@desplega.ai/agent-swarm 1.167.0 → 1.169.0

package/dist/{cli-wydz3feg.js → cli-61tbnjpf.js}

@@ -20,7 +20,7 @@ import {
 import {
   ensurePricingSeeded,
   ensureRbacSeeded
-} from "./cli-tx2zvn23.js";
+} from "./cli-91r17hb1.js";
 import {
   buildCatalogEntries,
   getCatalogGeneration,
@@ -30,83 +30,67 @@ import {
   requestModelCatalogRefresh,
   startPricingRefreshLoop,
   upsertModelCatalogOverlay
-} from "./cli-p8rt8spp.js";
+} from "./cli-vejds37t.js";
 import {
   loadModelsDevCache
-} from "./cli-v1pwxreq.js";
+} from "./cli-n4z21pt8.js";
 import {
   AppDefinitionSchema,
   AppElementsSchema,
   AppNameSchema,
-  BaseExecutor,
   ColumnKindSchema,
   ConnectionAuthInputSchema,
   DEFAULT_SCRIPT_RESOURCES,
-  HumanInTheLoopExecutor,
   MAX_SCRIPT_WALL_CLOCK_MS,
   MIN_SCRIPT_WALL_CLOCK_MS,
   SCRIPT_LONG_TIMEOUT_HINT_MS,
   SORTABLE_SYSTEM_DATE_COLUMNS,
   SYSTEM_COLUMN_KINDS,
-  SYSTEM_ONE_DECISION_NODE_TYPE,
-  SystemOneDecisionExecutor,
   appDefinitionNeedsRepair,
   applyAppDefinitionPatch,
-  applyDefinitionPatch,
   assertUrlSafe,
   buildSandboxedCommand,
   buildScriptCredentialBindings,
   buildScriptCredentialBindingsWithFailures,
   connectionAuthInputFromFlat,
   createApp,
-  createApprovalFollowUpTask,
   createCappedStreamState,
   decodeAppDefinition,
-  definitionNodeIds,
   deleteApp,
+  deleteScriptConnection,
   disableCredentialBinding,
   extractArgsJsonSchema,
   extractScriptSignature,
-  findEntryNodes,
-  generateEdges,
   getApp,
-  getNextTargets,
   getOAuthBindingTokenStatus,
   getOAuthProviderConfig,
   getSavedScriptOwnerAgentId,
   getScriptApiConnectionDescriptors,
   getScriptConnectionById,
   getScriptMcpConnectionDescriptors,
-  getSuccessors,
   isIso8601Date,
   listApps,
   listRelationalCredentialBindings,
   listScriptConnections,
   parseAppDefinition,
-  postApprovalCancellationUpdates,
   publicEndpointSsrfOptions,
   readStreamCapped,
   refreshScriptConnection,
   require_dist as require_dist2,
   resolveSyncRunAs,
-  resolveValidationPort,
-  resolveWorkflowLlmConfig,
   runSavedScriptAsAgent,
   runScript,
   sandboxSpawnEnv,
   setScriptConnectionEnabled,
   snapshotCapped,
-  systemOneRetryViolations,
-  systemOneUnresolvedError,
   typecheckScript,
   updateApp,
   upgradeAppDefinition,
   upsertCredentialBinding,
   upsertScriptConnection,
-  validateDefinition,
   validateScriptImports,
   writeBareImportShim
-} from "./cli-577bxkf6.js";
+} from "./cli-a8vps458.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -121,12 +105,77 @@ import {
   ensureToken,
   ensureTokenOrThrow,
   onAuthorizationRefreshed
-} from "./cli-kw0jcfje.js";
+} from "./cli-fyeft04q.js";
 import {
   AgentFsProvider,
   getFileStorageProvider,
   providerPath
 } from "./cli-mzfth0bp.js";
+import {
+  FAILED_TASK_OUTPUT_PREFIX,
+  FOREACH_TERMINAL_STEP_STATUSES,
+  SubWorkflowExecutor,
+  TriggerSchemaError,
+  WaitExecutor,
+  buildForeachAggregate,
+  buildNodeInterpolationCtx,
+  cancelWorkflowRun,
+  cancelWorkflowRunRows,
+  checkpointPortStepAndResolveSuccessors,
+  checkpointStep,
+  checkpointStepFailure,
+  checkpointStepWaiting,
+  completeTaskStepAndResolveSuccessors,
+  failRunOnUnreadableReplay,
+  failStepAndRunIfWaiting,
+  finalizeOrWait,
+  findJsonSchemaShapeErrors,
+  findReadyNodes,
+  getAutomationSetupStates,
+  getMaxWorkflowStepsPerRun,
+  getSecretInputKeys,
+  holdWorkflowRun,
+  initWaitBusSubscriptions,
+  interpolateNodeConfig,
+  isNeedsSetupFailure,
+  isWorkflowRunActive,
+  loadCompletedStepRouting,
+  notifyAutomationPreflightFailure,
+  parseSyntheticNodeId,
+  preflightAutomation,
+  recordSchedulePreflightFailure,
+  rehydrateCompletedStepOutputs,
+  renderAutomationTokens,
+  resolveInputValue,
+  resumeFromChildRun,
+  resumeWaitState,
+  retryFailedRun,
+  runStepValidation,
+  schedulePreflightInput,
+  scheduleTaskStepRetry,
+  scriptBodyInterpolationError,
+  setupWorkflowResumeListener,
+  shapeApprovalResolution,
+  startWorkflowExecution,
+  validateJsonSchema,
+  walkGraph,
+  withSaveWarnings,
+  workflowSaveWarnings
+} from "./cli-rh44xx46.js";
+import {
+  BaseExecutor,
+  HumanInTheLoopExecutor,
+  SystemOneDecisionExecutor,
+  applyDefinitionPatch,
+  createApprovalFollowUpTask,
+  definitionNodeIds,
+  generateEdges,
+  getSuccessors,
+  postApprovalCancellationUpdates,
+  resolveValidationPort,
+  resolveWorkflowLlmConfig,
+  validateDefinition
+} from "./cli-s0k2j7q9.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -147,6 +196,7 @@ import {
   getTaskUrl,
   hasTaskCitationCheckRefusal,
   markdownToSlack,
+  noteSlackInboundSideEffect,
   renderTaskCitations,
   startSlackApp,
   stopSlackApp,
@@ -156,11 +206,11 @@ import {
   taskCitationWarnings,
   upsertTaskCitations,
   withSpan
-} from "./cli-c8r99akr.js";
+} from "./cli-e5qk3m2a.js";
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-ypgba1a8.js";
+} from "./cli-jkfxpg1b.js";
 import {
   can,
   decideAdmission,
@@ -182,7 +232,6 @@ import {
   MEMORY_KEY_PATTERN,
   MEMORY_KEY_PATTERN_MESSAGE,
   SteeringRequestError,
-  WorkflowReplayStateError,
   acceptTask,
   agentContextKey,
   agentmailContextKey,
@@ -192,7 +241,6 @@ import {
   buildJiraContextKey,
   buildRoutingAffinityFromAgent,
   cancelApprovalRequestById,
-  cancelPendingApprovalRequestsForRun,
   cancelTask,
   checkDependencies,
   checkSlackRoutingCoherence,
@@ -220,8 +268,6 @@ import {
   createTaskExtended,
   createUser,
   createWorkflow,
-  createWorkflowRun,
-  createWorkflowRunStep,
   createWorkflowVersion,
   deleteAgentMailInboxMapping,
   deleteChannel,
@@ -237,7 +283,6 @@ import {
   deleteSwarmConfig,
   deleteUser,
   deleteWorkflow,
-  detachTaskFromWorkflowRunStep,
   embedScript,
   emitMcpServerConnectedTelemetry,
   exports_db,
@@ -274,7 +319,6 @@ import {
   getCompletedStepNodeIds,
   getContextVersion,
   getContextVersionHistory,
-  getCurrentStepForNode,
   getDailySpendForAgent,
   getDailySpendForUser,
   getDailySpendGlobal,
@@ -289,9 +333,6 @@ import {
   getInboxSummary,
   getInjectableGlobalConfigs,
   getKv,
-  getLastRunStart,
-  getLastSuccessfulRun,
-  getLatestStepForNode,
   getLeadAgent,
   getLogsByTaskIdAndEventType,
   getLogsByTaskIdChronological,
@@ -310,9 +351,7 @@ import {
   getPage,
   getPageBySlug,
   getPageVersions,
-  getPendingEventWaitNames,
   getPendingTaskForAgent,
-  getPendingWaitsByEvent,
   getPromptTemplateById,
   getPromptTemplateHistory,
   getPromptTemplates,
@@ -329,14 +368,13 @@ import {
   getServiceByAgentAndName,
   getServiceById,
   getSessionLogsByTaskId,
+  getSettledChildRunParentSteps,
   getSkillById,
   getSkillByName,
   getSkillFile,
   getSkillFiles,
   getSlackTreeMessageByThread,
   getSteeringMessageById,
-  getStepByIdempotencyKey,
-  getStepCountForNode,
   getStuckApprovalRuns,
   getStuckWaitRuns,
   getStuckWorkflowRuns,
@@ -347,11 +385,9 @@ import {
   getSwarmRepos,
   getTaskAttachments,
   getTaskById,
-  getTaskByWorkflowRunStepId,
   getUnassignedTasksCount,
   getUnreadMessages,
   getUserById,
-  getWaitStateById,
   getWorkflow,
   getWorkflowRun,
   getWorkflowRunStep,
@@ -390,7 +426,7 @@ import {
   init_telemetry,
   init_telemetry_identity,
   init_templates1 as init_templates,
-  init_workflow_replay,
+  init_workflow_runs,
   insertTaskAttachment,
   installMcpServer,
   installSkill,
@@ -431,6 +467,7 @@ import {
   promoteDraftTask,
   reassociateSessionLogs,
   recordBudgetRefusalNotification,
+  recordInlineScriptRun,
   recordSlackMessage,
   refreshDraftTaskLease,
   rejectTask,
@@ -443,13 +480,11 @@ import {
   resolveApprovalRequest,
   resolveSqliteVecExtensionPath,
   resolveStoreKey,
-  resolveWaitState,
   restoreScratchScriptLastUsedIfUnchanged,
   rowToCandidate,
   runWithoutRequestAuth,
   scheduleContextKey,
   scheduleOrgDomainRecompute,
-  scrubJsonValue,
   searchSkills,
   setBudgetRefusalFollowUpTaskId,
   setRequestAuth,
@@ -478,7 +513,6 @@ import {
   updateUser,
   updateWorkflow,
   updateWorkflowRun,
-  updateWorkflowRunStep,
   upsertKv,
   upsertOAuthApp,
   upsertPromptTemplate,
@@ -488,7 +522,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   workflowContextKey
-} from "./cli-mkdsy1nq.js";
+} from "./cli-rg1c8ccw.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -523,7 +557,6 @@ import {
   ReasoningEffortSchema,
   RepoGuidelinesInputSchema,
   RepoHooksSchema,
-  RetryPolicySchema,
   RoutingReasonSchema,
   ScheduledTaskTargetTypeSchema,
   ScriptRunStatusSchema,
@@ -557,11 +590,10 @@ import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl,
   taskAttachmentFetchCommand
-} from "./cli-mxvnnv5q.js";
+} from "./cli-jv36y8wz.js";
 import {
   getSlackConfiguration,
-  init_config,
-  isSlackConfigured
+  init_config
 } from "./cli-dmtrxqhg.js";
 import {
   deepInterpolate,
@@ -652,7 +684,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-ymmc1zxg.js";
+} from "./cli-m23r88re.js";
 import {
   init_event_bus,
   workflowEventBus
@@ -663,7 +695,6 @@ import {
 } from "./cli-zf8jjwex.js";
 import {
   init_secret_scrubber,
-  isSensitiveKey,
   refreshSecretScrubberCache,
   registerSensitiveKeyName,
   registerVolatileSecret,
@@ -2464,8 +2495,8 @@ var require_keyword = __commonJS(function(exports) {
     var _a;
     const { gen, keyword, schema, parentSchema, $data, it } = cxt;
     checkAsyncKeyword(it, def);
-    const validate2 = !$data && def.compile ? def.compile.call(it.self, schema, parentSchema, it) : def.validate;
-    const validateRef = useKeyword(gen, keyword, validate2);
+    const validate = !$data && def.compile ? def.compile.call(it.self, schema, parentSchema, it) : def.validate;
+    const validateRef = useKeyword(gen, keyword, validate);
     const valid = gen.let("valid");
     cxt.block$data(valid, validateKeyword);
     cxt.ok((_a = def.valid) !== null && _a !== undefined ? _a : valid);
@@ -3524,28 +3555,28 @@ var require_compile = __commonJS(function(exports) {
       if (this.opts.code.process)
         sourceCode = this.opts.code.process(sourceCode, sch);
       const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
-      const validate2 = makeValidate(this, this.scope.get());
-      this.scope.value(validateName, { ref: validate2 });
-      validate2.errors = null;
-      validate2.schema = sch.schema;
-      validate2.schemaEnv = sch;
+      const validate = makeValidate(this, this.scope.get());
+      this.scope.value(validateName, { ref: validate });
+      validate.errors = null;
+      validate.schema = sch.schema;
+      validate.schemaEnv = sch;
       if (sch.$async)
-        validate2.$async = true;
+        validate.$async = true;
       if (this.opts.code.source === true) {
-        validate2.source = { validateName, validateCode, scopeValues: gen._values };
+        validate.source = { validateName, validateCode, scopeValues: gen._values };
       }
       if (this.opts.unevaluated) {
         const { props, items } = schemaCxt;
-        validate2.evaluated = {
+        validate.evaluated = {
           props: props instanceof codegen_1.Name ? undefined : props,
           items: items instanceof codegen_1.Name ? undefined : items,
           dynamicProps: props instanceof codegen_1.Name,
           dynamicItems: items instanceof codegen_1.Name
         };
-        if (validate2.source)
-          validate2.source.evaluated = (0, codegen_1.stringify)(validate2.evaluated);
+        if (validate.source)
+          validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);
       }
-      sch.validate = validate2;
+      sch.validate = validate;
       return sch;
     } catch (e) {
       delete sch.validate;
@@ -6860,8 +6891,8 @@ var require_ajv = __commonJS(function(exports, module) {
 var require_formats = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.formatNames = exports.fastFormats = exports.fullFormats = undefined;
-  function fmtDef(validate2, compare) {
-    return { validate: validate2, compare };
+  function fmtDef(validate, compare) {
+    return { validate, compare };
   }
   exports.fullFormats = {
     date: fmtDef(date2, compareDate),
@@ -7301,10 +7332,10 @@ var require_validate2 = __commonJS(function(exports) {
   function _interopRequireDefault(e) {
     return e && e.__esModule ? e : { default: e };
   }
-  function validate2(uuid2) {
+  function validate(uuid2) {
     return typeof uuid2 === "string" && _regex.default.test(uuid2);
   }
-  var _default = exports.default = validate2;
+  var _default = exports.default = validate;
 });
 
 // node_modules/uuid/dist/parse.js
@@ -14382,2393 +14413,27 @@ var require_dist5 = __commonJS(function(exports) {
   }
   exports.Svix = Svix;
 });
-// src/automation-preflight-alert.ts
-init_constants();
-init_secret_scrubber();
-async function notifyAutomationPreflightFailure(preflight) {
-  const channel = process.env.SLACK_ALERTS_CHANNEL?.trim();
-  if (!channel) {
-    console.warn("[Automation Preflight] SLACK_ALERTS_CHANNEL not set; skipping alert");
-    return;
-  }
-  try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-nctetn1e.js");
-    const app = getSlackApp2();
-    if (!app) {
-      console.warn("[Automation Preflight] Slack not available, cannot send notification");
-      return;
-    }
-    await app.client.chat.postMessage({
-      channel,
-      text: scrubSecrets(`⚠️ Automation needs setup
-` + `Automation: ${preflight.kind} "${preflight.name}"
-Missing params: ${preflight.missing.params.join(", ") || "none"}
-Missing integrations: ${preflight.missing.integrations.join(", ") || "none"}
-Fire SKIPPED. It was not retried or queued.
-Fix setup: ${getAppUrl()}${preflight.fixUrl}`),
-      unfurl_links: false,
-      unfurl_media: false
-    });
-  } catch (error) {
-    console.error("[Automation Preflight] Failed to send Slack notification:", scrubSecrets(error instanceof Error ? error.message : String(error)));
-  }
-}
-
-// src/be/automation-preflight.ts
-init_config();
-init_env_flag();
-init_secret_scrubber();
-init_db2();
-init_oauth();
-init_scrub_json();
-var NEEDS_SETUP_PREFIX = "needs_setup:";
-function hasValue(value) {
-  if (value == null)
-    return false;
-  if (typeof value === "string")
-    return value.trim().length > 0;
-  if (Array.isArray(value))
-    return value.length > 0;
-  return true;
-}
-var GITHUB_REPOSITORY_SLUG = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}(?:\.git)?$/;
-var SAFE_SHELL_DATA = /^[A-Za-z0-9._~%/:@ -]+$/;
-var DNS_NAME = /^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$/;
-var SAFE_EXTERNAL_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
-var SAFE_GIT_REF = /^(?!-)(?!.*(?:\.\.|@\{|\/\/))[A-Za-z0-9._/-]+$/;
-var SAFE_TAG_PATTERN = /^(?!-)(?!.*(?:\.\.|\/\/))[A-Za-z0-9._*?/-]+$/;
-var SAFE_RELATIVE_PATH = /^(?![-/])(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]+$/;
-var SAFE_REPORT_NAME = /^(?!\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._ -]{0,127}$/;
-function isSafeRepository(value) {
-  if (!SAFE_SHELL_DATA.test(value) || value.trim() !== value || value.includes(" "))
-    return false;
-  const slug = value.replace(/^https:\/\/github\.com\//, "").replace(/^git@github\.com:/, "").replace(/\/$/, "");
-  return GITHUB_REPOSITORY_SLUG.test(slug);
-}
-function isSafeGscProperty(value) {
-  if (!SAFE_SHELL_DATA.test(value) || value.trim() !== value)
-    return false;
-  return value.split(" ").every((property) => {
-    if (!property)
-      return false;
-    if (property.startsWith("sc-domain:"))
-      return DNS_NAME.test(property.slice(10));
-    if (DNS_NAME.test(property))
-      return true;
-    try {
-      const url = new URL(property);
-      return url.protocol === "https:" && !url.username && !url.password && !url.port && !url.search && !url.hash && DNS_NAME.test(url.hostname);
-    } catch {
-      return false;
-    }
-  });
-}
-var PARAM_VALIDATORS = {
-  REPO_URL: (value) => typeof value === "string" && isSafeRepository(value),
-  GSC_PROPERTY: (value) => typeof value === "string" && isSafeGscProperty(value),
-  BRANCH: (value) => typeof value === "string" && SAFE_GIT_REF.test(value),
-  SCOPE_PATH: (value) => typeof value === "string" && SAFE_RELATIVE_PATH.test(value),
-  REPORT_NAME: (value) => typeof value === "string" && value.trim() === value && SAFE_REPORT_NAME.test(value),
-  TAG_PATTERN: (value) => typeof value === "string" && SAFE_TAG_PATTERN.test(value),
-  AGENT_FS_ORG_ID: (value) => typeof value === "string" && SAFE_EXTERNAL_ID.test(value),
-  ORG_ID: (value) => typeof value === "string" && SAFE_EXTERNAL_ID.test(value)
-};
-function isUsableParam(key, value) {
-  if (!hasValue(value))
-    return false;
-  return PARAM_VALIDATORS[key]?.(value) ?? true;
-}
-function uniqueSorted(values) {
-  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
-}
-function automationUrl(input) {
-  return input.kind === "schedule" ? `/schedules/${input.id}` : `/workflows/${input.id}`;
-}
-var INTEGRATION_FIX_URL = {
-  slack: "/settings/integrations/slack",
-  github: "/settings/integrations/github",
-  linear: "/settings/integrations/linear",
-  jira: "/settings/integrations/jira",
-  agentmail: "/settings/integrations/agentmail",
-  gsc: "/settings/integrations/gsc",
-  agentfs: "/settings/integrations/agentfs"
-};
-var INTEGRATION_FIRST_REQUIREMENTS = new Set([
-  "gsc",
-  "linear",
-  "agentmail"
-]);
-function automationIntegrationFixUrl(id) {
-  return INTEGRATION_FIX_URL[id];
-}
-function isNeedsSetupFailure(reason) {
-  return reason?.startsWith(NEEDS_SETUP_PREFIX) ?? false;
-}
-function preflightAutomation(input, setup) {
-  const params = input.params ?? {};
-  const guardedParams = Object.keys(params).filter((key) => (key in PARAM_VALIDATORS));
-  const missingParams = uniqueSorted([...input.requiredParams ?? [], ...guardedParams].filter((key) => !isUsableParam(key, params[key])));
-  const missingIntegrations = uniqueSorted((input.requires ?? []).filter((id) => setup[id] === "unverified"));
-  const missing = { params: missingParams, integrations: missingIntegrations };
-  const baseUrl = automationUrl(input);
-  const fixes = [
-    ...missingParams.map((key) => ({
-      type: "param",
-      key,
-      url: `${baseUrl}?param=${encodeURIComponent(key)}`
-    })),
-    ...missingIntegrations.map((key) => ({
-      type: "integration",
-      key,
-      url: automationIntegrationFixUrl(key)
-    }))
-  ];
-  if (missingParams.length === 0 && missingIntegrations.length === 0) {
-    return {
-      id: input.id,
-      name: input.name,
-      kind: input.kind,
-      state: "running",
-      missing,
-      fixes,
-      fixUrl: baseUrl
-    };
-  }
-  const firstParam = missingParams[0];
-  const firstIntegration = (input.requires ?? []).find((id) => missingIntegrations.includes(id));
-  const integrationFirst = (input.requires ?? []).some((id) => INTEGRATION_FIRST_REQUIREMENTS.has(id));
-  const fixUrl = integrationFirst && firstIntegration ? automationIntegrationFixUrl(firstIntegration) : firstParam ? `${baseUrl}?param=${encodeURIComponent(firstParam)}` : firstIntegration ? automationIntegrationFixUrl(firstIntegration) : baseUrl;
-  const failureReason = `${NEEDS_SETUP_PREFIX} params=[${missingParams.join(",")}] integrations=[${missingIntegrations.join(",")}]`;
-  return {
-    id: input.id,
-    name: input.name,
-    kind: input.kind,
-    state: "needs_setup",
-    missing,
-    fixes,
-    fixUrl,
-    failureReason
-  };
-}
-var EXACT_TOKEN = /^\{\{\s*([^}]+?)\s*\}\}$/;
-var TOKEN = /\{\{\s*([^}]+?)\s*\}\}/g;
-function renderAutomationTokens(value, params) {
-  function render(current) {
-    if (typeof current === "string") {
-      const exact = EXACT_TOKEN.exec(current);
-      if (exact?.[1] && Object.hasOwn(params, exact[1]))
-        return params[exact[1]];
-      return current.replace(TOKEN, (token, key) => {
-        if (!Object.hasOwn(params, key))
-          return token;
-        const replacement = params[key];
-        return typeof replacement === "object" ? JSON.stringify(replacement) : String(replacement);
-      });
-    }
-    if (Array.isArray(current))
-      return current.map(render);
-    if (current != null && typeof current === "object") {
-      return Object.fromEntries(Object.entries(current).map(([key, nested]) => [key, render(nested)]));
-    }
-    return current;
-  }
-  return render(value);
-}
-function present(value) {
-  return !!value?.trim();
-}
-async function getAutomationSetupStates() {
-  const [linearTokens, jiraTokens, jiraApp] = await Promise.all([
-    getOAuthTokens("linear"),
-    getOAuthTokens("jira"),
-    getOAuthApp("jira")
-  ]);
-  let jiraCloudId = false;
-  try {
-    const metadata = jiraApp?.metadata ? JSON.parse(jiraApp.metadata) : null;
-    jiraCloudId = !!(metadata && typeof metadata === "object" && metadata.cloudId);
-  } catch {
-    jiraCloudId = false;
-  }
-  const agentFsKey = process.env.API_AGENT_FS_API_KEY ?? process.env.AGENT_FS_API_KEY;
-  const agentFsOrg = process.env.AGENT_FS_DEFAULT_ORG_ID ?? process.env.AGENT_FS_SHARED_ORG_ID;
-  const gscConfigured = present(process.env.GSC_SERVICE_ACCOUNT_BASE64) || present(process.env.GSC_SERVICE_ACCOUNT_JSON);
-  return {
-    slack: getSlackConfiguration().mode === "socket" && isSlackConfigured() ? "configured" : "unverified",
-    github: present(process.env.GITHUB_WEBHOOK_SECRET) && present(process.env.GITHUB_APP_ID) && present(process.env.GITHUB_APP_PRIVATE_KEY) ? "verified" : "unverified",
-    linear: linearTokens ? "verified" : "unverified",
-    jira: jiraTokens && jiraCloudId ? "verified" : "unverified",
-    gsc: gscConfigured ? "verified" : "unverified",
-    agentmail: !isEnvFlagEnabled("AGENTMAIL_DISABLE", false) && present(process.env.AGENTMAIL_API_KEY) ? "verified" : "unverified",
-    agentfs: present(process.env.AGENT_FS_API_URL) && present(agentFsKey) && present(agentFsOrg) && present(process.env.AGENT_FS_DEFAULT_DRIVE_ID) ? "verified" : "unverified"
-  };
-}
-function schedulePreflightInput(schedule) {
-  return { ...schedule, kind: "schedule" };
-}
-function workflowPreflightInput(workflow) {
-  return { ...workflow, kind: "workflow" };
-}
-async function listEnabledAutomationPreflightInputs() {
-  const rows = await getDbClient().query(`SELECT id, name, 'schedule' AS kind, params, requiredParams, requires
-     FROM scheduled_tasks
-     WHERE enabled = 1
-     UNION ALL
-     SELECT id, name, 'workflow' AS kind, params, requiredParams, requires
-     FROM workflows
-     WHERE enabled = 1`);
-  return rows.map((row) => ({
-    id: row.id,
-    name: row.name,
-    kind: row.kind,
-    params: JSON.parse(row.params),
-    requiredParams: JSON.parse(row.requiredParams),
-    requires: JSON.parse(row.requires)
-  }));
-}
-function utcDayBounds(now) {
-  const start = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
-  return { start: start.toISOString(), end: new Date(start.getTime() + 86400000).toISOString() };
-}
-async function recordSchedulePreflightFailure(scheduleId, failureReason, now = new Date) {
-  const message = scrubSecrets(failureReason);
-  return await getDbClient().transaction(async (tx) => {
-    const row = await tx.get("SELECT lastErrorAt, lastErrorMessage FROM scheduled_tasks WHERE id = ?", [scheduleId]);
-    if (!row)
-      return false;
-    if (row.lastErrorMessage === message && row.lastErrorAt?.slice(0, 10) === now.toISOString().slice(0, 10)) {
-      return false;
-    }
-    await tx.run(`UPDATE scheduled_tasks
-       SET lastErrorAt = ?, lastErrorMessage = ?, lastUpdatedAt = ?
-       WHERE id = ?`, [now.toISOString(), message, now.toISOString(), scheduleId]);
-    return true;
-  });
-}
-async function recordWorkflowPreflightFailure(input) {
-  const now = input.now ?? new Date;
-  const bounds = utcDayBounds(now);
-  return await getDbClient().transaction(async (tx) => {
-    const existing = await tx.get(`SELECT id FROM workflow_runs
-       WHERE workflowId = ? AND status = 'failed'
-         AND error LIKE 'needs_setup:%'
-         AND startedAt >= ? AND startedAt < ?
-       ORDER BY startedAt ASC LIMIT 1`, [input.workflowId, bounds.start, bounds.end]);
-    if (existing)
-      return { runId: existing.id, recorded: false };
-    const runId = crypto.randomUUID();
-    const timestamp = now.toISOString();
-    await tx.run(`INSERT INTO workflow_runs
-         (id, workflowId, status, triggerType, triggerData, error, created_by,
-          startedAt, lastUpdatedAt, finishedAt)
-       VALUES (?, ?, 'failed', ?, ?, ?, ?, ?, ?, ?)`, [
-      runId,
-      input.workflowId,
-      input.triggerType,
-      input.triggerData === undefined ? null : scrubJsonValue(input.triggerData),
-      scrubSecrets(input.failureReason),
-      input.createdBy ?? null,
-      timestamp,
-      timestamp,
-      timestamp
-    ]);
-    return { runId, recorded: true };
-  });
-}
-
-// src/workflows/engine.ts
-init_db2();
-init_workflow_replay();
-init_telemetry();
-
-// src/workflows/checkpoint.ts
-init_db2();
-async function checkpointStep(runId, stepId, nodeId, result, ctx) {
-  await getDbClient().transaction(async () => {
-    await updateWorkflowRunStep(stepId, {
-      status: "completed",
-      output: result.output,
-      nextPort: result.nextPort || undefined,
-      finishedAt: new Date().toISOString()
-    });
-    ctx[nodeId] = result.output;
-    await updateWorkflowRun(runId, {
-      context: ctx
-    });
-  });
-}
-async function checkpointStepFailure(runId, stepId, error, retryCount, retryPolicy, options) {
-  const now = new Date().toISOString();
-  if (retryPolicy && retryCount < retryPolicy.maxRetries) {
-    const delay = calculateBackoff(retryPolicy, retryCount);
-    const nextRetryAt = new Date(Date.now() + delay).toISOString();
-    await updateWorkflowRunStep(stepId, {
-      status: "failed",
-      error,
-      retryCount: retryCount + 1,
-      maxRetries: retryPolicy.maxRetries,
-      nextRetryAt
-    });
-    return { shouldRetry: true };
-  }
-  await updateWorkflowRunStep(stepId, {
-    status: "failed",
-    error,
-    finishedAt: now,
-    nextRetryAt: null
-  });
-  const markRunFailed = options?.markRunFailed ?? true;
-  if (markRunFailed) {
-    await getDbClient().transaction(async () => {
-      const run = await getWorkflowRun(runId);
-      if (run?.status !== "running" && run?.status !== "waiting")
-        return;
-      await updateWorkflowRun(runId, {
-        status: "failed",
-        error: `Step failed: ${error}`,
-        finishedAt: now
-      });
-    });
-  }
-  return { shouldRetry: false };
-}
-async function checkpointStepWaiting(runId, stepId, ctx) {
-  return getDbClient().transaction(async () => {
-    const step = await getDbClient().get(`UPDATE workflow_run_steps
-         SET status = 'waiting'
-       WHERE id = ? AND runId = ? AND status = 'running'
-         AND EXISTS (
-           SELECT 1 FROM workflow_runs
-           WHERE id = ? AND status IN ('running', 'waiting')
-         )
-       RETURNING id`, [stepId, runId, runId]);
-    if (!step)
-      return false;
-    await updateWorkflowRun(runId, { status: "waiting", context: ctx });
-    return true;
-  });
-}
-function calculateBackoff(policy, attempt) {
-  let delay;
-  switch (policy.strategy) {
-    case "exponential": {
-      const base = policy.baseDelayMs * 2 ** attempt;
-      delay = Math.random() * Math.min(base, policy.maxDelayMs);
-      break;
-    }
-    case "linear":
-      delay = policy.baseDelayMs * (attempt + 1);
-      break;
-    case "static":
-      delay = policy.baseDelayMs;
-      break;
-    default:
-      delay = policy.baseDelayMs;
-  }
-  return Math.min(delay, policy.maxDelayMs);
-}
-
-// src/workflows/completed-step-routing.ts
-init_db2();
-
-// src/workflows/foreach-join.ts
-init_db2();
-var FOREACH_TERMINAL_STEP_STATUSES = new Set([
-  "completed",
-  "failed",
-  "cancelled",
-  "skipped"
-]);
-function parseSyntheticNodeId(nodeId) {
-  const separatorIndex = nodeId.indexOf("#");
-  if (separatorIndex <= 0 || separatorIndex === nodeId.length - 1)
-    return null;
-  return {
-    parentNodeId: nodeId.slice(0, separatorIndex),
-    itemKey: nodeId.slice(separatorIndex + 1)
-  };
-}
-function resolveForeachParent(def, nodeId) {
-  const parsed = parseSyntheticNodeId(nodeId);
-  if (!parsed)
-    return null;
-  const parent = def.nodes.find((node) => node.id === parsed.parentNodeId);
-  return parent?.type === "foreach" ? parent : null;
-}
-async function joinForeach(def, runId, childStep, ctx) {
-  const parent = resolveForeachParent(def, childStep.nodeId);
-  if (!parent) {
-    throw new Error(`Step "${childStep.nodeId}" is not a foreach child`);
-  }
-  const children = (await getWorkflowRunStepsByRunId(runId)).filter((step) => resolveForeachParent(def, step.nodeId)?.id === parent.id).sort((a, b) => childIndex(a) - childIndex(b));
-  if (children.some((step) => !FOREACH_TERMINAL_STEP_STATUSES.has(step.status))) {
-    return { joined: false, parentNodeId: parent.id, successors: [] };
-  }
-  const parentStep = await getLatestStepForNode(runId, parent.id);
-  if (!parentStep) {
-    throw new Error(`Waiting foreach parent step "${parent.id}" was not found`);
-  }
-  if (parentStep.status === "completed") {
-    return { joined: false, parentNodeId: parent.id, successors: [] };
-  }
-  const aggregate = buildForeachAggregate(children);
-  await checkpointStep(runId, parentStep.id, parent.id, { output: aggregate }, ctx);
-  return {
-    joined: true,
-    parentNodeId: parent.id,
-    successors: getSuccessors(def, parent.id)
-  };
-}
-function buildForeachAggregate(children) {
-  const orderedChildren = [...children].sort((a, b) => childIndex(a) - childIndex(b));
-  const results = orderedChildren.map((step) => {
-    const parsed = parseSyntheticNodeId(step.nodeId);
-    const status = resultStatus(step);
-    return {
-      itemKey: parsed.itemKey,
-      status,
-      output: step.output
-    };
-  });
-  const failedCount = results.filter((result) => result.status !== "completed").length;
-  const aggregate = {
-    results,
-    okCount: results.length - failedCount,
-    failedCount
-  };
-  return aggregate;
-}
-function childIndex(step) {
-  if (typeof step.input !== "object" || step.input === null)
-    return Number.MAX_SAFE_INTEGER;
-  const index = step.input.index;
-  return typeof index === "number" ? index : Number.MAX_SAFE_INTEGER;
-}
-function resultStatus(step) {
-  if (step.status !== "completed")
-    return step.status;
-  return step.error ? "failed" : "completed";
-}
-
-// src/workflows/completed-step-routing.ts
-async function loadCompletedStepRouting(def, runId, completedNodeIds) {
-  const activeEdges = new Set;
-  const stepsByNodeId = new Map;
-  for (const nodeId of completedNodeIds) {
-    if (resolveForeachParent(def, nodeId))
-      continue;
-    const step = await getLatestStepForNode(runId, nodeId);
-    if (step)
-      stepsByNodeId.set(nodeId, step);
-    const successors = step?.nextPort ? getSuccessors(def, nodeId, step.nextPort) : getSuccessors(def, nodeId);
-    for (const successor of successors) {
-      activeEdges.add(`${nodeId}→${successor.id}`);
-    }
-  }
-  return { activeEdges, stepsByNodeId };
-}
-
-// src/workflows/cooldown.ts
-init_db2();
-function cooldownToMs(cooldown) {
-  let ms = 0;
-  if (cooldown.hours)
-    ms += cooldown.hours * 60 * 60 * 1000;
-  if (cooldown.minutes)
-    ms += cooldown.minutes * 60 * 1000;
-  if (cooldown.seconds)
-    ms += cooldown.seconds * 1000;
-  return ms;
-}
-async function shouldSkipCooldown(workflowId, cooldown) {
-  const cooldownMs = cooldownToMs(cooldown);
-  const now = Date.now();
-  const lastSuccess = await getLastSuccessfulRun(workflowId);
-  if (lastSuccess?.finishedAt) {
-    const lastFinished = new Date(lastSuccess.finishedAt).getTime();
-    if (now - lastFinished < cooldownMs)
-      return true;
-  }
-  const lastAttempt = await getLastRunStart(workflowId);
-  if (lastAttempt?.startedAt) {
-    const lastStarted = new Date(lastAttempt.startedAt).getTime();
-    if (now - lastStarted < cooldownMs)
-      return true;
-  }
-  return false;
-}
-
-// src/workflows/input.ts
-init_db2();
-init_secret_scrubber();
-async function resolveInputs(input) {
-  const resolved = {};
-  for (const [key, value] of Object.entries(input)) {
-    resolved[key] = await resolveInputValue(value);
-  }
-  return resolved;
-}
-async function resolveInputValue(value) {
-  const envMatch = /^\$\{(.+)\}$/.exec(value);
-  if (envMatch?.[1]) {
-    const envName = envMatch[1];
-    const envValue = process.env[envName];
-    if (envValue === undefined) {
-      throw new Error(`Environment variable "${envName}" is not set`);
-    }
-    return envValue;
-  }
-  if (value.startsWith("secret.")) {
-    const secretName = value.slice("secret.".length);
-    const configs = await getSwarmConfigs({ scope: "global", key: secretName });
-    const secretConfig = configs.find((c) => c.isSecret);
-    if (!secretConfig) {
-      throw new Error(`Secret "${secretName}" not found in config store`);
-    }
-    return secretConfig.value;
-  }
-  return value;
-}
-var REDACTED_SECRET_VALUE = "***REDACTED***";
-function getSecretInputKeys(input) {
-  const keys = new Set;
-  if (!input)
-    return keys;
-  for (const [key, value] of Object.entries(input)) {
-    if (typeof value !== "string")
-      continue;
-    if (value.startsWith("secret.")) {
-      keys.add(key);
-      continue;
-    }
-    const envMatch = /^\$\{(.+)\}$/.exec(value);
-    if (envMatch?.[1] && isSensitiveKey(envMatch[1])) {
-      keys.add(key);
-    }
-  }
-  return keys;
-}
-function redactSecretsForStorage(ctx, secretKeys) {
-  if (secretKeys.size === 0)
-    return ctx;
-  const inputBlock = ctx.input;
-  if (!inputBlock || typeof inputBlock !== "object")
-    return ctx;
-  const redactedInput = { ...inputBlock };
-  let touched = false;
-  for (const key of secretKeys) {
-    if (key in redactedInput) {
-      redactedInput[key] = REDACTED_SECRET_VALUE;
-      touched = true;
-    }
-  }
-  if (!touched)
-    return ctx;
-  return { ...ctx, input: redactedInput };
-}
-
-// src/workflows/json-schema-validator.ts
-function validateJsonSchema(schema, data) {
-  const errors = [];
-  validate(schema, data, "", errors);
-  return errors;
-}
-function validate(schema, data, path, errors) {
-  const prefix = path || "root";
-  if (schema.type !== undefined) {
-    const expected = schema.type;
-    if (!matchesType(expected, data)) {
-      errors.push(`${prefix}: expected type "${expected}", got ${typeOf(data)}`);
-      return;
-    }
-  }
-  if (Array.isArray(schema.required) && typeof data === "object" && data !== null) {
-    const obj = data;
-    for (const key of schema.required) {
-      if (!(key in obj)) {
-        errors.push(`${prefix}: missing required property "${key}"`);
-      }
-    }
-  }
-  if (Array.isArray(schema.enum)) {
-    const allowed = schema.enum;
-    if (!allowed.some((v) => JSON.stringify(v) === JSON.stringify(data))) {
-      errors.push(`${prefix}: value ${JSON.stringify(data)} not in enum [${allowed.map((v) => JSON.stringify(v)).join(", ")}]`);
-      return;
-    }
-  }
-  if ("const" in schema) {
-    if (JSON.stringify(data) !== JSON.stringify(schema.const)) {
-      errors.push(`${prefix}: value ${JSON.stringify(data)} does not match const ${JSON.stringify(schema.const)}`);
-      return;
-    }
-  }
-  if (schema.properties !== undefined && typeof schema.properties === "object" && schema.properties !== null && typeof data === "object" && data !== null) {
-    const props = schema.properties;
-    const obj = data;
-    for (const [key, subSchema] of Object.entries(props)) {
-      if (key in obj) {
-        validate(subSchema, obj[key], path ? `${path}.${key}` : key, errors);
-      }
-    }
-  }
-  if (schema.items !== undefined && typeof schema.items === "object" && schema.items !== null && Array.isArray(data)) {
-    const itemSchema = schema.items;
-    for (let i = 0;i < data.length; i++) {
-      validate(itemSchema, data[i], `${prefix}[${i}]`, errors);
-    }
-  }
-}
-function matchesType(expected, data) {
-  switch (expected) {
-    case "string":
-      return typeof data === "string";
-    case "number":
-      return typeof data === "number";
-    case "boolean":
-      return typeof data === "boolean";
-    case "array":
-      return Array.isArray(data);
-    case "object":
-      return typeof data === "object" && data !== null && !Array.isArray(data);
-    default:
-      return true;
-  }
-}
-function typeOf(data) {
-  if (data === null)
-    return "null";
-  if (data === undefined)
-    return "undefined";
-  if (Array.isArray(data))
-    return "array";
-  return typeof data;
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function findJsonSchemaShapeErrors(schema, path = "outputSchema") {
-  const errors = [];
-  if (!isPlainObject(schema)) {
-    errors.push(`${path}: must be a JSON Schema object, got ${typeOf(schema)}`);
-    return errors;
-  }
-  if (schema.type !== undefined && typeof schema.type !== "string") {
-    errors.push(`${path}.type: must be a string, got ${typeOf(schema.type)}`);
-  }
-  if (schema.required !== undefined && (!Array.isArray(schema.required) || !schema.required.every((v) => typeof v === "string"))) {
-    errors.push(`${path}.required: must be an array of strings`);
-  }
-  if (schema.enum !== undefined && !Array.isArray(schema.enum)) {
-    errors.push(`${path}.enum: must be an array`);
-  }
-  if (schema.properties !== undefined) {
-    if (!isPlainObject(schema.properties)) {
-      errors.push(`${path}.properties: must be an object mapping property names to schemas`);
-    } else {
-      for (const [key, value] of Object.entries(schema.properties)) {
-        errors.push(...findJsonSchemaShapeErrors(value, `${path}.properties.${key}`));
-      }
-    }
-  }
-  if (schema.items !== undefined) {
-    errors.push(...findJsonSchemaShapeErrors(schema.items, `${path}.items`));
-  }
-  return errors;
-}
-
-// src/workflows/limits.ts
-var DEFAULT_MAX_STEPS_PER_RUN = 500;
-function getMaxWorkflowStepsPerRun() {
-  return Number(process.env.WORKFLOW_MAX_STEPS_PER_RUN) || DEFAULT_MAX_STEPS_PER_RUN;
-}
-
-// src/workflows/readiness.ts
-async function findWorkflowReadinessProblems(definition, registry) {
-  const nodesByType = new Map;
-  for (const node of definition.nodes) {
-    if (!registry.has(node.type))
-      continue;
-    const group = nodesByType.get(node.type) ?? [];
-    group.push({ id: node.id, config: node.config });
-    nodesByType.set(node.type, group);
-  }
-  const problems = [];
-  for (const [type, nodes] of nodesByType) {
-    try {
-      for (const problem of await registry.get(type).checkReadiness(nodes)) {
-        problems.push({ type, ...problem });
-      }
-    } catch {
-      problems.push({
-        type,
-        nodeIds: nodes.map((node) => node.id),
-        message: `Could not check whether "${type}" nodes are ready to run`
-      });
-    }
-  }
-  return problems;
-}
-function describeNodes(problem) {
-  const noun = problem.nodeIds.length === 1 ? "node" : "nodes";
-  return `${problem.type} ${noun} ${problem.nodeIds.map((id) => `"${id}"`).join(", ")}`;
-}
-function formatReadinessWarning(problem) {
-  return `${problem.message} Affects ${describeNodes(problem)}. Runs of this workflow fail before any node executes until this is fixed.`;
-}
-function formatReadinessProblems(problems) {
-  return problems.map((problem) => `${problem.message} Needed by ${describeNodes(problem)}.`).join(" ");
-}
-function formatReadinessRunError(problems) {
-  return `Run not started, no node executed: ${formatReadinessProblems(problems)}`;
-}
-async function workflowSaveWarnings(definition, registry) {
-  return (await findWorkflowReadinessProblems(definition, registry)).map(formatReadinessWarning);
-}
-function withSaveWarnings(text, warnings) {
-  return warnings.length === 0 ? text : `${text} ${warnings.map((warning) => `Warning: ${warning}`).join(" ")}`;
-}
-
-// src/workflows/template.ts
-init_template();
-
-// src/workflows/validation.ts
-function extractPassResult(executorType, output) {
-  if (!output || typeof output !== "object")
-    return false;
-  const o = output;
-  switch (executorType) {
-    case "validate":
-      return o.pass === true;
-    case "script":
-      return o.exitCode === 0;
-    case "property-match":
-      return o.passed === true;
-    case "raw-llm":
-      if (typeof o.result === "object" && o.result !== null) {
-        return o.result.pass === true;
-      }
-      return false;
-    default:
-      return o.pass === true || o.passed === true || o.exitCode === 0;
-  }
-}
-async function runStepValidation(registry, stepNode, stepOutput, context, meta) {
-  if (!stepNode.validation) {
-    return { outcome: "pass" };
-  }
-  const validation = stepNode.validation;
-  const executorType = validation.executor || "validate";
-  const executor = registry.get(executorType);
-  const validationConfig = {
-    targetNodeId: meta.nodeId,
-    ...validation.config
-  };
-  const validationContext = {
-    ...context,
-    [meta.nodeId]: stepOutput
-  };
-  const result = await executor.run({
-    config: validationConfig,
-    context: validationContext,
-    meta: {
-      ...meta,
-      stepId: crypto.randomUUID()
-    }
-  });
-  const passed = result.status === "success" && extractPassResult(executorType, result.output);
-  if (passed) {
-    return { outcome: "pass", passed: true };
-  }
-  if (validation.mustPass) {
-    if (validation.retry) {
-      return {
-        outcome: "retry",
-        passed: false,
-        retryContext: {
-          previousOutput: stepOutput,
-          validationResult: result.output
-        }
-      };
-    }
-    return { outcome: "halt", passed: false };
-  }
-  return { outcome: "pass", passed: false };
-}
-
-// src/workflows/engine.ts
-var DEFAULT_TIMEOUT_MS = 30000;
-function maxIterations() {
-  return Number(process.env.WORKFLOW_MAX_ITERATIONS) || 100;
-}
-
-class TriggerSchemaError extends Error {
-  validationErrors;
-  constructor(validationErrors) {
-    super(`Trigger schema validation failed: ${validationErrors.join("; ")}`);
-    this.validationErrors = validationErrors;
-    this.name = "TriggerSchemaError";
-  }
-}
-async function resolveRenderedWorkflowInputs(input) {
-  const stringInputs = {};
-  const resolved = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (typeof value === "string")
-      stringInputs[key] = value;
-    else
-      resolved[key] = value;
-  }
-  return { ...resolved, ...await resolveInputs(stringInputs) };
-}
-async function startWorkflowExecution(workflow, triggerData, registry, options = {}) {
-  const preflight = preflightAutomation(workflowPreflightInput(workflow), await getAutomationSetupStates());
-  if (preflight.state === "needs_setup") {
-    const { runId: runId2, recorded } = await recordWorkflowPreflightFailure({
-      workflowId: workflow.id,
-      triggerType: options.triggerType ?? "manual",
-      triggerData,
-      failureReason: preflight.failureReason,
-      createdBy: options.requestedByUserId
-    });
-    if (recorded)
-      await notifyAutomationPreflightFailure(preflight);
-    return runId2;
-  }
-  workflow = renderAutomationTokens(workflow, workflow.params ?? {});
-  if (workflow.triggerSchema) {
-    const validationErrors = validateJsonSchema(workflow.triggerSchema, triggerData);
-    if (validationErrors.length > 0) {
-      throw new TriggerSchemaError(validationErrors);
-    }
-  }
-  if (workflow.cooldown && await shouldSkipCooldown(workflow.id, workflow.cooldown)) {
-    const runId2 = crypto.randomUUID();
-    await createWorkflowRun({
-      id: runId2,
-      workflowId: workflow.id,
-      triggerType: options.triggerType ?? "manual",
-      triggerData,
-      createdBy: options.requestedByUserId
-    });
-    await updateWorkflowRun(runId2, {
-      status: "skipped",
-      error: "cooldown",
-      finishedAt: new Date().toISOString()
-    });
-    return runId2;
-  }
-  const runId = crypto.randomUUID();
-  await createWorkflowRun({
-    id: runId,
-    workflowId: workflow.id,
-    triggerType: options.triggerType ?? "manual",
-    triggerData,
-    createdBy: options.requestedByUserId
-  });
-  telemetry.workflow("started", {
-    workflowId: workflow.id,
-    nodeCount: workflow.definition.nodes.length,
-    triggerType: options.triggerType ?? "manual"
-  });
-  const notReady = await findWorkflowReadinessProblems(workflow.definition, registry);
-  if (notReady.length > 0) {
-    await updateWorkflowRun(runId, {
-      status: "failed",
-      error: formatReadinessRunError(notReady),
-      finishedAt: new Date().toISOString()
-    });
-    return runId;
-  }
-  const ctx = { trigger: triggerData };
-  if (options.requestedByUserId) {
-    ctx.swarm = { requestedByUserId: options.requestedByUserId };
-  }
-  if (workflow.dir || workflow.vcsRepo) {
-    ctx.workflow = { dir: workflow.dir, vcsRepo: workflow.vcsRepo };
-  }
-  if (workflow.input) {
-    try {
-      const resolved = await resolveRenderedWorkflowInputs(workflow.input);
-      Object.assign(ctx, { input: resolved });
-    } catch (err) {
-      await updateWorkflowRun(runId, {
-        status: "failed",
-        error: `Input resolution failed: ${err}`,
-        finishedAt: new Date().toISOString()
-      });
-      return runId;
-    }
-  }
-  const entryNodes = findEntryNodes(workflow.definition);
-  const secretKeys = getSecretInputKeys(workflow.input);
-  await walkGraph(workflow.definition, runId, ctx, entryNodes, registry, workflow.id, secretKeys, options);
-  return runId;
-}
-var activeWalks = new Map;
-var executingSteps = new Set;
-async function failRunOnUnreadableReplay(runId, err, stepId) {
-  if (!(err instanceof WorkflowReplayStateError))
-    return false;
-  const finishedAt = new Date().toISOString();
-  console.error(`[workflow] ${err.message}`);
-  if (stepId) {
-    await updateWorkflowRunStep(stepId, {
-      status: "failed",
-      error: err.message,
-      finishedAt,
-      nextRetryAt: null
-    });
-  }
-  await updateWorkflowRun(runId, { status: "failed", error: err.message, finishedAt });
-  return true;
-}
-function isWorkflowRunActive(runId) {
-  return activeWalks.has(runId);
-}
-function holdWorkflowRun(runId) {
-  activeWalks.set(runId, (activeWalks.get(runId) ?? 0) + 1);
-  let released = false;
-  return () => {
-    if (released)
-      return;
-    released = true;
-    const remaining = activeWalks.get(runId) - 1;
-    if (remaining === 0)
-      activeWalks.delete(runId);
-    else
-      activeWalks.set(runId, remaining);
-  };
-}
-async function walkGraph(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
-  const release = holdWorkflowRun(runId);
-  try {
-    await walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys, options);
-  } catch (err) {
-    if (!await failRunOnUnreadableReplay(runId, err))
-      throw err;
-  } finally {
-    release();
-  }
-}
-async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
-  if (!options.requestedByUserId) {
-    options = {
-      ...options,
-      requestedByUserId: (await getWorkflowRun(runId))?.createdBy
-    };
-  }
-  let nodeExecutionCount = 0;
-  if (!("run" in ctx)) {
-    ctx.run = { id: runId };
-  }
-  const { completedNodeIds } = await rehydrateCompletedStepOutputs(def, runId, ctx, registry);
-  const { activeEdges } = await loadCompletedStepRouting(def, runId, completedNodeIds);
-  const allSteps = await getWorkflowRunStepsByRunId(runId);
-  if (allSteps.length >= getMaxWorkflowStepsPerRun()) {
-    await updateWorkflowRun(runId, {
-      status: "failed",
-      error: `Circuit breaker: run exceeded ${getMaxWorkflowStepsPerRun()} total steps (WORKFLOW_MAX_STEPS_PER_RUN)`,
-      finishedAt: new Date().toISOString()
-    });
-    return;
-  }
-  for (const step of allSteps) {
-    if (step.status !== "waiting")
-      continue;
-    const successors = getSuccessors(def, step.nodeId);
-    for (const succ of successors) {
-      activeEdges.add(`${step.nodeId}→${succ.id}`);
-    }
-  }
-  const awaited = awaitedNodeIds(allSteps, activeEdges);
-  let pendingNodes = startNodes.filter((n) => {
-    const preds = getAllPredecessors(def, n.id);
-    if (preds.length === 0) {
-      return !completedNodeIds.has(n.id);
-    }
-    const activePreds = preds.filter((predId) => activeEdges.has(`${predId}→${n.id}`) || awaited.has(predId));
-    const predsToCheck = activePreds.length > 0 ? activePreds : preds;
-    return predsToCheck.every((p) => completedNodeIds.has(p));
-  });
-  const executedInThisWalk = new Set;
-  while (pendingNodes.length > 0) {
-    nodeExecutionCount += pendingNodes.length;
-    if (nodeExecutionCount > maxIterations()) {
-      await updateWorkflowRun(runId, {
-        status: "failed",
-        error: `Max node executions (${maxIterations()}) exceeded — possible infinite loop`,
-        finishedAt: new Date().toISOString()
-      });
-      return;
-    }
-    const results = await Promise.all(pendingNodes.map((node) => executeStep(def, runId, ctx, node, registry, workflowId, secretKeys, options).catch(async (err) => {
-      await failRunOnUnreadableReplay(runId, err);
-      return { outcome: "failed", successors: [] };
-    })));
-    const nextBatch = new Map;
-    let hasWaiting = false;
-    for (let i = 0;i < results.length; i++) {
-      const result = results[i];
-      if (result.outcome === "failed") {
-        const currentRun = await getWorkflowRun(runId);
-        if (currentRun?.status === "failed")
-          return;
-        continue;
-      }
-      if (result.outcome === "waiting") {
-        hasWaiting = true;
-        continue;
-      }
-      const sourceNodeId = pendingNodes[i].id;
-      completedNodeIds.add(sourceNodeId);
-      executedInThisWalk.add(sourceNodeId);
-      for (const succ of result.successors) {
-        activeEdges.add(`${sourceNodeId}→${succ.id}`);
-        nextBatch.set(succ.id, succ);
-      }
-    }
-    if (hasWaiting)
-      return;
-    const readyNext = [];
-    const batchSteps = nextBatch.size > 0 ? await getWorkflowRunStepsByRunId(runId) : [];
-    const batchAwaited = awaitedNodeIds(batchSteps, activeEdges);
-    const batchLatest = latestStepByNode(batchSteps);
-    for (const [nodeId, node] of nextBatch) {
-      if (executedInThisWalk.has(nodeId))
-        continue;
-      const allPreds = getAllPredecessors(def, nodeId);
-      for (const predId of allPreds) {
-        if (completedNodeIds.has(predId))
-          continue;
-        const latest = batchLatest.get(predId);
-        if (latest?.status !== "completed")
-          continue;
-        completedNodeIds.add(predId);
-        if (latest.output !== undefined)
-          ctx[predId] = latest.output;
-      }
-      const activePreds = allPreds.filter((predId) => activeEdges.has(`${predId}→${nodeId}`) || batchAwaited.has(predId));
-      const allActivePredsCompleted = activePreds.every((p) => completedNodeIds.has(p));
-      if (allActivePredsCompleted) {
-        readyNext.push(node);
-      }
-    }
-    pendingNodes = readyNext;
-  }
-  await getDbClient().transaction(async () => {
-    const run = await getWorkflowRun(runId);
-    if (!run || run.status !== "running")
-      return;
-    const finalSteps = await getWorkflowRunStepsByRunId(runId);
-    if (hasRunningStep(finalSteps))
-      return;
-    const hasWaitingSteps = finalSteps.some((s) => s.status === "waiting");
-    const hasPendingRetries = finalSteps.some((s) => s.status === "failed" && s.nextRetryAt != null);
-    const failedSteps = finalSteps.filter((s) => s.status === "failed" && s.nextRetryAt == null);
-    const entryNodeIds = new Set(findEntryNodes(def).map((n) => n.id));
-    const hasCompletedSteps = finalSteps.some((s) => s.status === "completed" && !entryNodeIds.has(s.nodeId));
-    if (hasWaitingSteps) {
-      await updateWorkflowRun(runId, { status: "waiting" });
-    } else if (!hasPendingRetries) {
-      if (failedSteps.length > 0 && !hasCompletedSteps) {
-        const failedNodeIds = failedSteps.map((s) => s.nodeId).join(", ");
-        await updateWorkflowRun(runId, {
-          status: "failed",
-          error: `All branches failed. Failed nodes: ${failedNodeIds}`,
-          context: ctx,
-          finishedAt: new Date().toISOString()
-        });
-      } else if (failedSteps.length > 0) {
-        const failedNodeIds = failedSteps.map((s) => s.nodeId).join(", ");
-        await updateWorkflowRun(runId, {
-          status: "completed",
-          error: `Partial failure: nodes [${failedNodeIds}] failed (mustPass validation), but other branches completed successfully`,
-          context: ctx,
-          finishedAt: new Date().toISOString()
-        });
-      } else {
-        await updateWorkflowRun(runId, {
-          status: "completed",
-          context: ctx,
-          finishedAt: new Date().toISOString()
-        });
-      }
-    }
-  });
-}
-function latestStepByNode(steps) {
-  const latest = new Map;
-  for (const step of steps)
-    latest.set(step.nodeId, step);
-  return latest;
-}
-function awaitedNodeIds(steps, activeEdges) {
-  const latest = latestStepByNode(steps);
-  const awaited = new Set;
-  for (const [nodeId, step] of latest) {
-    if (step.status === "running" || step.status === "waiting")
-      awaited.add(nodeId);
-  }
-  for (const edge of activeEdges) {
-    const target = edge.slice(edge.indexOf("→") + 1);
-    if (!latest.has(target))
-      awaited.add(target);
-  }
-  return awaited;
-}
-function hasRunningStep(steps) {
-  for (const step of latestStepByNode(steps).values()) {
-    if (step.status === "running")
-      return true;
-  }
-  return false;
-}
-async function rehydrateCompletedStepOutputs(def, runId, ctx, registry) {
-  const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
-  const latestSteps = new Map;
-  for (const nodeId of completedNodeIds) {
-    if (resolveForeachParent(def, nodeId))
-      continue;
-    const step = await getLatestStepForNode(runId, nodeId);
-    if (!step)
-      continue;
-    if (step.output !== undefined) {
-      const node = def.nodes.find((candidate) => candidate.id === nodeId);
-      if (node && registry.has(node.type)) {
-        const executor = registry.get(node.type);
-        const parseResult = executor.outputSchema.safeParse(step.output);
-        if (!parseResult.success) {
-          console.warn(`[workflow] Recovery: step ${nodeId} output failed validation: ${parseResult.error.message}`);
-          continue;
-        }
-      }
-      ctx[nodeId] = step.output;
-    }
-    latestSteps.set(nodeId, step);
-  }
-  return { completedNodeIds, latestSteps };
-}
-function getAllPredecessors(def, nodeId) {
-  const preds = [];
-  for (const node of def.nodes) {
-    if (!node.next)
-      continue;
-    if (getNextTargets(node.next).includes(nodeId)) {
-      preds.push(node.id);
-    }
-  }
-  return preds;
-}
-async function executeStep(def, runId, ctx, node, registry, workflowId, secretKeys = new Set, options = {}) {
-  let claimedStepId;
-  const claimStep = async () => {
-    const run = await getWorkflowRun(runId);
-    if (!run || run.status !== "running" && run.status !== "waiting") {
-      return { halted: true };
-    }
-    if (node.type !== "foreach") {
-      const current = await getCurrentStepForNode(runId, node.id, getAllPredecessors(def, node.id));
-      if (current && (current.status !== "running" || executingSteps.has(current.id))) {
-        return { current };
-      }
-    }
-    const iteration = await getStepCountForNode(runId, node.id);
-    const idempotencyKey = `${runId}:${node.id}:${iteration}`;
-    const existingStep = await getStepByIdempotencyKey(idempotencyKey);
-    if (existingStep && (existingStep.status === "completed" || existingStep.status === "waiting")) {
-      return { existingStep, stepId: existingStep.id, deduped: true };
-    }
-    const latestForeachStep = node.type === "foreach" ? await getLatestStepForNode(runId, node.id) : undefined;
-    const reusableForeachStep = latestForeachStep && !FOREACH_TERMINAL_STEP_STATUSES.has(latestForeachStep.status) ? latestForeachStep : undefined;
-    const stepId = reusableForeachStep?.id ?? crypto.randomUUID();
-    if (!reusableForeachStep) {
-      await createWorkflowRunStep({
-        id: stepId,
-        runId,
-        nodeId: node.id,
-        nodeType: node.type,
-        input: redactSecretsForStorage(ctx, secretKeys),
-        idempotencyKey
-      });
-    }
-    claimedStepId = stepId;
-    executingSteps.add(stepId);
-    return { existingStep, stepId, deduped: false };
-  };
-  const dedup = await getDbClient().transaction(claimStep).catch((err) => {
-    if (claimedStepId)
-      executingSteps.delete(claimedStepId);
-    throw err;
-  });
-  if ("halted" in dedup)
-    return { outcome: "completed", successors: [] };
-  if ("current" in dedup && dedup.current) {
-    if (dedup.current.status !== "completed")
-      return { outcome: "waiting", successors: [] };
-    ctx[node.id] = dedup.current.output;
-    return { outcome: "completed", successors: [] };
-  }
-  if (dedup.deduped && dedup.existingStep) {
-    if (dedup.existingStep.status === "completed") {
-      ctx[node.id] = dedup.existingStep.output;
-      const successors = getSuccessors(def, node.id);
-      return { outcome: "completed", successors };
-    }
-    return { outcome: "waiting", successors: [] };
-  }
-  try {
-    return await runClaimedStep(def, runId, ctx, node, registry, dedup.existingStep, dedup.stepId, workflowId, options);
-  } catch (err) {
-    if (await failRunOnUnreadableReplay(runId, err, dedup.stepId)) {
-      return { outcome: "failed", successors: [] };
-    }
-    throw err;
-  } finally {
-    executingSteps.delete(dedup.stepId);
-  }
-}
-async function runClaimedStep(def, runId, ctx, node, registry, existingStep, stepId, workflowId, options = {}) {
-  const executor = registry.get(node.type);
-  const systemOneRetryProblems = systemOneRetryViolations(node);
-  if (systemOneRetryProblems.length > 0) {
-    await checkpointStepFailure(runId, stepId, systemOneRetryProblems.join("; "), 0);
-    return { outcome: "failed", successors: [] };
-  }
-  const interpolationCtx = buildNodeInterpolationCtx(node, ctx);
-  if (node.inputSchema) {
-    const inputErrors = validateJsonSchema(node.inputSchema, interpolationCtx);
-    if (inputErrors.length > 0) {
-      const errorMsg = `Input schema validation failed: ${inputErrors.join("; ")}`;
-      await checkpointStepFailure(runId, stepId, errorMsg, 0);
-      throw new Error(errorMsg);
-    }
-  }
-  const {
-    value: interpolatedValue,
-    unresolved,
-    scriptBodyUnresolved,
-    strictUnresolved
-  } = interpolateNodeConfig(node, interpolationCtx);
-  const interpolatedConfig = interpolatedValue;
-  const executionCtx = { ...ctx, ...interpolationCtx };
-  if (scriptBodyUnresolved && scriptBodyUnresolved.length > 0) {
-    const errorMsg = scriptBodyInterpolationError(node.id, scriptBodyUnresolved);
-    await checkpointStepFailure(runId, stepId, errorMsg, 0);
-    return { outcome: "failed", successors: [] };
-  }
-  if (strictUnresolved && strictUnresolved.length > 0) {
-    await checkpointStepFailure(runId, stepId, systemOneUnresolvedError(node.id, strictUnresolved), 0);
-    return { outcome: "failed", successors: [] };
-  }
-  if (unresolved.length > 0) {
-    console.warn(`[workflow] Step ${node.id}: unresolved interpolation tokens: ${unresolved.join(", ")}`);
-    await updateWorkflowRunStep(stepId, {
-      diagnostics: JSON.stringify({ unresolvedTokens: unresolved })
-    });
-  }
-  const meta = {
-    runId,
-    stepId,
-    nodeId: node.id,
-    workflowId: workflowId || "",
-    dryRun: false,
-    requestedByUserId: options.requestedByUserId,
-    inputCtx: interpolationCtx
-  };
-  const configuredTimeoutMs = typeof node.config?.timeoutMs === "number" ? node.config.timeoutMs : node.type === "script" && typeof node.config?.timeout === "number" ? node.config.timeout : undefined;
-  const timeoutMs = configuredTimeoutMs ?? DEFAULT_TIMEOUT_MS;
-  let result;
-  try {
-    result = await Promise.race([
-      executor.run({
-        config: interpolatedConfig,
-        context: executionCtx,
-        meta
-      }),
-      timeoutPromise(timeoutMs)
-    ]);
-  } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : String(err);
-    const retryPolicy = node.retry || executor.retryPolicy;
-    const currentRetryCount = existingStep?.retryCount || 0;
-    const { shouldRetry } = await checkpointStepFailure(runId, stepId, errorMsg, currentRetryCount, retryPolicy);
-    if (!shouldRetry) {
-      throw err;
-    }
-    return { outcome: "completed", successors: [] };
-  }
-  if (result.status === "failed") {
-    const retryPolicy = node.retry || executor.retryPolicy;
-    const currentRetryCount = existingStep?.retryCount || 0;
-    const { shouldRetry } = await checkpointStepFailure(runId, stepId, result.error || "Executor returned failed status", currentRetryCount, retryPolicy);
-    if (result.output !== undefined) {
-      await updateWorkflowRunStep(stepId, { output: result.output });
-    }
-    if (!shouldRetry) {
-      throw new Error(result.error || "Step execution failed");
-    }
-    return { outcome: "completed", successors: [] };
-  }
-  if ("async" in result && result.async) {
-    const waiting = await checkpointStepWaiting(runId, stepId, ctx);
-    return { outcome: waiting ? "waiting" : "completed", successors: [] };
-  }
-  if (node.outputSchema && result.status === "success") {
-    const outputErrors = validateJsonSchema(node.outputSchema, result.output);
-    if (outputErrors.length > 0) {
-      const errorMsg = `Output schema validation failed: ${outputErrors.join("; ")}`;
-      await checkpointStepFailure(runId, stepId, errorMsg, 0);
-      throw new Error(errorMsg);
-    }
-  }
-  let validationResult;
-  if (node.validation) {
-    validationResult = await runStepValidation(registry, node, result.output, executionCtx, meta);
-    if (validationResult.outcome === "halt") {
-      const errorMsg = "Validation failed (mustPass)";
-      await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, { markRunFailed: false });
-      return { outcome: "failed", successors: [] };
-    }
-    if (validationResult.outcome === "retry") {
-      if (validationResult.retryContext) {
-        const historyKey = `${node.id}_validations`;
-        const existing = ctx[historyKey] || [];
-        ctx[historyKey] = [...existing, validationResult.retryContext];
-      }
-      const retryPolicy = node.validation.retry || node.retry;
-      const currentRetryCount = existingStep?.retryCount || 0;
-      await checkpointStepFailure(runId, stepId, "Validation failed, retrying", currentRetryCount, retryPolicy);
-      return { outcome: "completed", successors: [] };
-    }
-  }
-  result.nextPort = resolveValidationPort(node.next, result.nextPort, validationResult?.passed);
-  await checkpointStep(runId, stepId, node.id, result, ctx);
-  const successors = result.nextPort ? getSuccessors(def, node.id, result.nextPort) : getSuccessors(def, node.id);
-  return { outcome: "completed", successors };
-}
-function findReadyNodes(def, completedNodeIds, activeEdges) {
-  const predecessors = new Map;
-  for (const node of def.nodes) {
-    if (!predecessors.has(node.id)) {
-      predecessors.set(node.id, new Set);
-    }
-  }
-  for (const node of def.nodes) {
-    if (!node.next)
-      continue;
-    for (const target of getNextTargets(node.next)) {
-      if (!predecessors.has(target)) {
-        predecessors.set(target, new Set);
-      }
-      predecessors.get(target).add(node.id);
-    }
-  }
-  return def.nodes.filter((node) => {
-    if (completedNodeIds.has(node.id))
-      return false;
-    const preds = predecessors.get(node.id);
-    if (!preds || preds.size === 0)
-      return true;
-    if (activeEdges) {
-      const activePreds = [...preds].filter((predId) => activeEdges.has(`${predId}→${node.id}`));
-      if (activePreds.length === 0)
-        return false;
-      return activePreds.every((pred) => completedNodeIds.has(pred));
-    }
-    for (const pred of preds) {
-      if (!completedNodeIds.has(pred))
-        return false;
-    }
-    return true;
-  });
-}
-function buildNodeInterpolationCtx(node, ctx) {
-  const interpolationCtx = {};
-  if (ctx.trigger !== undefined)
-    interpolationCtx.trigger = ctx.trigger;
-  if (ctx.input !== undefined)
-    interpolationCtx.input = ctx.input;
-  if (ctx.workflow !== undefined)
-    interpolationCtx.workflow = ctx.workflow;
-  if (ctx.swarm !== undefined)
-    interpolationCtx.swarm = ctx.swarm;
-  if (ctx.run !== undefined)
-    interpolationCtx.run = ctx.run;
-  if (!node.inputs)
-    return interpolationCtx;
-  for (const [localName, sourcePath] of Object.entries(node.inputs)) {
-    const keys = sourcePath.split(".");
-    let value = ctx;
-    for (const key of keys) {
-      if (value == null || typeof value !== "object") {
-        value = undefined;
-        break;
-      }
-      value = value[key];
-    }
-    interpolationCtx[localName] = value;
-  }
-  return interpolationCtx;
-}
-var SCRIPT_BODY_ALLOWED_SOURCES = new Set(["input", "workflow", "swarm", "run"]);
-function buildScriptBodyCtx(node, interpolationCtx) {
-  const aliases = node.inputs ?? {};
-  const safe = {};
-  for (const [key, value] of Object.entries(interpolationCtx)) {
-    const sourcePath = aliases[key];
-    const root = sourcePath === undefined ? key : sourcePath.split(".")[0] ?? "";
-    if (SCRIPT_BODY_ALLOWED_SOURCES.has(root))
-      safe[key] = value;
-  }
-  return safe;
-}
-function interpolateNodeConfig(node, interpolationCtx) {
-  if (node.type === SYSTEM_ONE_DECISION_NODE_TYPE) {
-    const { state, questions, ...rest } = node.config;
-    const restResult = deepInterpolate(rest, interpolationCtx);
-    const dynamic = {};
-    if (Object.hasOwn(node.config, "state"))
-      dynamic.state = state;
-    if (Object.hasOwn(node.config, "questions"))
-      dynamic.questions = questions;
-    const dynamicResult = deepInterpolate(dynamic, interpolationCtx, { preserveRawTokens: true });
-    const unresolved = [...restResult.unresolved, ...dynamicResult.unresolved];
-    return {
-      value: {
-        ...restResult.value,
-        ...dynamicResult.value
-      },
-      unresolved,
-      strictUnresolved: unresolved
-    };
-  }
-  if (node.type === "foreach" && Object.hasOwn(node.config, "over")) {
-    const { over, body, ...configWithoutOverAndBody } = node.config;
-    const configResult2 = deepInterpolate(configWithoutOverAndBody, interpolationCtx);
-    const overResult = deepInterpolate(over, interpolationCtx, { preserveRawTokens: true });
-    return {
-      value: {
-        ...configResult2.value,
-        over: overResult.value,
-        body
-      },
-      unresolved: [...configResult2.unresolved, ...overResult.unresolved]
-    };
-  }
-  if (node.type === "human-in-the-loop" && typeof node.config.questions === "string") {
-    const { questions, ...configWithoutQuestions } = node.config;
-    const configResult2 = deepInterpolate(configWithoutQuestions, interpolationCtx);
-    const questionsResult = deepInterpolate(questions, interpolationCtx, {
-      preserveRawTokens: true
-    });
-    return {
-      value: {
-        ...configResult2.value,
-        questions: questionsResult.value
-      },
-      unresolved: [...configResult2.unresolved, ...questionsResult.unresolved]
-    };
-  }
-  if (node.type === "script" && typeof node.config.script === "string") {
-    const { script, ...configWithoutScript } = node.config;
-    const restResult = deepInterpolate(configWithoutScript, interpolationCtx);
-    const scriptResult = deepInterpolate(script, buildScriptBodyCtx(node, interpolationCtx));
-    return {
-      value: {
-        ...restResult.value,
-        script: scriptResult.unresolved.length > 0 ? script : scriptResult.value
-      },
-      unresolved: [...restResult.unresolved, ...scriptResult.unresolved],
-      scriptBodyUnresolved: scriptResult.unresolved
-    };
-  }
-  if (node.type !== "swarm-script" || !Object.hasOwn(node.config, "args")) {
-    return deepInterpolate(node.config, interpolationCtx);
-  }
-  const { args, ...configWithoutArgs } = node.config;
-  const configResult = deepInterpolate(configWithoutArgs, interpolationCtx);
-  const argsResult = deepInterpolate(args, interpolationCtx, { preserveRawTokens: true });
-  return {
-    value: {
-      ...configResult.value,
-      args: argsResult.value
-    },
-    unresolved: [...configResult.unresolved, ...argsResult.unresolved]
-  };
-}
-function scriptBodyInterpolationError(nodeId, tokens) {
-  const renderedTokens = [...new Set(tokens)].map((token) => `{{${token}}}`).join(", ");
-  return `Script body interpolation failed for node "${nodeId}": unresolved or disallowed token(s): ${renderedTokens}. ` + "Executable source may interpolate only input, workflow, swarm, or run values. " + "Pass dynamic trigger or upstream values through config.args and read them from argv.";
-}
-function timeoutPromise(ms) {
-  return new Promise((_, reject) => {
-    setTimeout(() => reject(new Error(`Step timed out after ${ms}ms`)), ms);
-  });
-}
 
 // src/workflows/index.ts
 init_event_bus();
 
 // src/workflows/recovery.ts
 init_db2();
-
-// src/workflows/approval-resolution.ts
-function shapeApprovalResolution(registry, definition, nodeId, parkedOutput, approval) {
-  const node = definition.nodes.find((candidate) => candidate.id === nodeId);
-  if (node && registry.has(node.type)) {
-    const shaped = registry.get(node.type).resolveApproval(parkedOutput, approval);
-    if (shaped)
-      return shaped;
-  }
-  return {
-    output: {
-      requestId: approval.requestId,
-      status: approval.status,
-      responses: approval.responses
-    },
-    nextPort: approval.status === "timeout" ? "timeout" : approval.status === "rejected" ? "rejected" : "approved"
-  };
-}
-
-// src/workflows/constants.ts
-var FAILED_TASK_OUTPUT_PREFIX = "[FAILED:";
-
-// src/workflows/resume.ts
-init_db2();
-init_secret_scrubber();
-init_event_bus();
-
-// src/workflows/executors/wait.ts
-init_zod();
-
-// src/workflows/wait-filter.ts
-var PARAM_SHADOW_KEYS = [
-  "require",
-  "process",
-  "Bun",
-  "globalThis",
-  "global",
-  "fetch",
-  "setTimeout",
-  "setInterval"
-];
-var PARAM_SHADOW_VALUES = PARAM_SHADOW_KEYS.map(() => {
-  return;
-});
-var BODY_SHADOW_KEYS = ["eval", "Function", "AsyncFunction"];
-var BODY_SHADOW_PREAMBLE = BODY_SHADOW_KEYS.map((k) => `var ${k} = undefined;`).join(" ");
-var FILTER_TIMEOUT_MS = 50;
-function getByDotPath(obj, path) {
-  if (obj === null || typeof obj !== "object") {
-    return { found: false, value: undefined };
-  }
-  const segments = path.split(".");
-  let cursor = obj;
-  for (const seg of segments) {
-    if (cursor === null || typeof cursor !== "object") {
-      return { found: false, value: undefined };
-    }
-    const rec = cursor;
-    if (!(seg in rec)) {
-      return { found: false, value: undefined };
-    }
-    cursor = rec[seg];
-  }
-  return { found: true, value: cursor };
-}
-function deepEqual(a, b) {
-  if (a === b)
-    return true;
-  if (typeof a !== typeof b)
-    return false;
-  if (a === null || b === null)
-    return false;
-  if (Array.isArray(a)) {
-    if (!Array.isArray(b))
-      return false;
-    if (a.length !== b.length)
-      return false;
-    for (let i = 0;i < a.length; i++) {
-      if (!deepEqual(a[i], b[i]))
-        return false;
-    }
-    return true;
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const aKeys = Object.keys(a);
-    const bKeys = Object.keys(b);
-    if (aKeys.length !== bKeys.length)
-      return false;
-    for (const k of aKeys) {
-      if (!deepEqual(a[k], b[k])) {
-        return false;
-      }
-    }
-    return true;
-  }
-  return false;
-}
-function matchObjectFilter(payload, filter) {
-  for (const [key, expected] of Object.entries(filter)) {
-    const { found, value } = getByDotPath(payload, key);
-    if (!found)
-      return false;
-    if (!deepEqual(value, expected))
-      return false;
-  }
-  return true;
-}
-async function runWithTimeout(fn) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const timer = setTimeout(() => {
-      if (settled)
-        return;
-      settled = true;
-      resolve(null);
-    }, FILTER_TIMEOUT_MS);
-    queueMicrotask(() => {
-      if (settled)
-        return;
-      try {
-        const v = fn();
-        if (v !== null && typeof v === "object" && typeof v.then === "function") {
-          v.catch(() => {});
-          settled = true;
-          clearTimeout(timer);
-          resolve({ __asyncRejected: true });
-          return;
-        }
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        resolve(v);
-      } catch {
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        resolve(null);
-      }
-    });
-  });
-}
-var ASYNC_SENTINEL = "__asyncRejected";
-function isAsyncSentinel(value) {
-  return value !== null && typeof value === "object" && value[ASYNC_SENTINEL] === true;
-}
-function compileStringFilter(filter) {
-  if (filter.length > 2048) {
-    throw new Error(`wait filter source exceeds 2KB cap (${filter.length} bytes)`);
-  }
-  let fn;
-  try {
-    fn = new Function(...PARAM_SHADOW_KEYS, "payload", `${BODY_SHADOW_PREAMBLE} return (${filter})(payload);`);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(`wait filter compile error: ${msg}`);
-  }
-  return (payload) => fn(...PARAM_SHADOW_VALUES, payload);
-}
-function nullifyPrototypes(value) {
-  if (value === null || typeof value !== "object")
-    return value;
-  if (Array.isArray(value)) {
-    return value.map(nullifyPrototypes);
-  }
-  const out = Object.create(null);
-  for (const [k, v] of Object.entries(value)) {
-    out[k] = nullifyPrototypes(v);
-  }
-  return out;
-}
-async function matchesFilter(payload, filter) {
-  if (filter === undefined || filter === null)
-    return true;
-  if (typeof filter === "object" && !Array.isArray(filter)) {
-    return matchObjectFilter(payload, filter);
-  }
-  if (typeof filter === "string") {
-    let userFn;
-    try {
-      userFn = compileStringFilter(filter);
-    } catch {
-      return false;
-    }
-    let cloned;
-    try {
-      const cloneOnce = structuredClone(payload);
-      cloned = nullifyPrototypes(cloneOnce);
-    } catch {
-      try {
-        cloned = nullifyPrototypes(payload);
-      } catch {
-        cloned = payload;
-      }
-    }
-    const result = await runWithTimeout(() => userFn(cloned));
-    if (result === null)
-      return false;
-    if (isAsyncSentinel(result))
-      return false;
-    return !!result;
-  }
-  return false;
-}
-
-// src/workflows/executors/wait.ts
-var WaitConfigSchema = exports_external.discriminatedUnion("mode", [
-  exports_external.object({
-    mode: exports_external.literal("time"),
-    durationMs: exports_external.number().int().min(1).max(31536000000).describe("Wait duration in milliseconds (effective resolution ~5s)")
-  }),
-  exports_external.object({
-    mode: exports_external.literal("event"),
-    eventName: exports_external.string().min(1),
-    filter: exports_external.union([exports_external.record(exports_external.string(), exports_external.unknown()), exports_external.string().max(2048)]).optional(),
-    scope: exports_external.enum(["run", "global"]).default("run"),
-    timeoutMs: exports_external.number().int().min(1).max(31536000000).optional().describe("Timeout in milliseconds (effective resolution ~5s) — when reached, routes via 'timeout' port")
-  })
-]);
-var WaitOutputSchema = exports_external.object({
-  waitId: exports_external.string().uuid(),
-  mode: exports_external.enum(["time", "event"]),
-  firedAt: exports_external.string().nullable(),
-  payload: exports_external.unknown().optional()
-});
-
-class WaitExecutor extends BaseExecutor {
-  type = "wait";
-  mode = "async";
-  configSchema = WaitConfigSchema;
-  outputSchema = WaitOutputSchema;
-  async execute(config, _context, meta) {
-    const { db } = this.deps;
-    const existing = await db.getWaitStateByStepId(meta.stepId);
-    if (existing) {
-      if (existing.status !== "pending") {
-        const nextPort = computeNextPort(existing.mode, existing.status);
-        return {
-          status: "success",
-          output: {
-            waitId: existing.id,
-            mode: existing.mode,
-            firedAt: existing.resolvedAt,
-            payload: existing.firedPayload ?? undefined
-          },
-          nextPort
-        };
-      }
-      return {
-        status: "success",
-        async: true,
-        waitFor: "wait.fired",
-        correlationId: existing.id
-      };
-    }
-    if (config.mode === "time") {
-      const waitId2 = crypto.randomUUID();
-      const wakeUpAt = new Date(Date.now() + config.durationMs).toISOString();
-      await db.createWaitState({
-        id: waitId2,
-        workflowRunId: meta.runId,
-        workflowRunStepId: meta.stepId,
-        mode: "time",
-        wakeUpAt
-      });
-      return {
-        status: "success",
-        async: true,
-        waitFor: "wait.fired",
-        correlationId: waitId2
-      };
-    }
-    if (typeof config.filter === "string") {
-      compileStringFilter(config.filter);
-    }
-    const waitId = crypto.randomUUID();
-    const expiresAt = config.timeoutMs ? new Date(Date.now() + config.timeoutMs).toISOString() : null;
-    await db.createWaitState({
-      id: waitId,
-      workflowRunId: meta.runId,
-      workflowRunStepId: meta.stepId,
-      mode: "event",
-      eventName: config.eventName,
-      eventFilter: config.filter ?? null,
-      expiresAt,
-      scope: config.scope
-    });
-    subscribeWaitToBus(waitId, config.eventName);
-    return {
-      status: "success",
-      async: true,
-      waitFor: "wait.fired",
-      correlationId: waitId
-    };
-  }
-}
-function computeNextPort(mode, status) {
-  if (mode === "time")
-    return "default";
-  return status === "timeout" ? "timeout" : "event";
-}
-
-// src/workflows/task-step-routing.ts
-init_db2();
-init_types();
-async function isTaskBoundToStep(taskId, stepId) {
-  const task = await getTaskById(taskId);
-  return task?.workflowRunStepId === stepId;
-}
-async function failStepAndRunIfWaiting(stepId, runId, reason, ownerTaskId) {
-  const now = new Date().toISOString();
-  return await getDbClient().transaction(async () => {
-    const current = await getWorkflowRunStep(stepId);
-    if (!current || current.status !== "waiting")
-      return false;
-    if (ownerTaskId && !await isTaskBoundToStep(ownerTaskId, stepId))
-      return false;
-    await updateWorkflowRunStep(stepId, {
-      status: "failed",
-      error: reason,
-      finishedAt: now
-    });
-    await updateWorkflowRun(runId, {
-      status: "failed",
-      error: reason,
-      finishedAt: now
-    });
-    return true;
-  });
-}
-async function checkpointPortStepAndResolveSuccessors(def, runId, stepId, nodeId, output, nextPort, ctx) {
-  return await getDbClient().transaction(async () => {
-    const current = await getWorkflowRunStep(stepId);
-    if (!current || current.status !== "waiting")
-      return { claimed: false, successors: [] };
-    await checkpointStep(runId, stepId, nodeId, { output, nextPort }, ctx);
-    await updateWorkflowRun(runId, { status: "running" });
-    return { claimed: true, successors: getSuccessors(def, nodeId, nextPort) };
-  });
-}
-async function scheduleTaskStepRetry(def, runId, step, taskId, reason) {
-  const node = def.nodes.find((n) => n.id === step.nodeId);
-  if (!node || node.type !== "agent-task" || !node.retry)
-    return "not-eligible";
-  const parsed = RetryPolicySchema.safeParse(node.retry);
-  if (!parsed.success)
-    return "not-eligible";
-  const policy = parsed.data;
-  return await getDbClient().transaction(async () => {
-    const current = await getWorkflowRunStep(step.id);
-    if (!current || current.status !== "waiting")
-      return "not-claimed";
-    if (!await isTaskBoundToStep(taskId, step.id))
-      return "not-claimed";
-    if (current.retryCount >= policy.maxRetries)
-      return "not-eligible";
-    await detachTaskFromWorkflowRunStep(taskId);
-    await checkpointStepFailure(runId, step.id, reason, current.retryCount, policy);
-    return "scheduled";
-  });
-}
-var UNCLAIMED = {
-  claimed: false,
-  foreachChild: false,
-  joined: false,
-  successors: []
-};
-async function completeTaskStepAndResolveSuccessors(def, runId, step, output, ctx, failureReason, ownerTaskId) {
-  return await getDbClient().transaction(async () => {
-    const current = await getWorkflowRunStep(step.id);
-    if (!current || current.status !== "waiting")
-      return UNCLAIMED;
-    if (ownerTaskId && !await isTaskBoundToStep(ownerTaskId, step.id))
-      return UNCLAIMED;
-    const foreachParent = resolveForeachParent(def, step.nodeId);
-    if (foreachParent) {
-      await updateWorkflowRunStep(step.id, {
-        status: "completed",
-        output,
-        ...failureReason !== undefined ? { error: failureReason } : {},
-        finishedAt: new Date().toISOString()
-      });
-      const join = await joinForeach(def, runId, step, ctx);
-      await updateWorkflowRun(runId, { status: "running" });
-      return {
-        claimed: true,
-        foreachChild: true,
-        joined: join.joined,
-        successors: join.successors
-      };
-    }
-    await checkpointStep(runId, step.id, step.nodeId, { output }, ctx);
-    await updateWorkflowRun(runId, { status: "running" });
-    return {
-      claimed: true,
-      foreachChild: false,
-      joined: true,
-      successors: getSuccessors(def, step.nodeId)
-    };
-  });
-}
-
-// src/workflows/resume.ts
-function setupWorkflowResumeListener(eventBus, registry) {
-  const onTaskCompleted = async (data) => {
-    try {
-      const event = data;
-      if (!event.workflowRunId || !event.workflowRunStepId)
-        return;
-      await resumeFromTaskCompletion(event, registry);
-    } catch (err) {
-      console.error("[workflows] Resume from task completion failed:", err);
-    }
-  };
-  eventBus.on("task.completed", onTaskCompleted);
-  const onTaskFailed = async (data) => {
-    try {
-      const event = data;
-      if (!event.workflowRunId || !event.workflowRunStepId)
-        return;
-      await handleTaskFailure(event, event.failureReason ?? "Task failed", registry, {
-        retryable: true
-      });
-    } catch (err) {
-      console.error("[workflows] Handle task failure error:", err);
-    }
-  };
-  eventBus.on("task.failed", onTaskFailed);
-  const onTaskCancelled = async (data) => {
-    try {
-      const event = data;
-      if (!event.workflowRunId || !event.workflowRunStepId)
-        return;
-      await handleTaskFailure(event, "Task was cancelled", registry, { retryable: false });
-    } catch (err) {
-      console.error("[workflows] Handle task cancellation error:", err);
-    }
-  };
-  eventBus.on("task.cancelled", onTaskCancelled);
-  const onApprovalResolved = async (data) => {
-    try {
-      const event = data;
-      if (!event.workflowRunId || !event.workflowRunStepId)
-        return;
-      await resumeFromApprovalResolution(event, registry);
-    } catch (err) {
-      console.error("[workflows] Resume from approval resolution failed:", err);
-    }
-  };
-  eventBus.on("approval.resolved", onApprovalResolved);
-  return () => {
-    eventBus.off("task.completed", onTaskCompleted);
-    eventBus.off("task.failed", onTaskFailed);
-    eventBus.off("task.cancelled", onTaskCancelled);
-    eventBus.off("approval.resolved", onApprovalResolved);
-  };
-}
-async function failClosedOnUnreadableReplay(runId, stepId, resume) {
-  try {
-    await resume();
-  } catch (err) {
-    if (!await failRunOnUnreadableReplay(runId, err, stepId))
-      throw err;
-  }
-}
-async function resumeFromTaskCompletion(event, registry) {
-  await failClosedOnUnreadableReplay(event.workflowRunId, event.workflowRunStepId, () => resumeFromTaskCompletionUnguarded(event, registry));
-}
-async function resumeFromTaskCompletionUnguarded(event, registry) {
-  const run = await getWorkflowRun(event.workflowRunId);
-  if (!run || run.status !== "waiting" && run.status !== "running")
-    return;
-  const step = await getWorkflowRunStep(event.workflowRunStepId);
-  if (!step || step.status !== "waiting")
-    return;
-  if (await isStaleTaskEvent(step.id, event))
-    return;
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    return;
-  const ctx = run.context ?? {};
-  let taskOutput = event.output;
-  if (event.output) {
-    try {
-      const parsed = JSON.parse(event.output);
-      if (typeof parsed === "object" && parsed !== null) {
-        taskOutput = parsed;
-      }
-    } catch {}
-  }
-  const stepOutput = { taskId: event.taskId, taskOutput };
-  const routing = await completeTaskStepAndResolveSuccessors(workflow.definition, run.id, step, stepOutput, ctx);
-  if (!routing.claimed)
-    return;
-  const successors = routing.successors;
-  if (successors.length > 0) {
-    const secretKeys = getSecretInputKeys(workflow.input);
-    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
-  } else {
-    await finalizeOrWait(run.id);
-  }
-}
-async function finalizeOrWait(runId) {
-  await getDbClient().transaction(async () => {
-    const steps = await getWorkflowRunStepsByRunId(runId);
-    if (hasRunningStep(steps)) {
-      const run = await getWorkflowRun(runId);
-      if (run?.status === "waiting")
-        await updateWorkflowRun(runId, { status: "running" });
-      return;
-    }
-    const hasWaiting = steps.some((s) => s.status === "waiting" || s.status === "failed" && s.nextRetryAt != null);
-    if (hasWaiting) {
-      await updateWorkflowRun(runId, { status: "waiting" });
-    } else {
-      await updateWorkflowRun(runId, {
-        status: "completed",
-        finishedAt: new Date().toISOString()
-      });
-    }
-  });
-}
-async function handleTaskFailure(event, reason, registry, options) {
-  await failClosedOnUnreadableReplay(event.workflowRunId, event.workflowRunStepId, () => handleTaskFailureUnguarded(event, reason, registry, options));
-}
-async function handleTaskFailureUnguarded(event, reason, registry, options) {
-  const run = await getWorkflowRun(event.workflowRunId);
-  if (!run || run.status !== "waiting" && run.status !== "running")
-    return;
-  const step = await getWorkflowRunStep(event.workflowRunStepId);
-  if (!step || step.status !== "waiting")
-    return;
-  if (await isStaleTaskEvent(step.id, event))
-    return;
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    return;
-  if (options.retryable) {
-    const retry = await scheduleTaskStepRetry(workflow.definition, run.id, step, event.taskId, reason);
-    if (retry === "scheduled") {
-      console.log(`[workflows] Task ${event.taskId} failed; step ${step.nodeId} of run ${run.id} queued for retry ${step.retryCount + 1}`);
-      return;
-    }
-    if (retry === "not-claimed")
-      return;
-  }
-  const onFailure = workflow.definition.onNodeFailure ?? "fail";
-  if (onFailure === "fail") {
-    await markRunFailed(event, reason);
-    return;
-  }
-  const ctx = run.context ?? {};
-  const stepOutput = {
-    taskId: event.taskId,
-    taskOutput: `${FAILED_TASK_OUTPUT_PREFIX} ${reason}] This node failed or was cancelled.`
-  };
-  const routing = await completeTaskStepAndResolveSuccessors(workflow.definition, run.id, step, stepOutput, ctx, reason);
-  if (!routing.claimed)
-    return;
-  const successors = routing.successors;
-  if (successors.length > 0) {
-    const secretKeys = getSecretInputKeys(workflow.input);
-    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
-  } else {
-    await finalizeOrWait(run.id);
-  }
-}
-async function isStaleTaskEvent(stepId, event) {
-  if (!event.taskId)
-    return false;
-  const boundTask = await getTaskByWorkflowRunStepId(stepId);
-  return boundTask != null && boundTask.id !== event.taskId;
-}
-async function markRunFailed(event, reason) {
-  await failStepAndRunIfWaiting(event.workflowRunStepId, event.workflowRunId, reason);
-}
-async function retryFailedRun(runId, registry) {
-  const run = await getWorkflowRun(runId);
-  if (!run || run.status !== "failed")
-    throw new Error("Run is not in failed state");
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    throw new Error("Workflow not found");
-  const steps = await getWorkflowRunStepsByRunId(runId);
-  const failedStep = steps.find((s) => s.status === "failed");
-  if (!failedStep)
-    throw new Error("No failed step found");
-  const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
-  const notReady = await findWorkflowReadinessProblems({ nodes: workflow.definition.nodes.filter((node) => !completedNodeIds.has(node.id)) }, registry);
-  if (notReady.length > 0) {
-    throw new Error(`Retry not started, run left failed: ${formatReadinessProblems(notReady)}`);
-  }
-  const { activeEdges } = await loadCompletedStepRouting(workflow.definition, runId, completedNodeIds);
-  const foreachParent = resolveForeachParent(workflow.definition, failedStep.nodeId);
-  const failedNode = foreachParent ?? workflow.definition.nodes.find((n) => n.id === failedStep.nodeId);
-  if (!failedNode)
-    throw new Error(`Node ${failedStep.nodeId} not found in workflow definition`);
-  const hasStructuralPredecessor = workflow.definition.nodes.some((node) => node.next && getNextTargets(node.next).includes(failedNode.id));
-  const hasActivePredecessor = [...activeEdges].some((edge) => edge.endsWith(`→${failedNode.id}`));
-  const shouldRetryFailedNode = foreachParent != null || !hasStructuralPredecessor || hasActivePredecessor;
-  const ctx = run.context ?? {};
-  const claimed = await getDbClient().transaction(async () => {
-    const current = await getWorkflowRun(runId);
-    if (!current || current.status !== "failed")
-      return false;
-    await updateWorkflowRunStep(failedStep.id, {
-      status: shouldRetryFailedNode ? "pending" : "cancelled",
-      error: shouldRetryFailedNode ? null : "Skipped on retry because its branch was not active"
-    });
-    await updateWorkflowRun(runId, { status: "running", error: null, context: ctx });
-    return true;
-  });
-  if (!claimed)
-    throw new Error("Run is not in failed state");
-  const liveNodeIds = new Set(steps.filter((s) => s.status === "running" || s.status === "waiting").map((s) => s.nodeId));
-  const readyNodes = findReadyNodes(workflow.definition, completedNodeIds, activeEdges).filter((n) => n.id === failedNode.id || !liveNodeIds.has(n.id));
-  const nodesToRun = !shouldRetryFailedNode || readyNodes.some((n) => n.id === failedNode.id) ? readyNodes : [failedNode, ...readyNodes];
-  const secretKeys = getSecretInputKeys(workflow.input);
-  await walkGraph(workflow.definition, runId, ctx, nodesToRun, registry, workflow.id, secretKeys);
-}
-async function cancelWorkflowRunRows(runId, cancelReason) {
-  const terminalStatuses = ["completed", "failed", "cancelled", "skipped"];
-  const now = new Date().toISOString();
-  return await getDbClient().transaction(async () => {
-    const current = await getWorkflowRun(runId);
-    if (!current || terminalStatuses.includes(current.status))
-      return false;
-    const steps = await getWorkflowRunStepsByRunId(runId);
-    for (const step of steps) {
-      if (terminalStatuses.includes(step.status))
-        continue;
-      const task = await getTaskByWorkflowRunStepId(step.id);
-      if (task) {
-        await cancelTask(task.id, cancelReason);
-      }
-      await updateWorkflowRunStep(step.id, {
-        status: "cancelled",
-        error: cancelReason,
-        finishedAt: now
-      });
-    }
-    await cancelPendingApprovalRequestsForRun(runId, cancelReason);
-    await updateWorkflowRun(runId, {
-      status: "cancelled",
-      error: cancelReason,
-      finishedAt: now
-    });
-    return true;
-  });
-}
-async function cancelWorkflowRun(runId, reason) {
-  const run = await getWorkflowRun(runId);
-  if (!run)
-    throw new Error("Workflow run not found");
-  const terminalStatuses = ["completed", "failed", "cancelled", "skipped"];
-  if (terminalStatuses.includes(run.status) && run.status !== "cancelled") {
-    throw new Error(`Cannot cancel run in '${run.status}' state`);
-  }
-  const cancelReason = reason ?? "Cancelled by user";
-  const applied = await cancelWorkflowRunRows(runId, cancelReason);
-  const cancelledApprovals = await listCancelledApprovalRequestsForRun(runId);
-  const latestRun = await getWorkflowRun(runId);
-  if (!applied && latestRun?.status !== "cancelled") {
-    throw new Error(`Cannot cancel run in '${latestRun?.status ?? "missing"}' state`);
-  }
-  await postApprovalCancellationUpdates(cancelledApprovals, applied ? cancelReason : latestRun?.error ?? cancelReason);
-}
-async function resumeFromApprovalResolution(event, registry) {
-  await failClosedOnUnreadableReplay(event.workflowRunId, event.workflowRunStepId, () => resumeFromApprovalResolutionUnguarded(event, registry));
-}
-async function resumeFromApprovalResolutionUnguarded(event, registry) {
-  const run = await getWorkflowRun(event.workflowRunId);
-  if (!run || run.status !== "waiting" && run.status !== "running")
-    return;
-  const step = await getWorkflowRunStep(event.workflowRunStepId);
-  if (!step || step.status !== "waiting")
-    return;
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    return;
-  if (event.status === "cancelled") {
-    console.warn(`[workflows] approval ${event.requestId} is cancelled; step ${event.workflowRunStepId} stays waiting for the run cancel path`);
-    return;
-  }
-  const ctx = run.context ?? {};
-  const { output: stepOutput, nextPort } = shapeApprovalResolution(registry, workflow.definition, step.nodeId, step.output, { requestId: event.requestId, status: event.status, responses: event.responses });
-  const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, stepOutput, nextPort, ctx);
-  if (!routing.claimed)
-    return;
-  const successors = routing.successors;
-  if (successors.length > 0) {
-    const secretKeys = getSecretInputKeys(workflow.input);
-    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
-  } else {
-    await finalizeOrWait(run.id);
-  }
-}
-async function resumeWaitState(waitId, status, payload, registry) {
-  const cappedPayload = capPayload(payload);
-  const result = await resolveWaitState(waitId, { status, firedPayload: cappedPayload });
-  if (!result.updated || !result.row)
-    return;
-  const waitRow = result.row;
-  await failClosedOnUnreadableReplay(waitRow.workflowRunId, waitRow.workflowRunStepId, () => resumeClaimedWait(waitRow, status, cappedPayload, registry));
-}
-async function resumeClaimedWait(waitRow, status, cappedPayload, registry) {
-  const run = await getWorkflowRun(waitRow.workflowRunId);
-  if (!run || run.status !== "waiting" && run.status !== "running")
-    return;
-  const step = await getWorkflowRunStep(waitRow.workflowRunStepId);
-  if (!step || step.status !== "waiting")
-    return;
-  const workflow = await getWorkflow(run.workflowId);
-  if (!workflow)
-    return;
-  const nextPort = computeNextPort(waitRow.mode, status);
-  const ctx = run.context ?? {};
-  const stepOutput = {
-    waitId: waitRow.id,
-    mode: waitRow.mode,
-    firedAt: waitRow.resolvedAt,
-    payload: cappedPayload === undefined ? undefined : cappedPayload
-  };
-  const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, stepOutput, nextPort, ctx);
-  if (!routing.claimed)
-    return;
-  if (waitRow.mode === "event" && waitRow.eventName) {
-    pruneWaitFromBus(waitRow.id, waitRow.eventName);
-  }
-  const successors = routing.successors;
-  if (successors.length > 0) {
-    const secretKeys = getSecretInputKeys(workflow.input);
-    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
-  } else {
-    await finalizeOrWait(run.id);
-  }
-}
-var FIRED_PAYLOAD_BYTE_CAP = 64 * 1024;
-function capPayload(payload) {
-  if (payload === undefined || payload === null)
-    return payload;
-  let encoded;
-  try {
-    encoded = JSON.stringify(payload);
-  } catch {
-    return { truncated: true, reason: "non-serializable" };
-  }
-  if (encoded.length <= FIRED_PAYLOAD_BYTE_CAP) {
-    return payload;
-  }
-  const summary = encoded.slice(0, 1024);
-  return {
-    truncated: true,
-    originalSize: encoded.length,
-    summary
-  };
-}
-var waitsByEvent = new Map;
-var listenersByEvent = new Map;
-var busRegistry = null;
-async function initWaitBusSubscriptions(registry) {
-  busRegistry = registry;
-  const pendingNames = await collectPendingEventNames();
-  for (const name of pendingNames) {
-    const pending = await getPendingWaitsByEvent(name);
-    for (const w of pending) {
-      registerWait(w.id, name);
-    }
-  }
-}
-async function collectPendingEventNames() {
-  return new Set(await getPendingEventWaitNames());
-}
-function subscribeWaitToBus(waitId, eventName) {
-  registerWait(waitId, eventName);
-}
-function registerWait(waitId, eventName) {
-  let set = waitsByEvent.get(eventName);
-  if (!set) {
-    set = new Set;
-    waitsByEvent.set(eventName, set);
-  }
-  set.add(waitId);
-  if (!listenersByEvent.has(eventName)) {
-    const listener = (data) => {
-      processBusEvent(eventName, data).catch((err) => {
-        console.error(`[workflows] Wait bus listener failed for event=${eventName}:`, scrubSecrets(err instanceof Error ? err.message : String(err)));
-      });
-    };
-    listenersByEvent.set(eventName, listener);
-    workflowEventBus.on(eventName, listener);
-  }
-}
-function pruneWaitFromBus(waitId, eventName) {
-  const set = waitsByEvent.get(eventName);
-  if (!set)
-    return;
-  set.delete(waitId);
-  if (set.size === 0) {
-    waitsByEvent.delete(eventName);
-    const listener = listenersByEvent.get(eventName);
-    if (listener) {
-      workflowEventBus.off(eventName, listener);
-      listenersByEvent.delete(eventName);
-    }
-  }
-}
-async function processBusEvent(eventName, payload) {
-  const set = waitsByEvent.get(eventName);
-  if (!set || set.size === 0)
-    return;
-  if (!busRegistry)
-    return;
-  const waitIds = [...set];
-  for (const waitId of waitIds) {
-    try {
-      const row = await getWaitStateById(waitId);
-      if (!row || row.status !== "pending") {
-        set.delete(waitId);
-        continue;
-      }
-      if (row.eventScope === "run") {
-        if (!isPayloadInRun(payload, row.workflowRunId))
-          continue;
-      }
-      const ok = await matchesFilter(payload, row.eventFilter ?? undefined);
-      if (!ok)
-        continue;
-      await resumeWaitState(waitId, "fired", payload, busRegistry);
-    } catch (err) {
-      console.error(`[workflows] Wait bus listener failed for wait=${waitId} event=${eventName}:`, err);
-    }
-  }
-  if (set.size === 0) {
-    waitsByEvent.delete(eventName);
-    const listener = listenersByEvent.get(eventName);
-    if (listener) {
-      workflowEventBus.off(eventName, listener);
-      listenersByEvent.delete(eventName);
-    }
-  }
-}
-function isPayloadInRun(payload, runId) {
-  if (typeof payload !== "object" || payload === null)
-    return false;
-  const rec = payload;
-  return rec._runId === runId || rec.workflowRunId === runId;
-}
-
-// src/workflows/recovery.ts
+init_workflow_runs();
 async function recoverIncompleteRuns(registry) {
   let recovered = 0;
   recovered += await recoverRunningRuns(registry);
   recovered += await recoverWaitingRuns(registry);
   recovered += await recoverApprovalWaitingRuns(registry);
   recovered += await recoverWaitStates(registry);
+  for (const parentStepId of await getSettledChildRunParentSteps()) {
+    try {
+      if (await resumeFromChildRun(parentStepId, registry))
+        recovered++;
+    } catch (err) {
+      console.error(`[workflows] Failed to resume sub-workflow step ${parentStepId}:`, err);
+    }
+  }
   if (recovered > 0) {
     console.log(`[workflows] Recovered ${recovered} incomplete run(s)`);
   }
@@ -18074,6 +15739,7 @@ var import_cron_parser = __toESM(require_dist2(), 1);
 init_db2();
 init_db();
 init_telemetry();
+init_secret_scrubber();
 
 // src/scheduler/deferred-task-waits.ts
 init_db2();
@@ -18500,18 +16166,64 @@ async function executeScheduleScript(schedule) {
     throw new Error(`Script '${schedule.scriptName}' not found`);
   }
   const agentId = schedule.createdByAgentId ?? "schedule";
-  const output = await runScript({
-    source: script.source,
-    args: schedule.scriptArgs ?? {},
-    fsMode: "none",
+  const args = schedule.scriptArgs ?? {};
+  const record2 = {
     agentId,
-    egressSecrets: await buildScriptCredentialBindings({ agentId }),
-    apiConnections: getScriptApiConnectionDescriptors({ agentId }),
-    mcpConnections: getScriptMcpConnectionDescriptors({ agentId }),
-    timeoutMs: 60000
-  });
+    scriptName: schedule.scriptName,
+    source: `// Scheduled run of '${script.name}' v${script.version} (global, contentHash ${script.contentHash}) by schedule '${schedule.name}'.
+// Full source: script_versions row for this version.
+`,
+    args,
+    startedAt: new Date().toISOString()
+  };
+  let output;
+  try {
+    output = await runScript({
+      source: script.source,
+      args,
+      fsMode: "none",
+      agentId,
+      egressSecrets: await buildScriptCredentialBindings({ agentId }),
+      apiConnections: getScriptApiConnectionDescriptors({ agentId }),
+      mcpConnections: getScriptMcpConnectionDescriptors({ agentId }),
+      timeoutMs: 60000
+    });
+  } catch (err) {
+    await recordScheduleScriptRun({
+      ...record2,
+      status: "failed",
+      error: err instanceof Error ? err.message : String(err)
+    });
+    throw err;
+  }
   if (output.exitCode !== 0 || output.error) {
-    throw new Error(output.stderr || `Script '${schedule.scriptName}' exited with code ${output.exitCode}${output.error ? ` (${output.error})` : ""}`);
+    const message = output.stderr || `Script '${schedule.scriptName}' exited with code ${output.exitCode}${output.error ? ` (${output.error})` : ""}`;
+    await recordScheduleScriptRun({
+      ...record2,
+      status: "failed",
+      output: output.result,
+      error: message
+    });
+    throw new Error(message);
+  }
+  await recordScheduleScriptRun({ ...record2, status: "completed", output: output.result });
+}
+async function recordScheduleScriptRun(run) {
+  try {
+    await recordInlineScriptRun({
+      id: crypto.randomUUID(),
+      agentId: run.agentId,
+      scriptName: run.scriptName,
+      source: run.source,
+      args: scrubObject(run.args),
+      status: run.status,
+      output: scrubObject(run.output),
+      error: run.error === undefined ? undefined : scrubSecrets(run.error),
+      startedAt: run.startedAt,
+      finishedAt: new Date().toISOString()
+    });
+  } catch (err) {
+    console.warn(`[scheduler] could not record script run for '${run.scriptName}': ${scrubSecrets(err instanceof Error ? err.message : String(err))}`);
   }
 }
 
@@ -23004,7 +20716,7 @@ class Protocol {
     };
   }
 }
-function isPlainObject2(value) {
+function isPlainObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeCapabilities(base, additional) {
@@ -23015,7 +20727,7 @@ function mergeCapabilities(base, additional) {
     if (addValue === undefined)
       continue;
     const baseValue = result[k];
-    if (isPlainObject2(baseValue) && isPlainObject2(addValue)) {
+    if (isPlainObject(baseValue) && isPlainObject(addValue)) {
       result[k] = { ...baseValue, ...addValue };
     } else {
       result[k] = addValue;
@@ -29180,7 +26892,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-nctetn1e.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-80w6qspx.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -29251,7 +26963,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-qg3myn53.js");
+  const { getDbClient: getDbClient2 } = await import("./db-wa6s1mwv.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -103056,7 +100768,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-2t9kesn1.js");
+  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-ac0v8v9d.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider2().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await stopSlackApp();
@@ -103069,10 +100781,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-fmp5ww69.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-feda8wn8.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-1ze5853n.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-3nc0aaed.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -104190,7 +101902,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-7vnwj9qw.js");
+  const dispatcher = await import("./dispatcher-nhs2pkr8.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -110679,7 +108391,7 @@ async function applyRating(events, ctx = {}) {
   const accepted = [];
   const rejected = [];
   for (const event of events) {
-    const reason = validate2(event);
+    const reason = validate(event);
     if (reason) {
       rejected.push({ event, reason });
       continue;
@@ -110786,7 +108498,7 @@ async function applyRating(events, ctx = {}) {
   }
   return { applied, rejected: [...rejected, ...lateRejects] };
 }
-function validate2(event) {
+function validate(event) {
   if (!event.source || event.source.trim() === "") {
     return "source is required";
   }
@@ -125161,8 +122873,16 @@ init_zod();
 init_db2();
 init_rbac();
 var scriptConnectionsInputSchema = object({
-  action: _enum(["list", "upsert-openapi", "upsert-mcp", "upsert-graphql", "refresh", "disable"]).describe("List, create/update, refresh, or disable a script connection."),
-  id: string().uuid().optional().describe("Existing connection ID for update, refresh, or disable."),
+  action: _enum([
+    "list",
+    "upsert-openapi",
+    "upsert-mcp",
+    "upsert-graphql",
+    "refresh",
+    "disable",
+    "delete"
+  ]).describe("List, create/update, refresh, disable, or delete a script connection. delete is permanent: it removes the connection, its managed credential binding, and any inline secret it owns."),
+  id: string().uuid().optional().describe("Existing connection ID for update, refresh, disable, or delete."),
   slug: string().min(1).max(80).optional().describe("Stable script namespace slug exposed under ctx.api or ctx.mcp."),
   displayName: string().max(160).optional().describe("Human-readable connection name."),
   scope: _enum(["global", "agent", "repo"]).optional().describe("Connection visibility scope."),
@@ -125251,6 +122971,26 @@ var registerScriptConnectionsTool = (server) => {
         data: { yourAgentId: requestInfo.agentId, connections: connections2 }
       });
     }
+    if (args2.action === "delete") {
+      if (!args2.id) {
+        return toolErr("id is required for delete.", {
+          data: {
+            yourAgentId: requestInfo.agentId,
+            connections: listScriptConnections({ includeDisabled: true, allScopes: true })
+          }
+        });
+      }
+      const deleted = await deleteScriptConnection(args2.id);
+      const connections2 = listScriptConnections({ includeDisabled: true, allScopes: true });
+      if (!deleted) {
+        return toolErr(`Script connection ${args2.id} not found.`, {
+          data: { yourAgentId: requestInfo.agentId, connections: connections2 }
+        });
+      }
+      return toolOk(`Script connection ${deleted.slug} deleted.`, {
+        data: { yourAgentId: requestInfo.agentId, connections: connections2 }
+      });
+    }
     if (args2.action === "refresh") {
       if (!args2.id) {
         return toolErr("id is required for refresh.", {
@@ -125946,7 +123686,7 @@ async function sendTaskHandler(ctx, {
       data: { yourAgentId: creatorAgentId }
     });
   }
-  if (ctx.kind === "owner" && requestedAgentId === ctx.agentId) {
+  if (ctx.kind === "owner" && requestedAgentId === ctx.agentId && ctx.requestInfo?.callOrigin !== "script-sdk") {
     return toolErr("Cannot send a task to yourself, are you drunk?", {
       data: { yourAgentId: ctx.agentId }
     });
@@ -127649,6 +125389,7 @@ async function downloadSlackFile(file, token, path3) {
   }
 }
 async function createSlackTaskWithFiles(description, options, inbound) {
+  noteSlackInboundSideEffect("task_created");
   if (inbound.fetched.length === 0) {
     const task2 = await createTaskWithSiblingAwareness(description, options, { origin: "slack" });
     return { task: task2, unattached: inbound.failed };
@@ -133992,7 +131733,7 @@ async function runHandler(loaded, handler, event, payload) {
   const startedAt = Date.now();
   let timeout;
   try {
-    const timeoutPromise2 = new Promise((_, reject) => {
+    const timeoutPromise = new Promise((_, reject) => {
       timeout = setTimeout(() => {
         controller.abort();
         reject(new ExtensionTimeoutError);
@@ -134001,7 +131742,7 @@ async function runHandler(loaded, handler, event, payload) {
     });
     const result = await Promise.race([
       Promise.resolve().then(() => handler.handler(payload, buildCtx(loaded, event, controller.signal))),
-      timeoutPromise2
+      timeoutPromise
     ]);
     const durationMs = Date.now() - startedAt;
     return { ok: true, result, durationMs };
@@ -134064,8 +131805,8 @@ async function dispatchPre(event, payload, opts) {
     console.error("[extensions] pre dispatch inside transaction:", scrubSecrets(String(event)));
     return { action: "continue" };
   }
-  let currentPayload = payload;
-  let mergedData = {};
+  let currentPayload = { ...payload };
+  const mergedData = {};
   let modified = false;
   for (const { loaded, handler } of handlersFor(event, opts)) {
     if (!isRegistered(loaded.record.id))
@@ -134114,7 +131855,7 @@ async function dispatchPre(event, payload, opts) {
             throw validation.error;
           data = definedObject(validation.data);
         }
-        mergedData = { ...mergedData, ...data };
+        Object.assign(mergedData, data);
         currentPayload = mergePayload(event, currentPayload, data);
         modified = true;
         await markSuccess(loaded);
@@ -134610,7 +132351,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-nctetn1e.js");
+        const { getSlackApp: getSlackApp2 } = await import("./app-80w6qspx.js");
         const app = getSlackApp2();
         if (!app) {
           return {
@@ -135378,6 +133119,7 @@ function createExecutorRegistry(deps) {
   registry3.register(new ForeachExecutor(deps));
   registry3.register(new HumanInTheLoopExecutor(deps));
   registry3.register(new WaitExecutor(deps));
+  registry3.register(new SubWorkflowExecutor(deps, registry3));
   return registry3;
 }
 
@@ -135418,4 +133160,4 @@ async function initWorkflows() {
   logOpenWebhookTriggers();
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, validateJsonSchema, workflowSaveWarnings, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };