@desplega.ai/agent-swarm 2.4.4 → 2.5.0

package/dist/cli-3zwye9sn.js

@@ -0,0 +1,1193 @@
+import {
+  getDbClient2,
+  getTaskById2,
+  cancelTask2,
+  getChildWorkflowRunId,
+  getWorkflowRunLineage,
+  createForeachAttemptSteps,
+  init_workflow_runs,
+  getWorkflow2,
+  getWorkflowRun2,
+  updateWorkflowRun2,
+  getWorkflowRunStep2,
+  updateWorkflowRunStep2,
+  getWorkflowRunStepsByRunId2,
+  getCompletedStepNodeIds2,
+  getTaskByWorkflowRunStepId2,
+  detachTaskFromWorkflowRunStep2,
+  cancelPendingApprovalRequestsForRun2,
+  listCancelledApprovalRequestsForRun2,
+  getWaitStateById2,
+  getPendingEventWaitNames2,
+  getPendingWaitsByEvent2,
+  resolveWaitState2,
+  init_db3
+} from "./cli-fcc5qe3f.js";
+import {
+  BaseExecutor,
+  postApprovalCancellationUpdates,
+  checkpointStep,
+  checkpointStepFailure,
+  FAILED_TASK_OUTPUT_PREFIX,
+  loadCompletedStepRouting,
+  getSecretInputKeys,
+  getMaxWorkflowStepsPerRun,
+  findWorkflowReadinessProblems,
+  formatReadinessProblems,
+  startWorkflowExecution2,
+  failRunOnUnreadableReplay,
+  walkGraph,
+  hasRunningStep,
+  findReadyNodes,
+  startForeachDrive,
+  FOREACH_TERMINAL_STEP_STATUSES,
+  parseSyntheticNodeId,
+  resolveForeachParent,
+  settleForeachChild,
+  resolveStepNode,
+  stepFailureMode,
+  getNextTargets,
+  getSuccessors
+} from "./cli-92mqenkc.js";
+import {
+  workflowEventBus2,
+  init_event_bus
+} from "./cli-dabehxhp.js";
+import {
+  RetryPolicySchema,
+  SUPERSEDED_WORKFLOW_TASK_REASON,
+  init_types
+} from "./cli-rh5smt8t.js";
+import {
+  init_zod
+} from "./cli-4chz1hye.js";
+import {
+  string2,
+  number2,
+  unknown,
+  object2,
+  union2,
+  discriminatedUnion,
+  record2,
+  _enum2,
+  literal2
+} from "./cli-d9f7gzeq.js";
+import {
+  scrubSecrets,
+  init_secret_scrubber
+} from "./cli-n4c8e3s5.js";
+
+// src/workflows/approval-resolution.ts
+function shapeApprovalResolution(registry, definition, nodeId, parkedOutput, approval) {
+  const node = resolveStepNode(definition, nodeId);
+  if (node && registry.has(node.type)) {
+    const shaped = registry.get(node.type).resolveApproval(parkedOutput, approval);
+    if (shaped)
+      return shaped;
+  }
+  return {
+    output: {
+      requestId: approval.requestId,
+      status: approval.status,
+      responses: approval.responses
+    },
+    nextPort: approval.status === "timeout" ? "timeout" : approval.status === "rejected" ? "rejected" : "approved"
+  };
+}
+
+// src/workflows/resume.ts
+init_db3();
+init_workflow_runs();
+init_secret_scrubber();
+init_event_bus();
+
+// src/workflows/executors/sub-workflow.ts
+init_zod();
+init_workflow_runs();
+var SubWorkflowConfigSchema = object2({
+  workflowId: string2().min(1).describe("Workflow to run as a child"),
+  inputs: record2(string2(), unknown()).optional().describe("Trigger data for the child run, validated against its triggerSchema")
+});
+var SubWorkflowOutputSchema = object2({
+  runId: string2(),
+  outputs: record2(string2(), unknown()),
+  error: string2().optional()
+});
+var MAX_SUB_WORKFLOW_DEPTH = 16;
+var NON_NODE_CONTEXT_KEYS = new Set(["trigger", "input", "swarm", "workflow"]);
+function childRunOutcome(child) {
+  if (child.status === "running" || child.status === "waiting")
+    return null;
+  if (child.status !== "completed") {
+    const reason = child.error ? `: ${child.error}` : "";
+    return { error: `Child workflow run ${child.id} ${child.status}${reason}` };
+  }
+  const outputs = {};
+  for (const [key, value] of Object.entries(child.context ?? {})) {
+    if (!NON_NODE_CONTEXT_KEYS.has(key))
+      outputs[key] = value;
+  }
+  return { output: { runId: child.id, outputs, error: child.error } };
+}
+
+class SubWorkflowExecutor extends BaseExecutor {
+  registry;
+  type = "sub-workflow";
+  mode = "async";
+  configSchema = SubWorkflowConfigSchema;
+  outputSchema = SubWorkflowOutputSchema;
+  constructor(deps, registry) {
+    super(deps);
+    this.registry = registry;
+  }
+  async execute(config, _context, meta) {
+    const { db } = this.deps;
+    const existingId = await getChildWorkflowRunId(meta.stepId);
+    const existing = existingId ? await db.getWorkflowRun(existingId) : null;
+    if (existing)
+      return this.settle(existing);
+    const lineage = await getWorkflowRunLineage(meta.runId, MAX_SUB_WORKFLOW_DEPTH);
+    if (lineage.length > MAX_SUB_WORKFLOW_DEPTH) {
+      return {
+        status: "failed",
+        error: `Sub-workflow nesting exceeds ${MAX_SUB_WORKFLOW_DEPTH} levels`
+      };
+    }
+    if (config.workflowId === meta.workflowId || lineage.includes(config.workflowId)) {
+      return {
+        status: "failed",
+        error: `Sub-workflow recursion: workflow ${config.workflowId} is already running in this run's ancestry`
+      };
+    }
+    const workflow = await db.getWorkflow(config.workflowId);
+    if (!workflow)
+      return { status: "failed", error: `Workflow ${config.workflowId} not found` };
+    if (!workflow.enabled) {
+      return { status: "failed", error: `Workflow ${config.workflowId} is disabled` };
+    }
+    const childRunId = await startWorkflowExecution2(workflow, config.inputs ?? {}, this.registry, {
+      requestedByUserId: meta.requestedByUserId,
+      parentStepId: meta.stepId
+    });
+    const child = await db.getWorkflowRun(childRunId);
+    if (!child)
+      return { status: "failed", error: `Child workflow run ${childRunId} not found` };
+    return this.settle(child);
+  }
+  settle(child) {
+    const outcome = childRunOutcome(child);
+    if (!outcome) {
+      return {
+        status: "success",
+        async: true,
+        waitFor: "workflow.child.finished",
+        correlationId: child.id
+      };
+    }
+    if ("error" in outcome)
+      return { status: "failed", error: outcome.error };
+    return { status: "success", output: outcome.output, nextPort: "success" };
+  }
+}
+
+// src/workflows/executors/wait.ts
+init_zod();
+
+// src/workflows/wait-filter.ts
+var PARAM_SHADOW_KEYS = [
+  "require",
+  "process",
+  "Bun",
+  "globalThis",
+  "global",
+  "fetch",
+  "setTimeout",
+  "setInterval"
+];
+var PARAM_SHADOW_VALUES = PARAM_SHADOW_KEYS.map(() => {
+  return;
+});
+var BODY_SHADOW_KEYS = ["eval", "Function", "AsyncFunction"];
+var BODY_SHADOW_PREAMBLE = BODY_SHADOW_KEYS.map((k) => `var ${k} = undefined;`).join(" ");
+var FILTER_TIMEOUT_MS = 50;
+function getByDotPath(obj, path) {
+  if (obj === null || typeof obj !== "object") {
+    return { found: false, value: undefined };
+  }
+  const segments = path.split(".");
+  let cursor = obj;
+  for (const seg of segments) {
+    if (cursor === null || typeof cursor !== "object") {
+      return { found: false, value: undefined };
+    }
+    const rec = cursor;
+    if (!(seg in rec)) {
+      return { found: false, value: undefined };
+    }
+    cursor = rec[seg];
+  }
+  return { found: true, value: cursor };
+}
+function deepEqual(a, b) {
+  if (a === b)
+    return true;
+  if (typeof a !== typeof b)
+    return false;
+  if (a === null || b === null)
+    return false;
+  if (Array.isArray(a)) {
+    if (!Array.isArray(b))
+      return false;
+    if (a.length !== b.length)
+      return false;
+    for (let i = 0;i < a.length; i++) {
+      if (!deepEqual(a[i], b[i]))
+        return false;
+    }
+    return true;
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length)
+      return false;
+    for (const k of aKeys) {
+      if (!deepEqual(a[k], b[k])) {
+        return false;
+      }
+    }
+    return true;
+  }
+  return false;
+}
+function matchObjectFilter(payload, filter) {
+  for (const [key, expected] of Object.entries(filter)) {
+    const { found, value } = getByDotPath(payload, key);
+    if (!found)
+      return false;
+    if (!deepEqual(value, expected))
+      return false;
+  }
+  return true;
+}
+async function runWithTimeout(fn) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled)
+        return;
+      settled = true;
+      resolve(null);
+    }, FILTER_TIMEOUT_MS);
+    queueMicrotask(() => {
+      if (settled)
+        return;
+      try {
+        const v = fn();
+        const then = v !== null && typeof v === "object" ? v.then : undefined;
+        if (typeof then === "function") {
+          then.call(v, undefined, () => {});
+          settled = true;
+          clearTimeout(timer);
+          resolve({ __asyncRejected: true });
+          return;
+        }
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(v);
+      } catch {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(null);
+      }
+    });
+  });
+}
+var ASYNC_SENTINEL = "__asyncRejected";
+function isAsyncSentinel(value) {
+  return value !== null && typeof value === "object" && value[ASYNC_SENTINEL] === true;
+}
+function compileStringFilter(filter) {
+  if (filter.length > 2048) {
+    throw new Error(`wait filter source exceeds 2KB cap (${filter.length} bytes)`);
+  }
+  let fn;
+  try {
+    fn = new Function(...PARAM_SHADOW_KEYS, "payload", `${BODY_SHADOW_PREAMBLE} return (${filter})(payload);`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`wait filter compile error: ${msg}`);
+  }
+  return (payload) => fn(...PARAM_SHADOW_VALUES, payload);
+}
+function nullifyPrototypes(value) {
+  if (value === null || typeof value !== "object")
+    return value;
+  if (Array.isArray(value)) {
+    return value.map(nullifyPrototypes);
+  }
+  const out = Object.create(null);
+  for (const [k, v] of Object.entries(value)) {
+    out[k] = nullifyPrototypes(v);
+  }
+  return out;
+}
+async function matchesFilter(payload, filter) {
+  if (filter === undefined || filter === null)
+    return true;
+  if (typeof filter === "object" && !Array.isArray(filter)) {
+    return matchObjectFilter(payload, filter);
+  }
+  if (typeof filter === "string") {
+    let userFn;
+    try {
+      userFn = compileStringFilter(filter);
+    } catch {
+      return false;
+    }
+    let cloned;
+    try {
+      const cloneOnce = structuredClone(payload);
+      cloned = nullifyPrototypes(cloneOnce);
+    } catch {
+      try {
+        cloned = nullifyPrototypes(payload);
+      } catch {
+        cloned = payload;
+      }
+    }
+    const result = await runWithTimeout(() => userFn(cloned));
+    if (result === null)
+      return false;
+    if (isAsyncSentinel(result))
+      return false;
+    return !!result;
+  }
+  return false;
+}
+
+// src/workflows/executors/wait.ts
+var WaitConfigSchema = discriminatedUnion("mode", [
+  object2({
+    mode: literal2("time"),
+    durationMs: number2().int().min(1).max(31536000000).describe("Wait duration in milliseconds (effective resolution ~5s)")
+  }),
+  object2({
+    mode: literal2("event"),
+    eventName: string2().min(1),
+    filter: union2([record2(string2(), unknown()), string2().max(2048)]).optional(),
+    scope: _enum2(["run", "global"]).default("run"),
+    timeoutMs: number2().int().min(1).max(31536000000).optional().describe("Timeout in milliseconds (effective resolution ~5s) — when reached, routes via 'timeout' port")
+  })
+]);
+var WaitOutputSchema = object2({
+  waitId: string2().uuid(),
+  mode: _enum2(["time", "event"]),
+  firedAt: string2().nullable(),
+  payload: unknown().optional()
+});
+
+class WaitExecutor extends BaseExecutor {
+  type = "wait";
+  mode = "async";
+  configSchema = WaitConfigSchema;
+  outputSchema = WaitOutputSchema;
+  async execute(config, _context, meta) {
+    const { db } = this.deps;
+    const existing = await db.getWaitStateByStepId(meta.stepId);
+    if (existing) {
+      if (existing.status !== "pending") {
+        const nextPort = computeNextPort(existing.mode, existing.status);
+        return {
+          status: "success",
+          output: {
+            waitId: existing.id,
+            mode: existing.mode,
+            firedAt: existing.resolvedAt,
+            payload: existing.firedPayload ?? undefined
+          },
+          nextPort
+        };
+      }
+      return {
+        status: "success",
+        async: true,
+        waitFor: "wait.fired",
+        correlationId: existing.id
+      };
+    }
+    if (config.mode === "time") {
+      const waitId = crypto.randomUUID();
+      const wakeUpAt = new Date(Date.now() + config.durationMs).toISOString();
+      await db.createWaitState({
+        id: waitId,
+        workflowRunId: meta.runId,
+        workflowRunStepId: meta.stepId,
+        mode: "time",
+        wakeUpAt
+      });
+      return {
+        status: "success",
+        async: true,
+        waitFor: "wait.fired",
+        correlationId: waitId
+      };
+    }
+    if (typeof config.filter === "string") {
+      compileStringFilter(config.filter);
+    }
+    const waitId = crypto.randomUUID();
+    const expiresAt = config.timeoutMs ? new Date(Date.now() + config.timeoutMs).toISOString() : null;
+    await db.createWaitState({
+      id: waitId,
+      workflowRunId: meta.runId,
+      workflowRunStepId: meta.stepId,
+      mode: "event",
+      eventName: config.eventName,
+      eventFilter: config.filter ?? null,
+      expiresAt,
+      scope: config.scope
+    });
+    subscribeWaitToBus2(waitId, config.eventName);
+    return {
+      status: "success",
+      async: true,
+      waitFor: "wait.fired",
+      correlationId: waitId
+    };
+  }
+}
+function computeNextPort(mode, status) {
+  if (mode === "time")
+    return "default";
+  return status === "timeout" ? "timeout" : "event";
+}
+
+// src/workflows/task-step-routing.ts
+init_db3();
+init_types();
+var UNCLAIMED = {
+  claimed: false,
+  foreachChild: false,
+  joined: false,
+  successors: [],
+  runFailed: false
+};
+async function isTaskBoundToStep(taskId, stepId) {
+  const task = await getTaskById2(taskId);
+  return task?.workflowRunStepId === stepId;
+}
+async function failStepAndRunIfWaiting(def, stepId, runId, reason, ownerTaskId, options = {}) {
+  const now = new Date().toISOString();
+  return await getDbClient2().transaction(async () => {
+    const current = await getWorkflowRunStep2(stepId);
+    if (!current || current.status !== "waiting")
+      return UNCLAIMED;
+    if (ownerTaskId && !await isTaskBoundToStep(ownerTaskId, stepId))
+      return UNCLAIMED;
+    if (resolveForeachParent(def, current.nodeId)) {
+      const ctx = options.ctx ?? ((await getWorkflowRun2(runId))?.context ?? {});
+      return toRoutingResult(await settleForeachChild(def, runId, stepId, { status: "failed", error: reason }, ctx, {
+        registry: options.registry
+      }));
+    }
+    await updateWorkflowRunStep2(stepId, {
+      status: "failed",
+      error: reason,
+      finishedAt: now
+    });
+    await updateWorkflowRun2(runId, {
+      status: "failed",
+      error: reason,
+      finishedAt: now
+    });
+    return { claimed: true, foreachChild: false, joined: false, successors: [], runFailed: true };
+  });
+}
+function toRoutingResult(settle) {
+  return {
+    claimed: settle.claimed,
+    foreachChild: true,
+    joined: settle.joined,
+    successors: settle.successors,
+    runFailed: settle.runFailed
+  };
+}
+async function checkpointPortStepAndResolveSuccessors(def, runId, stepId, nodeId, output, nextPort, ctx, registry) {
+  return await getDbClient2().transaction(async () => {
+    const current = await getWorkflowRunStep2(stepId);
+    if (!current || current.status !== "waiting")
+      return UNCLAIMED;
+    const run = await getWorkflowRun2(runId);
+    if (!run || run.status !== "waiting" && run.status !== "running") {
+      return UNCLAIMED;
+    }
+    if (resolveForeachParent(def, nodeId)) {
+      return toRoutingResult(await settleForeachChild(def, runId, stepId, { status: "completed", output, nextPort }, ctx, {
+        registry
+      }));
+    }
+    await checkpointStep(runId, stepId, nodeId, { output, nextPort }, ctx);
+    await updateWorkflowRun2(runId, { status: "running" });
+    return {
+      claimed: true,
+      foreachChild: false,
+      joined: true,
+      successors: getSuccessors(def, nodeId, nextPort),
+      runFailed: false
+    };
+  });
+}
+var SUPERSEDE_RETRY_POLICY = {
+  maxRetries: 1,
+  strategy: "static",
+  baseDelayMs: 30000,
+  maxDelayMs: 30000
+};
+async function scheduleTaskStepRetry(def, runId, step, taskId, reason) {
+  const node = def.nodes.find((n) => n.id === step.nodeId);
+  if (!node || node.type !== "agent-task")
+    return "not-eligible";
+  let policy;
+  if (node.retry) {
+    const parsed = RetryPolicySchema.safeParse(node.retry);
+    if (!parsed.success)
+      return "not-eligible";
+    policy = parsed.data;
+  } else {
+    if (!await isSupersedeCut(taskId, reason))
+      return "not-eligible";
+    policy = SUPERSEDE_RETRY_POLICY;
+  }
+  return await getDbClient2().transaction(async () => {
+    const current = await getWorkflowRunStep2(step.id);
+    if (!current || current.status !== "waiting")
+      return "not-claimed";
+    if (!await isTaskBoundToStep(taskId, step.id))
+      return "not-claimed";
+    if (current.retryCount >= policy.maxRetries)
+      return "not-eligible";
+    await detachTaskFromWorkflowRunStep2(taskId);
+    await checkpointStepFailure(runId, step.id, reason, current.retryCount, policy);
+    return "scheduled";
+  });
+}
+async function isSupersedeCut(taskId, reason) {
+  if (reason === SUPERSEDED_WORKFLOW_TASK_REASON)
+    return true;
+  const task = await getTaskById2(taskId);
+  return task?.failureReason === SUPERSEDED_WORKFLOW_TASK_REASON;
+}
+async function completeTaskStepAndResolveSuccessors(def, runId, step, output, ctx, failureReason, ownerTaskId, registry) {
+  return await getDbClient2().transaction(async () => {
+    const current = await getWorkflowRunStep2(step.id);
+    if (!current || current.status !== "waiting")
+      return UNCLAIMED;
+    if (ownerTaskId && !await isTaskBoundToStep(ownerTaskId, step.id))
+      return UNCLAIMED;
+    if (resolveForeachParent(def, step.nodeId)) {
+      return toRoutingResult(await settleForeachChild(def, runId, step.id, {
+        status: "completed",
+        output,
+        ...failureReason !== undefined ? { error: failureReason } : {}
+      }, ctx, { registry }));
+    }
+    await checkpointStep(runId, step.id, step.nodeId, { output }, ctx);
+    await updateWorkflowRun2(runId, { status: "running" });
+    return {
+      claimed: true,
+      foreachChild: false,
+      joined: true,
+      successors: getSuccessors(def, step.nodeId),
+      runFailed: false
+    };
+  });
+}
+
+// src/workflows/resume.ts
+function setupWorkflowResumeListener2(eventBus, registry) {
+  const onTaskCompleted = async (data) => {
+    try {
+      const event = data;
+      if (!event.workflowRunId || !event.workflowRunStepId)
+        return;
+      await resumeFromTaskCompletion(event, registry);
+    } catch (err) {
+      console.error("[workflows] Resume from task completion failed:", err);
+    }
+  };
+  eventBus.on("task.completed", onTaskCompleted);
+  const onTaskFailed = async (data) => {
+    try {
+      const event = data;
+      if (!event.workflowRunId || !event.workflowRunStepId)
+        return;
+      await handleTaskFailure(event, event.failureReason ?? "Task failed", registry, {
+        retryable: true
+      });
+    } catch (err) {
+      console.error("[workflows] Handle task failure error:", err);
+    }
+  };
+  eventBus.on("task.failed", onTaskFailed);
+  const onTaskCancelled = async (data) => {
+    try {
+      const event = data;
+      if (!event.workflowRunId || !event.workflowRunStepId)
+        return;
+      await handleTaskFailure(event, "Task was cancelled", registry, { retryable: false });
+    } catch (err) {
+      console.error("[workflows] Handle task cancellation error:", err);
+    }
+  };
+  eventBus.on("task.cancelled", onTaskCancelled);
+  const onApprovalResolved = async (data) => {
+    try {
+      const event = data;
+      if (!event.workflowRunId || !event.workflowRunStepId)
+        return;
+      await resumeFromApprovalResolution(event, registry);
+    } catch (err) {
+      console.error("[workflows] Resume from approval resolution failed:", err);
+    }
+  };
+  eventBus.on("approval.resolved", onApprovalResolved);
+  const onChildRunFinished = async (data) => {
+    try {
+      const { parentStepId } = data;
+      if (!parentStepId)
+        return;
+      await resumeFromChildRun2(parentStepId, registry);
+    } catch (err) {
+      console.error("[workflows] Resume from child workflow run failed:", err);
+    }
+  };
+  eventBus.on("workflow.child.finished", onChildRunFinished);
+  return () => {
+    eventBus.off("task.completed", onTaskCompleted);
+    eventBus.off("task.failed", onTaskFailed);
+    eventBus.off("task.cancelled", onTaskCancelled);
+    eventBus.off("approval.resolved", onApprovalResolved);
+    eventBus.off("workflow.child.finished", onChildRunFinished);
+  };
+}
+async function failClosedOnUnreadableReplay(runId, stepId, resume) {
+  try {
+    await resume();
+  } catch (err) {
+    if (!await failRunOnUnreadableReplay(runId, err, stepId))
+      throw err;
+  }
+}
+async function resumeFromTaskCompletion(event, registry) {
+  await failClosedOnUnreadableReplay(event.workflowRunId, event.workflowRunStepId, () => resumeFromTaskCompletionUnguarded(event, registry));
+}
+async function resumeFromTaskCompletionUnguarded(event, registry) {
+  const run = await getWorkflowRun2(event.workflowRunId);
+  if (!run)
+    return;
+  let taskOutput = event.output;
+  if (event.output) {
+    try {
+      const parsed = JSON.parse(event.output);
+      if (typeof parsed === "object" && parsed !== null) {
+        taskOutput = parsed;
+      }
+    } catch {}
+  }
+  const stepOutput = { taskId: event.taskId, taskOutput };
+  if (run.status !== "waiting" && run.status !== "running") {
+    await recordLateForeachOutcome(run, event.workflowRunStepId, event, {
+      status: "completed",
+      output: stepOutput
+    });
+    return;
+  }
+  const step = await getWorkflowRunStep2(event.workflowRunStepId);
+  if (!step || step.status !== "waiting")
+    return;
+  if (await isStaleTaskEvent(step.id, event))
+    return;
+  const workflow = await getWorkflow2(run.workflowId);
+  if (!workflow)
+    return;
+  const ctx = run.context ?? {};
+  const routing = await completeTaskStepAndResolveSuccessors(workflow.definition, run.id, step, stepOutput, ctx, undefined, undefined, registry);
+  if (!routing.claimed)
+    return;
+  const successors = routing.successors;
+  if (successors.length > 0) {
+    const secretKeys = getSecretInputKeys(workflow.input);
+    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
+  } else {
+    await finalizeOrWait2(run.id);
+  }
+}
+async function finalizeOrWait2(runId) {
+  await getDbClient2().transaction(async () => {
+    const steps = await getWorkflowRunStepsByRunId2(runId);
+    if (hasRunningStep(steps)) {
+      const run = await getWorkflowRun2(runId);
+      if (run?.status === "waiting")
+        await updateWorkflowRun2(runId, { status: "running" });
+      return;
+    }
+    const hasWaiting = steps.some((s) => s.status === "waiting" || s.status === "failed" && s.nextRetryAt != null);
+    if (hasWaiting) {
+      await updateWorkflowRun2(runId, { status: "waiting" });
+    } else {
+      await updateWorkflowRun2(runId, {
+        status: "completed",
+        finishedAt: new Date().toISOString()
+      });
+    }
+  });
+}
+async function handleTaskFailure(event, reason, registry, options) {
+  await failClosedOnUnreadableReplay(event.workflowRunId, event.workflowRunStepId, () => handleTaskFailureUnguarded(event, reason, registry, options));
+}
+async function handleTaskFailureUnguarded(event, reason, registry, options) {
+  const run = await getWorkflowRun2(event.workflowRunId);
+  if (!run)
+    return;
+  if (run.status !== "waiting" && run.status !== "running") {
+    await recordLateForeachOutcome(run, event.workflowRunStepId, event, {
+      status: "failed",
+      error: reason
+    });
+    return;
+  }
+  const step = await getWorkflowRunStep2(event.workflowRunStepId);
+  if (!step || step.status !== "waiting")
+    return;
+  if (await isStaleTaskEvent(step.id, event))
+    return;
+  const workflow = await getWorkflow2(run.workflowId);
+  if (!workflow)
+    return;
+  if (options.retryable) {
+    const retry = await scheduleTaskStepRetry(workflow.definition, run.id, step, event.taskId, reason);
+    if (retry === "scheduled") {
+      console.log(`[workflows] Task ${event.taskId} failed; step ${step.nodeId} of run ${run.id} queued for retry ${step.retryCount + 1}`);
+      return;
+    }
+    if (retry === "not-claimed")
+      return;
+  }
+  const onFailure = stepFailureMode(workflow.definition, step.nodeId);
+  if (onFailure === "fail") {
+    await markRunFailed(workflow.definition, event, reason, registry);
+    return;
+  }
+  const ctx = run.context ?? {};
+  const stepOutput = {
+    taskId: event.taskId,
+    taskOutput: `${FAILED_TASK_OUTPUT_PREFIX} ${reason}] This node failed or was cancelled.`
+  };
+  const routing = await completeTaskStepAndResolveSuccessors(workflow.definition, run.id, step, stepOutput, ctx, reason, undefined, registry);
+  if (!routing.claimed)
+    return;
+  const successors = routing.successors;
+  if (successors.length > 0) {
+    const secretKeys = getSecretInputKeys(workflow.input);
+    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
+  } else {
+    await finalizeOrWait2(run.id);
+  }
+}
+async function recordLateForeachOutcome(run, stepId, event, outcome) {
+  if (run.status !== "failed")
+    return;
+  const step = await getWorkflowRunStep2(stepId);
+  if (!step || step.status !== "waiting")
+    return;
+  if (await isStaleTaskEvent(step.id, event))
+    return;
+  const workflow = await getWorkflow2(run.workflowId);
+  if (!workflow || !resolveForeachParent(workflow.definition, step.nodeId))
+    return;
+  await settleForeachChild(workflow.definition, run.id, step.id, outcome, run.context ?? {});
+}
+async function isStaleTaskEvent(stepId, event) {
+  if (!event.taskId)
+    return false;
+  const boundTask = await getTaskByWorkflowRunStepId2(stepId);
+  return boundTask != null && boundTask.id !== event.taskId;
+}
+async function markRunFailed(def, event, reason, registry) {
+  await failStepAndRunIfWaiting(def, event.workflowRunStepId, event.workflowRunId, reason, undefined, { registry });
+}
+async function retryFailedRun2(runId, registry) {
+  const run = await getWorkflowRun2(runId);
+  if (!run || run.status !== "failed")
+    throw new Error("Run is not in failed state");
+  const workflow = await getWorkflow2(run.workflowId);
+  if (!workflow)
+    throw new Error("Workflow not found");
+  const steps = await getWorkflowRunStepsByRunId2(runId);
+  const latestSteps = [...latestStepPerNode(steps).values()];
+  const failedStep = latestSteps.find((s) => s.status === "failed");
+  if (!failedStep)
+    throw new Error("No failed step found");
+  const completedNodeIds = new Set(await getCompletedStepNodeIds2(runId));
+  const notReady = await findWorkflowReadinessProblems({ nodes: workflow.definition.nodes.filter((node) => !completedNodeIds.has(node.id)) }, registry);
+  if (notReady.length > 0) {
+    throw new Error(`Retry not started, run left failed: ${formatReadinessProblems(notReady)}`);
+  }
+  const { activeEdges } = await loadCompletedStepRouting(workflow.definition, runId, completedNodeIds);
+  const foreachParent = resolveForeachParent(workflow.definition, failedStep.nodeId);
+  const failedNode = foreachParent ?? workflow.definition.nodes.find((n) => n.id === failedStep.nodeId);
+  if (!failedNode)
+    throw new Error(`Node ${failedStep.nodeId} not found in workflow definition`);
+  const hasStructuralPredecessor = workflow.definition.nodes.some((node) => node.next && getNextTargets(node.next).includes(failedNode.id));
+  const hasActivePredecessor = [...activeEdges].some((edge) => edge.endsWith(`→${failedNode.id}`));
+  const shouldRetryFailedNode = foreachParent != null || !hasStructuralPredecessor || hasActivePredecessor;
+  const ctx = run.context ?? {};
+  const attempts = await getDbClient2().transaction(async () => {
+    const current = await getWorkflowRun2(runId);
+    if (!current || current.status !== "failed")
+      return null;
+    const currentSteps = await getWorkflowRunStepsByRunId2(runId);
+    const attempts = foreachRetryAttempts(workflow.definition, [
+      ...latestStepPerNode(currentSteps).values()
+    ]);
+    const capError = foreachRetryCapError(currentSteps.length, attempts);
+    if (capError)
+      throw new Error(`Retry not started, run left failed: ${capError}`);
+    if (!foreachParent) {
+      await updateWorkflowRunStep2(failedStep.id, {
+        status: shouldRetryFailedNode ? "pending" : "cancelled",
+        error: shouldRetryFailedNode ? null : "Skipped on retry because its branch was not active"
+      });
+    }
+    await createForeachAttemptSteps(runId, attempts.flatMap((attempt) => attempt.rows));
+    await updateWorkflowRun2(runId, { status: "running", error: null, context: ctx });
+    return attempts;
+  });
+  if (!attempts)
+    throw new Error("Run is not in failed state");
+  const liveNodeIds = new Set(steps.filter((s) => s.status === "running" || s.status === "waiting").map((s) => s.nodeId));
+  const readyNodes = findReadyNodes(workflow.definition, completedNodeIds, activeEdges).filter((n) => n.id === failedNode.id || !liveNodeIds.has(n.id));
+  const nodesToRun = !shouldRetryFailedNode || readyNodes.some((n) => n.id === failedNode.id) ? readyNodes : [failedNode, ...readyNodes];
+  const secretKeys = getSecretInputKeys(workflow.input);
+  await walkGraph(workflow.definition, runId, ctx, nodesToRun, registry, workflow.id, secretKeys);
+  for (const attempt of attempts) {
+    if (attempt.parent.id !== failedNode.id) {
+      startForeachDrive(runId, attempt.parent.id, registry);
+    }
+  }
+}
+function latestStepPerNode(steps) {
+  const latest = new Map;
+  for (const step of steps)
+    latest.set(step.nodeId, step);
+  return latest;
+}
+function foreachRetryAttempts(def, latestSteps) {
+  const byParent = new Map;
+  const latestByNode = new Map(latestSteps.map((step) => [step.nodeId, step]));
+  for (const step of latestSteps) {
+    if (step.status !== "failed" && step.status !== "cancelled")
+      continue;
+    const parent = resolveForeachParent(def, step.nodeId);
+    if (!parent)
+      continue;
+    const parentStep = latestByNode.get(parent.id);
+    if (!parentStep || FOREACH_TERMINAL_STEP_STATUSES.has(parentStep.status))
+      continue;
+    const input = step.input ?? {};
+    const entry = byParent.get(parent.id) ?? { parent, rows: [] };
+    entry.rows.push({
+      nodeId: step.nodeId,
+      nodeType: step.nodeType,
+      itemKey: typeof input.itemKey === "string" ? input.itemKey : parseSyntheticNodeId(step.nodeId)?.itemKey ?? "",
+      index: typeof input.index === "number" ? input.index : 0
+    });
+    byParent.set(parent.id, entry);
+  }
+  return [...byParent.values()];
+}
+function foreachRetryCapError(existingSteps, attempts) {
+  const added = attempts.reduce((sum, attempt) => sum + attempt.rows.length, 0);
+  if (added === 0)
+    return null;
+  const maxSteps = getMaxWorkflowStepsPerRun();
+  if (existingSteps + added < maxSteps)
+    return null;
+  return `foreach retry would reach ${maxSteps} total steps (WORKFLOW_MAX_STEPS_PER_RUN): ${existingSteps} existing + ${added} new attempts leaves no room for the retry walk`;
+}
+async function cancelWorkflowRunRows2(runId, cancelReason) {
+  const terminalStatuses = ["completed", "failed", "cancelled", "skipped"];
+  const now = new Date().toISOString();
+  return await getDbClient2().transaction(async () => {
+    const current = await getWorkflowRun2(runId);
+    if (!current || terminalStatuses.includes(current.status))
+      return false;
+    const steps = await getWorkflowRunStepsByRunId2(runId);
+    for (const step of steps) {
+      if (terminalStatuses.includes(step.status))
+        continue;
+      const task = await getTaskByWorkflowRunStepId2(step.id);
+      if (task) {
+        await cancelTask2(task.id, cancelReason);
+      }
+      await updateWorkflowRunStep2(step.id, {
+        status: "cancelled",
+        error: cancelReason,
+        finishedAt: now
+      });
+    }
+    await cancelPendingApprovalRequestsForRun2(runId, cancelReason);
+    await updateWorkflowRun2(runId, {
+      status: "cancelled",
+      error: cancelReason,
+      finishedAt: now
+    });
+    return true;
+  });
+}
+async function cancelWorkflowRun2(runId, reason) {
+  const run = await getWorkflowRun2(runId);
+  if (!run)
+    throw new Error("Workflow run not found");
+  const terminalStatuses = ["completed", "failed", "cancelled", "skipped"];
+  if (terminalStatuses.includes(run.status) && run.status !== "cancelled") {
+    throw new Error(`Cannot cancel run in '${run.status}' state`);
+  }
+  const cancelReason = reason ?? "Cancelled by user";
+  const applied = await cancelWorkflowRunRows2(runId, cancelReason);
+  const cancelledApprovals = await listCancelledApprovalRequestsForRun2(runId);
+  const latestRun = await getWorkflowRun2(runId);
+  if (!applied && latestRun?.status !== "cancelled") {
+    throw new Error(`Cannot cancel run in '${latestRun?.status ?? "missing"}' state`);
+  }
+  await postApprovalCancellationUpdates(cancelledApprovals, applied ? cancelReason : latestRun?.error ?? cancelReason);
+}
+async function resumeFromApprovalResolution(event, registry) {
+  await failClosedOnUnreadableReplay(event.workflowRunId, event.workflowRunStepId, () => resumeFromApprovalResolutionUnguarded(event, registry));
+}
+async function resumeFromApprovalResolutionUnguarded(event, registry) {
+  const run = await getWorkflowRun2(event.workflowRunId);
+  if (!run || run.status !== "waiting" && run.status !== "running")
+    return;
+  const step = await getWorkflowRunStep2(event.workflowRunStepId);
+  if (!step || step.status !== "waiting")
+    return;
+  const workflow = await getWorkflow2(run.workflowId);
+  if (!workflow)
+    return;
+  if (event.status === "cancelled") {
+    console.warn(`[workflows] approval ${event.requestId} is cancelled; step ${event.workflowRunStepId} stays waiting for the run cancel path`);
+    return;
+  }
+  const ctx = run.context ?? {};
+  const { output: stepOutput, nextPort } = shapeApprovalResolution(registry, workflow.definition, step.nodeId, step.output, { requestId: event.requestId, status: event.status, responses: event.responses });
+  const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, stepOutput, nextPort, ctx, registry);
+  if (!routing.claimed)
+    return;
+  const successors = routing.successors;
+  if (successors.length > 0) {
+    const secretKeys = getSecretInputKeys(workflow.input);
+    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
+  } else {
+    await finalizeOrWait2(run.id);
+  }
+}
+async function resumeWaitState2(waitId, status, payload, registry) {
+  const cappedPayload = capPayload(payload);
+  const result = await resolveWaitState2(waitId, { status, firedPayload: cappedPayload });
+  if (!result.updated || !result.row)
+    return;
+  const waitRow = result.row;
+  await failClosedOnUnreadableReplay(waitRow.workflowRunId, waitRow.workflowRunStepId, () => resumeClaimedWait(waitRow, status, cappedPayload, registry));
+}
+async function recoverResolvedWaitState2(waitId, registry) {
+  const waitRow = await getWaitStateById2(waitId);
+  if (!waitRow)
+    return;
+  const status = waitRow.status;
+  if (status !== "fired" && status !== "timeout")
+    return;
+  await failClosedOnUnreadableReplay(waitRow.workflowRunId, waitRow.workflowRunStepId, () => resumeClaimedWait(waitRow, status, waitRow.firedPayload, registry));
+}
+async function resumeClaimedWait(waitRow, status, cappedPayload, registry) {
+  const run = await getWorkflowRun2(waitRow.workflowRunId);
+  if (!run || run.status !== "waiting" && run.status !== "running")
+    return;
+  const step = await getWorkflowRunStep2(waitRow.workflowRunStepId);
+  if (!step || step.status !== "waiting")
+    return;
+  const workflow = await getWorkflow2(run.workflowId);
+  if (!workflow)
+    return;
+  const nextPort = computeNextPort(waitRow.mode, status);
+  const ctx = run.context ?? {};
+  const stepOutput = {
+    waitId: waitRow.id,
+    mode: waitRow.mode,
+    firedAt: waitRow.resolvedAt,
+    payload: cappedPayload === undefined ? undefined : cappedPayload
+  };
+  const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, stepOutput, nextPort, ctx, registry);
+  if (!routing.claimed)
+    return;
+  if (waitRow.mode === "event" && waitRow.eventName) {
+    pruneWaitFromBus(waitRow.id, waitRow.eventName);
+  }
+  const successors = routing.successors;
+  if (successors.length > 0) {
+    const secretKeys = getSecretInputKeys(workflow.input);
+    await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id, secretKeys);
+  } else {
+    await finalizeOrWait2(run.id);
+  }
+}
+async function resumeFromChildRun2(parentStepId, registry) {
+  const step = await getWorkflowRunStep2(parentStepId);
+  if (!step || step.status !== "waiting" || step.nodeType !== "sub-workflow")
+    return false;
+  const childId = await getChildWorkflowRunId(parentStepId);
+  const child = childId ? await getWorkflowRun2(childId) : null;
+  const outcome = child ? childRunOutcome(child) : { error: `Child workflow run of step ${parentStepId} was deleted` };
+  if (!outcome)
+    return false;
+  let claimed = false;
+  await failClosedOnUnreadableReplay(step.runId, step.id, async () => {
+    const run = await getWorkflowRun2(step.runId);
+    if (!run || run.status !== "waiting" && run.status !== "running")
+      return;
+    const workflow = await getWorkflow2(run.workflowId);
+    if (!workflow)
+      return;
+    const ctx = run.context ?? {};
+    const routing = "error" in outcome ? await failStepAndRunIfWaiting(workflow.definition, step.id, run.id, outcome.error, undefined, { ctx, registry }) : await checkpointPortStepAndResolveSuccessors(workflow.definition, run.id, step.id, step.nodeId, outcome.output, "success", ctx, registry);
+    if (!routing.claimed || routing.runFailed) {
+      claimed = routing.claimed;
+      return;
+    }
+    claimed = true;
+    if (routing.successors.length > 0) {
+      const secretKeys = getSecretInputKeys(workflow.input);
+      await walkGraph(workflow.definition, run.id, ctx, routing.successors, registry, workflow.id, secretKeys);
+    } else {
+      await finalizeOrWait2(run.id);
+    }
+  });
+  return claimed;
+}
+var FIRED_PAYLOAD_BYTE_CAP = 64 * 1024;
+function capPayload(payload) {
+  if (payload === undefined || payload === null)
+    return payload;
+  let encoded;
+  try {
+    encoded = JSON.stringify(payload);
+  } catch {
+    return { truncated: true, reason: "non-serializable" };
+  }
+  if (encoded.length <= FIRED_PAYLOAD_BYTE_CAP) {
+    return payload;
+  }
+  const summary = encoded.slice(0, 1024);
+  return {
+    truncated: true,
+    originalSize: encoded.length,
+    summary
+  };
+}
+var waitsByEvent = new Map;
+var listenersByEvent = new Map;
+var busRegistry = null;
+async function initWaitBusSubscriptions2(registry) {
+  busRegistry = registry;
+  const pendingNames = await collectPendingEventNames();
+  for (const name of pendingNames) {
+    const pending = await getPendingWaitsByEvent2(name);
+    for (const w of pending) {
+      registerWait(w.id, name);
+    }
+  }
+}
+async function collectPendingEventNames() {
+  return new Set(await getPendingEventWaitNames2());
+}
+function subscribeWaitToBus2(waitId, eventName) {
+  registerWait(waitId, eventName);
+}
+function registerWait(waitId, eventName) {
+  let set = waitsByEvent.get(eventName);
+  if (!set) {
+    set = new Set;
+    waitsByEvent.set(eventName, set);
+  }
+  set.add(waitId);
+  if (!listenersByEvent.has(eventName)) {
+    const listener = (data) => {
+      processBusEvent(eventName, data).catch((err) => {
+        console.error(`[workflows] Wait bus listener failed for event=${eventName}:`, scrubSecrets(err instanceof Error ? err.message : String(err)));
+      });
+    };
+    listenersByEvent.set(eventName, listener);
+    workflowEventBus2.on(eventName, listener);
+  }
+}
+function pruneWaitFromBus(waitId, eventName) {
+  const set = waitsByEvent.get(eventName);
+  if (!set)
+    return;
+  set.delete(waitId);
+  if (set.size === 0) {
+    waitsByEvent.delete(eventName);
+    const listener = listenersByEvent.get(eventName);
+    if (listener) {
+      workflowEventBus2.off(eventName, listener);
+      listenersByEvent.delete(eventName);
+    }
+  }
+}
+async function processBusEvent(eventName, payload) {
+  const set = waitsByEvent.get(eventName);
+  if (!set || set.size === 0)
+    return;
+  if (!busRegistry)
+    return;
+  const waitIds = [...set];
+  for (const waitId of waitIds) {
+    try {
+      const row = await getWaitStateById2(waitId);
+      if (!row || row.status !== "pending") {
+        set.delete(waitId);
+        continue;
+      }
+      if (row.eventScope === "run") {
+        if (!isPayloadInRun(payload, row.workflowRunId))
+          continue;
+      }
+      const ok = await matchesFilter(payload, row.eventFilter ?? undefined);
+      if (!ok)
+        continue;
+      await resumeWaitState2(waitId, "fired", payload, busRegistry);
+    } catch (err) {
+      console.error(`[workflows] Wait bus listener failed for wait=${waitId} event=${eventName}:`, err);
+    }
+  }
+  if (set.size === 0) {
+    waitsByEvent.delete(eventName);
+    const listener = listenersByEvent.get(eventName);
+    if (listener) {
+      workflowEventBus2.off(eventName, listener);
+      listenersByEvent.delete(eventName);
+    }
+  }
+}
+function isPayloadInRun(payload, runId) {
+  if (typeof payload !== "object" || payload === null)
+    return false;
+  const rec = payload;
+  return rec._runId === runId || rec.workflowRunId === runId;
+}
+export { shapeApprovalResolution, SubWorkflowExecutor, WaitExecutor, failStepAndRunIfWaiting, checkpointPortStepAndResolveSuccessors, scheduleTaskStepRetry, completeTaskStepAndResolveSuccessors, setupWorkflowResumeListener2, finalizeOrWait2, retryFailedRun2, cancelWorkflowRunRows2, cancelWorkflowRun2, resumeWaitState2, recoverResolvedWaitState2, resumeFromChildRun2, initWaitBusSubscriptions2, subscribeWaitToBus2 };