBusEvent(eventName, data).catch((err) => {
-        console.error(`[workflows] Wait bus listener failed for event=${eventName}:`, scrubSecrets(err instanceof Error ? err.message : String(err)));
-      });
-    };
-    listenersByEvent.set(eventName, listener);
-    workflowEventBus.on(eventName, listener);
-  }
-}
-function pruneWaitFromBus(waitId, eventName) {
-  const set = waitsByEvent.get(eventName);
-  if (!set)
-    return;
-  set.delete(waitId);
-  if (set.size === 0) {
-    waitsByEvent.delete(eventName);
-    const listener = listenersByEvent.get(eventName);
-    if (listener) {
-      workflowEventBus.off(eventName, listener);
-      listenersByEvent.delete(eventName);
-    }
-  }
-}
-async function processBusEvent(eventName, payload) {
-  const set = waitsByEvent.get(eventName);
-  if (!set || set.size === 0)
-    return;
-  if (!busRegistry)
-    return;
-  const waitIds = [...set];
-  for (const waitId of waitIds) {
-    try {
-      const row = await getWaitStateById(waitId);
-      if (!row || row.status !== "pending") {
-        set.delete(waitId);
-        continue;
-      }
-      if (row.eventScope === "run") {
-        if (!isPayloadInRun(payload, row.workflowRunId))
-          continue;
-      }
-      const ok = await matchesFilter(payload, row.eventFilter ?? undefined);
-      if (!ok)
-        continue;
-      await resumeWaitState(waitId, "fired", payload, busRegistry);
-    } catch (err) {
-      console.error(`[workflows] Wait bus listener failed for wait=${waitId} event=${eventName}:`, err);
-    }
-  }
-  if (set.size === 0) {
-    waitsByEvent.delete(eventName);
-    const listener = listenersByEvent.get(eventName);
-    if (listener) {
-      workflowEventBus.off(eventName, listener);
-      listenersByEvent.delete(eventName);
-    }
-  }
-}
-function isPayloadInRun(payload, runId) {
-  if (typeof payload !== "object" || payload === null)
-    return false;
-  const rec = payload;
-  return rec._runId === runId || rec.workflowRunId === runId;
-}
-
-// src/workflows/recovery.ts
-async function recoverIncompleteRuns(registry) {
-  let recovered = 0;
-  recovered += await recoverRunningRuns(registry);
-  recovered += await recoverWaitingRuns(registry);
-  recovered += await recoverApprovalWaitingRuns(registry);
-  recovered += await recoverWaitStates(registry);
-  if (recovered > 0) {
-    console.log(`[workflows] Recovered ${recovered} incomplete run(s) on startup`);
-  }
-  return recovered;
-}
-async function recoverRunningRuns(registry) {
-  const runningRunIds = await getRunIdsByStatus("running");
-  let recovered = 0;
-  for (const runId of runningRunIds) {
-    try {
-      const run = await getWorkflowRun(runId);
-      if (!run || run.status !== "running")
-        continue;
-      const workflow = await getWorkflow(run.workflowId);
-      if (!workflow)
-        continue;
-      const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
-      const ctx = run.context ?? {};
-      const readyNodes = findReadyNodes(workflow.definition, completedNodeIds);
-      if (readyNodes.length === 0) {
-        await updateWorkflowRun(runId, {
-          status: "completed",
-          context: ctx,
-          finishedAt: new Date().toISOString()
-        });
-      } else {
-        const secretKeys = getSecretInputKeys(workflow.input);
-        await walkGraph(workflow.definition, runId, ctx, readyNodes, registry, workflow.id, secretKeys);
-      }
-      recovered++;
-    } catch (err) {
-      console.error(`[workflows] Failed to recover running run ${runId}:`, err);
-    }
-  }
-  return recovered;
-}
-async function recoverWaitingRuns(registry) {
-  const stuckRuns = await getStuckWorkflowRuns();
-  let recovered = 0;
-  for (const stuck of stuckRuns) {
-    try {
-      const run = await getWorkflowRun(stuck.runId);
-      const workflow = await getWorkflow(stuck.workflowId);
-      if (!run || run.status !== "waiting" || !workflow)
-        continue;
-      const taskCompleted = stuck.taskStatus === "completed";
-      if (!taskCompleted && (workflow.definition.onNodeFailure ?? "fail") === "fail") {
-        const reason2 = stuck.taskStatus === "failed" ? "Task failed (recovered)" : "Task cancelled (recovered)";
-        const claimed = await failStepAndRunIfWaiting(stuck.stepId, stuck.runId, reason2);
-        if (!claimed)
-          continue;
-        recovered++;
-        continue;
-      }
-      const ctx = run.context ?? {};
-      const reason = stuck.taskStatus === "failed" ? "Task failed (recovered)" : "Task cancelled (recovered)";
-      const stepOutput = {
-        taskId: stuck.taskId,
-        taskOutput: taskCompleted ? parseRecoveredTaskOutput(stuck.taskOutput) : `${FAILED_TASK_OUTPUT_PREFIX} ${reason}] This node failed or was cancelled.`
-      };
-      const step = await getWorkflowRunStep(stuck.stepId);
-      if (!step)
-        continue;
-      const routing = await completeTaskStepAndResolveSuccessors(workflow.definition, stuck.runId, step, stepOutput, ctx, taskCompleted ? undefined : reason);
-      if (!routing.claimed)
-        continue;
-      if (routing.foreachChild && !routing.joined) {
-        await finalizeOrWait(stuck.runId);
-      } else {
-        const secretKeys = getSecretInputKeys(workflow.input);
-        await walkGraph(workflow.definition, stuck.runId, ctx, routing.successors, registry, workflow.id, secretKeys);
-      }
-      recovered++;
-    } catch (err) {
-      console.error(`[workflows] Failed to recover waiting run ${stuck.runId}:`, err);
-    }
-  }
-  return recovered;
-}
-function parseRecoveredTaskOutput(output) {
-  if (output === null)
-    return null;
-  try {
-    const parsed = JSON.parse(output);
-    return typeof parsed === "object" && parsed !== null ? parsed : output;
-  } catch {
-    return output;
-  }
-}
-async function recoverApprovalWaitingRuns(registry) {
-  const stuckRuns = await getStuckApprovalRuns();
-  let recovered = 0;
-  for (const stuck of stuckRuns) {
-    try {
-      const run = await getWorkflowRun(stuck.runId);
-      const workflow = await getWorkflow(stuck.workflowId);
-      if (!run || !workflow)
-        continue;
-      let approvalStatus = stuck.approvalStatus;
-      let responses = stuck.approvalResponses ? JSON.parse(stuck.approvalResponses) : null;
-      if (approvalStatus === "pending" && stuck.expiresAt) {
-        await resolveApprovalRequest(stuck.approvalId, {
-          status: "timeout"
-        });
-        approvalStatus = "timeout";
-        responses = null;
-      }
-      const nextPort = approvalStatus === "timeout" ? "timeout" : approvalStatus === "rejected" ? "rejected" : "approved";
-      const ctx = run.context ?? {};
-      const stepOutput = {
-        requestId: stuck.approvalId,
-        status: approvalStatus,
-        responses
-      };
-      const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, stuck.runId, stuck.stepId, stuck.nodeId, stepOutput, nextPort, ctx);
-      if (!routing.claimed)
-        continue;
-      if (routing.successors.length > 0) {
-        const secretKeys = getSecretInputKeys(workflow.input);
-        await walkGraph(workflow.definition, stuck.runId, ctx, routing.successors, registry, workflow.id, secretKeys);
-      } else {
-        await finalizeOrWait(stuck.runId);
-      }
-      recovered++;
-    } catch (err) {
-      console.error(`[workflows] Failed to recover approval-waiting run ${stuck.runId}:`, err);
-    }
-  }
-  return recovered;
-}
-async function recoverWaitStates(registry) {
-  const stuckRuns = await getStuckWaitRuns();
-  let recovered = 0;
-  for (const stuck of stuckRuns) {
-    try {
-      let resumeStatus;
-      let payload;
-      if (stuck.waitStatus === "fired") {
-        resumeStatus = "fired";
-        payload = stuck.firedPayload != null ? safeJsonParse(stuck.firedPayload) : undefined;
-      } else if (stuck.waitStatus === "timeout") {
-        resumeStatus = "timeout";
-      } else {
-        resumeStatus = stuck.waitMode === "time" ? "fired" : "timeout";
-      }
-      await resumeWaitState(stuck.waitId, resumeStatus, payload, registry);
-      recovered++;
-    } catch (err) {
-      console.error(`[workflows] Failed to recover wait-state ${stuck.waitId}:`, err);
-    }
-  }
-  return recovered;
-}
-function safeJsonParse(s) {
-  try {
-    return JSON.parse(s);
-  } catch {
-    return s;
-  }
-}
-async function getRunIdsByStatus(status) {
-  const rows = await getDbClient().query("SELECT id FROM workflow_runs WHERE status = ?", [status]);
-  return rows.map((r) => r.id);
-}
-// src/workflows/retry-poller.ts
-init_db();
-var pollerTimeout = null;
-function startRetryPoller(registry, intervalMs = 5000) {
-  if (pollerTimeout !== null)
-    return;
-  async function poll() {
-    try {
-      const retryableSteps = await getRetryableSteps();
-      for (const step of retryableSteps) {
-        try {
-          const run = await getWorkflowRun(step.runId);
-          if (!run)
-            continue;
-          const workflow = await getWorkflow(run.workflowId);
-          if (!workflow)
-            continue;
-          const node = workflow.definition.nodes.find((n) => n.id === step.nodeId);
-          if (!node)
-            continue;
-          console.log(`[workflows] Retrying step ${step.nodeId} (attempt ${step.retryCount}) for run ${step.runId}`);
-          if (run.status === "failed") {
-            await updateWorkflowRun(run.id, {
-              status: "running",
-              error: undefined
-            });
-          }
-          await updateWorkflowRunStep(step.id, {
-            status: "running",
-            error: undefined,
-            nextRetryAt: undefined
-          });
-          const ctx = run.context ?? {};
-          if (!("run" in ctx))
-            ctx.run = { id: run.id };
-          await rehydrateCompletedStepOutputs(workflow.definition, run.id, ctx, registry);
-          const inputCtx = buildNodeInterpolationCtx(node, ctx);
-          const { value: interpolatedValue, scriptBodyUnresolved } = interpolateNodeConfig(node, inputCtx);
-          if (scriptBodyUnresolved && scriptBodyUnresolved.length > 0) {
-            await checkpointStepFailure(run.id, step.id, scriptBodyInterpolationError(node.id, scriptBodyUnresolved), step.retryCount);
-            continue;
-          }
-          const interpolatedConfig = interpolatedValue;
-          const executor = registry.get(node.type);
-          const meta = {
-            runId: run.id,
-            stepId: step.id,
-            nodeId: step.nodeId,
-            workflowId: workflow.id,
-            dryRun: false,
-            requestedByUserId: run.createdBy,
-            inputCtx
-          };
-          try {
-            const result = await executor.run({
-              config: interpolatedConfig,
-              context: ctx,
-              meta
-            });
-            if (result.status === "failed") {
-              const retryPolicy = node.retry || executor.retryPolicy;
-              await checkpointStepFailure(run.id, step.id, result.error || "Retry failed", step.retryCount, retryPolicy);
-            } else if ("async" in result && result.async) {
-              const waiting = await checkpointStepWaiting(run.id, step.id, ctx);
-              if (!waiting)
-                continue;
-            } else {
-              if (node.validation) {
-                const validationResult = await runStepValidation(registry, node, result.output, ctx, meta);
-                if (validationResult.outcome === "halt") {
-                  await checkpointStepFailure(run.id, step.id, "Validation failed (mustPass)", step.retryCount);
-                  continue;
-                }
-                if (validationResult.outcome === "retry") {
-                  if (validationResult.retryContext) {
-                    const historyKey = `${node.id}_validations`;
-                    const existing = ctx[historyKey] || [];
-                    ctx[historyKey] = [...existing, validationResult.retryContext];
-                  }
-                  const retryPolicy = node.validation.retry || node.retry;
-                  await checkpointStepFailure(run.id, step.id, "Validation failed, retrying", step.retryCount, retryPolicy);
-                  continue;
-                }
-              }
-              await checkpointStep(run.id, step.id, step.nodeId, result, ctx);
-              const port = result.nextPort || "default";
-              const successors = getSuccessors(workflow.definition, step.nodeId, port);
-              if (successors.length > 0) {
-                await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id);
-              } else {
-                await updateWorkflowRun(run.id, {
-                  status: "completed",
-                  context: ctx,
-                  finishedAt: new Date().toISOString()
-                });
-              }
-            }
-          } catch (err) {
-            const errorMsg = err instanceof Error ? err.message : String(err);
-            const retryPolicy = node.retry || executor.retryPolicy;
-            await checkpointStepFailure(run.id, step.id, errorMsg, step.retryCount, retryPolicy);
-          }
-        } catch (err) {
-          console.error(`[workflows] Retry failed for step ${step.id}:`, err);
-        }
-      }
-    } catch (err) {
-      console.error("[workflows] Retry poller error:", err);
-    }
-    pollerTimeout = setTimeout(poll, intervalMs);
-  }
-  pollerTimeout = setTimeout(poll, intervalMs);
-}
-function stopRetryPoller() {
-  if (pollerTimeout !== null) {
-    clearTimeout(pollerTimeout);
-    pollerTimeout = null;
-  }
-}
-// src/workflows/templates.ts
-function validateTemplateVariables(template, provided) {
-  const missing = [];
-  for (const variable of template.variables) {
-    if (variable.required && !(variable.name in provided)) {
-      if (variable.default === undefined) {
-        missing.push(variable.name);
-      }
-    }
-  }
-  return missing;
-}
-function instantiateTemplate(template, variables) {
-  const missing = validateTemplateVariables(template, variables);
-  if (missing.length > 0) {
-    throw new Error(`Missing required template variables: ${missing.join(", ")}`);
-  }
-  const resolved = {};
-  for (const variable of template.variables) {
-    if (variable.name in variables) {
-      resolved[variable.name] = variables[variable.name];
-    } else if (variable.default !== undefined) {
-      resolved[variable.name] = variable.default;
-    }
-  }
-  const cloned = JSON.parse(JSON.stringify(template.definition));
-  return replaceVariables(cloned, resolved);
-}
-function replaceVariables(obj, variables) {
-  if (typeof obj === "string") {
-    return replaceStringPlaceholders(obj, variables);
-  }
-  if (Array.isArray(obj)) {
-    return obj.map((item) => replaceVariables(item, variables));
-  }
-  if (obj !== null && typeof obj === "object") {
-    const result = {};
-    for (const [key, value] of Object.entries(obj)) {
-      result[key] = replaceVariables(value, variables);
-    }
-    return result;
-  }
-  return obj;
-}
-function replaceStringPlaceholders(template, variables) {
-  return template.replace(/\{\{(\w+)\}\}/g, (_match, name) => {
-    const value = variables[name];
-    if (value === undefined)
-      return _match;
-    if (typeof value === "object" && value !== null)
-      return JSON.stringify(value);
-    return String(value);
-  });
-}
-// src/workflows/triggers.ts
-init_db();
-import crypto2 from "node:crypto";
-var DEFAULT_HMAC_HEADER = "X-Hub-Signature-256";
-var FALLBACK_HMAC_HEADERS = ["x-hub-signature-256", "x-signature", "x-webhook-signature"];
-function getHeader(headers, name) {
-  const target = name.toLowerCase();
-  for (const [key, value] of Object.entries(headers)) {
-    if (key.toLowerCase() === target) {
-      return Array.isArray(value) ? value[0] : value;
-    }
-  }
-  return;
-}
-function resolveSignature(headers, hmacHeader) {
-  for (const name of [hmacHeader, ...FALLBACK_HMAC_HEADERS]) {
-    const value = getHeader(headers, name);
-    if (value)
-      return value;
-  }
-  return;
-}
-async function resolveHmacSecret(raw) {
-  if (/^secret\..+$/.test(raw) || /^\$\{.+\}$/.test(raw)) {
-    try {
-      return await resolveInputValue(raw);
-    } catch (err) {
-      throw new WebhookError(`Failed to resolve webhook HMAC secret: ${err instanceof Error ? err.message : String(err)}`, 500);
-    }
-  }
-  return raw;
-}
-async function verifyWebhookRequest(trigger, rawBody, headers) {
-  if (!trigger.hmacSecret) {
-    if (trigger.verification) {
-      throw new WebhookError("Webhook trigger has `verification` configured but no `hmacSecret`; refusing to accept unverified requests", 500);
-    }
-    return;
-  }
-  const secret = await resolveHmacSecret(trigger.hmacSecret);
-  const verification = trigger.verification;
-  if (!verification) {
-    const hmacHeader = trigger.hmacHeader || DEFAULT_HMAC_HEADER;
-    const signature2 = resolveSignature(headers, hmacHeader);
-    if (!signature2) {
-      throw new WebhookError("Missing signature", 401);
-    }
-    if (!verifyHmacSignature(secret, rawBody, signature2)) {
-      throw new WebhookError("Invalid signature", 401);
-    }
-    return;
-  }
-  const header = verification.header || DEFAULT_HMAC_HEADER;
-  const signature = getHeader(headers, header);
-  if (!signature) {
-    throw new WebhookError("Missing signature", 401);
-  }
-  let isValid = false;
-  switch (verification.format) {
-    case "hmac-sha256":
-      isValid = verifyHmacSignature(secret, rawBody, signature);
-      break;
-    case "timestamped-hmac-sha256":
-      isValid = verifyTimestampedHmacSignature(secret, rawBody, signature, {
-        timestampKey: verification.timestampKey,
-        signatureKey: verification.signatureKey,
-        toleranceSeconds: verification.toleranceSeconds
-      });
-      break;
-    case "token-equality":
-      isValid = verifyTokenEquality(secret, signature);
-      break;
-  }
-  if (!isValid) {
-    throw new WebhookError("Invalid signature", 401);
-  }
-}
-async function handleWebhookTrigger(workflowId, payload, headers, registry, options = {}) {
-  const workflow = await getWorkflow(workflowId);
-  if (!workflow) {
-    throw new WebhookError("Workflow not found", 404);
-  }
-  if (!workflow.enabled) {
-    throw new WebhookError("Workflow is disabled", 400);
-  }
-  const webhookTrigger = workflow.triggers.find((t) => t.type === "webhook");
-  if (!webhookTrigger) {
-    if (!options.alreadyAuthenticated) {
-      throw new WebhookError("Workflow does not declare a webhook trigger", 404);
-    }
-  } else {
-    await verifyWebhookRequest(webhookTrigger, typeof payload === "string" ? payload : JSON.stringify(payload), headers);
-  }
-  const triggerData = parseTriggerPayload(payload);
-  const runId = await startWorkflowExecution(workflow, triggerData, registry, {
-    triggerType: "event",
-    requestedByUserId: options.requestedByUserId
-  });
-  return { runId };
-}
-function parseTriggerPayload(payload) {
-  if (typeof payload !== "string" || payload.length === 0)
-    return payload;
-  try {
-    return JSON.parse(payload);
-  } catch {
-    return payload;
-  }
-}
-async function logOpenWebhookTriggers() {
-  try {
-    const open = (await listWorkflows({ enabled: true })).filter((workflow) => workflow.triggers.some((trigger) => trigger.type === "webhook" && !trigger.hmacSecret && !trigger.verification));
-    if (open.length === 0)
-      return;
-    console.log(`[workflows] ${open.length} enabled workflow(s) expose an open (unsigned) webhook trigger — ` + "anyone with the URL can start them, which is a supported opt-in. " + "Set `hmacSecret` on a trigger to require a signature: " + open.map((workflow) => `${workflow.name} (${workflow.id})`).join(", "));
-  } catch (err) {
-    console.error("[workflows] Failed to inventory open webhook triggers:", err);
-  }
-}
-async function handleEventTrigger(eventName, payload, registry) {
-  const workflows = (await listWorkflows({ enabled: true })).filter((workflow) => workflow.triggers.some((trigger) => trigger.type === "event" && trigger.eventName === eventName));
-  const runIds = [];
-  for (const workflow of workflows) {
-    const runId = await startWorkflowExecution(workflow, payload, registry, {
-      triggerType: "event"
-    });
-    runIds.push(runId);
-  }
-  return runIds;
-}
-async function handleScheduleTrigger(scheduleId, schedule, registry) {
-  const workflows = await getWorkflowsByScheduleId(scheduleId);
-  if (workflows.length === 0)
-    return [];
-  const runIds = [];
-  for (const workflow of workflows) {
-    const triggerData = {
-      scheduleId,
-      scheduleName: schedule.name,
-      firedAt: new Date().toISOString()
-    };
-    const runId = await startWorkflowExecution(workflow, triggerData, registry, {
-      triggerType: "schedule",
-      requestedByUserId: schedule.createdBy
-    });
-    runIds.push(runId);
-    console.log(`[Triggers] Schedule "${schedule.name}" triggered workflow "${workflow.name}" (run: ${runId})`);
-  }
-  return runIds;
-}
-function verifyHmacSignature(secret, body, providedSignature) {
-  const hmac = crypto2.createHmac("sha256", secret);
-  hmac.update(body);
-  const expectedHex = hmac.digest("hex");
-  const normalizedProvided = providedSignature.startsWith("sha256=") ? providedSignature.slice(7) : providedSignature;
-  try {
-    return crypto2.timingSafeEqual(Buffer.from(normalizedProvided, "hex"), Buffer.from(expectedHex, "hex"));
-  } catch {
-    return false;
-  }
-}
-function verifyTimestampedHmacSignature(secret, body, headerValue, opts = {}, nowMs = Date.now()) {
-  const timestampKey = opts.timestampKey ?? "t";
-  const signatureKey = opts.signatureKey ?? "v1";
-  const toleranceSeconds = opts.toleranceSeconds ?? 300;
-  const parsed = parseSignatureHeader(headerValue);
-  const timestampValue = parsed.get(timestampKey)?.[0];
-  const signatures = parsed.get(signatureKey) ?? [];
-  if (!timestampValue || signatures.length === 0 || !/^\d+$/.test(timestampValue)) {
-    return false;
-  }
-  const timestampSeconds = Number(timestampValue);
-  if (!Number.isSafeInteger(timestampSeconds)) {
-    return false;
-  }
-  const ageSeconds = Math.abs(nowMs / 1000 - timestampSeconds);
-  if (ageSeconds > toleranceSeconds) {
-    return false;
-  }
-  const hmac = crypto2.createHmac("sha256", secret);
-  hmac.update(`${timestampValue}.${body}`);
-  const expectedHex = hmac.digest("hex");
-  const expected = Buffer.from(expectedHex, "hex");
-  return signatures.some((signature) => timingSafeEqualHex(signature, expected));
-}
-function verifyTokenEquality(secret, providedToken) {
-  const secretDigest = crypto2.createHash("sha256").update(secret).digest();
-  const providedDigest = crypto2.createHash("sha256").update(providedToken).digest();
-  return crypto2.timingSafeEqual(providedDigest, secretDigest);
-}
-function parseSignatureHeader(headerValue) {
-  const parsed = new Map;
-  for (const part of headerValue.split(",")) {
-    const trimmed = part.trim();
-    const separatorIndex = trimmed.indexOf("=");
-    if (separatorIndex <= 0)
-      continue;
-    const key = trimmed.slice(0, separatorIndex).trim();
-    const value = trimmed.slice(separatorIndex + 1).trim();
-    const values = parsed.get(key) ?? [];
-    values.push(value);
-    parsed.set(key, values);
-  }
-  return parsed;
-}
-function timingSafeEqualHex(providedHex, expected) {
-  try {
-    return crypto2.timingSafeEqual(Buffer.from(providedHex, "hex"), expected);
-  } catch {
-    return false;
-  }
-}
-
-class WebhookError extends Error {
-  statusCode;
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
-    this.name = "WebhookError";
-  }
-}
-// src/workflows/version.ts
-init_db();
-async function snapshotWorkflow(workflowId, changedByAgentId) {
-  const workflow = await getWorkflow(workflowId);
-  if (!workflow) {
-    throw new Error(`Workflow ${workflowId} not found — cannot create snapshot`);
-  }
-  const existingVersions = await getWorkflowVersions(workflowId);
-  const maxVersion = existingVersions.length > 0 ? existingVersions[0].version : 0;
-  const nextVersion = maxVersion + 1;
-  const snapshot = {
-    name: workflow.name,
-    description: workflow.description,
-    definition: workflow.definition,
-    triggers: workflow.triggers,
-    cooldown: workflow.cooldown,
-    input: workflow.input,
-    triggerSchema: workflow.triggerSchema,
-    params: workflow.params,
-    requiredParams: workflow.requiredParams,
-    requires: workflow.requires,
-    dir: workflow.dir,
-    vcsRepo: workflow.vcsRepo,
-    enabled: workflow.enabled
-  };
-  return createWorkflowVersion({
-    workflowId,
-    version: nextVersion,
-    snapshot,
-    changedByAgentId
-  });
-}
-async function snapshotAndUpdateWorkflow(workflowId, updates, opts = {}) {
-  return await getDbClient().transaction(async () => {
-    let version = null;
-    if (opts.snapshotOptional) {
-      try {
-        version = await snapshotWorkflow(workflowId, opts.changedByAgentId);
-      } catch {}
-    } else {
-      version = await snapshotWorkflow(workflowId, opts.changedByAgentId);
-    }
-    const workflow = await updateWorkflow(workflowId, updates);
-    return { workflow, version };
-  });
-}
-// src/workflows/wait-poller.ts
-init_db();
-var pollerTimeout2 = null;
-function startWaitPoller(registry, intervalMs = 5000) {
-  if (pollerTimeout2 !== null)
-    return;
-  async function poll() {
-    try {
-      const dueWaits = await getDueWaitStates();
-      for (const wait of dueWaits) {
-        try {
-          const kind = wait.mode === "time" ? "fired" : "timeout";
-          await resumeWaitState(wait.id, kind, undefined, registry);
-        } catch (err) {
-          console.error(`[workflows] Wait poller failed for wait ${wait.id}:`, err);
-        }
-      }
-    } catch (err) {
-      console.error("[workflows] Wait poller tick error:", err);
-    }
-    pollerTimeout2 = setTimeout(poll, intervalMs);
-  }
-  pollerTimeout2 = setTimeout(poll, intervalMs);
-}
-function stopWaitPoller() {
-  if (pollerTimeout2 !== null) {
-    clearTimeout(pollerTimeout2);
-    pollerTimeout2 = null;
-  }
-}
-
-// src/workflows/index.ts
-init_db();
-init_secret_scrubber();
-init_event_bus();
-
-// src/workflows/executors/registry.ts
-init_zod();
-
-// src/workflows/executors/agent-task.ts
-init_zod();
-init_context_key();
-init_types();
-var AgentTaskConfigSchema = exports_external.object({
-  template: exports_external.string(),
-  agentId: exports_external.string().optional(),
-  routingReason: RoutingReasonSchema.optional(),
-  routingNote: exports_external.string().max(200).optional(),
-  tags: exports_external.array(exports_external.string()).optional(),
-  priority: exports_external.number().int().min(0).max(100).optional(),
-  offerMode: exports_external.boolean().optional(),
-  dir: exports_external.string().min(1).optional(),
-  vcsRepo: exports_external.string().min(1).optional(),
-  model: exports_external.string().min(1).optional(),
-  modelTier: ModelTierSchema.optional(),
-  effort: ReasoningEffortSchema.optional(),
-  parentTaskId: exports_external.string().uuid().optional(),
-  requestedByUserId: exports_external.string().optional(),
-  outputSchema: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
-  followUpConfig: FollowUpConfigSchema.optional()
-});
-var AgentTaskOutputSchema = exports_external.object({
-  taskId: exports_external.string().uuid(),
-  taskOutput: exports_external.unknown()
-});
-
-class AgentTaskExecutor extends BaseExecutor {
-  type = "agent-task";
-  mode = "async";
-  configSchema = AgentTaskConfigSchema;
-  outputSchema = AgentTaskOutputSchema;
-  async execute(config, _context, meta) {
-    const { db } = this.deps;
-    const existingTask = await db.getTaskByWorkflowRunStepId(meta.stepId);
-    if (existingTask) {
-      if (existingTask.status === "completed") {
-        return {
-          status: "success",
-          output: {
-            taskId: existingTask.id,
-            taskOutput: existingTask.output
-          }
-        };
-      }
-      return {
-        status: "success",
-        async: true,
-        waitFor: "task.completed",
-        correlationId: existingTask.id
-      };
-    }
-    let effectiveDir = config.dir;
-    let effectiveVcsRepo = config.vcsRepo;
-    let effectiveKey;
-    if (meta.workflowId) {
-      const workflow = await db.getWorkflow(meta.workflowId);
-      if (workflow) {
-        if (!effectiveDir && workflow.dir)
-          effectiveDir = workflow.dir;
-        if (!effectiveVcsRepo && workflow.vcsRepo)
-          effectiveVcsRepo = workflow.vcsRepo;
-        effectiveKey = workflow.key;
-      }
-    }
-    const { description: taskDescription, options: taskOptions } = await withSiblingAwareness(config.template, {
-      key: effectiveKey,
-      agentId: config.agentId ?? null,
-      routingReason: config.routingReason ?? (config.agentId ? "human_pinned" : undefined),
-      routingNote: config.routingNote,
-      routingSource: config.routingReason ? "declared" : config.agentId ? "engine_default" : undefined,
-      source: "workflow",
-      tags: config.tags,
-      priority: config.priority,
-      offeredTo: config.offerMode ? config.agentId : undefined,
-      workflowRunId: meta.runId,
-      workflowRunStepId: meta.stepId,
-      dir: effectiveDir,
-      vcsRepo: effectiveVcsRepo,
-      ...splitLegacyModelAlias({ model: config.model, modelTier: config.modelTier }),
-      effort: config.effort,
-      parentTaskId: config.parentTaskId,
-      requestedByUserId: config.requestedByUserId ?? meta.requestedByUserId,
-      outputSchema: config.outputSchema,
-      followUpConfig: config.followUpConfig,
-      contextKey: workflowContextKey({ workflowRunId: meta.runId })
-    });
-    const task = await db.createTaskExtended(taskDescription, taskOptions);
-    return {
-      status: "success",
-      async: true,
-      waitFor: "task.completed",
-      correlationId: task.id
-    };
-  }
-}
-
-// src/workflows/executors/code-match.ts
-init_zod();
-var CodeMatchConfigSchema = exports_external.object({
-  code: exports_external.string(),
-  outputPorts: exports_external.array(exports_external.string()).min(1)
-});
-var CodeMatchOutputSchema = exports_external.object({
-  port: exports_external.string(),
-  rawResult: exports_external.unknown()
-});
-var SANDBOX_KEYS = [
-  "require",
-  "process",
-  "Bun",
-  "globalThis",
-  "global",
-  "fetch",
-  "setTimeout",
-  "setInterval"
-];
-var SANDBOX_VALUES = SANDBOX_KEYS.map(() => {
-  return;
-});
-
-class CodeMatchExecutor extends BaseExecutor {
-  type = "code-match";
-  mode = "instant";
-  configSchema = CodeMatchConfigSchema;
-  outputSchema = CodeMatchOutputSchema;
-  async execute(config, context, _meta) {
-    try {
-      const fn = new Function(...SANDBOX_KEYS, "input", `"use strict"; return (${config.code})(input);`);
-      const rawResult = fn(...SANDBOX_VALUES, context);
-      let port;
-      if (typeof rawResult === "boolean") {
-        port = rawResult ? "true" : "false";
-      } else if (typeof rawResult === "string") {
-        port = rawResult;
-      } else {
-        port = String(rawResult);
-      }
-      if (!config.outputPorts.includes(port)) {
-        return {
-          status: "failed",
-          error: `code-match returned "${port}" which is not in outputPorts: [${config.outputPorts.join(", ")}]`
-        };
-      }
-      return {
-        status: "success",
-        output: { port, rawResult },
-        nextPort: port
-      };
-    } catch (err) {
-      return {
-        status: "failed",
-        error: `code-match execution error: ${err instanceof Error ? err.message : String(err)}`
-      };
-    }
-  }
-}
-
-// src/workflows/executors/foreach.ts
-init_zod();
-init_template();
-var ForeachBodySchema = exports_external.object({
-  type: exports_external.literal("agent-task"),
-  config: exports_external.record(exports_external.string(), exports_external.unknown())
-});
-var ForeachConfigSchema = exports_external.object({
-  over: exports_external.array(exports_external.record(exports_external.string(), exports_external.unknown())),
-  itemKey: exports_external.string().min(1),
-  body: ForeachBodySchema,
-  concurrency: exports_external.never().optional()
-});
-var ForeachResultSchema = exports_external.object({
-  itemKey: exports_external.string(),
-  status: exports_external.enum(["completed", "failed", "cancelled", "skipped"]),
-  output: exports_external.unknown().optional()
-});
-var ForeachOutputSchema = exports_external.object({
-  results: exports_external.array(ForeachResultSchema),
-  okCount: exports_external.number().int().nonnegative(),
-  failedCount: exports_external.number().int().nonnegative()
-});
-
-class ForeachExecutor extends BaseExecutor {
-  type = "foreach";
-  mode = "async";
-  configSchema = ForeachConfigSchema;
-  outputSchema = ForeachOutputSchema;
-  async execute(config, context, meta) {
-    if (config.over.length === 0) {
-      return {
-        status: "success",
-        output: { results: [], okCount: 0, failedCount: 0 }
-      };
-    }
-    const items = config.over.map((item, index) => {
-      const rawItemKey = item[config.itemKey];
-      if (typeof rawItemKey !== "string" || rawItemKey.length === 0) {
-        throw new Error(`foreach item at index ${index} is missing non-empty string itemKey property "${config.itemKey}"`);
-      }
-      return { item, index, itemKey: rawItemKey };
-    });
-    const seenItemKeys = new Set;
-    for (const { itemKey } of items) {
-      if (seenItemKeys.has(itemKey)) {
-        throw new Error(`foreach itemKey "${itemKey}" is duplicated`);
-      }
-      seenItemKeys.add(itemKey);
-    }
-    const agentTaskExecutor = new AgentTaskExecutor(this.deps);
-    const runSteps = await this.deps.db.getWorkflowRunStepsByRunId(meta.runId);
-    const childStepsByNodeId = new Map(runSteps.filter((step) => parseSyntheticNodeId(step.nodeId)?.parentNodeId === meta.nodeId).map((step) => [step.nodeId, step]));
-    const childCountToCreate = items.filter(({ itemKey }) => !childStepsByNodeId.has(`${meta.nodeId}#${itemKey}`)).length;
-    const maxSteps = getMaxWorkflowStepsPerRun();
-    const workflow = await this.deps.db.getWorkflow(meta.workflowId);
-    const hasSuccessors = workflow ? getSuccessors(workflow.definition, meta.nodeId).length > 0 : true;
-    const totalSteps = runSteps.length + childCountToCreate;
-    const capBreached = hasSuccessors ? totalSteps >= maxSteps : totalSteps > maxSteps;
-    if (childCountToCreate > 0 && capBreached) {
-      return {
-        status: "failed",
-        error: `foreach would reach ${maxSteps} total steps (WORKFLOW_MAX_STEPS_PER_RUN): ${runSteps.length} existing + ${childCountToCreate} children${hasSuccessors ? " leaves no room for the post-join walk" : " exceeds the per-run cap"}`
-      };
-    }
-    for (const { index, itemKey } of items) {
-      const childNodeId = `${meta.nodeId}#${itemKey}`;
-      if (childStepsByNodeId.has(childNodeId))
-        continue;
-      const childStepId = crypto.randomUUID();
-      const childStep = await this.deps.db.createWorkflowRunStep({
-        id: childStepId,
-        runId: meta.runId,
-        nodeId: childNodeId,
-        nodeType: "agent-task",
-        input: { itemKey, index }
-      });
-      await this.deps.db.updateWorkflowRunStep(childStepId, {
-        idempotencyKey: `${meta.runId}:${childNodeId}:0`
-      });
-      childStepsByNodeId.set(childNodeId, childStep);
-    }
-    for (const { item, index, itemKey } of items) {
-      const childNodeId = `${meta.nodeId}#${itemKey}`;
-      const childStep = childStepsByNodeId.get(childNodeId);
-      if (FOREACH_TERMINAL_STEP_STATUSES.has(childStep.status))
-        continue;
-      const bodyCtx = { ...meta.inputCtx ?? context, item, index };
-      const childInterpolation = deepInterpolate(config.body.config, bodyCtx);
-      if (childInterpolation.unresolved.length > 0) {
-        console.warn(`[workflow] Step ${childNodeId}: unresolved interpolation tokens: ${childInterpolation.unresolved.join(", ")}`);
-        await this.deps.db.updateWorkflowRunStep(childStep.id, {
-          diagnostics: JSON.stringify({ unresolvedTokens: childInterpolation.unresolved })
-        });
-      }
-      const linkedTask = await this.deps.db.getTaskByWorkflowRunStepId(childStep.id);
-      if (linkedTask?.status === "failed" || linkedTask?.status === "cancelled") {
-        await this.deps.db.detachTaskFromWorkflowRunStep(linkedTask.id);
-      }
-      const childResult = await agentTaskExecutor.run({
-        config: childInterpolation.value,
-        context,
-        meta: {
-          ...meta,
-          stepId: childStep.id,
-          nodeId: childNodeId
-        }
-      });
-      if (childResult.status !== "success") {
-        throw new Error(childResult.error ?? `foreach child "${itemKey}" failed to start`);
-      }
-      if ("async" in childResult) {
-        await this.deps.db.updateWorkflowRunStep(childStep.id, { status: "waiting" });
-      } else {
-        await this.deps.db.updateWorkflowRunStep(childStep.id, {
-          status: "completed",
-          output: normalizeExistingTaskOutput(childResult.output),
-          finishedAt: new Date().toISOString()
-        });
-      }
-    }
-    const childSteps = (await this.deps.db.getWorkflowRunStepsByRunId(meta.runId)).filter((step) => parseSyntheticNodeId(step.nodeId)?.parentNodeId === meta.nodeId);
-    if (childSteps.every((step) => FOREACH_TERMINAL_STEP_STATUSES.has(step.status))) {
-      return { status: "success", output: buildForeachAggregate(childSteps) };
-    }
-    return {
-      status: "success",
-      async: true,
-      waitFor: "task.completed",
-      correlationId: meta.stepId
-    };
-  }
-}
-function normalizeExistingTaskOutput(output) {
-  if (typeof output !== "object" || output === null)
-    return output;
-  const record = output;
-  if (typeof record.taskOutput !== "string")
-    return output;
-  try {
-    const parsed = JSON.parse(record.taskOutput);
-    if (typeof parsed === "object" && parsed !== null) {
-      return { ...record, taskOutput: parsed };
-    }
-  } catch {}
-  return output;
-}
-
-// src/workflows/executors/human-in-the-loop.ts
-init_zod();
-init_constants();
-init_secret_scrubber();
-var SelectOptionSchema = exports_external.object({
-  value: exports_external.string(),
-  label: exports_external.string(),
-  description: exports_external.string().optional()
-});
-var QuestionSchema = exports_external.discriminatedUnion("type", [
-  exports_external.object({
-    id: exports_external.string(),
-    type: exports_external.literal("approval"),
-    label: exports_external.string(),
-    required: exports_external.boolean().default(true),
-    description: exports_external.string().optional()
-  }),
-  exports_external.object({
-    id: exports_external.string(),
-    type: exports_external.literal("text"),
-    label: exports_external.string(),
-    required: exports_external.boolean().default(true),
-    description: exports_external.string().optional(),
-    placeholder: exports_external.string().optional(),
-    multiline: exports_external.boolean().optional()
-  }),
-  exports_external.object({
-    id: exports_external.string(),
-    type: exports_external.literal("single-select"),
-    label: exports_external.string(),
-    required: exports_external.boolean().default(true),
-    description: exports_external.string().optional(),
-    options: exports_external.array(SelectOptionSchema)
-  }),
-  exports_external.object({
-    id: exports_external.string(),
-    type: exports_external.literal("multi-select"),
-    label: exports_external.string(),
-    required: exports_external.boolean().default(true),
-    description: exports_external.string().optional(),
-    options: exports_external.array(SelectOptionSchema),
-    minSelections: exports_external.number().int().min(0).optional(),
-    maxSelections: exports_external.number().int().min(1).optional()
-  }),
-  exports_external.object({
-    id: exports_external.string(),
-    type: exports_external.literal("boolean"),
-    label: exports_external.string(),
-    required: exports_external.boolean().default(true),
-    description: exports_external.string().optional(),
-    defaultValue: exports_external.boolean().optional()
-  })
-]);
-var ApproverConfigSchema = exports_external.object({
-  users: exports_external.array(exports_external.string()).optional(),
-  roles: exports_external.array(exports_external.string()).optional(),
-  policy: exports_external.union([exports_external.literal("any"), exports_external.literal("all"), exports_external.object({ min: exports_external.number().int().min(1) })])
-});
-var NotificationConfigSchema = exports_external.object({
-  channel: exports_external.enum(["slack", "email"]),
-  target: exports_external.string()
-});
-var HITLConfigSchema = exports_external.object({
-  title: exports_external.string(),
-  questions: exports_external.array(QuestionSchema).min(1),
-  approvers: ApproverConfigSchema,
-  timeout: exports_external.object({
-    seconds: exports_external.number().int().min(1),
-    action: exports_external.literal("reject")
-  }).optional(),
-  notifications: exports_external.array(NotificationConfigSchema).optional()
-});
-var HITLOutputSchema = exports_external.object({
-  requestId: exports_external.string().uuid(),
-  status: exports_external.string(),
-  responses: exports_external.record(exports_external.string(), exports_external.unknown()).nullable()
-});
-
-class HumanInTheLoopExecutor extends BaseExecutor {
-  type = "human-in-the-loop";
-  mode = "async";
-  configSchema = HITLConfigSchema;
-  outputSchema = HITLOutputSchema;
-  async execute(config, _context, meta) {
-    const { db } = this.deps;
-    const existing = await db.getApprovalRequestByStepId(meta.stepId);
-    if (existing) {
-      if (existing.status !== "pending") {
-        if (existing.status === "cancelled") {
-          return {
-            status: "failed",
-            error: `Approval request was cancelled: ${existing.resolutionReason ?? "workflow run cancelled"}`
-          };
-        }
-        const nextPort = existing.status === "timeout" ? "timeout" : existing.status === "rejected" ? "rejected" : "approved";
-        return {
-          status: "success",
-          output: {
-            requestId: existing.id,
-            status: existing.status,
-            responses: existing.responses
-          },
-          nextPort
-        };
-      }
-      return {
-        status: "success",
-        async: true,
-        waitFor: "approval.resolved",
-        correlationId: existing.id
-      };
-    }
-    const requestId = crypto.randomUUID();
-    const created = await db.createApprovalRequest({
-      id: requestId,
-      title: config.title,
-      questions: config.questions,
-      approvers: config.approvers,
-      workflowRunId: meta.runId,
-      workflowRunStepId: meta.stepId,
-      timeoutSeconds: config.timeout?.seconds,
-      notificationChannels: config.notifications,
-      createdBy: meta.requestedByUserId,
-      requireActionableWorkflow: true
-    });
-    if (created.status === "cancelled") {
-      return {
-        status: "success",
-        async: true,
-        waitFor: "approval.resolved",
-        correlationId: requestId
-      };
-    }
-    if (config.notifications?.length) {
-      this.dispatchNotifications(requestId, config, db).catch((err) => {
-        console.error("[HITL] Unexpected error dispatching notifications:", scrubSecrets(err instanceof Error ? err.message : String(err)));
-      });
-    }
-    return {
-      status: "success",
-      async: true,
-      waitFor: "approval.resolved",
-      correlationId: requestId
-    };
-  }
-  async dispatchNotifications(requestId, config, db) {
-    if (!config.notifications?.length)
-      return;
-    const approvalUrl = `${getAppUrl()}/approval-requests/${requestId}`;
-    const updatedChannels = [...config.notifications];
-    let updated = false;
-    for (let i = 0;i < config.notifications.length; i++) {
-      const notification = config.notifications[i];
-      if (notification.channel === "email") {
-        console.warn(`[HITL] Email notifications not yet supported (target: ${notification.target})`);
-        continue;
-      }
-      if (notification.channel === "slack") {
-        try {
-          const { getSlackApp: getSlackApp2 } = await import("./app-dty7p9hg.js");
-          const slackApp = getSlackApp2();
-          if (!slackApp) {
-            console.warn("[HITL] Slack not initialized — cannot send notification");
-            continue;
-          }
-          const questionsSummary = config.questions.map((q) => `• ${q.label}`).join(`
-`);
-          const timeoutText = config.timeout ? `
-⏱ _Timeout: ${formatTimeout(config.timeout.seconds)} — auto-rejects if not responded_` : "";
-          const blocks = [
-            {
-              type: "section",
-              text: {
-                type: "mrkdwn",
-                text: `\uD83D\uDD14 *Approval Required: ${config.title}*`
-              }
-            },
-            {
-              type: "section",
-              text: {
-                type: "mrkdwn",
-                text: `*Questions:*
-${questionsSummary}${timeoutText}`
-              }
-            },
-            {
-              type: "actions",
-              elements: [
-                {
-                  type: "button",
-                  text: { type: "plain_text", text: "Review & Respond" },
-                  url: approvalUrl,
-                  style: "primary"
-                }
-              ]
-            }
-          ];
-          const result = await slackApp.client.chat.postMessage({
-            channel: notification.target,
-            text: `Approval Required: ${config.title} — ${approvalUrl}`,
-            unfurl_links: false,
-            unfurl_media: false,
-            blocks
-          });
-          if (result.ts) {
-            updatedChannels[i] = { ...notification, messageTs: result.ts };
-            updated = true;
-          }
-          console.log(`[HITL] Slack notification sent to ${notification.target} for request ${requestId}`);
-        } catch (err) {
-          console.error(`[HITL] Failed to send Slack notification to ${notification.target}:`, scrubSecrets(err instanceof Error ? err.message : String(err)));
-        }
-      }
-    }
-    if (updated) {
-      try {
-        await db.updateApprovalRequestNotifications(requestId, updatedChannels);
-        const latest = await db.getApprovalRequestById(requestId);
-        if (latest?.status === "cancelled") {
-          await postApprovalCancellationUpdates([latest], latest.resolutionReason ?? "Workflow run cancelled");
-        }
-      } catch (err) {
-        console.error("[HITL] Failed to update notification channels in DB:", scrubSecrets(err instanceof Error ? err.message : String(err)));
-      }
-    }
-  }
-}
-function formatTimeout(seconds) {
-  if (seconds < 60)
-    return `${seconds}s`;
-  if (seconds < 3600)
-    return `${Math.round(seconds / 60)}m`;
-  const hours = Math.floor(seconds / 3600);
-  const mins = Math.round(seconds % 3600 / 60);
-  return mins > 0 ? `${hours}h ${mins}m` : `${hours}h`;
-}
-
-// src/workflows/executors/notify.ts
-init_zod();
-var NotifyConfigSchema = exports_external.object({
-  channel: exports_external.enum(["swarm", "slack", "email"]),
-  target: exports_external.string().optional(),
-  template: exports_external.string()
-});
-var NotifyOutputSchema = exports_external.object({
-  sent: exports_external.boolean(),
-  messageId: exports_external.string().optional(),
-  message: exports_external.string()
-});
-
-class NotifyExecutor extends BaseExecutor {
-  type = "notify";
-  mode = "instant";
-  configSchema = NotifyConfigSchema;
-  outputSchema = NotifyOutputSchema;
-  async execute(config, context, _meta) {
-    const message = this.deps.interpolate(config.template, context);
-    switch (config.channel) {
-      case "swarm": {
-        if (!config.target) {
-          return {
-            status: "success",
-            output: { sent: false, message }
-          };
-        }
-        try {
-          const result = await this.deps.db.postMessage(config.target, null, message);
-          return {
-            status: "success",
-            output: { sent: true, messageId: result.id, message }
-          };
-        } catch (err) {
-          return {
-            status: "failed",
-            error: `Failed to post swarm message: ${err instanceof Error ? err.message : String(err)}`
-          };
-        }
-      }
-      case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-dty7p9hg.js");
-        const app = getSlackApp2();
-        if (!app) {
-          return {
-            status: "success",
-            output: { sent: false, message }
-          };
-        }
-        try {
-          const result = await app.client.chat.postMessage({
-            channel: config.target || "",
-            text: message,
-            unfurl_links: false,
-            unfurl_media: false
-          });
-          return {
-            status: "success",
-            output: { sent: true, messageId: result.ts || "", message }
-          };
-        } catch (err) {
-          return {
-            status: "failed",
-            error: `Failed to post Slack message: ${err instanceof Error ? err.message : String(err)}`
-          };
-        }
-      }
-      case "email": {
-        console.log(`[notify] Email stub — target: ${config.target}, message: ${message}`);
-        return {
-          status: "success",
-          output: { sent: false, message }
-        };
-      }
-    }
-  }
-}
-
-// src/workflows/executors/property-match.ts
-init_zod();
-var ConditionSchema = exports_external.object({
-  field: exports_external.string(),
-  op: exports_external.enum(["eq", "neq", "contains", "not_contains", "gt", "lt", "exists"]),
-  value: exports_external.unknown().optional()
-});
-var PropertyMatchConfigSchema = exports_external.object({
-  conditions: exports_external.array(ConditionSchema).min(1),
-  mode: exports_external.enum(["all", "any"]).default("all")
-});
-var ConditionResultSchema = exports_external.object({
-  field: exports_external.string(),
-  op: exports_external.string(),
-  expected: exports_external.unknown().optional(),
-  actual: exports_external.unknown().optional(),
-  passed: exports_external.boolean()
-});
-var PropertyMatchOutputSchema = exports_external.object({
-  passed: exports_external.boolean(),
-  results: exports_external.array(ConditionResultSchema)
-});
-
-class PropertyMatchExecutor extends BaseExecutor {
-  type = "property-match";
-  mode = "instant";
-  configSchema = PropertyMatchConfigSchema;
-  outputSchema = PropertyMatchOutputSchema;
-  async execute(config, context, _meta) {
-    const results = config.conditions.map((cond) => {
-      const actual = resolvePath(context, cond.field);
-      const passed2 = evaluateCondition(cond.op, actual, cond.value);
-      return { field: cond.field, op: cond.op, expected: cond.value, actual, passed: passed2 };
-    });
-    const passed = config.mode === "all" ? results.every((r) => r.passed) : results.some((r) => r.passed);
-    return {
-      status: "success",
-      output: { passed, results },
-      nextPort: passed ? "true" : "false"
-    };
-  }
-}
-function resolvePath(obj, path) {
-  const keys = path.split(".");
-  let current = obj;
-  for (const key of keys) {
-    if (current == null || typeof current !== "object")
-      return;
-    current = current[key];
-  }
-  return current;
-}
-function evaluateCondition(op, actual, expected) {
-  switch (op) {
-    case "eq":
-      return actual === expected;
-    case "neq":
-      return actual !== expected;
-    case "contains":
-      return Array.isArray(actual) ? actual.includes(expected) : String(actual ?? "").includes(String(expected));
-    case "not_contains":
-      return Array.isArray(actual) ? !actual.includes(expected) : !String(actual ?? "").includes(String(expected));
-    case "gt":
-      return Number(actual) > Number(expected);
-    case "lt":
-      return Number(actual) < Number(expected);
-    case "exists":
-      return actual != null;
-    default:
-      return false;
-  }
-}
-
-// src/workflows/executors/raw-llm.ts
-init_zod();
-
-// src/workflows/executors/workflow-llm.ts
-async function resolveWorkflowLlmConfig(requestedModel, env = process.env) {
-  const credential = await resolveCredential({ env });
-  if (!credential) {
-    throw new Error("No workflow LLM credential found. Set OPENROUTER_API_KEY or OPENAI_API_KEY.");
-  }
-  if (credential.kind !== "openrouter" && credential.kind !== "openai") {
-    throw new Error(`Workflow LLM nodes do not support the resolved ${credential.kind} credential yet. Set OPENROUTER_API_KEY or OPENAI_API_KEY.`);
-  }
-  const providerPrefix = `${credential.kind}/`;
-  const model = requestedModel ?? DEFAULT_MODEL[credential.kind];
-  return {
-    apiKey: credential.apiKey,
-    baseURL: credential.kind === "openrouter" ? getOpenRouterBaseUrl(env) : undefined,
-    model: model.startsWith(providerPrefix) ? model.slice(providerPrefix.length) : model
-  };
-}
-
-// src/workflows/executors/raw-llm.ts
-var RawLlmConfigSchema = exports_external.object({
-  prompt: exports_external.string(),
-  model: exports_external.string().optional(),
-  schema: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
-  fallbackPort: exports_external.string().optional()
-});
-var RawLlmOutputSchema = exports_external.object({
-  result: exports_external.unknown(),
-  model: exports_external.string()
-});
-async function executeRawLlm(config) {
-  let modelName = config.model ?? "google/gemini-3-flash-preview";
-  try {
-    const { createOpenAI } = await import("./index-n5t1gzfb.js");
-    const llmConfig = await resolveWorkflowLlmConfig(config.model);
-    modelName = llmConfig.model;
-    const provider = createOpenAI({
-      baseURL: llmConfig.baseURL,
-      apiKey: llmConfig.apiKey
-    });
-    const model = provider(llmConfig.model);
-    if (config.schema) {
-      const { generateObject, jsonSchema } = await import("./index-aa3sa6s8.js");
-      const { object } = await generateObject({
-        model,
-        schema: jsonSchema(config.schema),
-        prompt: config.prompt,
-        providerOptions: {
-          openai: { strictJsonSchema: false }
-        }
-      });
-      return {
-        status: "success",
-        output: { result: object, model: modelName }
-      };
-    }
-    const { generateText } = await import("./index-aa3sa6s8.js");
-    const { text } = await generateText({
-      model,
-      prompt: config.prompt
-    });
-    return {
-      status: "success",
-      output: { result: text, model: modelName }
-    };
-  } catch (err) {
-    const httpStatus = err?.status ?? err?.statusCode;
-    const isRateLimited = httpStatus === 429 || httpStatus === 529 || err instanceof Error && /rate.?limit|too many requests|529/i.test(err.message);
-    if (isRateLimited) {
-      throw err;
-    }
-    if (config.fallbackPort) {
-      return {
-        status: "success",
-        output: { result: null, model: modelName },
-        error: `LLM call failed, using fallback port: ${err instanceof Error ? err.message : String(err)}`
-      };
-    }
-    return {
-      status: "failed",
-      error: `LLM call failed: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-}
-
-class RawLlmExecutor extends BaseExecutor {
-  type = "raw-llm";
-  mode = "instant";
-  configSchema = RawLlmConfigSchema;
-  outputSchema = RawLlmOutputSchema;
-  async execute(config, context, _meta) {
-    const prompt = this.deps.interpolate(config.prompt, context);
-    const result = await executeRawLlm({ ...config, prompt });
-    if (result.status === "success" && result.error) {
-      return {
-        status: "success",
-        output: result.output,
-        nextPort: config.fallbackPort,
-        error: result.error
-      };
-    }
-    return result;
-  }
-}
-
-// src/workflows/executors/script.ts
-init_zod();
-var MAX_OUTPUT_BYTES = 1048576;
-var STREAM_DRAIN_GRACE_MS = 5000;
-function unrefTimer(id) {
-  if (typeof id === "object" && "unref" in id)
-    id.unref();
-}
-function withDeadline(promise, ms, onDeadline) {
-  return new Promise((resolve) => {
-    const id = globalThis.setTimeout(() => resolve(onDeadline()), ms);
-    unrefTimer(id);
-    promise.then((value) => {
-      globalThis.clearTimeout(id);
-      resolve(value);
-    }, () => {
-      globalThis.clearTimeout(id);
-      resolve(onDeadline());
-    });
-  });
-}
-var ScriptConfigSchema = exports_external.object({
-  runtime: exports_external.enum(["bash", "ts", "python"]),
-  script: exports_external.string(),
-  args: exports_external.array(exports_external.string()).optional(),
-  timeout: exports_external.number().int().min(1000).max(MAX_SCRIPT_WALL_CLOCK_MS).default(30000),
-  cwd: exports_external.string().optional()
-});
-var ScriptOutputSchema = exports_external.object({
-  exitCode: exports_external.number(),
-  stdout: exports_external.string(),
-  stderr: exports_external.string()
-});
-var DEFAULT_TIMEOUT = 30000;
-
-class ScriptExecutor extends BaseExecutor {
-  type = "script";
-  mode = "instant";
-  configSchema = ScriptConfigSchema;
-  outputSchema = ScriptOutputSchema;
-  async execute(config, _context, _meta) {
-    const timeoutMs = config.timeout ?? DEFAULT_TIMEOUT;
-    try {
-      const result = await this.runScript(config, timeoutMs);
-      if (result.exitCode !== 0) {
-        return {
-          status: "failed",
-          error: result.stderr || `Script exited with code ${result.exitCode}`,
-          output: result
-        };
-      }
-      let output = result;
-      if (result.stdout) {
-        try {
-          const parsed = JSON.parse(result.stdout);
-          if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-            output = { ...result, ...parsed };
-          }
-        } catch {}
-      }
-      return {
-        status: "success",
-        output,
-        nextPort: "success"
-      };
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const isTimeout = message.startsWith("Script timed out after");
-      return {
-        status: "failed",
-        error: `Script execution error: ${message}`,
-        output: {
-          exitCode: -1,
-          stdout: "",
-          stderr: isTimeout ? message : `Script execution error: ${message}`
-        }
-      };
-    }
-  }
-  async runScript(config, timeoutMs) {
-    const { runtime, script, args = [], cwd } = config;
-    let cmd;
-    switch (runtime) {
-      case "bash":
-        cmd = ["bash", "-c", script, ...args];
-        break;
-      case "ts":
-        cmd = ["bun", "-e", script, "--", ...args];
-        break;
-      case "python":
-        cmd = ["python3", "-c", script, ...args];
-        break;
-    }
-    const scopedTmpdir = cwd ? undefined : `${process.env.TMPDIR ?? "/tmp"}/workflow-script-${crypto.randomUUID()}`;
-    if (scopedTmpdir)
-      await Bun.$`mkdir -p ${scopedTmpdir}`;
-    const workdir = cwd ?? scopedTmpdir;
-    const env = {
-      PATH: process.env.PATH ?? "/usr/bin:/bin",
-      HOME: process.env.HOME ?? "/tmp",
-      LANG: process.env.LANG ?? "C.UTF-8",
-      LC_ALL: process.env.LC_ALL ?? "C.UTF-8",
-      TMPDIR: workdir ?? process.env.TMPDIR ?? "/tmp"
-    };
-    try {
-      const proc = registerProcessGroup(Bun.spawn(buildSandboxedCommand(cmd, env), {
-        stdout: "pipe",
-        stderr: "pipe",
-        cwd: workdir,
-        detached: detachedProcessGroup,
-        env: sandboxSpawnEnv(env)
-      }));
-      const stdoutState = createCappedStreamState();
-      const stderrState = createCappedStreamState();
-      const stdoutPromise = readStreamCapped(proc.stdout, MAX_OUTPUT_BYTES, stdoutState);
-      const stderrPromise = readStreamCapped(proc.stderr, MAX_OUTPUT_BYTES, stderrState);
-      let timedOut = false;
-      const killTimer = globalThis.setTimeout(() => {
-        timedOut = true;
-        try {
-          terminateProcessGroup(proc.pid);
-        } catch {}
-      }, timeoutMs);
-      unrefTimer(killTimer);
-      let exitCode;
-      try {
-        exitCode = await proc.exited;
-        await terminateProcessGroup(proc.pid);
-      } finally {
-        globalThis.clearTimeout(killTimer);
-      }
-      if (timedOut) {
-        stdoutPromise.catch(() => {});
-        stderrPromise.catch(() => {});
-        throw new Error(`Script timed out after ${timeoutMs}ms`);
-      }
-      const [stdout, stderr] = await Promise.all([
-        withDeadline(stdoutPromise, STREAM_DRAIN_GRACE_MS, () => snapshotCapped(stdoutState)),
-        withDeadline(stderrPromise, STREAM_DRAIN_GRACE_MS, () => snapshotCapped(stderrState))
-      ]);
-      return {
-        exitCode,
-        stdout: (stdout.truncated ? `${stdout.text}
-…[stdout truncated]` : stdout.text).trimEnd(),
-        stderr: (stderr.truncated ? `${stderr.text}
-…[stderr truncated]` : stderr.text).trimEnd()
-      };
-    } finally {
-      if (scopedTmpdir)
-        await Bun.$`rm -rf ${scopedTmpdir}`.catch(() => {});
-    }
-  }
-}
-
-// src/workflows/executors/swarm-script.ts
-init_zod();
-init_constants();
-init_template();
-var SWARM_SCRIPT_DEFAULT_TIMEOUT_MS = DEFAULT_SCRIPT_RESOURCES.wallClockMs;
-var SWARM_SCRIPT_MIN_TIMEOUT_MS = MIN_SCRIPT_WALL_CLOCK_MS;
-var SWARM_SCRIPT_MAX_TIMEOUT_MS = MAX_SCRIPT_WALL_CLOCK_MS;
-var SwarmScriptConfigSchema = exports_external.object({
-  scriptName: exports_external.string().min(1),
-  scope: exports_external.enum(["global", "agent"]).optional(),
-  pinHash: exports_external.string().min(1).optional(),
-  args: exports_external.record(exports_external.string(), exports_external.unknown()).default({}),
-  fsMode: exports_external.enum(["none", "workspace-rw"]).default("none"),
-  timeoutMs: exports_external.number().int().min(SWARM_SCRIPT_MIN_TIMEOUT_MS).max(SWARM_SCRIPT_MAX_TIMEOUT_MS).default(SWARM_SCRIPT_DEFAULT_TIMEOUT_MS)
-});
-var SwarmScriptOutputSchema = exports_external.object({
-  result: exports_external.unknown().optional(),
-  stdout: exports_external.string(),
-  stderr: exports_external.string(),
-  truncated: exports_external.object({ stdout: exports_external.boolean(), stderr: exports_external.boolean() }),
-  durationMs: exports_external.number(),
-  exitCode: exports_external.number(),
-  scriptName: exports_external.string(),
-  contentHash: exports_external.string(),
-  version: exports_external.number()
-});
-var WORKFLOW_INTERPOLATION_ROOTS = new Set(["trigger", "input", "workflow", "swarm", "run"]);
-function findWorkflowSourceTokens(source, inputCtx) {
-  const roots = new Set([...WORKFLOW_INTERPOLATION_ROOTS, ...Object.keys(inputCtx ?? {})]);
-  return findInterpolationTokens(source).filter((token) => {
-    const root = token.split(".")[0];
-    return root !== undefined && roots.has(root);
-  });
-}
-
-class SwarmScriptExecutor extends BaseExecutor {
-  type = "swarm-script";
-  mode = "instant";
-  configSchema = SwarmScriptConfigSchema;
-  outputSchema = SwarmScriptOutputSchema;
-  async execute(config, context, meta) {
-    if (config.fsMode === "workspace-rw") {
-      return {
-        status: "failed",
-        error: "swarm-script: fsMode 'workspace-rw' is v2 only; use 'none' or omit"
-      };
-    }
-    const workflow = await this.deps.db.getWorkflow(meta.workflowId);
-    const agentId = workflow?.createdByAgentId ?? agentIdFromContext(context);
-    const resolved = await resolveScriptSource(config, agentId);
-    if (!resolved.ok) {
-      return { status: "failed", error: resolved.error };
-    }
-    const sourceTokens = findWorkflowSourceTokens(resolved.source, meta.inputCtx);
-    if (sourceTokens.length > 0) {
-      const renderedTokens = [...new Set(sourceTokens)].map((token) => `{{${token}}}`).join(", ");
-      return {
-        status: "failed",
-        error: `swarm-script body interpolation failed for node "${meta.nodeId}": unresolved token(s): ${renderedTokens}. ` + "Named script source is not workflow-interpolated; pass dynamic values through config.args and read them from args."
-      };
-    }
-    const runStartTouch = resolved.script.isScratch ? await touchScratchScriptLastUsed(resolved.script.id) : null;
-    const credentials = await buildScriptCredentialBindingsWithFailures({
-      agentId: agentId ?? undefined
-    });
-    const output = await runScript({
-      source: resolved.source,
-      args: config.args,
-      fsMode: "none",
-      agentId: agentId ?? "workflow",
-      mcpBaseUrl: getMcpBaseUrl(),
-      egressSecrets: credentials.egressSecrets,
-      failedBindings: credentials.failedBindings,
-      apiConnections: getScriptApiConnectionDescriptors({ agentId: agentId ?? undefined }),
-      mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agentId ?? undefined }),
-      timeoutMs: config.timeoutMs
-    });
-    if (output.exitCode === 0 && !output.error && !output.runtimeError) {
-      await touchScratchScriptLastUsed(resolved.script.id);
-    } else if (resolved.script.isScratch && runStartTouch) {
-      await restoreScratchScriptLastUsedIfUnchanged(resolved.script.id, resolved.script.updatedAt, runStartTouch);
-    }
-    const workflowOutput = {
-      result: output.result,
-      stdout: output.stdout,
-      stderr: output.stderr,
-      truncated: output.truncated,
-      durationMs: output.durationMs,
-      exitCode: output.exitCode,
-      scriptName: resolved.script.name,
-      contentHash: resolved.contentHash,
-      version: resolved.version
-    };
-    if (output.exitCode !== 0 || output.error) {
-      return {
-        status: "failed",
-        error: output.stderr || `swarm-script: script exited with code ${output.exitCode}${output.error ? ` (${output.error})` : ""}`,
-        output: workflowOutput
-      };
-    }
-    return {
-      status: "success",
-      output: workflowOutput,
-      nextPort: "success"
-    };
-  }
-}
-function agentIdFromContext(context) {
-  const trigger = context.trigger;
-  if (trigger && typeof trigger === "object") {
-    const value = trigger.agentId;
-    if (typeof value === "string" && value.length > 0)
-      return value;
-  }
-  return;
-}
-async function resolveScriptSource(config, agentId) {
-  if (config.scope === "agent" && !agentId) {
-    return {
-      ok: false,
-      error: "swarm-script: agent-scoped scripts require the workflow to have createdByAgentId or trigger.agentId"
-    };
-  }
-  const script = config.scope === "global" ? await getScript({ name: config.scriptName, scope: "global" }) : config.scope === "agent" ? await getScript({ name: config.scriptName, scope: "agent", scopeId: agentId }) : agentId ? await getScript({ name: config.scriptName, scope: "agent", scopeId: agentId }) ?? await getScript({ name: config.scriptName, scope: "global" }) : await getScript({ name: config.scriptName, scope: "global" });
-  if (!script) {
-    const scopeHint = config.scope ? ` in ${config.scope} scope` : "";
-    return {
-      ok: false,
-      error: `swarm-script: script '${config.scriptName}' not found${scopeHint}`
-    };
-  }
-  if (!config.pinHash) {
-    return {
-      ok: true,
-      script,
-      source: script.source,
-      contentHash: script.contentHash,
-      version: script.version
-    };
-  }
-  const version = await getScriptVersion({ scriptId: script.id, contentHash: config.pinHash });
-  if (!version) {
-    return {
-      ok: false,
-      error: `swarm-script: pinHash '${config.pinHash}' not found for script '${config.scriptName}'`
-    };
-  }
-  return {
-    ok: true,
-    script,
-    source: version.source,
-    contentHash: version.contentHash,
-    version: version.version
-  };
-}
-
-// src/workflows/executors/validate.ts
-init_zod();
-var ValidateConfigSchema = exports_external.object({
-  targetNodeId: exports_external.string(),
-  prompt: exports_external.string().optional(),
-  schema: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
-});
-var ValidateOutputSchema = exports_external.object({
-  pass: exports_external.boolean(),
-  reasoning: exports_external.string(),
-  confidence: exports_external.number().min(0).max(1)
-});
-
-class ValidateExecutor extends BaseExecutor {
-  type = "validate";
-  mode = "instant";
-  configSchema = ValidateConfigSchema;
-  outputSchema = ValidateOutputSchema;
-  async execute(config, context, _meta) {
-    const targetOutput = context[config.targetNodeId];
-    if (targetOutput === undefined) {
-      return {
-        status: "success",
-        output: {
-          pass: false,
-          reasoning: `Target node "${config.targetNodeId}" has no output in context`,
-          confidence: 1
-        },
-        nextPort: "fail"
-      };
-    }
-    if (config.schema) {
-      return this.validateWithSchema(targetOutput, config.schema);
-    }
-    if (config.prompt) {
-      return this.validateWithLlm(targetOutput, config.prompt, context);
-    }
-    return {
-      status: "success",
-      output: { pass: true, reasoning: "Target node output exists", confidence: 1 },
-      nextPort: "pass"
-    };
-  }
-  validateWithSchema(targetOutput, schema) {
-    try {
-      const errors = validateJsonSchemaBasic(targetOutput, schema);
-      if (errors.length === 0) {
-        return {
-          status: "success",
-          output: { pass: true, reasoning: "Output matches schema", confidence: 1 },
-          nextPort: "pass"
-        };
-      }
-      return {
-        status: "success",
-        output: {
-          pass: false,
-          reasoning: `Schema validation failed: ${errors.join("; ")}`,
-          confidence: 1
-        },
-        nextPort: "fail"
-      };
-    } catch (err) {
-      return {
-        status: "success",
-        output: {
-          pass: false,
-          reasoning: `Schema validation error: ${err instanceof Error ? err.message : String(err)}`,
-          confidence: 0.5
-        },
-        nextPort: "fail"
-      };
-    }
-  }
-  async validateWithLlm(targetOutput, prompt, context) {
-    const interpolatedPrompt = this.deps.interpolate(prompt, context);
-    const outputStr = typeof targetOutput === "string" ? targetOutput : JSON.stringify(targetOutput);
-    try {
-      const { createOpenAI } = await import("./index-n5t1gzfb.js");
-      const { generateObject, jsonSchema } = await import("./index-aa3sa6s8.js");
-      const llmConfig = await resolveWorkflowLlmConfig();
-      const provider = createOpenAI({
-        baseURL: llmConfig.baseURL,
-        apiKey: llmConfig.apiKey
-      });
-      const { object } = await generateObject({
-        model: provider(llmConfig.model),
-        schema: jsonSchema({
-          type: "object",
-          properties: {
-            pass: { type: "boolean" },
-            reasoning: { type: "string" },
-            confidence: { type: "number", minimum: 0, maximum: 1 }
-          },
-          required: ["pass", "reasoning", "confidence"]
-        }),
-        providerOptions: {
-          openai: { strictJsonSchema: false }
-        },
-        prompt: `Evaluate the following output against the validation criteria.
-
-Criteria: ${interpolatedPrompt}
-
-Output to validate:
-${outputStr}
-
-Respond with pass (boolean), reasoning (string), and confidence (0-1).`
-      });
-      const result = object;
-      return {
-        status: "success",
-        output: result,
-        nextPort: result.pass ? "pass" : "fail"
-      };
-    } catch (err) {
-      const httpStatus = err?.status ?? err?.statusCode;
-      const isRateLimited = httpStatus === 429 || httpStatus === 529 || err instanceof Error && /rate.?limit|too many requests|529/i.test(err.message);
-      if (isRateLimited) {
-        throw err;
-      }
-      return {
-        status: "success",
-        output: {
-          pass: false,
-          reasoning: `LLM validation failed: ${err instanceof Error ? err.message : String(err)}`,
-          confidence: 0
-        },
-        nextPort: "fail"
-      };
-    }
-  }
-}
-function validateJsonSchemaBasic(value, schema) {
-  const errors = [];
-  if (schema.type) {
-    const expectedType = schema.type;
-    if (expectedType === "object") {
-      if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        errors.push(`Expected object, got ${Array.isArray(value) ? "array" : typeof value}`);
-        return errors;
-      }
-      if (schema.properties && typeof schema.properties === "object") {
-        const props = schema.properties;
-        const obj = value;
-        for (const [key, propSchema] of Object.entries(props)) {
-          if ("const" in propSchema && obj[key] !== propSchema.const) {
-            errors.push(`Property "${key}": expected const ${JSON.stringify(propSchema.const)}, got ${JSON.stringify(obj[key])}`);
-          }
-          if ("enum" in propSchema && Array.isArray(propSchema.enum)) {
-            if (!propSchema.enum.includes(obj[key])) {
-              errors.push(`Property "${key}": expected one of ${JSON.stringify(propSchema.enum)}, got ${JSON.stringify(obj[key])}`);
-            }
-          }
-        }
-      }
-      if (Array.isArray(schema.required)) {
-        const obj = value;
-        for (const key of schema.required) {
-          if (!(key in obj)) {
-            errors.push(`Missing required property "${key}"`);
-          }
-        }
-      }
-    } else if (expectedType === "string" && typeof value !== "string") {
-      errors.push(`Expected string, got ${typeof value}`);
-    } else if (expectedType === "number" && typeof value !== "number") {
-      errors.push(`Expected number, got ${typeof value}`);
-    } else if (expectedType === "boolean" && typeof value !== "boolean") {
-      errors.push(`Expected boolean, got ${typeof value}`);
-    } else if (expectedType === "array" && !Array.isArray(value)) {
-      errors.push(`Expected array, got ${typeof value}`);
-    }
-  }
-  return errors;
-}
-
-// src/workflows/executors/vcs.ts
-init_zod();
-var VcsConfigSchema = exports_external.object({
-  action: exports_external.enum(["create-issue", "create-pr", "comment"]),
-  provider: exports_external.enum(["github", "gitlab"]),
-  repo: exports_external.string(),
-  title: exports_external.string().optional(),
-  body: exports_external.string().optional(),
-  branch: exports_external.string().optional(),
-  baseBranch: exports_external.string().optional(),
-  issueNumber: exports_external.number().optional(),
-  prNumber: exports_external.number().optional()
-});
-var VcsOutputSchema = exports_external.object({
-  url: exports_external.string(),
-  id: exports_external.union([exports_external.string(), exports_external.number()])
-});
-
-class VcsExecutor extends BaseExecutor {
-  type = "vcs";
-  mode = "instant";
-  configSchema = VcsConfigSchema;
-  outputSchema = VcsOutputSchema;
-  async execute(config, context, _meta) {
-    const title = config.title ? this.deps.interpolate(config.title, context) : "";
-    const body = config.body ? this.deps.interpolate(config.body, context) : "";
-    console.log(`[vcs] Stub — ${config.action} on ${config.provider}/${config.repo}: title="${title}" body="${body.slice(0, 80)}"`);
-    const mockId = `stub-${Date.now()}`;
-    const mockUrl = `https://${config.provider}.com/${config.repo}/${config.action}/${mockId}`;
-    return {
-      status: "success",
-      output: { url: mockUrl, id: mockId }
-    };
-  }
-}
-
-// src/workflows/executors/registry.ts
-class ExecutorRegistry {
-  executors = new Map;
-  register(executor) {
-    this.executors.set(executor.type, executor);
-  }
-  get(type) {
-    const executor = this.executors.get(type);
-    if (!executor)
-      throw new Error(`Unknown executor type: ${type}`);
-    return executor;
-  }
-  has(type) {
-    return this.executors.has(type);
-  }
-  types() {
-    return [...this.executors.keys()];
-  }
-  describe(type) {
-    const executor = this.get(type);
-    return {
-      type: executor.type,
-      mode: executor.mode,
-      configSchema: exports_external.toJSONSchema(executor.configSchema),
-      outputSchema: exports_external.toJSONSchema(executor.outputSchema)
-    };
-  }
-  describeAll() {
-    return this.types().map((t) => this.describe(t));
-  }
-}
-function createExecutorRegistry(deps) {
-  const registry = new ExecutorRegistry;
-  registry.register(new PropertyMatchExecutor(deps));
-  registry.register(new CodeMatchExecutor(deps));
-  registry.register(new NotifyExecutor(deps));
-  registry.register(new RawLlmExecutor(deps));
-  registry.register(new ScriptExecutor(deps));
-  registry.register(new SwarmScriptExecutor(deps));
-  registry.register(new VcsExecutor(deps));
-  registry.register(new ValidateExecutor(deps));
-  registry.register(new AgentTaskExecutor(deps));
-  registry.register(new ForeachExecutor(deps));
-  registry.register(new HumanInTheLoopExecutor(deps));
-  registry.register(new WaitExecutor(deps));
-  return registry;
-}
-
-// src/workflows/index.ts
-var _registry = null;
-var slackMessageTriggerListenerInitialized = false;
-function createBuiltInExecutorRegistry() {
-  return createExecutorRegistry({
-    db: exports_db,
-    eventBus: workflowEventBus,
-    interpolate: (template, ctx) => interpolate(template, ctx).result
-  });
-}
-function getExecutorRegistry() {
-  _registry ??= createBuiltInExecutorRegistry();
-  return _registry;
-}
-function setupSlackMessageTriggerListener() {
-  if (slackMessageTriggerListenerInitialized)
-    return;
-  workflowEventBus.on("slack.message", (payload) => {
-    handleEventTrigger("slack.message", payload, getExecutorRegistry()).catch((err) => {
-      console.error("[workflows] Failed to dispatch slack.message event trigger:", scrubSecrets(err instanceof Error ? err.message : String(err)));
-    });
-  });
-  slackMessageTriggerListenerInitialized = true;
-}
-async function initWorkflows() {
-  _registry = getExecutorRegistry();
-  setupWorkflowResumeListener(workflowEventBus, _registry);
-  setupSlackMessageTriggerListener();
-  recoverIncompleteRuns(_registry).catch((err) => {
-    console.error("[workflows] Failed to recover incomplete runs on startup:", err);
-  });
-  startRetryPoller(_registry);
-  startWaitPoller(_registry);
-  await initWaitBusSubscriptions(_registry);
-  logOpenWebhookTriggers();
-}
-
-export { validateJsonSchema, findJsonSchemaShapeErrors, notifyAutomationPreflightFailure, automationIntegrationFixUrl, isNeedsSetupFailure, preflightAutomation, renderAutomationTokens, getAutomationSetupStates, schedulePreflightInput, listEnabledAutomationPreflightInputs, recordSchedulePreflightFailure, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows };