@desplega.ai/agent-swarm 1.167.0 → 1.169.0

package/dist/cli-rh44xx46.js

@@ -0,0 +1,2659 @@
+import {
+  BaseExecutor,
+  SYSTEM_ONE_DECISION_NODE_TYPE,
+  findEntryNodes,
+  getNextTargets,
+  getSuccessors,
+  postApprovalCancellationUpdates,
+  resolveValidationPort,
+  systemOneRetryViolations,
+  systemOneUnresolvedError
+} from "./cli-s0k2j7q9.js";
+import {
+  WorkflowReplayStateError,
+  cancelPendingApprovalRequestsForRun,
+  cancelTask,
+  createWorkflowRun,
+  createWorkflowRunStep,
+  detachTaskFromWorkflowRunStep,
+  getChildWorkflowRunId,
+  getCompletedStepNodeIds,
+  getCurrentStepForNode,
+  getDbClient,
+  getLastRunStart,
+  getLastSuccessfulRun,
+  getLatestStepForNode,
+  getOAuthApp,
+  getOAuthTokens,
+  getPendingEventWaitNames,
+  getPendingWaitsByEvent,
+  getStepByIdempotencyKey,
+  getStepCountForNode,
+  getSwarmConfigs,
+  getTaskById,
+  getTaskByWorkflowRunStepId,
+  getWaitStateById,
+  getWorkflow,
+  getWorkflowRun,
+  getWorkflowRunLineage,
+  getWorkflowRunStep,
+  getWorkflowRunStepsByRunId,
+  init_db1 as init_db,
+  init_oauth,
+  init_scrub_json,
+  init_telemetry,
+  init_workflow_replay,
+  init_workflow_runs,
+  listCancelledApprovalRequestsForRun,
+  listCancelledApprovalRequestsForStep,
+  resolveWaitState,
+  scrubJsonValue,
+  telemetry,
+  updateWorkflowRun,
+  updateWorkflowRunStep
+} from "./cli-rg1c8ccw.js";
+import {
+  RetryPolicySchema,
+  init_types
+} from "./cli-xvdgasgy.js";
+import {
+  getSlackConfiguration,
+  init_config,
+  isSlackConfigured
+} from "./cli-dmtrxqhg.js";
+import {
+  deepInterpolate,
+  init_template
+} from "./cli-5c2j5yvx.js";
+import {
+  getAppUrl,
+  init_constants
+} from "./cli-gd4favx9.js";
+import {
+  init_env_flag,
+  isEnvFlagEnabled
+} from "./cli-ej6gbxfb.js";
+import {
+  init_zod
+} from "./cli-sd0mxa3c.js";
+import {
+  exports_external
+} from "./cli-w5e1d1vv.js";
+import {
+  init_event_bus,
+  workflowEventBus
+} from "./cli-mb75wpxf.js";
+import {
+  init_secret_scrubber,
+  isSensitiveKey,
+  scrubSecrets
+} from "./cli-wt7ccy4r.js";
+import {
+  __require
+} from "./cli-bc05qbss.js";
+
+// src/workflows/resume.ts
+init_db();
+init_workflow_runs();
+init_secret_scrubber();
+
+// src/workflows/approval-resolution.ts
+function shapeApprovalResolution(registry, definition, nodeId, parkedOutput, approval) {
+  const node = definition.nodes.find((candidate) => candidate.id === nodeId);
+  if (node && registry.has(node.type)) {
+    const shaped = registry.get(node.type).resolveApproval(parkedOutput, approval);
+    if (shaped)
+      return shaped;
+  }
+  return {
+    output: {
+      requestId: approval.requestId,
+      status: approval.status,
+      responses: approval.responses
+    },
+    nextPort: approval.status === "timeout" ? "timeout" : approval.status === "rejected" ? "rejected" : "approved"
+  };
+}
+
+// src/workflows/completed-step-routing.ts
+init_db();
+
+// src/workflows/foreach-join.ts
+init_db();
+
+// src/workflows/checkpoint.ts
+init_db();
+async function checkpointStep(runId, stepId, nodeId, result, ctx) {
+  await getDbClient().transaction(async () => {
+    await updateWorkflowRunStep(stepId, {
+      status: "completed",
+      output: result.output,
+      nextPort: result.nextPort || undefined,
+      finishedAt: new Date().toISOString()
+    });
+    ctx[nodeId] = result.output;
+    await updateWorkflowRun(runId, {
+      context: ctx
+    });
+  });
+}
+async function checkpointStepFailure(runId, stepId, error, retryCount, retryPolicy, options) {
+  const now = new Date().toISOString();
+  if (retryPolicy && retryCount < retryPolicy.maxRetries) {
+    const delay = calculateBackoff(retryPolicy, retryCount);
+    const nextRetryAt = new Date(Date.now() + delay).toISOString();
+    await updateWorkflowRunStep(stepId, {
+      status: "failed",
+      error,
+      retryCount: retryCount + 1,
+      maxRetries: retryPolicy.maxRetries,
+      nextRetryAt
+    });
+    return { shouldRetry: true };
+  }
+  await updateWorkflowRunStep(stepId, {
+    status: "failed",
+    error,
+    finishedAt: now,
+    nextRetryAt: null
+  });
+  const markRunFailed = options?.markRunFailed ?? true;
+  if (markRunFailed) {
+    await getDbClient().transaction(async () => {
+      const run = await getWorkflowRun(runId);
+      if (run?.status !== "running" && run?.status !== "waiting")
+        return;
+      await updateWorkflowRun(runId, {
+        status: "failed",
+        error: `Step failed: ${error}`,
+        finishedAt: now
+      });
+    });
+  }
+  return { shouldRetry: false };
+}
+async function checkpointStepWaiting(runId, stepId, ctx) {
+  return getDbClient().transaction(async () => {
+    const step = await getDbClient().get(`UPDATE workflow_run_steps
+         SET status = 'waiting'
+       WHERE id = ? AND runId = ? AND status = 'running'
+         AND EXISTS (
+           SELECT 1 FROM workflow_runs
+           WHERE id = ? AND status IN ('running', 'waiting')
+         )
+       RETURNING id`, [stepId, runId, runId]);
+    if (!step)
+      return false;
+    await updateWorkflowRun(runId, { status: "waiting", context: ctx });
+    return true;
+  });
+}
+function calculateBackoff(policy, attempt) {
+  let delay;
+  switch (policy.strategy) {
+    case "exponential": {
+      const base = policy.baseDelayMs * 2 ** attempt;
+      delay = Math.random() * Math.min(base, policy.maxDelayMs);
+      break;
+    }
+    case "linear":
+      delay = policy.baseDelayMs * (attempt + 1);
+      break;
+    case "static":
+      delay = policy.baseDelayMs;
+      break;
+    default:
+      delay = policy.baseDelayMs;
+  }
+  return Math.min(delay, policy.maxDelayMs);
+}
+
+// src/workflows/foreach-join.ts
+var FOREACH_TERMINAL_STEP_STATUSES = new Set([
+  "completed",
+  "failed",
+  "cancelled",
+  "skipped"
+]);
+function parseSyntheticNodeId(nodeId) {
+  const separatorIndex = nodeId.indexOf("#");
+  if (separatorIndex <= 0 || separatorIndex === nodeId.length - 1)
+    return null;
+  return {
+    parentNodeId: nodeId.slice(0, separatorIndex),
+    itemKey: nodeId.slice(separatorIndex + 1)
+  };
+}
+function resolveForeachParent(def, nodeId) {
+  const parsed = parseSyntheticNodeId(nodeId);
+  if (!parsed)
+    return null;
+  const parent = def.nodes.find((node) => node.id === parsed.parentNodeId);
+  return parent?.type === "foreach" ? parent : null;
+}
+async function joinForeach(def, runId, childStep, ctx) {
+  const parent = resolveForeachParent(def, childStep.nodeId);
+  if (!parent) {
+    throw new Error(`Step "${childStep.nodeId}" is not a foreach child`);
+  }
+  const children = (await getWorkflowRunStepsByRunId(runId)).filter((step) => resolveForeachParent(def, step.nodeId)?.id === parent.id).sort((a, b) => childIndex(a) - childIndex(b));
+  if (children.some((step) => !FOREACH_TERMINAL_STEP_STATUSES.has(step.status))) {
+    return { joined: false, parentNodeId: parent.id, successors: [] };
+  }
+  const parentStep = await getLatestStepForNode(runId, parent.id);
+  if (!parentStep) {
+    throw new Error(`Waiting foreach parent step "${parent.id}" was not found`);
+  }
+  if (parentStep.status === "completed") {
+    return { joined: false, parentNodeId: parent.id, successors: [] };
+  }
+  const aggregate = buildForeachAggregate(children);
+  await checkpointStep(runId, parentStep.id, parent.id, { output: aggregate }, ctx);
+  return {
+    joined: true,
+    parentNodeId: parent.id,
+    successors: getSuccessors(def, parent.id)
+  };
+}
+function buildForeachAggregate(children) {
+  const orderedChildren = [...children].sort((a, b) => childIndex(a) - childIndex(b));
+  const results = orderedChildren.map((step) => {
+    const parsed = parseSyntheticNodeId(step.nodeId);
+    const status = resultStatus(step);
+    return {
+      itemKey: parsed.itemKey,
+      status,
+      output: step.output
+    };
+  });
+  const failedCount = results.filter((result) => result.status !== "completed").length;
+  const aggregate = {
+    results,
+    okCount: results.length - failedCount,
+    failedCount
+  };
+  return aggregate;
+}
+function childIndex(step) {
+  if (typeof step.input !== "object" || step.input === null)
+    return Number.MAX_SAFE_INTEGER;
+  const index = step.input.index;
+  return typeof index === "number" ? index : Number.MAX_SAFE_INTEGER;
+}
+function resultStatus(step) {
+  if (step.status !== "completed")
+    return step.status;
+  return step.error ? "failed" : "completed";
+}
+
+// src/workflows/completed-step-routing.ts
+async function loadCompletedStepRouting(def, runId, completedNodeIds) {
+  const activeEdges = new Set;
+  const stepsByNodeId = new Map;
+  for (const nodeId of completedNodeIds) {
+    if (resolveForeachParent(def, nodeId))
+      continue;
+    const step = await getLatestStepForNode(runId, nodeId);
+    if (step)
+      stepsByNodeId.set(nodeId, step);
+    const successors = step?.nextPort ? getSuccessors(def, nodeId, step.nextPort) : getSuccessors(def, nodeId);
+    for (const successor of successors) {
+      activeEdges.add(`${nodeId}→${successor.id}`);
+    }
+  }
+  return { activeEdges, stepsByNodeId };
+}
+
+// src/workflows/constants.ts
+var FAILED_TASK_OUTPUT_PREFIX = "[FAILED:";
+
+// src/automation-preflight-alert.ts
+init_constants();
+init_secret_scrubber();
+async function notifyAutomationPreflightFailure(preflight) {
+  const channel = process.env.SLACK_ALERTS_CHANNEL?.trim();
+  if (!channel) {
+    console.warn("[Automation Preflight] SLACK_ALERTS_CHANNEL not set; skipping alert");
+    return;
+  }
+  try {
+    const { getSlackApp } = await import("./app-80w6qspx.js");
+    const app = getSlackApp();
+    if (!app) {
+      console.warn("[Automation Preflight] Slack not available, cannot send notification");
+      return;
+    }
+    await app.client.chat.postMessage({
+      channel,
+      text: scrubSecrets(`⚠️ Automation needs setup
+` + `Automation: ${preflight.kind} "${preflight.name}"
+Missing params: ${preflight.missing.params.join(", ") || "none"}
+Missing integrations: ${preflight.missing.integrations.join(", ") || "none"}
+Fire SKIPPED. It was not retried or queued.
+Fix setup: ${getAppUrl()}${preflight.fixUrl}`),
+      unfurl_links: false,
+      unfurl_media: false
+    });
+  } catch (error) {
+    console.error("[Automation Preflight] Failed to send Slack notification:", scrubSecrets(error instanceof Error ? error.message : String(error)));
+  }
+}
+
+// src/be/automation-preflight.ts
+init_config();
+init_env_flag();
+init_secret_scrubber();
+init_db();
+init_oauth();
+init_scrub_json();
+var NEEDS_SETUP_PREFIX = "needs_setup:";
+function hasValue(value) {
+  if (value == null)
+    return false;
+  if (typeof value === "string")
+    return value.trim().length > 0;
+  if (Array.isArray(value))
+    return value.length > 0;
+  return true;
+}
+var GITHUB_REPOSITORY_SLUG = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}(?:\.git)?$/;
+var SAFE_SHELL_DATA = /^[A-Za-z0-9._~%/:@ -]+$/;
+var DNS_NAME = /^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$/;
+var SAFE_EXTERNAL_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+var SAFE_GIT_REF = /^(?!-)(?!.*(?:\.\.|@\{|\/\/))[A-Za-z0-9._/-]+$/;
+var SAFE_TAG_PATTERN = /^(?!-)(?!.*(?:\.\.|\/\/))[A-Za-z0-9._*?/-]+$/;
+var SAFE_RELATIVE_PATH = /^(?![-/])(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]+$/;
+var SAFE_REPORT_NAME = /^(?!\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._ -]{0,127}$/;
+function isSafeRepository(value) {
+  if (!SAFE_SHELL_DATA.test(value) || value.trim() !== value || value.includes(" "))
+    return false;
+  const slug = value.replace(/^https:\/\/github\.com\//, "").replace(/^git@github\.com:/, "").replace(/\/$/, "");
+  return GITHUB_REPOSITORY_SLUG.test(slug);
+}
+function isSafeGscProperty(value) {
+  if (!SAFE_SHELL_DATA.test(value) || value.trim() !== value)
+    return false;
+  return value.split(" ").every((property) => {
+    if (!property)
+      return false;
+    if (property.startsWith("sc-domain:"))
+      return DNS_NAME.test(property.slice(10));
+    if (DNS_NAME.test(property))
+      return true;
+    try {
+      const url = new URL(property);
+      return url.protocol === "https:" && !url.username && !url.password && !url.port && !url.search && !url.hash && DNS_NAME.test(url.hostname);
+    } catch {
+      return false;
+    }
+  });
+}
+var PARAM_VALIDATORS = {
+  REPO_URL: (value) => typeof value === "string" && isSafeRepository(value),
+  GSC_PROPERTY: (value) => typeof value === "string" && isSafeGscProperty(value),
+  BRANCH: (value) => typeof value === "string" && SAFE_GIT_REF.test(value),
+  SCOPE_PATH: (value) => typeof value === "string" && SAFE_RELATIVE_PATH.test(value),
+  REPORT_NAME: (value) => typeof value === "string" && value.trim() === value && SAFE_REPORT_NAME.test(value),
+  TAG_PATTERN: (value) => typeof value === "string" && SAFE_TAG_PATTERN.test(value),
+  AGENT_FS_ORG_ID: (value) => typeof value === "string" && SAFE_EXTERNAL_ID.test(value),
+  ORG_ID: (value) => typeof value === "string" && SAFE_EXTERNAL_ID.test(value)
+};
+function isUsableParam(key, value) {
+  if (!hasValue(value))
+    return false;
+  return PARAM_VALIDATORS[key]?.(value) ?? true;
+}
+function uniqueSorted(values) {
+  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}
+function automationUrl(input) {
+  return input.kind === "schedule" ? `/schedules/${input.id}` : `/workflows/${input.id}`;
+}
+var INTEGRATION_FIX_URL = {
+  slack: "/settings/integrations/slack",
+  github: "/settings/integrations/github",
+  linear: "/settings/integrations/linear",
+  jira: "/settings/integrations/jira",
+  agentmail: "/settings/integrations/agentmail",
+  gsc: "/settings/integrations/gsc",
+  agentfs: "/settings/integrations/agentfs"
+};
+var INTEGRATION_FIRST_REQUIREMENTS = new Set([
+  "gsc",
+  "linear",
+  "agentmail"
+]);
+function automationIntegrationFixUrl(id) {
+  return INTEGRATION_FIX_URL[id];
+}
+function isNeedsSetupFailure(reason) {
+  return reason?.startsWith(NEEDS_SETUP_PREFIX) ?? false;
+}
+function preflightAutomation(input, setup) {
+  const params = input.params ?? {};
+  const guardedParams = Object.keys(params).filter((key) => (key in PARAM_VALIDATORS));
+  const missingParams = uniqueSorted([...input.requiredParams ?? [], ...guardedParams].filter((key) => !isUsableParam(key, params[key])));
+  const missingIntegrations = uniqueSorted((input.requires ?? []).filter((id) => setup[id] === "unverified"));
+  const missing = { params: missingParams, integrations: missingIntegrations };
+  const baseUrl = automationUrl(input);
+  const fixes = [
+    ...missingParams.map((key) => ({
+      type: "param",
+      key,
+      url: `${baseUrl}?param=${encodeURIComponent(key)}`
+    })),
+    ...missingIntegrations.map((key) => ({
+      type: "integration",
+      key,
+      url: automationIntegrationFixUrl(key)
+    }))
+  ];
+  if (missingParams.length === 0 && missingIntegrations.length === 0) {
+    return {
+      id: input.id,
+      name: input.name,
+      kind: input.kind,
+      state: "running",
+      missing,
+      fixes,
+      fixUrl: baseUrl
+    };
+  }
+  const firstParam = missingParams[0];
+  const firstIntegration = (input.requires ?? []).find((id) => missingIntegrations.includes(id));
+  const integrationFirst = (input.requires ?? []).some((id) => INTEGRATION_FIRST_REQUIREMENTS.has(id));
+  const fixUrl = integrationFirst && firstIntegration ? automationIntegrationFixUrl(firstIntegration) : firstParam ? `${baseUrl}?param=${encodeURIComponent(firstParam)}` : firstIntegration ? automationIntegrationFixUrl(firstIntegration) : baseUrl;
+  const failureReason = `${NEEDS_SETUP_PREFIX} params=[${missingParams.join(",")}] integrations=[${missingIntegrations.join(",")}]`;
+  return {
+    id: input.id,
+    name: input.name,
+    kind: input.kind,
+    state: "needs_setup",
+    missing,
+    fixes,
+    fixUrl,
+    failureReason
+  };
+}
+var EXACT_TOKEN = /^\{\{\s*([^}]+?)\s*\}\}$/;
+var TOKEN = /\{\{\s*([^}]+?)\s*\}\}/g;
+function renderAutomationTokens(value, params) {
+  function render(current) {
+    if (typeof current === "string") {
+      const exact = EXACT_TOKEN.exec(current);
+      if (exact?.[1] && Object.hasOwn(params, exact[1]))
+        return params[exact[1]];
+      return current.replace(TOKEN, (token, key) => {
+        if (!Object.hasOwn(params, key))
+          return token;
+        const replacement = params[key];
+        return typeof replacement === "object" ? JSON.stringify(replacement) : String(replacement);
+      });
+    }
+    if (Array.isArray(current))
+      return current.map(render);
+    if (current != null && typeof current === "object") {
+      return Object.fromEntries(Object.entries(current).map(([key, nested]) => [key, render(nested)]));
+    }
+    return current;
+  }
+  return render(value);
+}
+function present(value) {
+  return !!value?.trim();
+}
+async function getAutomationSetupStates() {
+  const [linearTokens, jiraTokens, jiraApp] = await Promise.all([
+    getOAuthTokens("linear"),
+    getOAuthTokens("jira"),
+    getOAuthApp("jira")
+  ]);
+  let jiraCloudId = false;
+  try {
+    const metadata = jiraApp?.metadata ? JSON.parse(jiraApp.metadata) : null;
+    jiraCloudId = !!(metadata && typeof metadata === "object" && metadata.cloudId);
+  } catch {
+    jiraCloudId = false;
+  }
+  const agentFsKey = process.env.API_AGENT_FS_API_KEY ?? process.env.AGENT_FS_API_KEY;
+  const agentFsOrg = process.env.AGENT_FS_DEFAULT_ORG_ID ?? process.env.AGENT_FS_SHARED_ORG_ID;
+  const gscConfigured = present(process.env.GSC_SERVICE_ACCOUNT_BASE64) || present(process.env.GSC_SERVICE_ACCOUNT_JSON);
+  return {
+    slack: getSlackConfiguration().mode === "socket" && isSlackConfigured() ? "configured" : "unverified",
+    github: present(process.env.GITHUB_WEBHOOK_SECRET) && present(process.env.GITHUB_APP_ID) && present(process.env.GITHUB_APP_PRIVATE_KEY) ? "verified" : "unverified",
+    linear: linearTokens ? "verified" : "unverified",
+    jira: jiraTokens && jiraCloudId ? "verified" : "unverified",
+    gsc: gscConfigured ? "verified" : "unverified",
+    agentmail: !isEnvFlagEnabled("AGENTMAIL_DISABLE", false) && present(process.env.AGENTMAIL_API_KEY) ? "verified" : "unverified",
+    agentfs: present(process.env.AGENT_FS_API_URL) && present(agentFsKey) && present(agentFsOrg) && present(process.env.AGENT_FS_DEFAULT_DRIVE_ID) ? "verified" : "unverified"
+  };
+}
+function schedulePreflightInput(schedule) {
+  return { ...schedule, kind: "schedule" };
+}
+function workflowPreflightInput(workflow) {
+  return { ...workflow, kind: "workflow" };
+}
+async function listEnabledAutomationPreflightInputs() {
+  const rows = await getDbClient().query(`SELECT id, name, 'schedule' AS kind, params, requiredParams, requires
+     FROM scheduled_tasks
+     WHERE enabled = 1
+     UNION ALL
+     SELECT id, name, 'workflow' AS kind, params, requiredParams, requires
+     FROM workflows
+     WHERE enabled = 1`);
+  return rows.map((row) => ({
+    id: row.id,
+    name: row.name,
+    kind: row.kind,
+    params: JSON.parse(row.params),
+    requiredParams: JSON.parse(row.requiredParams),
+    requires: JSON.parse(row.requires)
+  }));
+}
+function utcDayBounds(now) {
+  const start = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
+  return { start: start.toISOString(), end: new Date(start.getTime() + 86400000).toISOString() };
+}
+async function recordSchedulePreflightFailure(scheduleId, failureReason, now = new Date) {
+  const message = scrubSecrets(failureReason);
+  return await getDbClient().transaction(async (tx) => {
+    const row = await tx.get("SELECT lastErrorAt, lastErrorMessage FROM scheduled_tasks WHERE id = ?", [scheduleId]);
+    if (!row)
+      return false;
+    if (row.lastErrorMessage === message && row.lastErrorAt?.slice(0, 10) === now.toISOString().slice(0, 10)) {
+      return false;
+    }
+    await tx.run(`UPDATE scheduled_tasks
+       SET lastErrorAt = ?, lastErrorMessage = ?, lastUpdatedAt = ?
+       WHERE id = ?`, [now.toISOString(), message, now.toISOString(), scheduleId]);
+    return true;
+  });
+}
+async function recordWorkflowPreflightFailure(input) {
+  const now = input.now ?? new Date;
+  const bounds = utcDayBounds(now);
+  return await getDbClient().transaction(async (tx) => {
+    const existing = await tx.get(`SELECT id FROM workflow_runs
+       WHERE workflowId = ? AND status = 'failed'
+         AND error LIKE 'needs_setup:%'
+         AND startedAt >= ? AND startedAt < ?
+       ORDER BY startedAt ASC LIMIT 1`, [input.workflowId, bounds.start, bounds.end]);
+    if (existing)
+      return { runId: existing.id, recorded: false };
+    const runId = crypto.randomUUID();
+    const timestamp = now.toISOString();
+    await tx.run(`INSERT INTO workflow_runs
+         (id, workflowId, status, triggerType, triggerData, error, created_by,
+          startedAt, lastUpdatedAt, finishedAt)
+       VALUES (?, ?, 'failed', ?, ?, ?, ?, ?, ?, ?)`, [
+      runId,
+      input.workflowId,
+      input.triggerType,
+      input.triggerData === undefined ? null : scrubJsonValue(input.triggerData),
+      scrubSecrets(input.failureReason),
+      input.createdBy ?? null,
+      timestamp,
+      timestamp,
+      timestamp
+    ]);
+    return { runId, recorded: true };
+  });
+}
+
+// src/workflows/engine.ts
+init_db();
+init_workflow_replay();
+init_telemetry();
+
+// src/workflows/cooldown.ts
+init_db();
+function cooldownToMs(cooldown) {
+  let ms = 0;
+  if (cooldown.hours)
+    ms += cooldown.hours * 60 * 60 * 1000;
+  if (cooldown.minutes)
+    ms += cooldown.minutes * 60 * 1000;
+  if (cooldown.seconds)
+    ms += cooldown.seconds * 1000;
+  return ms;
+}
+async function shouldSkipCooldown(workflowId, cooldown) {
+  const cooldownMs = cooldownToMs(cooldown);
+  const now = Date.now();
+  const lastSuccess = await getLastSuccessfulRun(workflowId);
+  if (lastSuccess?.finishedAt) {
+    const lastFinished = new Date(lastSuccess.finishedAt).getTime();
+    if (now - lastFinished < cooldownMs)
+      return true;
+  }
+  const lastAttempt = await getLastRunStart(workflowId);
+  if (lastAttempt?.startedAt) {
+    const lastStarted = new Date(lastAttempt.startedAt).getTime();
+    if (now - lastStarted < cooldownMs)
+      return true;
+  }
+  return false;
+}
+
+// src/workflows/input.ts
+init_db();
+init_secret_scrubber();
+async function resolveInputs(input) {
+  const resolved = {};
+  for (const [key, value] of Object.entries(input)) {
+    resolved[key] = await resolveInputValue(value);
+  }
+  return resolved;
+}
+async function resolveInputValue(value) {
+  const envMatch = /^\$\{(.+)\}$/.exec(value);
+  if (envMatch?.[1]) {
+    const envName = envMatch[1];
+    const envValue = process.env[envName];
+    if (envValue === undefined) {
+      throw new Error(`Environment variable "${envName}" is not set`);
+    }
+    return envValue;
+  }
+  if (value.startsWith("secret.")) {
+    const secretName = value.slice("secret.".length);
+    const configs = await getSwarmConfigs({ scope: "global", key: secretName });
+    const secretConfig = configs.find((c) => c.isSecret);
+    if (!secretConfig) {
+      throw new Error(`Secret "${secretName}" not found in config store`);
+    }
+    return secretConfig.value;
+  }
+  return value;
+}
+var REDACTED_SECRET_VALUE = "***REDACTED***";
+function getSecretInputKeys(input) {
+  const keys = new Set;
+  if (!input)
+    return keys;
+  for (const [key, value] of Object.entries(input)) {
+    if (typeof value !== "string")
+      continue;
+    if (value.startsWith("secret.")) {
+      keys.add(key);
+      continue;
+    }
+    const envMatch = /^\$\{(.+)\}$/.exec(value);
+    if (envMatch?.[1] && isSensitiveKey(envMatch[1])) {
+      keys.add(key);
+    }
+  }
+  return keys;
+}
+function redactSecretsForStorage(ctx, secretKeys) {
+  if (secretKeys.size === 0)
+    return ctx;
+  const inputBlock = ctx.input;
+  if (!inputBlock || typeof inputBlock !== "object")
+    return ctx;
+  const redactedInput = { ...inputBlock };
+  let touched = false;
+  for (const key of secretKeys) {
+    if (key in redactedInput) {
+      redactedInput[key] = REDACTED_SECRET_VALUE;
+      touched = true;
+    }
+  }
+  if (!touched)
+    return ctx;
+  return { ...ctx, input: redactedInput };
+}
+
+// src/workflows/json-schema-validator.ts
+function validateJsonSchema(schema, data) {
+  const errors = [];
+  validate(schema, data, "", errors);
+  return errors;
+}
+function validate(schema, data, path, errors) {
+  const prefix = path || "root";
+  if (schema.type !== undefined) {
+    const expected = schema.type;
+    if (!matchesType(expected, data)) {
+      errors.push(`${prefix}: expected type "${expected}", got ${typeOf(data)}`);
+      return;
+    }
+  }
+  if (Array.isArray(schema.required) && typeof data === "object" && data !== null) {
+    const obj = data;
+    for (const key of schema.required) {
+      if (!(key in obj)) {
+        errors.push(`${prefix}: missing required property "${key}"`);
+      }
+    }
+  }
+  if (Array.isArray(schema.enum)) {
+    const allowed = schema.enum;
+    if (!allowed.some((v) => JSON.stringify(v) === JSON.stringify(data))) {
+      errors.push(`${prefix}: value ${JSON.stringify(data)} not in enum [${allowed.map((v) => JSON.stringify(v)).join(", ")}]`);
+      return;
+    }
+  }
+  if ("const" in schema) {
+    if (JSON.stringify(data) !== JSON.stringify(schema.const)) {
+      errors.push(`${prefix}: value ${JSON.stringify(data)} does not match const ${JSON.stringify(schema.const)}`);
+      return;
+    }
+  }
+  if (schema.properties !== undefined && typeof schema.properties === "object" && schema.properties !== null && typeof data === "object" && data !== null) {
+    const props = schema.properties;
+    const obj = data;
+    for (const [key, subSchema] of Object.entries(props)) {
+      if (key in obj) {
+        validate(subSchema, obj[key], path ? `${path}.${key}` : key, errors);
+      }
+    }
+  }
+  if (schema.items !== undefined && typeof schema.items === "object" && schema.items !== null && Array.isArray(data)) {
+    const itemSchema = schema.items;
+    for (let i = 0;i < data.length; i++) {
+      validate(itemSchema, data[i], `${prefix}[${i}]`, errors);
+    }
+  }
+}
+function matchesType(expected, data) {
+  switch (expected) {
+    case "string":
+      return typeof data === "string";
+    case "number":
+      return typeof data === "number";
+    case "boolean":
+      return typeof data === "boolean";
+    case "array":
+      return Array.isArray(data);
+    case "object":
+      return typeof data === "object" && data !== null && !Array.isArray(data);
+    default:
+      return true;
+  }
+}
+function typeOf(data) {
+  if (data === null)
+    return "null";
+  if (data === undefined)
+    return "undefined";
+  if (Array.isArray(data))
+    return "array";
+  return typeof data;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function findJsonSchemaShapeErrors(schema, path = "outputSchema") {
+  const errors = [];
+  if (!isPlainObject(schema)) {
+    errors.push(`${path}: must be a JSON Schema object, got ${typeOf(schema)}`);
+    return errors;
+  }
+  if (schema.type !== undefined && typeof schema.type !== "string") {
+    errors.push(`${path}.type: must be a string, got ${typeOf(schema.type)}`);
+  }
+  if (schema.required !== undefined && (!Array.isArray(schema.required) || !schema.required.every((v) => typeof v === "string"))) {
+    errors.push(`${path}.required: must be an array of strings`);
+  }
+  if (schema.enum !== undefined && !Array.isArray(schema.enum)) {
+    errors.push(`${path}.enum: must be an array`);
+  }
+  if (schema.properties !== undefined) {
+    if (!isPlainObject(schema.properties)) {
+      errors.push(`${path}.properties: must be an object mapping property names to schemas`);
+    } else {
+      for (const [key, value] of Object.entries(schema.properties)) {
+        errors.push(...findJsonSchemaShapeErrors(value, `${path}.properties.${key}`));
+      }
+    }
+  }
+  if (schema.items !== undefined) {
+    errors.push(...findJsonSchemaShapeErrors(schema.items, `${path}.items`));
+  }
+  return errors;
+}
+
+// src/workflows/limits.ts
+var DEFAULT_MAX_STEPS_PER_RUN = 500;
+function getMaxWorkflowStepsPerRun() {
+  return Number(process.env.WORKFLOW_MAX_STEPS_PER_RUN) || DEFAULT_MAX_STEPS_PER_RUN;
+}
+
+// src/workflows/readiness.ts
+async function findWorkflowReadinessProblems(definition, registry) {
+  const nodesByType = new Map;
+  for (const node of definition.nodes) {
+    if (!registry.has(node.type))
+      continue;
+    const group = nodesByType.get(node.type) ?? [];
+    group.push({ id: node.id, config: node.config });
+    nodesByType.set(node.type, group);
+  }
+  const problems = [];
+  for (const [type, nodes] of nodesByType) {
+    try {
+      for (const problem of await registry.get(type).checkReadiness(nodes)) {
+        problems.push({ type, ...problem });
+      }
+    } catch {
+      problems.push({
+        type,
+        nodeIds: nodes.map((node) => node.id),
+        message: `Could not check whether "${type}" nodes are ready to run`
+      });
+    }
+  }
+  return problems;
+}
+function describeNodes(problem) {
+  const noun = problem.nodeIds.length === 1 ? "node" : "nodes";
+  return `${problem.type} ${noun} ${problem.nodeIds.map((id) => `"${id}"`).join(", ")}`;
+}
+function formatReadinessWarning(problem) {
+  return `${problem.message} Affects ${describeNodes(problem)}. Runs of this workflow fail before any node executes until this is fixed.`;
+}
+function formatReadinessProblems(problems) {
+  return problems.map((problem) => `${problem.message} Needed by ${describeNodes(problem)}.`).join(" ");
+}
+function formatReadinessRunError(problems) {
+  return `Run not started, no node executed: ${formatReadinessProblems(problems)}`;
+}
+async function workflowSaveWarnings(definition, registry) {
+  return (await findWorkflowReadinessProblems(definition, registry)).map(formatReadinessWarning);
+}
+function withSaveWarnings(text, warnings) {
+  return warnings.length === 0 ? text : `${text} ${warnings.map((warning) => `Warning: ${warning}`).join(" ")}`;
+}
+
+// src/workflows/template.ts
+init_template();
+
+// src/workflows/validation.ts
+function extractPassResult(executorType, output) {
+  if (!output || typeof output !== "object")
+    return false;
+  const o = output;
+  switch (executorType) {
+    case "validate":
+      return o.pass === true;
+    case "script":
+      return o.exitCode === 0;
+    case "property-match":
+      return o.passed === true;
+    case "raw-llm":
+      if (typeof o.result === "object" && o.result !== null) {
+        return o.result.pass === true;
+      }
+      return false;
+    default:
+      return o.pass === true || o.passed === true || o.exitCode === 0;
+  }
+}
+async function runStepValidation(registry, stepNode, stepOutput, context, meta) {
+  if (!stepNode.validation) {
+    return { outcome: "pass" };
+  }
+  const validation = stepNode.validation;
+  const executorType = validation.executor || "validate";
+  const executor = registry.get(executorType);
+  const validationConfig = {
+    targetNodeId: meta.nodeId,
+    ...validation.config
+  };
+  const validationContext = {
+    ...context,
+    [meta.nodeId]: stepOutput
+  };
+  const result = await executor.run({
+    config: validationConfig,
+    context: validationContext,
+    meta: {
+      ...meta,
+      stepId: crypto.randomUUID()
+    }
+  });
+  const passed = result.status === "success" && extractPassResult(executorType, result.output);
+  if (passed) {
+    return { outcome: "pass", passed: true };
+  }
+  if (validation.mustPass) {
+    if (validation.retry) {
+      return {
+        outcome: "retry",
+        passed: false,
+        retryContext: {
+          previousOutput: stepOutput,
+          validationResult: result.output
+        }
+      };
+    }
+    return { outcome: "halt", passed: false };
+  }
+  return { outcome: "pass", passed: false };
+}
+
+// src/workflows/engine.ts
+var DEFAULT_TIMEOUT_MS = 30000;
+function maxIterations() {
+  return Number(process.env.WORKFLOW_MAX_ITERATIONS) || 100;
+}
+
+class TriggerSchemaError extends Error {
+  validationErrors;
+  constructor(validationErrors) {
+    super(`Trigger schema validation failed: ${validationErrors.join("; ")}`);
+    this.validationErrors = validationErrors;
+    this.name = "TriggerSchemaError";
+  }
+}
+async function resolveRenderedWorkflowInputs(input) {
+  const stringInputs = {};
+  const resolved = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (typeof value === "string")
+      stringInputs[key] = value;
+    else
+      resolved[key] = value;
+  }
+  return { ...resolved, ...await resolveInputs(stringInputs) };
+}
+async function startWorkflowExecution(workflow, triggerData, registry, options = {}) {
+  const preflight = preflightAutomation(workflowPreflightInput(workflow), await getAutomationSetupStates());
+  if (preflight.state === "needs_setup") {
+    const { runId: runId2, recorded } = await recordWorkflowPreflightFailure({
+      workflowId: workflow.id,
+      triggerType: options.triggerType ?? "manual",
+      triggerData,
+      failureReason: preflight.failureReason,
+      createdBy: options.requestedByUserId
+    });
+    if (recorded)
+      await notifyAutomationPreflightFailure(preflight);
+    return runId2;
+  }
+  workflow = renderAutomationTokens(workflow, workflow.params ?? {});
+  if (workflow.triggerSchema) {
+    const validationErrors = validateJsonSchema(workflow.triggerSchema, triggerData);
+    if (validationErrors.length > 0) {
+      throw new TriggerSchemaError(validationErrors);
+    }
+  }
+  if (workflow.cooldown && await shouldSkipCooldown(workflow.id, workflow.cooldown)) {
+    const runId2 = crypto.randomUUID();
+    await createWorkflowRun({
+      id: runId2,
+      workflowId: workflow.id,
+      triggerType: options.triggerType ?? "manual",
+      triggerData,
+      createdBy: options.requestedByUserId,
+      parentStepId: options.parentStepId
+    });
+    await updateWorkflowRun(runId2, {
+      status: "skipped",
+      error: "cooldown",
+      finishedAt: new Date().toISOString()
+    });
+    return runId2;
+  }
+  const runId = crypto.randomUUID();
+  await createWorkflowRun({
+    id: runId,
+    workflowId: workflow.id,
+    triggerType: options.triggerType ?? "manual",
+    triggerData,
+    createdBy: options.requestedByUserId,
+    parentStepId: options.parentStepId
+  });
+  telemetry.workflow("started", {
+    workflowId: workflow.id,
+    nodeCount: workflow.definition.nodes.length,
+    triggerType: options.triggerType ?? "manual"
+  });
+  const notReady = await findWorkflowReadinessProblems(workflow.definition, registry);
+  if (notReady.length > 0) {
+    await updateWorkflowRun(runId, {
+      status: "failed",
+      error: formatReadinessRunError(notReady),
+      finishedAt: new Date().toISOString()
+    });
+    return runId;
+  }
+  const ctx = { trigger: triggerData };
+  if (options.requestedByUserId) {
+    ctx.swarm = { requestedByUserId: options.requestedByUserId };
+  }
+  if (workflow.dir || workflow.vcsRepo) {
+    ctx.workflow = { dir: workflow.dir, vcsRepo: workflow.vcsRepo };
+  }
+  if (workflow.input) {
+    try {
+      const resolved = await resolveRenderedWorkflowInputs(workflow.input);
+      Object.assign(ctx, { input: resolved });
+    } catch (err) {
+      await updateWorkflowRun(runId, {
+        status: "failed",
+        error: `Input resolution failed: ${err}`,
+        finishedAt: new Date().toISOString()
+      });
+      return runId;
+    }
+  }
+  const entryNodes = findEntryNodes(workflow.definition);
+  const secretKeys = getSecretInputKeys(workflow.input);
+  const walk = walkGraph(workflow.definition, runId, ctx, entryNodes, registry, workflow.id, secretKeys, options);
+  if (options.parentStepId) {
+    walk.catch((err) => console.error(`[workflows] Child workflow run ${runId} failed:`, err));
+    return runId;
+  }
+  await walk;
+  return runId;
+}
+var activeWalks = new Map;
+var executingSteps = new Set;
+async function failRunOnUnreadableReplay(runId, err, stepId) {
+  if (!(err instanceof WorkflowReplayStateError))
+    return false;
+  const finishedAt = new Date().toISOString();
+  console.error(`[workflow] ${err.message}`);
+  if (stepId) {
+    await updateWorkflowRunStep(stepId, {
+      status: "failed",
+      error: err.message,
+      finishedAt,
+      nextRetryAt: null
+    });
+  }
+  await updateWorkflowRun(runId, { status: "failed", error: err.message, finishedAt });
+  return true;
+}
+function isWorkflowRunActive(runId) {
+  return activeWalks.has(runId);
+}
+function holdWorkflowRun(runId) {
+  activeWalks.set(runId, (activeWalks.get(runId) ?? 0) + 1);
+  let released = false;
+  return () => {
+    if (released)
+      return;
+    released = true;
+    const remaining = activeWalks.get(runId) - 1;
+    if (remaining === 0)
+      activeWalks.delete(runId);
+    else
+      activeWalks.set(runId, remaining);
+  };
+}
+async function walkGraph(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
+  const release = holdWorkflowRun(runId);
+  try {
+    await walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys, options);
+  } catch (err) {
+    if (!await failRunOnUnreadableReplay(runId, err))
+      throw err;
+  } finally {
+    release();
+  }
+}
+async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
+  if (!options.requestedByUserId) {
+    options = {
+      ...options,
+      requestedByUserId: (await getWorkflowRun(runId))?.createdBy
+    };
+  }
+  let nodeExecutionCount = 0;
+  if (!("run" in ctx)) {
+    ctx.run = { id: runId };
+  }
+  const { completedNodeIds } = await rehydrateCompletedStepOutputs(def, runId, ctx, registry);
+  const { activeEdges } = await loadCompletedStepRouting(def, runId, completedNodeIds);
+  const allSteps = await getWorkflowRunStepsByRunId(runId);
+  if (allSteps.length >= getMaxWorkflowStepsPerRun()) {
+    await updateWorkflowRun(runId, {
+      status: "failed",
+      error: `Circuit breaker: run exceeded ${getMaxWorkflowStepsPerRun()} total steps (WORKFLOW_MAX_STEPS_PER_RUN)`,
+      finishedAt: new Date().toISOString()
+    });
+    return;
+  }
+  for (const step of allSteps) {
+    if (step.status !== "waiting")
+      continue;
+    const successors = getSuccessors(def, step.nodeId);
+    for (const succ of successors) {
+      activeEdges.add(`${step.nodeId}→${succ.id}`);
+    }
+  }
+  const awaited = awaitedNodeIds(allSteps, activeEdges);
+  let pendingNodes = startNodes.filter((n) => {
+    const preds = getAllPredecessors(def, n.id);
+    if (preds.length === 0) {
+      return !completedNodeIds.has(n.id);
+    }
+    const activePreds = preds.filter((predId) => activeEdges.has(`${predId}→${n.id}`) || awaited.has(predId));
+    const predsToCheck = activePreds.length > 0 ? activePreds : preds;
+    return predsToCheck.every((p) => completedNodeIds.has(p));
+  });
+  const executedInThisWalk = new Set;
+  while (pendingNodes.length > 0) {
+    nodeExecutionCount += pendingNodes.length;
+    if (nodeExecutionCount > maxIterations()) {
+      await updateWorkflowRun(runId, {
+        status: "failed",
+        error: `Max node executions (${maxIterations()}) exceeded — possible infinite loop`,
+        finishedAt: new Date().toISOString()
+      });
+      return;
+    }
+    const results = await Promise.all(pendingNodes.map((node) => executeStep(def, runId, ctx, node, registry, workflowId, secretKeys, options).catch(async (err) => {
+      await failRunOnUnreadableReplay(runId, err);
+      return { outcome: "failed", successors: [] };
+    })));
+    const nextBatch = new Map;
+    let hasWaiting = false;
+    for (let i = 0;i < results.length; i++) {
+      const result = results[i];
+      if (result.outcome === "failed") {
+        const currentRun = await getWorkflowRun(runId);
+        if (currentRun?.status === "failed")
+          return;
+        continue;
+      }
+      if (result.outcome === "waiting") {
+        hasWaiting = true;
+        continue;
+      }
+      const sourceNodeId = pendingNodes[i].id;
+      completedNodeIds.add(sourceNodeId);
+      executedInThisWalk.add(sourceNodeId);
+      for (const succ of result.successors) {
+        activeEdges.add(`${sourceNodeId}→${succ.id}`);
+        nextBatch.set(succ.id, succ);
+      }
+    }
+    if (hasWaiting)
+      return;
+    const readyNext = [];
+    const batchSteps = nextBatch.size > 0 ? await getWorkflowRunStepsByRunId(runId) : [];
+    const batchAwaited = awaitedNodeIds(batchSteps, activeEdges);
+    const batchLatest = latestStepByNode(batchSteps);
+    for (const [nodeId, node] of nextBatch) {
+      if (executedInThisWalk.has(nodeId))
+        continue;
+      const allPreds = getAllPredecessors(def, nodeId);
+      for (const predId of allPreds) {
+        if (completedNodeIds.has(predId))
+          continue;
+        const latest = batchLatest.get(predId);
+        if (latest?.status !== "completed")
+          continue;
+        completedNodeIds.add(predId);
+        if (latest.output !== undefined)
+          ctx[predId] = latest.output;
+      }
+      const activePreds = allPreds.filter((predId) => activeEdges.has(`${predId}→${nodeId}`) || batchAwaited.has(predId));
+      const allActivePredsCompleted = activePreds.every((p) => completedNodeIds.has(p));
+      if (allActivePredsCompleted) {
+        readyNext.push(node);
+      }
+    }
+    pendingNodes = readyNext;
+  }
+  await getDbClient().transaction(async () => {
+    const run = await getWorkflowRun(runId);
+    if (!run || run.status !== "running")
+      return;
+    const finalSteps = await getWorkflowRunStepsByRunId(runId);
+    if (hasRunningStep(finalSteps))
+      return;
+    const hasWaitingSteps = finalSteps.some((s) => s.status === "waiting");
+    const hasPendingRetries = finalSteps.some((s) => s.status === "failed" && s.nextRetryAt != null);
+    const failedSteps = finalSteps.filter((s) => s.status === "failed" && s.nextRetryAt == null);
+    const entryNodeIds = new Set(findEntryNodes(def).map((n) => n.id));
+    const hasCompletedSteps = finalSteps.some((s) => s.status === "completed" && !entryNodeIds.has(s.nodeId));
+    if (hasWaitingSteps) {
+      await updateWorkflowRun(runId, { status: "waiting" });
+    } else if (!hasPendingRetries) {
+      if (failedSteps.length > 0 && !hasCompletedSteps) {
+        const failedNodeIds = failedSteps.map((s) => s.nodeId).join(", ");
+        await updateWorkflowRun(runId, {
+          status: "failed",
+          error: `All branches failed. Failed nodes: ${failedNodeIds}`,
+          context: ctx,
+          finishedAt: new Date().toISOString()
+        });
+      } else if (failedSteps.length > 0) {
+        const failedNodeIds = failedSteps.map((s) => s.nodeId).join(", ");
+        await updateWorkflowRun(runId, {
+          status: "completed",
+          error: `Partial failure: nodes [${failedNodeIds}] failed (mustPass validation), but other branches completed successfully`,
+          context: ctx,
+          finishedAt: new Date().toISOString()
+        });
+      } else {
+        await updateWorkflowRun(runId, {
+          status: "completed",
+          context: ctx,
+          finishedAt: new Date().toISOString()
+        });
+      }
+    }
+  });
+}
+function latestStepByNode(steps) {
+  const latest = new Map;
+  for (const step of steps)
+    latest.set(step.nodeId, step);
+  return latest;
+}
+function awaitedNodeIds(steps, activeEdges) {
+  const latest = latestStepByNode(steps);
+  const awaited = new Set;
+  for (const [nodeId, step] of latest) {
+    if (step.status === "running" || step.status === "waiting")
+      awaited.add(nodeId);
+  }
+  for (const edge of activeEdges) {
+    const target = edge.slice(edge.indexOf("→") + 1);
+    if (!latest.has(target))
+      awaited.add(target);
+  }
+  return awaited;
+}
+function hasRunningStep(steps) {
+  for (const step of latestStepByNode(steps).values()) {
+    if (step.status === "running")
+      return true;
+  }
+  return false;
+}
+async function rehydrateCompletedStepOutputs(def, runId, ctx, registry) {
+  const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
+  const latestSteps = new Map;
+  for (const nodeId of completedNodeIds) {
+    if (resolveForeachParent(def, nodeId))
+      continue;
+    const step = await getLatestStepForNode(runId, nodeId);
+    if (!step)
+      continue;
+    if (step.output !== undefined) {
+      const node = def.nodes.find((candidate) => candidate.id === nodeId);
+      if (node && registry.has(node.type)) {
+        const executor = registry.get(node.type);
+        const parseResult = executor.outputSchema.safeParse(step.output);
+        if (!parseResult.success) {
+          console.warn(`[workflow] Recovery: step ${nodeId} output failed validation: ${parseResult.error.message}`);
+          continue;
+        }
+      }
+      ctx[nodeId] = step.output;
+    }
+    latestSteps.set(nodeId, step);
+  }
+  return { completedNodeIds, latestSteps };
+}
+function getAllPredecessors(def, nodeId) {
+  const preds = [];
+  for (const node of def.nodes) {
+    if (!node.next)
+      continue;
+    if (getNextTargets(node.next).includes(nodeId)) {
+      preds.push(node.id);
+    }
+  }
+  return preds;
+}
+async function executeStep(def, runId, ctx, node, registry, workflowId, secretKeys = new Set, options = {}) {
+  let claimedStepId;
+  const claimStep = async () => {
+    const run = await getWorkflowRun(runId);
+    if (!run || run.status !== "running" && run.status !== "waiting") {
+      return { halted: true };
+    }
+    if (node.type !== "foreach") {
+      const current = await getCurrentStepForNode(runId, node.id, getAllPredecessors(def, node.id));
+      if (current && (current.status !== "running" || executingSteps.has(current.id))) {
+        return { current };
+      }
+    }
+    const iteration = await getStepCountForNode(runId, node.id);
+    const idempotencyKey = `${runId}:${node.id}:${iteration}`;
+    const existingStep = await getStepByIdempotencyKey(idempotencyKey);
+    if (existingStep && (existingStep.status === "completed" || existingStep.status === "waiting")) {
+      return { existingStep, stepId: existingStep.id, deduped: true };
+    }
+    const latestForeachStep = node.type === "foreach" ? await getLatestStepForNode(runId, node.id) : undefined;
+    const reusableForeachStep = latestForeachStep && !FOREACH_TERMINAL_STEP_STATUSES.has(latestForeachStep.status) ? latestForeachStep : undefined;
+    const stepId = reusableForeachStep?.id ?? crypto.randomUUID();
+    if (!reusableForeachStep) {
+      await createWorkflowRunStep({
+        id: stepId,
+        runId,
+        nodeId: node.id,
+        nodeType: node.type,
+        input: redactSecretsForStorage(ctx, secretKeys),
+        idempotencyKey
+      });
+    }
+    claimedStepId = stepId;
+    executingSteps.add(stepId);
+    return { existingStep, stepId, deduped: false };
+  };
+  const dedup = await getDbClient().transaction(claimStep).catch((err) => {
+    if (claimedStepId)
+      executingSteps.delete(claimedStepId);
+    throw err;
+  });
+  if ("halted" in dedup)
+    return { outcome: "completed", successors: [] };
+  if ("current" in dedup && dedup.current) {
+    if (dedup.current.status !== "completed")
+      return { outcome: "waiting", successors: [] };
+    ctx[node.id] = dedup.current.output;
+    return { outcome: "completed", successors: [] };
+  }
+  if (dedup.deduped && dedup.existingStep) {
+    if (dedup.existingStep.status === "completed") {
+      ctx[node.id] = dedup.existingStep.output;
+      const successors = getSuccessors(def, node.id);
+      return { outcome: "completed", successors };
+    }
+    return { outcome: "waiting", successors: [] };
+  }
+  try {
+    return await runClaimedStep(def, runId, ctx, node, registry, dedup.existingStep, dedup.stepId, workflowId, options);
+  } catch (err) {
+    if (await failRunOnUnreadableReplay(runId, err, dedup.stepId)) {
+      return { outcome: "failed", successors: [] };
+    }
+    throw err;
+  } finally {
+    executingSteps.delete(dedup.stepId);
+  }
+}
+async function runClaimedStep(def, runId, ctx, node, registry, existingStep, stepId, workflowId, options = {}) {
+  const executor = registry.get(node.type);
+  const systemOneRetryProblems = systemOneRetryViolations(node);
+  if (systemOneRetryProblems.length > 0) {
+    await checkpointStepFailure(runId, stepId, systemOneRetryProblems.join("; "), 0);
+    return { outcome: "failed", successors: [] };
+  }
+  const interpolationCtx = buildNodeInterpolationCtx(node, ctx);
+  if (node.inputSchema) {
+    const inputErrors = validateJsonSchema(node.inputSchema, interpolationCtx);
+    if (inputErrors.length > 0) {
+      const errorMsg = `Input schema validation failed: ${inputErrors.join("; ")}`;
+      await checkpointStepFailure(runId, stepId, errorMsg, 0);
+      throw new Error(errorMsg);
+    }
+  }
+  const {
+    value: interpolatedValue,
+    unresolved,
+    scriptBodyUnresolved,
+    strictUnresolved
+  } = interpolateNodeConfig(node, interpolationCtx);
+  const interpolatedConfig = interpolatedValue;
+  const executionCtx = { ...ctx, ...interpolationCtx };
+  if (scriptBodyUnresolved && scriptBodyUnresolved.length > 0) {
+    const errorMsg = scriptBodyInterpolationError(node.id, scriptBodyUnresolved);
+    await checkpointStepFailure(runId, stepId, errorMsg, 0);
+    return { outcome: "failed", successors: [] };
+  }
+  if (strictUnresolved && strictUnresolved.length > 0) {
+    await checkpointStepFailure(runId, stepId, systemOneUnresolvedError(node.id, strictUnresolved), 0);
+    return { outcome: "failed", successors: [] };
+  }
+  if (unresolved.length > 0) {
+    console.warn(`[workflow] Step ${node.id}: unresolved interpolation tokens: ${unresolved.join(", ")}`);
+    await updateWorkflowRunStep(stepId, {
+      diagnostics: JSON.stringify({ unresolvedTokens: unresolved })
+    });
+  }
+  const meta = {
+    runId,
+    stepId,
+    nodeId: node.id,
+    workflowId: workflowId || "",
+    dryRun: false,
+    requestedByUserId: options.requestedByUserId,
+    inputCtx: interpolationCtx
+  };
+  const configuredTimeoutMs = typeof node.config?.timeoutMs === "number" ? node.config.timeoutMs : node.type === "script" && typeof node.config?.timeout === "number" ? node.config.timeout : undefined;
+  const timeoutMs = configuredTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  let result;
+  try {
+    result = await Promise.race([
+      executor.run({
+        config: interpolatedConfig,
+        context: executionCtx,
+        meta
+      }),
+      timeoutPromise(timeoutMs)
+    ]);
+  } catch (err) {
+    const errorMsg = err instanceof Error ? err.message : String(err);
+    const retryPolicy = node.retry || executor.retryPolicy;
+    const currentRetryCount = existingStep?.retryCount || 0;
+    const { shouldRetry } = await checkpointStepFailure(runId, stepId, errorMsg, currentRetryCount, retryPolicy);
+    if (!shouldRetry) {
+      throw err;
+    }
+    return { outcome: "completed", successors: [] };
+  }
+  if (result.status === "failed") {
+    const retryPolicy = node.retry || executor.retryPolicy;
+    const currentRetryCount = existingStep?.retryCount || 0;
+    const { shouldRetry } = await checkpointStepFailure(runId, stepId, result.error || "Executor returned failed status", currentRetryCount, retryPolicy);
+    if (result.output !== undefined) {
+      await updateWorkflowRunStep(stepId, { output: result.output });
+    }
+    if (!shouldRetry) {
+      throw new Error(result.error || "Step execution failed");
+    }
+    return { outcome: "completed", successors: [] };
+  }
+  if ("async" in result && result.async) {
+    const waiting = await checkpointStepWaiting(runId, stepId, ctx);
+    if (waiting && result.waitFor === "workflow.child.finished") {
+      const { resumeFromChildRun } = await import("./resume-cq2pkp8q.js");
+      await resumeFromChildRun(stepId, registry);
+    }
+    return { outcome: waiting ? "waiting" : "completed", successors: [] };
+  }
+  if (node.outputSchema && result.status === "success") {
+    const outputErrors = validateJsonSchema(node.outputSchema, result.output);
+    if (outputErrors.length > 0) {
+      const errorMsg = `Output schema validation failed: ${outputErrors.join("; ")}`;
+      await checkpointStepFailure(runId, stepId, errorMsg, 0);
+      throw new Error(errorMsg);
+    }
+  }
+  let validationResult;
+  if (node.validation) {
+    validationResult = await runStepValidation(registry, node, result.output, executionCtx, meta);
+    if (validationResult.outcome === "halt") {
+      const errorMsg = "Validation failed (mustPass)";
+      await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, { markRunFailed: false });
+      return { outcome: "failed", successors: [] };
+    }
+    if (validationResult.outcome === "retry") {
+      if (validationResult.retryContext) {
+        const historyKey = `${node.id}_validations`;
+        const existing = ctx[historyKey] || [];
+        ctx[historyKey] = [...existing, validationResult.retryContext];
+      }
+      const retryPolicy = node.validation.retry || node.retry;
+      const currentRetryCount = existingStep?.retryCount || 0;
+      await checkpointStepFailure(runId, stepId, "Validation failed, retrying", currentRetryCount, retryPolicy);
+      return { outcome: "completed", successors: [] };
+    }
+  }
+  result.nextPort = resolveValidationPort(node.next, result.nextPort, validationResult?.passed);
+  await checkpointStep(runId, stepId, node.id, result, ctx);
+  const successors = result.nextPort ? getSuccessors(def, node.id, result.nextPort) : getSuccessors(def, node.id);
+  return { outcome: "completed", successors };
+}
+function findReadyNodes(def, completedNodeIds, activeEdges) {
+  const predecessors = new Map;
+  for (const node of def.nodes) {
+    if (!predecessors.has(node.id)) {
+      predecessors.set(node.id, new Set);
+    }
+  }
+  for (const node of def.nodes) {
+    if (!node.next)
+      continue;
+    for (const target of getNextTargets(node.next)) {
+      if (!predecessors.has(target)) {
+        predecessors.set(target, new Set);
+      }
+      predecessors.get(target).add(node.id);
+    }
+  }
+  return def.nodes.filter((node) => {
+    if (completedNodeIds.has(node.id))
+      return false;
+    const preds = predecessors.get(node.id);
+    if (!preds || preds.size === 0)
+      return true;
+    if (activeEdges) {
+      const activePreds = [...preds].filter((predId) => activeEdges.has(`${predId}→${node.id}`));
+      if (activePreds.length === 0)
+        return false;
+      return activePreds.every((pred) => completedNodeIds.has(pred));
+    }
+    for (const pred of preds) {
+      if (!completedNodeIds.has(pred))
+        return false;
+    }
+    return true;
+  });
+}
+function buildNodeInterpolationCtx(node, ctx) {
+  const interpolationCtx = {};
+  if (ctx.trigger !== undefined)
+    interpolationCtx.trigger = ctx.trigger;
+  if (ctx.input !== undefined)
+    interpolationCtx.input = ctx.input;
+  if (ctx.workflow !== undefined)
+    interpolationCtx.workflow = ctx.workflow;
+  if (ctx.swarm !== undefined)
+    interpolationCtx.swarm = ctx.swarm;
+  if (ctx.run !== undefined)
+    interpolationCtx.run = ctx.run;
+  if (!node.inputs)
+    return interpolationCtx;
+  for (const [localName, sourcePath] of Object.entries(node.inputs)) {
+    const keys = sourcePath.split(".");
+    let value = ctx;
+    for (const key of keys) {
+      if (value == null || typeof value !== "object") {
+        value = undefined;
+        break;
+      }
+      value = value[key];
+    }
+    interpolationCtx[localName] = value;
+  }
+  return interpolationCtx;
+}
+var SCRIPT_BODY_ALLOWED_SOURCES = new Set(["input", "workflow", "swarm", "run"]);
+function buildScriptBodyCtx(node, interpolationCtx) {
+  const aliases = node.inputs ?? {};
+  const safe = {};
+  for (const [key, value] of Object.entries(interpolationCtx)) {
+    const sourcePath = aliases[key];
+    const root = sourcePath === undefined ? key : sourcePath.split(".")[0] ?? "";
+    if (SCRIPT_BODY_ALLOWED_SOURCES.has(root))
+      safe[key] = value;
+  }
+  return safe;
+}
+function interpolateNodeConfig(node, interpolationCtx) {
+  if (node.type === SYSTEM_ONE_DECISION_NODE_TYPE) {
+    const { state, questions, ...rest } = node.config;
+    const restResult = deepInterpolate(rest, interpolationCtx);
+    const dynamic = {};
+    if (Object.hasOwn(node.config, "state"))
+      dynamic.state = state;
+    if (Object.hasOwn(node.config, "questions"))
+      dynamic.questions = questions;
+    const dynamicResult = deepInterpolate(dynamic, interpolationCtx, { preserveRawTokens: true });
+    const unresolved = [...restResult.unresolved, ...dynamicResult.unresolved];
+    return {
+      value: {
+        ...restResult.value,
+        ...dynamicResult.value
+      },
+      unresolved,
+      strictUnresolved: unresolved
+    };
+  }
+  if (node.type === "foreach" && Object.hasOwn(node.config, "over")) {
+    const { over, body, ...configWithoutOverAndBody } = node.config;
+    const configResult2 = deepInterpolate(configWithoutOverAndBody, interpolationCtx);
+    const overResult = deepInterpolate(over, interpolationCtx, { preserveRawTokens: true });
+    return {
+      value: {
+        ...configResult2.value,
+        over: overResult.value,
+        body
+      },
+      unresolved: [...configResult2.unresolved, ...overResult.unresolved]
+    };
+  }
+  if (node.type === "human-in-the-loop" && typeof node.config.questions === "string") {
+    const { questions, ...configWithoutQuestions } = node.config;
+    const configResult2 = deepInterpolate(configWithoutQuestions, interpolationCtx);
+    const questionsResult = deepInterpolate(questions, interpolationCtx, {
+      preserveRawTokens: true
+    });
+    return {
+      value: {
+        ...configResult2.value,
+        questions: questionsResult.value
+      },
+      unresolved: [...configResult2.unresolved, ...questionsResult.unresolved]
+    };
+  }
+  if (node.type === "script" && typeof node.config.script === "string") {
+    const { script, ...configWithoutScript } = node.config;
+    const restResult = deepInterpolate(configWithoutScript, interpolationCtx);
+    const scriptResult = deepInterpolate(script, buildScriptBodyCtx(node, interpolationCtx));
+    return {
+      value: {
+        ...restResult.value,
+        script: scriptResult.unresolved.length > 0 ? script : scriptResult.value
+      },
+      unresolved: [...restResult.unresolved, ...scriptResult.unresolved],
+      scriptBodyUnresolved: scriptResult.unresolved
+    };
+  }
+  if (node.type !== "swarm-script" || !Object.hasOwn(node.config, "args")) {
+    return deepInterpolate(node.config, interpolationCtx);
+  }
+  const { args, ...configWithoutArgs } = node.config;
+  const configResult = deepInterpolate(configWithoutArgs, interpolationCtx);
+  const argsResult = deepInterpolate(args, interpolationCtx, { preserveRawTokens: true });
+  return {
+    value: {
+      ...configResult.value,
+      args: argsResult.value
+    },
+    unresolved: [...configResult.unresolved, ...argsResult.unresolved]
+  };
+}
+function scriptBodyInterpolationError(nodeId, tokens) {
+  const renderedTokens = [...new Set(tokens)].map((token) => `{{${token}}}`).join(", ");
+  return `Script body interpolation failed for node "${nodeId}": unresolved or disallowed token(s): ${renderedTokens}. Executable source may interpolate only input, workflow, swarm, or run values. Pass dynamic trigger or upstream values through config.args and read them from argv.`;
+}
+function timeoutPromise(ms) {
+  return new Promise((_, reject) => {
+    setTimeout(() => reject(new Error(`Step timed out after ${ms}ms`)), ms);
+  });
+}
+
+// src/workflows/resume.ts
+init_event_bus();
+
+// src/workflows/executors/sub-workflow.ts
+init_zod();
+init_workflow_runs();
+var SubWorkflowConfigSchema = exports_external.object({
+  workflowId: exports_external.string().min(1).describe("Workflow to run as a child"),
+  inputs: exports_external.record(exports_external.string(), exports_external.unknown()).optional().describe("Trigger data for the child run, validated against its triggerSchema")
+});
+var SubWorkflowOutputSchema = exports_external.object({
+  runId: exports_external.string(),
+  outputs: exports_external.record(exports_external.string(), exports_external.unknown()),
+  error: exports_external.string().optional()
+});
+var MAX_SUB_WORKFLOW_DEPTH = 16;
+var NON_NODE_CONTEXT_KEYS = new Set(["trigger", "input", "swarm", "workflow"]);
+function childRunOutcome(child) {
+  if (child.status === "running" || child.status === "waiting")
+    return null;
+  if (child.status !== "completed") {
+    const reason = child.error ? `: ${child.error}` : "";
+    return { error: `Child workflow run ${child.id} ${child.status}${reason}` };
+  }
+  const outputs = {};
+  for (const [key, value] of Object.entries(child.context ?? {})) {
+    if (!NON_NODE_CONTEXT_KEYS.has(key))
+      outputs[key] = value;
+  }
+  return { output: { runId: child.id, outputs, error: child.error } };
+}
+
+class SubWorkflowExecutor extends BaseExecutor {
+  registry;
+  type = "sub-workflow";
+  mode = "async";
+  configSchema = SubWorkflowConfigSchema;
+  outputSchema = SubWorkflowOutputSchema;
+  constructor(deps, registry) {
+    super(deps);
+    this.registry = registry;
+  }
+  async execute(config, _context, meta) {
+    const { db } = this.deps;
+    const existingId = await getChildWorkflowRunId(meta.stepId);
+    const existing = existingId ? await db.getWorkflowRun(existingId) : null;
+    if (existing)
+      return this.settle(existing);
+    const lineage = await getWorkflowRunLineage(meta.runId, MAX_SUB_WORKFLOW_DEPTH);
+    if (lineage.length > MAX_SUB_WORKFLOW_DEPTH) {
+      return {
+        status: "failed",
+        error: `Sub-workflow nesting exceeds ${MAX_SUB_WORKFLOW_DEPTH} levels`
+      };
+    }
+    if (config.workflowId === meta.workflowId || lineage.includes(config.workflowId)) {
+      return {
+        status: "failed",
+        error: `Sub-workflow recursion: workflow ${config.workflowId} is already running in this run's ancestry`
+      };
+    }
+    const workflow = await db.getWorkflow(config.workflowId);
+    if (!workflow)
+      return { status: "failed", error: `Workflow ${config.workflowId} not found` };
+    if (!workflow.enabled) {
+      return { status: "failed", error: `Workflow ${config.workflowId} is disabled` };
+    }
+    const childRunId = await startWorkflowExecution(workflow, config.inputs ?? {}, this.registry, {
+      requestedByUserId: meta.requestedByUserId,
+      parentStepId: meta.stepId
+    });
+    const child = await db.getWorkflowRun(childRunId);
+    if (!child)
+      return { status: "failed", error: `Child workflow run ${childRunId} not found` };
+    return this.settle(child);
+  }
+  settle(child) {
+    const outcome = childRunOutcome(child);
+    if (!outcome) {
+      return {
+        status: "success",
+        async: true,
+        waitFor: "workflow.child.finished",
+        correlationId: child.id
+      };
+    }
+    if ("error" in outcome)
+      return { status: "failed", error: outcome.error };
+    return { status: "success", output: outcome.output, nextPort: "success" };
+  }
+}
+
+// src/workflows/executors/wait.ts
+init_zod();
+
+// src/workflows/wait-filter.ts
+var PARAM_SHADOW_KEYS = [
+  "require",
+  "process",
+  "Bun",
+  "globalThis",
+  "global",
+  "fetch",
+  "setTimeout",
+  "setInterval"
+];
+var PARAM_SHADOW_VALUES = PARAM_SHADOW_KEYS.map(() => {
+  return;
+});
+var BODY_SHADOW_KEYS = ["eval", "Function", "AsyncFunction"];
+var BODY_SHADOW_PREAMBLE = BODY_SHADOW_KEYS.map((k) => `var ${k} = undefined;`).join(" ");
+var FILTER_TIMEOUT_MS = 50;
+function getByDotPath(obj, path) {
+  if (obj === null || typeof obj !== "object") {
+    return { found: false, value: undefined };
+  }
+  const segments = path.split(".");
+  let cursor = obj;
+  for (const seg of segments) {
+    if (cursor === null || typeof cursor !== "object") {
+      return { found: false, value: undefined };
+    }
+    const rec = cursor;
+    if (!(seg in rec)) {
+      return { found: false, value: undefined };
+    }
+    cursor = rec[seg];
+  }
+  return { found: true, value: cursor };
+}
+function deepEqual(a, b) {
+  if (a === b)
+    return true;
+  if (typeof a !== typeof b)
+    return false;
+  if (a === null || b === null)
+    return false;
+  if (Array.isArray(a)) {
+    if (!Array.isArray(b))
+      return false;
+    if (a.length !== b.length)
+      return false;
+    for (let i = 0;i < a.length; i++) {
+      if (!deepEqual(a[i], b[i]))
+        return false;
+    }
+    return true;
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length)
+      return false;
+    for (const k of aKeys) {
+      if (!deepEqual(a[k], b[k])) {
+        return false;
+      }
+    }
+    return true;
+  }
+  return false;
+}
+function matchObjectFilter(payload, filter) {
+  for (const [key, expected] of Object.entries(filter)) {
+    const { found, value } = getByDotPath(payload, key);
+    if (!found)
+      return false;
+    if (!deepEqual(value, expected))
+      return false;
+  }
+  return true;
+}
+async function runWithTimeout(fn) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled)
+        return;
+      settled = true;
+      resolve(null);
+    }, FILTER_TIMEOUT_MS);
+    queueMicrotask(() => {
+      if (settled)
+        return;
+      try {
+        const v = fn();
+        const then = v !== null && typeof v === "object" ? v.then : undefined;
+        if (typeof then === "function") {
+          then.call(v, undefined, () => {});
+          settled = true;
+          clearTimeout(timer);
+          resolve({ __asyncRejected: true });
+          return;
+        }
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(v);
+      } catch {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(null);
+      }
+    });
+  });
+}
+var ASYNC_SENTINEL = "__asyncRejected";
+function isAsyncSentinel(value) {
+  return value !== null && typeof value === "object" && value[ASYNC_SENTINEL] === true;
+}
+function compileStringFilter(filter) {
+  if (filter.length > 2048) {
+    throw new Error(`wait filter source exceeds 2KB cap (${filter.length} bytes)`);
+  }
+  let fn;
+  try {
+    fn = new Function(...PARAM_SHADOW_KEYS, "payload", `${BODY_SHADOW_PREAMBLE} return (${filter})(payload);`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`wait filter compile error: ${msg}`);
+  }
+  return (payload) => fn(...PARAM_SHADOW_VALUES, payload);
+}
+function nullifyPrototypes(value) {
+  if (value === null || typeof value !== "object")
+    return value;
+  if (Array.isArray(value)) {
+    return value.map(nullifyPrototypes);
+  }
+  const out = Object.create(null);
+  for (const [k, v] of Object.entries(value)) {
+    out[k] = nullifyPrototypes(v);
+  }
+  return out;
+}
+async function matchesFilter(payload, filter) {
+  if (filter === undefined || filter === null)
+    return true;
+  if (typeof filter === "object" && !Array.isArray(filter)) {
+    return matchObjectFilter(payload, filter);
+  }
+  if (typeof filter === "string") {
+    let userFn;
+    try {
+      userFn = compileStringFilter(filter);
+    } catch {
+      return false;
+    }
+    let cloned;
+    try {
+      const cloneOnce = structuredClone(payload);
+      cloned = nullifyPrototypes(cloneOnce);
+    } catch {
+      try {
+        cloned = nullifyPrototypes(payload);
+      } catch {
+        cloned = payload;
+      }
+    }
+    const result = await runWithTimeout(() => userFn(cloned));
+    if (result === null)
+      return false;
+    if (isAsyncSentinel(result))
+      return false;
+    return !!result;
+  }
+  return false;
+}
+
+// src/workflows/executors/wait.ts
+var WaitConfigSchema = exports_external.discriminatedUnion("mode", [
+  exports_external.object({
+    mode: exports_external.literal("time"),
+    durationMs: exports_external.number().int().min(1).max(31536000000).describe("Wait duration in milliseconds (effective resolution ~5s)")
+  }),
+  exports_external.object({
+    mode: exports_external.literal("event"),
+    eventName: exports_external.string().min(1),
+    filter: exports_external.union([exports_external.record(exports_external.string(), exports_external.unknown()), exports_external.string().max(2048)]).optional(),
+    scope: exports_external.enum(["run", "global"]).default("run"),
+    timeoutMs: exports_external.number().int().min(1).max(31536000000).optional().describe("Timeout in milliseconds (effective resolution ~5s) — when reached, routes via 'timeout' port")
+  })
+]);
+var WaitOutputSchema = exports_external.object({
+  waitId: exports_external.string().uuid(),
+  mode: exports_external.enum(["time", "event"]),
+  firedAt: exports_external.string().nullable(),
+  payload: exports_external.unknown().optional()
+});
+
+class WaitExecutor extends BaseExecutor {
+  type = "wait";
+  mode = "async";
+  configSchema = WaitConfigSchema;
+  outputSchema = WaitOutputSchema;
+  async execute(config, _context, meta) {
+    const { db } = this.deps;
+    const existing = await db.getWaitStateByStepId(meta.stepId);
+    if (existing) {
+      if (existing.status !== "pending") {
+        const nextPort = computeNextPort(existing.mode, existing.status);
+        return {
+          status: "success",
+          output: {
+            waitId: existing.id,
+            mode: existing.mode,
+            firedAt: existing.resolvedAt,
+            payload: existing.firedPayload ?? undefined
+          },
+          nextPort
+        };
+      }
+      return {
+        status: "success",
+        async: true,
+        waitFor: "wait.fired",
+        correlationId: existing.id
+      };
+    }
+    if (config.mode === "time") {
+      const waitId2 = crypto.randomUUID();
+      const wakeUpAt = new Date(Date.now() + config.durationMs).toISOString();
+      await db.createWaitState({
+        id: waitId2,
+        workflowRunId: meta.runId,
+        workflowRunStepId: meta.stepId,
+        mode: "time",
+        wakeUpAt
+      });
+      return {
+        status: "success",
+        async: true,
+        waitFor: "wait.fired",
+        correlationId: waitId2
+      };
+    }
+    if (typeof config.filter === "string") {
+      compileStringFilter(config.filter);
+    }
+    const waitId = crypto.randomUUID();
+    const expiresAt = config.timeoutMs ? new Date(Date.now() + config.timeoutMs).toISOString() : null;
+    await db.createWaitState({
+      id: waitId,
+      workflowRunId: meta.runId,
+      workflowRunStepId: meta.stepId,
+      mode: "event",
+      eventName: config.eventName,
+      eventFilter: config.filter ?? null,
+      expiresAt,
+      scope: config.scope
+    });
+    subscribeWaitToBus(waitId, config.eventName);
+    return {
+      status: "success",
+      async: true,
+      waitFor: "wait.fired",
+      correlationId: waitId
+    };
+  }
+}
+function computeNextPort(mode, status) {
+  if (mode === "time")
+    return "default";
+  return status === "timeout" ? "timeout" : "event";
+}
+
+// src/workflows/task-step-routing.ts
+init_db();
+init_types();
+async function isTaskBoundToStep(taskId, stepId) {
+  const task = await getTaskById(taskId);
+  return task?.workflowRunStepId === stepId;
+}
+async function failStepAndRunIfWaiting(stepId, runId, reason, ownerTaskId) {
+  const now = new Date().toISOString();
+  return await getDbClient().transaction(async () => {
+    const current = await getWorkflowRunStep(stepId);
+    if (!current || current.status !== "waiting")
+      return false;
+    if (ownerTaskId && !await isTaskBoundToStep(ownerTaskId, stepId))
+      return false;
+    await updateWorkflowRunStep(stepId, {
+      status: "failed",
+      error: reason,
+      finishedAt: now
+    });
+    await updateWorkflowRun(runId, {
+      status: "failed",
+      error: reason,
+      finishedAt: now
+    });
+    return true;
+  });
+}
+async function checkpointPortStepAndResolveSuccessors(def, runId, stepId, nodeId, output, nextPort, ctx) {
+  return await getDbClient().transaction(async () => {
+    const current = await getWorkflowRunStep(stepId);
+    if (!current || current.status !== "waiting")
+      return { claimed: false, successors: [] };
+    await checkpointStep(runId, stepId, nodeId, { output, nextPort }, ctx);
+    await updateWorkflowRun(runId, { status: "running" });
+    return { claimed: true, successors: getSuccessors(def, nodeId, nextPort) };
+  });
+}
+async function scheduleTaskStepRetry(def, runId, step, taskId, reason) {
+  const node = def.nodes.find((n) => n.id === step.nodeId);
+  if (!node || node.type !== "agent-task" || !node.retry)
+    return "not-eligible";
+  const parsed = RetryPolicySchema.safeParse(node.retry);
+  if (!parsed.success)
+    return "not-eligible";
+  const policy = parsed.data;
+  return await getDbClient().transaction(async () => {
+    const current = await getWorkflowRunStep(step.id);
+    if (!current || current.status !== "waiting")
+      return "not-claimed";
+    if (!await isTaskBoundToStep(taskId, step.id))
+      return "not-claimed";
+    if (current.retryCount >= policy.maxRetries)
+      return "not-eligible";
+    await detachTaskFromWorkflowRunStep(taskId);
+    await checkpointStepFailure(runId, step.id, reason, current.retryCount, policy);
+    return "scheduled";
+  });
+}
+var UNCLAIMED = {
+  claimed: false,
+  foreachChild: false,
+  joined: false,
+  successors: []
+};
+async function completeTaskStepAndResolveSuccessors(def, runId, step, output, ctx, failureReason, ownerTaskId) {
+  return await getDbClient().transaction(async () => {
+    const current = await getWorkflowRunStep(step.id);
+    if (!current || current.status !== "waiting")
+      return UNCLAIMED;
+    if (ownerTaskId && !await isTaskBoundToStep(ownerTaskId, step.id))
+      return UNCLAIMED;
+    const foreachParent = resolveForeachParent(def, step.nodeId);
+    if (foreachParent) {
+      await updateWorkflowRunStep(step.id, {
+        status: "completed",
+        output,
+        ...failureReason !== undefined ? { error: failureReason } : {},
+        finishedAt: new Date().toISOString()
+      });
+      const join = await joinForeach(def, runId, step, ctx);
+      await updateWorkflowRun(runId, { status: "running" });
+      return {
+        claimed: true,
+        foreachChild: true,
+        joined: join.joined,
+        successors: join.successors
+      };
+    }
+    await checkpointStep(runId, step.id, step.nodeId, { output }, ctx);
+    await updateWorkflowRun(runId, { status: "running" });
+    return {
+      claimed: true,
+      foreachChild: false,
+      joined: true,
+      successors: getSuccessors(def, step.nodeId)
+    };
+  });
+}
+
+// src/workflows/resume.ts
+function setupWorkflowResumeListener(eventBus, registry) {
+  const onTaskCompleted = async (data) => {
+    try {
+      const event = data;
+      if (!event.workflowRunId || !event.workflowRunStepId)
+        return;
+      await resumeFromTaskCompletion(event, registry);
+    } catch (err) {
+      console.error("[workflows] Resume from task completion failed:", err);
+    }
+  };
+  eventBus.on("task.completed", onTaskCompleted);
+  const onTaskFailed = async (data) => {
+    try {
+      const event = data;
+      if (!event.workflowRunId || !event.workflowRunStepId)
+        return;
+      await handleTaskFailure(event, event.failureReason ?? "Task failed", registry, {
+        retryable: true
+      });
+    } catch (err) {
+      console.error("[workflows] Handle task failure error:", err);
+    }
+  };
+  eventBus.on("task.failed", onTaskFailed);
+  const onTaskCancelled = async (data) => {
+    try {
+      const event = data;
+      if (!event.workflowRunId || !event.workflowRunStepId)
+        return;
+      await handleTaskFailure(event, "Task was cancelled", registry, { retryable: false });
+    } catch (err) {
+      console.error("[workflows] Handle task cancellation error:", err);
+    }
+  };
+  eventBus.on("task.cancelled", onTaskCancelled);
+  const onApprovalResolved = async (data) => {
+    try {
+      const event = data;
+      if (!event.workflowRunId || !event.workflowRunStepId)
+        return;
+      await resumeFromApprovalResolution(event, registry);
+    } catch (err) {
+      console.error("[workflows] Resume from approval resolution failed:", err);
+    }
+  };
+  eventBus.on("approval.resolved", onApprovalResolved);
+  const onChildRunFinished = async (data) => {
+    try {
+      const { parentStepId } = data;
+      if (!parentStepId)
+        return;
+      await resumeFromChildRun(parentStepId, registry);
+    } catch (err) {
+      console.error("[workflows] Resume from child workflow run failed:", err);
+    }
+  };
+  eventBus.on("workflow.child.finished", onChildRunFinished);
+  return () => {
+    eventBus.off("task.completed", onTaskCompleted);
+    eventBus.off("task.failed", onTaskFailed);
+    eventBus.off("task.cancelled", onTaskCancelled);
+    eventBus.off("approval.resolved", onApprovalResolved);
+    eventBus.off("workflow.child.finished", onChildRunFinished);
+  };
+}
+async function failClosedOnUnreadableReplay(runId, stepId, resume) {
+  try {
+    await resume();
+  } catch (err) {
+    if (!await failRunOnUnreadableReplay(runId, err, stepId))
+      throw err;
+  }
+}
+async function resumeFromTaskCompletion(event, registry) {
+  await failClosedOnUnreadableReplay(event.workflowRunId, event.workflowRunStepId, () => resumeFromTaskCompletionUnguarded(event, registry));
+}
+async function resumeFromTaskCompletionUnguarded(event, registry) {
+  const run = await getWorkflowRun(event.workflowRunId);
+  if (!run || run.status !== "waiting" && run.status !== "running")
+    return;
+  const step = await getWorkflowRunStep(event.workflowRunStepId);
+  if (!step || step.status !== "waiting")
+    return;
+  if (await isStaleTaskEvent(step.id, event))
+    return;
+  const workflow = await getWorkflow(run.workflowId);
+  if (!workflow)
+    return;
+  const ctx = run.context ?? {};
+  let taskOutput = event.output;
+  if (event.output) {
+    try {
+      const parsed = JSON.parse(event.output);
+      if (typeof parsed === "object" && parsed !== null) {
+        taskOutput = parsed;
+      }
+    } catch {}
+  }
+  const stepOutput = { taskId: event.taskId, taskOutput };
+  const routing = await completeTaskStepAndResolveSuccessors(workflow.definition, run.id, step, stepOutput, ctx);
+  if (!routing.claimed)
+    return;
+  const successors = routing.successors;
+  if (successors.length > 0) {
+    const secretKeys = getSecretInputKeys(workflow.input);
+    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
+  } else {
+    await finalizeOrWait(run.id);
+  }
+}
+async function finalizeOrWait(runId) {
+  await getDbClient().transaction(async () => {
+    const steps = await getWorkflowRunStepsByRunId(runId);
+    if (hasRunningStep(steps)) {
+      const run = await getWorkflowRun(runId);
+      if (run?.status === "waiting")
+        await updateWorkflowRun(runId, { status: "running" });
+      return;
+    }
+    const hasWaiting = steps.some((s) => s.status === "waiting" || s.status === "failed" && s.nextRetryAt != null);
+    if (hasWaiting) {
+      await updateWorkflowRun(runId, { status: "waiting" });
+    } else {
+      await updateWorkflowRun(runId, {
+        status: "completed",
+        finishedAt: new Date().toISOString()
+      });
+    }
+  });
+}
+async function handleTaskFailure(event, reason, registry, options) {
+  await failClosedOnUnreadableReplay(event.workflowRunId, event.workflowRunStepId, () => handleTaskFailureUnguarded(event, reason, registry, options));
+}
+async function handleTaskFailureUnguarded(event, reason, registry, options) {
+  const run = await getWorkflowRun(event.workflowRunId);
+  if (!run || run.status !== "waiting" && run.status !== "running")
+    return;
+  const step = await getWorkflowRunStep(event.workflowRunStepId);
+  if (!step || step.status !== "waiting")
+    return;
+  if (await isStaleTaskEvent(step.id, event))
+    return;
+  const workflow = await getWorkflow(run.workflowId);
+  if (!workflow)
+    return;
+  if (options.retryable) {
+    const retry = await scheduleTaskStepRetry(workflow.definition, run.id, step, event.taskId, reason);
+    if (retry === "scheduled") {
+      console.log(`[workflows] Task ${event.taskId} failed; step ${step.nodeId} of run ${run.id} queued for retry ${step.retryCount + 1}`);
+      return;
+    }
+    if (retry === "not-claimed")
+      return;
+  }
+  const onFailure = workflow.definition.onNodeFailure ?? "fail";
+  if (onFailure === "fail") {
+    await markRunFailed(event, reason);
+    return;
+  }
+  const ctx = run.context ?? {};
+  const stepOutput = {
+    taskId: event.taskId,
+    taskOutput: `${FAILED_TASK_OUTPUT_PREFIX} ${reason}] This node failed or was cancelled.`
+  };
+  const routing = await completeTaskStepAndResolveSuccessors(workflow.definition, run.id, step, stepOutput, ctx, reason);
+  if (!routing.claimed)
+    return;
+  const successors = routing.successors;
+  if (successors.length > 0) {
+    const secretKeys = getSecretInputKeys(workflow.input);
+    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
+  } else {
+    await finalizeOrWait(run.id);
+  }
+}
+async function isStaleTaskEvent(stepId, event) {
+  if (!event.taskId)
+    return false;
+  const boundTask = await getTaskByWorkflowRunStepId(stepId);
+  return boundTask != null && boundTask.id !== event.taskId;
+}
+async function markRunFailed(event, reason) {
+  await failStepAndRunIfWaiting(event.workflowRunStepId, event.workflowRunId, reason);
+}
+async function retryFailedRun(runId, registry) {
+  const run = await getWorkflowRun(runId);
+  if (!run || run.status !== "failed")
+    throw new Error("Run is not in failed state");
+  const workflow = await getWorkflow(run.workflowId);
+  if (!workflow)
+    throw new Error("Workflow not found");
+  const steps = await getWorkflowRunStepsByRunId(runId);
+  const failedStep = steps.find((s) => s.status === "failed");
+  if (!failedStep)
+    throw new Error("No failed step found");
+  const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
+  const notReady = await findWorkflowReadinessProblems({ nodes: workflow.definition.nodes.filter((node) => !completedNodeIds.has(node.id)) }, registry);
+  if (notReady.length > 0) {
+    throw new Error(`Retry not started, run left failed: ${formatReadinessProblems(notReady)}`);
+  }
+  const { activeEdges } = await loadCompletedStepRouting(workflow.definition, runId, completedNodeIds);
+  const foreachParent = resolveForeachParent(workflow.definition, failedStep.nodeId);
+  const failedNode = foreachParent ?? workflow.definition.nodes.find((n) => n.id === failedStep.nodeId);
+  if (!failedNode)
+    throw new Error(`Node ${failedStep.nodeId} not found in workflow definition`);
+  const hasStructuralPredecessor = workflow.definition.nodes.some((node) => node.next && getNextTargets(node.next).includes(failedNode.id));
+  const hasActivePredecessor = [...activeEdges].some((edge) => edge.endsWith(`→${failedNode.id}`));
+  const shouldRetryFailedNode = foreachParent != null || !hasStructuralPredecessor || hasActivePredecessor;
+  const ctx = run.context ?? {};
+  const claimed = await getDbClient().transaction(async () => {
+    const current = await getWorkflowRun(runId);
+    if (!current || current.status !== "failed")
+      return false;
+    await updateWorkflowRunStep(failedStep.id, {
+      status: shouldRetryFailedNode ? "pending" : "cancelled",
+      error: shouldRetryFailedNode ? null : "Skipped on retry because its branch was not active"
+    });
+    await updateWorkflowRun(runId, { status: "running", error: null, context: ctx });
+    return true;
+  });
+  if (!claimed)
+    throw new Error("Run is not in failed state");
+  const liveNodeIds = new Set(steps.filter((s) => s.status === "running" || s.status === "waiting").map((s) => s.nodeId));
+  const readyNodes = findReadyNodes(workflow.definition, completedNodeIds, activeEdges).filter((n) => n.id === failedNode.id || !liveNodeIds.has(n.id));
+  const nodesToRun = !shouldRetryFailedNode || readyNodes.some((n) => n.id === failedNode.id) ? readyNodes : [failedNode, ...readyNodes];
+  const secretKeys = getSecretInputKeys(workflow.input);
+  await walkGraph(workflow.definition, runId, ctx, nodesToRun, registry, workflow.id, secretKeys);
+}
+async function cancelWorkflowRunRows(runId, cancelReason) {
+  const terminalStatuses = ["completed", "failed", "cancelled", "skipped"];
+  const now = new Date().toISOString();
+  return await getDbClient().transaction(async () => {
+    const current = await getWorkflowRun(runId);
+    if (!current || terminalStatuses.includes(current.status))
+      return false;
+    const steps = await getWorkflowRunStepsByRunId(runId);
+    for (const step of steps) {
+      if (terminalStatuses.includes(step.status))
+        continue;
+      const task = await getTaskByWorkflowRunStepId(step.id);
+      if (task) {
+        await cancelTask(task.id, cancelReason);
+      }
+      await updateWorkflowRunStep(step.id, {
+        status: "cancelled",
+        error: cancelReason,
+        finishedAt: now
+      });
+    }
+    await cancelPendingApprovalRequestsForRun(runId, cancelReason);
+    await updateWorkflowRun(runId, {
+      status: "cancelled",
+      error: cancelReason,
+      finishedAt: now
+    });
+    return true;
+  });
+}
+async function cancelWorkflowRun(runId, reason) {
+  const run = await getWorkflowRun(runId);
+  if (!run)
+    throw new Error("Workflow run not found");
+  const terminalStatuses = ["completed", "failed", "cancelled", "skipped"];
+  if (terminalStatuses.includes(run.status) && run.status !== "cancelled") {
+    throw new Error(`Cannot cancel run in '${run.status}' state`);
+  }
+  const cancelReason = reason ?? "Cancelled by user";
+  const applied = await cancelWorkflowRunRows(runId, cancelReason);
+  const cancelledApprovals = await listCancelledApprovalRequestsForRun(runId);
+  const latestRun = await getWorkflowRun(runId);
+  if (!applied && latestRun?.status !== "cancelled") {
+    throw new Error(`Cannot cancel run in '${latestRun?.status ?? "missing"}' state`);
+  }
+  await postApprovalCancellationUpdates(cancelledApprovals, applied ? cancelReason : latestRun?.error ?? cancelReason);
+}
+async function cancelWorkflowRunStep(stepId, reason = "Cancelled by user", slackClient) {
+  const now = new Date().toISOString();
+  let persistedReason = reason;
+  await getDbClient().transaction(async () => {
+    const step = await getWorkflowRunStep(stepId);
+    if (!step)
+      throw new Error("Workflow run step not found");
+    if (step.nodeType !== "human-in-the-loop") {
+      throw new Error("Only human-in-the-loop steps have an approval cancellation lifecycle");
+    }
+    if (["completed", "failed", "skipped"].includes(step.status)) {
+      throw new Error(`Cannot cancel step in '${step.status}' state`);
+    }
+    if (step.status === "cancelled") {
+      persistedReason = step.error ?? reason;
+      return;
+    }
+    const task = await getTaskByWorkflowRunStepId(stepId);
+    if (task)
+      await cancelTask(task.id, reason);
+    await updateWorkflowRunStep(stepId, {
+      status: "cancelled",
+      error: reason,
+      finishedAt: now
+    });
+  });
+  const approvals = await listCancelledApprovalRequestsForStep(stepId);
+  await postApprovalCancellationUpdates(approvals, persistedReason, slackClient);
+}
+async function resumeFromApprovalResolution(event, registry) {
+  await failClosedOnUnreadableReplay(event.workflowRunId, event.workflowRunStepId, () => resumeFromApprovalResolutionUnguarded(event, registry));
+}
+async function resumeFromApprovalResolutionUnguarded(event, registry) {
+  const run = await getWorkflowRun(event.workflowRunId);
+  if (!run || run.status !== "waiting" && run.status !== "running")
+    return;
+  const step = await getWorkflowRunStep(event.workflowRunStepId);
+  if (!step || step.status !== "waiting")
+    return;
+  const workflow = await getWorkflow(run.workflowId);
+  if (!workflow)
+    return;
+  if (event.status === "cancelled") {
+    console.warn(`[workflows] approval ${event.requestId} is cancelled; step ${event.workflowRunStepId} stays waiting for the run cancel path`);
+    return;
+  }
+  const ctx = run.context ?? {};
+  const { output: stepOutput, nextPort } = shapeApprovalResolution(registry, workflow.definition, step.nodeId, step.output, { requestId: event.requestId, status: event.status, responses: event.responses });
+  const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, stepOutput, nextPort, ctx);
+  if (!routing.claimed)
+    return;
+  const successors = routing.successors;
+  if (successors.length > 0) {
+    const secretKeys = getSecretInputKeys(workflow.input);
+    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
+  } else {
+    await finalizeOrWait(run.id);
+  }
+}
+async function resumeWaitState(waitId, status, payload, registry) {
+  const cappedPayload = capPayload(payload);
+  const result = await resolveWaitState(waitId, { status, firedPayload: cappedPayload });
+  if (!result.updated || !result.row)
+    return;
+  const waitRow = result.row;
+  await failClosedOnUnreadableReplay(waitRow.workflowRunId, waitRow.workflowRunStepId, () => resumeClaimedWait(waitRow, status, cappedPayload, registry));
+}
+async function resumeClaimedWait(waitRow, status, cappedPayload, registry) {
+  const run = await getWorkflowRun(waitRow.workflowRunId);
+  if (!run || run.status !== "waiting" && run.status !== "running")
+    return;
+  const step = await getWorkflowRunStep(waitRow.workflowRunStepId);
+  if (!step || step.status !== "waiting")
+    return;
+  const workflow = await getWorkflow(run.workflowId);
+  if (!workflow)
+    return;
+  const nextPort = computeNextPort(waitRow.mode, status);
+  const ctx = run.context ?? {};
+  const stepOutput = {
+    waitId: waitRow.id,
+    mode: waitRow.mode,
+    firedAt: waitRow.resolvedAt,
+    payload: cappedPayload === undefined ? undefined : cappedPayload
+  };
+  const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, stepOutput, nextPort, ctx);
+  if (!routing.claimed)
+    return;
+  if (waitRow.mode === "event" && waitRow.eventName) {
+    pruneWaitFromBus(waitRow.id, waitRow.eventName);
+  }
+  const successors = routing.successors;
+  if (successors.length > 0) {
+    const secretKeys = getSecretInputKeys(workflow.input);
+    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
+  } else {
+    await finalizeOrWait(run.id);
+  }
+}
+async function resumeFromChildRun(parentStepId, registry) {
+  const step = await getWorkflowRunStep(parentStepId);
+  if (!step || step.status !== "waiting" || step.nodeType !== "sub-workflow")
+    return false;
+  const childId = await getChildWorkflowRunId(parentStepId);
+  const child = childId ? await getWorkflowRun(childId) : null;
+  const outcome = child ? childRunOutcome(child) : { error: `Child workflow run of step ${parentStepId} was deleted` };
+  if (!outcome)
+    return false;
+  let claimed = false;
+  await failClosedOnUnreadableReplay(step.runId, step.id, async () => {
+    const run = await getWorkflowRun(step.runId);
+    if (!run || run.status !== "waiting" && run.status !== "running")
+      return;
+    const workflow = await getWorkflow(run.workflowId);
+    if (!workflow)
+      return;
+    if ("error" in outcome) {
+      claimed = await failStepAndRunIfWaiting(step.id, run.id, outcome.error);
+      return;
+    }
+    const ctx = run.context ?? {};
+    const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, outcome.output, "success", ctx);
+    if (!routing.claimed)
+      return;
+    claimed = true;
+    if (routing.successors.length > 0) {
+      const secretKeys = getSecretInputKeys(workflow.input);
+      await walkGraph(workflow.definition, run.id, ctx, routing.successors, registry, workflow.id, secretKeys);
+    } else {
+      await finalizeOrWait(run.id);
+    }
+  });
+  return claimed;
+}
+var FIRED_PAYLOAD_BYTE_CAP = 64 * 1024;
+function capPayload(payload) {
+  if (payload === undefined || payload === null)
+    return payload;
+  let encoded;
+  try {
+    encoded = JSON.stringify(payload);
+  } catch {
+    return { truncated: true, reason: "non-serializable" };
+  }
+  if (encoded.length <= FIRED_PAYLOAD_BYTE_CAP) {
+    return payload;
+  }
+  const summary = encoded.slice(0, 1024);
+  return {
+    truncated: true,
+    originalSize: encoded.length,
+    summary
+  };
+}
+var waitsByEvent = new Map;
+var listenersByEvent = new Map;
+var busRegistry = null;
+async function initWaitBusSubscriptions(registry) {
+  busRegistry = registry;
+  const pendingNames = await collectPendingEventNames();
+  for (const name of pendingNames) {
+    const pending = await getPendingWaitsByEvent(name);
+    for (const w of pending) {
+      registerWait(w.id, name);
+    }
+  }
+}
+async function collectPendingEventNames() {
+  return new Set(await getPendingEventWaitNames());
+}
+function subscribeWaitToBus(waitId, eventName) {
+  registerWait(waitId, eventName);
+}
+function registerWait(waitId, eventName) {
+  let set = waitsByEvent.get(eventName);
+  if (!set) {
+    set = new Set;
+    waitsByEvent.set(eventName, set);
+  }
+  set.add(waitId);
+  if (!listenersByEvent.has(eventName)) {
+    const listener = (data) => {
+      processBusEvent(eventName, data).catch((err) => {
+        console.error(`[workflows] Wait bus listener failed for event=${eventName}:`, scrubSecrets(err instanceof Error ? err.message : String(err)));
+      });
+    };
+    listenersByEvent.set(eventName, listener);
+    workflowEventBus.on(eventName, listener);
+  }
+}
+function pruneWaitFromBus(waitId, eventName) {
+  const set = waitsByEvent.get(eventName);
+  if (!set)
+    return;
+  set.delete(waitId);
+  if (set.size === 0) {
+    waitsByEvent.delete(eventName);
+    const listener = listenersByEvent.get(eventName);
+    if (listener) {
+      workflowEventBus.off(eventName, listener);
+      listenersByEvent.delete(eventName);
+    }
+  }
+}
+async function processBusEvent(eventName, payload) {
+  const set = waitsByEvent.get(eventName);
+  if (!set || set.size === 0)
+    return;
+  if (!busRegistry)
+    return;
+  const waitIds = [...set];
+  for (const waitId of waitIds) {
+    try {
+      const row = await getWaitStateById(waitId);
+      if (!row || row.status !== "pending") {
+        set.delete(waitId);
+        continue;
+      }
+      if (row.eventScope === "run") {
+        if (!isPayloadInRun(payload, row.workflowRunId))
+          continue;
+      }
+      const ok = await matchesFilter(payload, row.eventFilter ?? undefined);
+      if (!ok)
+        continue;
+      await resumeWaitState(waitId, "fired", payload, busRegistry);
+    } catch (err) {
+      console.error(`[workflows] Wait bus listener failed for wait=${waitId} event=${eventName}:`, err);
+    }
+  }
+  if (set.size === 0) {
+    waitsByEvent.delete(eventName);
+    const listener = listenersByEvent.get(eventName);
+    if (listener) {
+      workflowEventBus.off(eventName, listener);
+      listenersByEvent.delete(eventName);
+    }
+  }
+}
+function isPayloadInRun(payload, runId) {
+  if (typeof payload !== "object" || payload === null)
+    return false;
+  const rec = payload;
+  return rec._runId === runId || rec.workflowRunId === runId;
+}
+function _resetWaitBusSubscriptionsForTests() {
+  for (const [name, listener] of listenersByEvent.entries()) {
+    workflowEventBus.off(name, listener);
+  }
+  listenersByEvent.clear();
+  waitsByEvent.clear();
+  busRegistry = null;
+}
+
+export { notifyAutomationPreflightFailure, automationIntegrationFixUrl, isNeedsSetupFailure, preflightAutomation, renderAutomationTokens, getAutomationSetupStates, schedulePreflightInput, listEnabledAutomationPreflightInputs, recordSchedulePreflightFailure, checkpointStep, checkpointStepFailure, checkpointStepWaiting, FOREACH_TERMINAL_STEP_STATUSES, parseSyntheticNodeId, buildForeachAggregate, loadCompletedStepRouting, resolveInputValue, getSecretInputKeys, validateJsonSchema, findJsonSchemaShapeErrors, getMaxWorkflowStepsPerRun, workflowSaveWarnings, withSaveWarnings, runStepValidation, shapeApprovalResolution, FAILED_TASK_OUTPUT_PREFIX, SubWorkflowExecutor, WaitExecutor, failStepAndRunIfWaiting, checkpointPortStepAndResolveSuccessors, scheduleTaskStepRetry, completeTaskStepAndResolveSuccessors, setupWorkflowResumeListener, finalizeOrWait, retryFailedRun, cancelWorkflowRunRows, cancelWorkflowRun, cancelWorkflowRunStep, resumeWaitState, resumeFromChildRun, initWaitBusSubscriptions, subscribeWaitToBus, _resetWaitBusSubscriptionsForTests, TriggerSchemaError, startWorkflowExecution, failRunOnUnreadableReplay, isWorkflowRunActive, holdWorkflowRun, walkGraph, rehydrateCompletedStepOutputs, findReadyNodes, buildNodeInterpolationCtx, interpolateNodeConfig, scriptBodyInterpolationError };