@desplega.ai/agent-swarm 2.4.5 → 2.5.0

package/dist/{cli-xpa64rek.js → cli-92mqenkc.js}

@@ -1,27 +1,64 @@
 import {
+  telemetry,
+  init_telemetry,
+  scrubJsonValue,
+  init_scrub_json,
+  getDbClient2,
   getTaskById2,
+  createForeachChildSteps,
+  init_workflow_runs,
+  getOAuthApp,
+  getOAuthTokens,
+  init_oauth,
+  WorkflowReplayStateError,
+  init_workflow_replay,
   createTaskExtended2,
+  getSwarmConfigs2,
+  getWorkflow2,
+  createWorkflowRun2,
+  getWorkflowRun2,
+  updateWorkflowRun2,
+  createWorkflowRunStep2,
+  getWorkflowRunStep2,
+  updateWorkflowRunStep2,
+  getWorkflowRunStepsByRunId2,
+  getLastSuccessfulRun2,
+  getLastRunStart2,
+  getCompletedStepNodeIds2,
+  getTaskByWorkflowRunStepId2,
+  detachTaskFromWorkflowRunStep2,
+  getStepByIdempotencyKey2,
+  getStepCountForNode2,
+  getLatestStepForNode2,
+  getCurrentStepForNode2,
   claimApprovalCancellationNotification2,
   completeApprovalCancellationNotificationClaim2,
   releaseApprovalCancellationNotificationClaim2,
   init_db3
-} from "./cli-wt0jf9hm.js";
+} from "./cli-fcc5qe3f.js";
 import {
   getSlackApp2
-} from "./cli-37j04k05.js";
+} from "./cli-fy1jyyym.js";
 import {
   DEFAULT_MODEL,
   resolveCredential
-} from "./cli-8nyhf7za.js";
+} from "./cli-qqzmjxkf.js";
 import {
   TERMINAL_TASK_STATUSES,
   init_types
-} from "./cli-eww120g8.js";
+} from "./cli-rh5smt8t.js";
+import {
+  getSlackConfiguration,
+  isSlackConfigured,
+  init_config
+} from "./cli-qeaq3j6t.js";
 import {
   selectCredential,
   init_credentials
 } from "./cli-zw88zjba.js";
 import {
+  deepInterpolate,
+  init_template,
   resolveTemplate,
   init_resolver
 } from "./cli-tx00c0h6.js";
@@ -55,9 +92,14 @@ import {
   init_constants2
 } from "./cli-gf2850q7.js";
 import {
+  isEnvFlagEnabled,
+  init_env_flag
+} from "./cli-cebvbc9t.js";
+import {
+  isSensitiveKey,
   scrubSecrets,
   init_secret_scrubber
-} from "./cli-xf234ws8.js";
+} from "./cli-n4c8e3s5.js";
 import {
   providerKeyVars,
   providerBaseUrl,
@@ -65,6 +107,300 @@ import {
   init_src2
 } from "./cli-nwyw3zhg.js";
 
+// src/automation-preflight-alert.ts
+init_constants2();
+init_secret_scrubber();
+async function notifyAutomationPreflightFailure(preflight) {
+  const channel = process.env.SLACK_ALERTS_CHANNEL?.trim();
+  if (!channel) {
+    console.warn("[Automation Preflight] SLACK_ALERTS_CHANNEL not set; skipping alert");
+    return;
+  }
+  try {
+    const { getSlackApp } = await import("./app-0qp0a2gk.js");
+    const app = getSlackApp();
+    if (!app) {
+      console.warn("[Automation Preflight] Slack not available, cannot send notification");
+      return;
+    }
+    await app.client.chat.postMessage({
+      channel,
+      text: scrubSecrets(`⚠️ Automation needs setup
+` + `Automation: ${preflight.kind} "${preflight.name}"
+Missing params: ${preflight.missing.params.join(", ") || "none"}
+Missing integrations: ${preflight.missing.integrations.join(", ") || "none"}
+Fire SKIPPED. It was not retried or queued.
+Fix setup: ${getAppUrl()}${preflight.fixUrl}`),
+      unfurl_links: false,
+      unfurl_media: false
+    });
+  } catch (error) {
+    console.error("[Automation Preflight] Failed to send Slack notification:", scrubSecrets(error instanceof Error ? error.message : String(error)));
+  }
+}
+
+// src/be/automation-preflight.ts
+init_config();
+init_env_flag();
+init_secret_scrubber();
+init_db3();
+init_oauth();
+init_scrub_json();
+var NEEDS_SETUP_PREFIX = "needs_setup:";
+function hasValue(value) {
+  if (value == null)
+    return false;
+  if (typeof value === "string")
+    return value.trim().length > 0;
+  if (Array.isArray(value))
+    return value.length > 0;
+  return true;
+}
+var GITHUB_REPOSITORY_SLUG = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}(?:\.git)?$/;
+var SAFE_SHELL_DATA = /^[A-Za-z0-9._~%/:@ -]+$/;
+var DNS_NAME = /^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$/;
+var SAFE_EXTERNAL_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+var SAFE_GIT_REF = /^(?!-)(?!.*(?:\.\.|@\{|\/\/))[A-Za-z0-9._/-]+$/;
+var SAFE_TAG_PATTERN = /^(?!-)(?!.*(?:\.\.|\/\/))[A-Za-z0-9._*?/-]+$/;
+var SAFE_RELATIVE_PATH = /^(?![-/])(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]+$/;
+var SAFE_REPORT_NAME = /^(?!\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._ -]{0,127}$/;
+function isSafeRepository(value) {
+  if (!SAFE_SHELL_DATA.test(value) || value.trim() !== value || value.includes(" "))
+    return false;
+  const slug = value.replace(/^https:\/\/github\.com\//, "").replace(/^git@github\.com:/, "").replace(/\/$/, "");
+  return GITHUB_REPOSITORY_SLUG.test(slug);
+}
+function isSafeGscProperty(value) {
+  if (!SAFE_SHELL_DATA.test(value) || value.trim() !== value)
+    return false;
+  return value.split(" ").every((property) => {
+    if (!property)
+      return false;
+    if (property.startsWith("sc-domain:"))
+      return DNS_NAME.test(property.slice(10));
+    if (DNS_NAME.test(property))
+      return true;
+    try {
+      const url = new URL(property);
+      return url.protocol === "https:" && !url.username && !url.password && !url.port && !url.search && !url.hash && DNS_NAME.test(url.hostname);
+    } catch {
+      return false;
+    }
+  });
+}
+var PARAM_VALIDATORS = {
+  REPO_URL: (value) => typeof value === "string" && isSafeRepository(value),
+  GSC_PROPERTY: (value) => typeof value === "string" && isSafeGscProperty(value),
+  BRANCH: (value) => typeof value === "string" && SAFE_GIT_REF.test(value),
+  SCOPE_PATH: (value) => typeof value === "string" && SAFE_RELATIVE_PATH.test(value),
+  REPORT_NAME: (value) => typeof value === "string" && value.trim() === value && SAFE_REPORT_NAME.test(value),
+  TAG_PATTERN: (value) => typeof value === "string" && SAFE_TAG_PATTERN.test(value),
+  AGENT_FS_ORG_ID: (value) => typeof value === "string" && SAFE_EXTERNAL_ID.test(value),
+  ORG_ID: (value) => typeof value === "string" && SAFE_EXTERNAL_ID.test(value)
+};
+function isUsableParam(key, value) {
+  if (!hasValue(value))
+    return false;
+  return PARAM_VALIDATORS[key]?.(value) ?? true;
+}
+function uniqueSorted(values) {
+  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}
+function automationUrl(input) {
+  return input.kind === "schedule" ? `/schedules/${input.id}` : `/workflows/${input.id}`;
+}
+var INTEGRATION_FIX_URL = {
+  slack: "/settings/integrations/slack",
+  github: "/settings/integrations/github",
+  linear: "/settings/integrations/linear",
+  jira: "/settings/integrations/jira",
+  agentmail: "/settings/integrations/agentmail",
+  gsc: "/settings/integrations/gsc",
+  agentfs: "/settings/integrations/agentfs"
+};
+var INTEGRATION_FIRST_REQUIREMENTS = new Set([
+  "gsc",
+  "linear",
+  "agentmail"
+]);
+function automationIntegrationFixUrl(id) {
+  return INTEGRATION_FIX_URL[id];
+}
+function isNeedsSetupFailure(reason) {
+  return reason?.startsWith(NEEDS_SETUP_PREFIX) ?? false;
+}
+function preflightAutomation(input, setup) {
+  const params = input.params ?? {};
+  const guardedParams = Object.keys(params).filter((key) => (key in PARAM_VALIDATORS));
+  const missingParams = uniqueSorted([...input.requiredParams ?? [], ...guardedParams].filter((key) => !isUsableParam(key, params[key])));
+  const missingIntegrations = uniqueSorted((input.requires ?? []).filter((id) => setup[id] === "unverified"));
+  const missing = { params: missingParams, integrations: missingIntegrations };
+  const baseUrl = automationUrl(input);
+  const fixes = [
+    ...missingParams.map((key) => ({
+      type: "param",
+      key,
+      url: `${baseUrl}?param=${encodeURIComponent(key)}`
+    })),
+    ...missingIntegrations.map((key) => ({
+      type: "integration",
+      key,
+      url: automationIntegrationFixUrl(key)
+    }))
+  ];
+  if (missingParams.length === 0 && missingIntegrations.length === 0) {
+    return {
+      id: input.id,
+      name: input.name,
+      kind: input.kind,
+      state: "running",
+      missing,
+      fixes,
+      fixUrl: baseUrl
+    };
+  }
+  const firstParam = missingParams[0];
+  const firstIntegration = (input.requires ?? []).find((id) => missingIntegrations.includes(id));
+  const integrationFirst = (input.requires ?? []).some((id) => INTEGRATION_FIRST_REQUIREMENTS.has(id));
+  const fixUrl = integrationFirst && firstIntegration ? automationIntegrationFixUrl(firstIntegration) : firstParam ? `${baseUrl}?param=${encodeURIComponent(firstParam)}` : firstIntegration ? automationIntegrationFixUrl(firstIntegration) : baseUrl;
+  const failureReason = `${NEEDS_SETUP_PREFIX} params=[${missingParams.join(",")}] integrations=[${missingIntegrations.join(",")}]`;
+  return {
+    id: input.id,
+    name: input.name,
+    kind: input.kind,
+    state: "needs_setup",
+    missing,
+    fixes,
+    fixUrl,
+    failureReason
+  };
+}
+var EXACT_TOKEN = /^\{\{\s*([^}]+?)\s*\}\}$/;
+var TOKEN = /\{\{\s*([^}]+?)\s*\}\}/g;
+function renderAutomationTokens(value, params) {
+  function render(current) {
+    if (typeof current === "string") {
+      const exact = EXACT_TOKEN.exec(current);
+      if (exact?.[1] && Object.hasOwn(params, exact[1]))
+        return params[exact[1]];
+      return current.replace(TOKEN, (token, key) => {
+        if (!Object.hasOwn(params, key))
+          return token;
+        const replacement = params[key];
+        return typeof replacement === "object" ? JSON.stringify(replacement) : String(replacement);
+      });
+    }
+    if (Array.isArray(current))
+      return current.map(render);
+    if (current != null && typeof current === "object") {
+      return Object.fromEntries(Object.entries(current).map(([key, nested]) => [key, render(nested)]));
+    }
+    return current;
+  }
+  return render(value);
+}
+function present(value) {
+  return !!value?.trim();
+}
+async function getAutomationSetupStates() {
+  const [linearTokens, jiraTokens, jiraApp] = await Promise.all([
+    getOAuthTokens("linear"),
+    getOAuthTokens("jira"),
+    getOAuthApp("jira")
+  ]);
+  let jiraCloudId = false;
+  try {
+    const metadata = jiraApp?.metadata ? JSON.parse(jiraApp.metadata) : null;
+    jiraCloudId = !!(metadata && typeof metadata === "object" && metadata.cloudId);
+  } catch {
+    jiraCloudId = false;
+  }
+  const agentFsKey = process.env.API_AGENT_FS_API_KEY ?? process.env.AGENT_FS_API_KEY;
+  const agentFsOrg = process.env.AGENT_FS_DEFAULT_ORG_ID ?? process.env.AGENT_FS_SHARED_ORG_ID;
+  const gscConfigured = present(process.env.GSC_SERVICE_ACCOUNT_BASE64) || present(process.env.GSC_SERVICE_ACCOUNT_JSON);
+  return {
+    slack: getSlackConfiguration().mode === "socket" && isSlackConfigured() ? "configured" : "unverified",
+    github: present(process.env.GITHUB_WEBHOOK_SECRET) && present(process.env.GITHUB_APP_ID) && present(process.env.GITHUB_APP_PRIVATE_KEY) ? "verified" : "unverified",
+    linear: linearTokens ? "verified" : "unverified",
+    jira: jiraTokens && jiraCloudId ? "verified" : "unverified",
+    gsc: gscConfigured ? "verified" : "unverified",
+    agentmail: !isEnvFlagEnabled("AGENTMAIL_DISABLE", false) && present(process.env.AGENTMAIL_API_KEY) ? "verified" : "unverified",
+    agentfs: present(process.env.AGENT_FS_API_URL) && present(agentFsKey) && present(agentFsOrg) && present(process.env.AGENT_FS_DEFAULT_DRIVE_ID) ? "verified" : "unverified"
+  };
+}
+function schedulePreflightInput(schedule) {
+  return { ...schedule, kind: "schedule" };
+}
+function workflowPreflightInput(workflow) {
+  return { ...workflow, kind: "workflow" };
+}
+async function listEnabledAutomationPreflightInputs() {
+  const rows = await getDbClient2().query(`SELECT id, name, 'schedule' AS kind, params, requiredParams, requires
+     FROM scheduled_tasks
+     WHERE enabled = 1
+     UNION ALL
+     SELECT id, name, 'workflow' AS kind, params, requiredParams, requires
+     FROM workflows
+     WHERE enabled = 1`);
+  return rows.map((row) => ({
+    id: row.id,
+    name: row.name,
+    kind: row.kind,
+    params: JSON.parse(row.params),
+    requiredParams: JSON.parse(row.requiredParams),
+    requires: JSON.parse(row.requires)
+  }));
+}
+function utcDayBounds(now) {
+  const start = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
+  return { start: start.toISOString(), end: new Date(start.getTime() + 86400000).toISOString() };
+}
+async function recordSchedulePreflightFailure(scheduleId, failureReason, now = new Date) {
+  const message = scrubSecrets(failureReason);
+  return await getDbClient2().transaction(async (tx) => {
+    const row = await tx.get("SELECT lastErrorAt, lastErrorMessage FROM scheduled_tasks WHERE id = ?", [scheduleId]);
+    if (!row)
+      return false;
+    if (row.lastErrorMessage === message && row.lastErrorAt?.slice(0, 10) === now.toISOString().slice(0, 10)) {
+      return false;
+    }
+    await tx.run(`UPDATE scheduled_tasks
+       SET lastErrorAt = ?, lastErrorMessage = ?, lastUpdatedAt = ?
+       WHERE id = ?`, [now.toISOString(), message, now.toISOString(), scheduleId]);
+    return true;
+  });
+}
+async function recordWorkflowPreflightFailure(input) {
+  const now = input.now ?? new Date;
+  const bounds = utcDayBounds(now);
+  return await getDbClient2().transaction(async (tx) => {
+    const existing = await tx.get(`SELECT id FROM workflow_runs
+       WHERE workflowId = ? AND status = 'failed'
+         AND error LIKE 'needs_setup:%'
+         AND startedAt >= ? AND startedAt < ?
+       ORDER BY startedAt ASC LIMIT 1`, [input.workflowId, bounds.start, bounds.end]);
+    if (existing)
+      return { runId: existing.id, recorded: false };
+    const runId = crypto.randomUUID();
+    const timestamp = now.toISOString();
+    await tx.run(`INSERT INTO workflow_runs
+         (id, workflowId, status, triggerType, triggerData, error, created_by,
+          startedAt, lastUpdatedAt, finishedAt)
+       VALUES (?, ?, 'failed', ?, ?, ?, ?, ?, ?, ?)`, [
+      runId,
+      input.workflowId,
+      input.triggerType,
+      input.triggerData === undefined ? null : scrubJsonValue(input.triggerData),
+      scrubSecrets(input.failureReason),
+      input.createdBy ?? null,
+      timestamp,
+      timestamp,
+      timestamp
+    ]);
+    return { runId, recorded: true };
+  });
+}
+
 // src/workflows/executors/system-one-decision.ts
 init_zod();
 init_secret_scrubber();
@@ -454,7 +790,7 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       }
       if (notification.channel === "slack") {
         try {
-          const { getSlackApp } = await import("./app-353vre8g.js");
+          const { getSlackApp } = await import("./app-0qp0a2gk.js");
           const slackApp = getSlackApp();
           if (!slackApp) {
             console.warn("[HITL] Slack not initialized — cannot send notification");
@@ -2547,175 +2883,2034 @@ class SystemOneDecisionExecutor extends BaseExecutor {
   }
 }
 
-// src/workflows/definition.ts
-function getNextTargets(next) {
-  if (typeof next === "string")
-    return [next];
-  if (Array.isArray(next))
-    return next;
-  return Object.values(next);
+// src/workflows/foreach-join.ts
+init_db3();
+
+// src/workflows/checkpoint.ts
+init_db3();
+async function checkpointStep(runId, stepId, nodeId, result, ctx) {
+  await getDbClient2().transaction(async () => {
+    await updateWorkflowRunStep2(stepId, {
+      status: "completed",
+      output: result.output,
+      nextPort: result.nextPort || undefined,
+      finishedAt: new Date().toISOString()
+    });
+    ctx[nodeId] = result.output;
+    await updateWorkflowRun2(runId, {
+      context: ctx
+    });
+  });
 }
-function generateEdges(def) {
-  const edges = [];
-  for (const node of def.nodes) {
-    if (!node.next)
-      continue;
-    if (typeof node.next === "string") {
-      edges.push({
-        id: `${node.id}→${node.next}`,
-        source: node.id,
-        target: node.next,
-        sourcePort: "default"
+async function checkpointStepFailure(runId, stepId, error, retryCount, retryPolicy, options) {
+  const now = new Date().toISOString();
+  if (retryPolicy && retryCount < retryPolicy.maxRetries) {
+    const delay = calculateBackoff(retryPolicy, retryCount);
+    const nextRetryAt = new Date(Date.now() + delay).toISOString();
+    await updateWorkflowRunStep2(stepId, {
+      status: "failed",
+      error,
+      retryCount: retryCount + 1,
+      maxRetries: retryPolicy.maxRetries,
+      nextRetryAt
+    });
+    return { shouldRetry: true };
+  }
+  await updateWorkflowRunStep2(stepId, {
+    status: "failed",
+    error,
+    finishedAt: now,
+    nextRetryAt: null
+  });
+  const markRunFailed = options?.markRunFailed ?? true;
+  if (markRunFailed) {
+    await getDbClient2().transaction(async () => {
+      const run = await getWorkflowRun2(runId);
+      if (run?.status !== "running" && run?.status !== "waiting")
+        return;
+      await updateWorkflowRun2(runId, {
+        status: "failed",
+        error: `Step failed: ${error}`,
+        finishedAt: now
       });
-    } else if (Array.isArray(node.next)) {
-      for (const targetId of node.next) {
-        edges.push({
-          id: `${node.id}→${targetId}`,
-          source: node.id,
-          target: targetId,
-          sourcePort: "default"
-        });
-      }
-    } else {
-      for (const [port, targetId] of Object.entries(node.next)) {
-        edges.push({
-          id: `${node.id}→${targetId}:${port}`,
-          source: node.id,
-          target: targetId,
-          sourcePort: port
-        });
-      }
+    });
+  }
+  return { shouldRetry: false };
+}
+async function checkpointStepWaiting(runId, stepId, ctx, options = {}) {
+  return getDbClient2().transaction(async () => {
+    const step = await getDbClient2().get(`UPDATE workflow_run_steps
+         SET status = 'waiting'
+       WHERE id = ? AND runId = ? AND status = 'running'
+         AND EXISTS (
+           SELECT 1 FROM workflow_runs
+           WHERE id = ? AND status IN ('running', 'waiting')
+         )
+       RETURNING id`, [stepId, runId, runId]);
+    if (!step)
+      return false;
+    await updateWorkflowRun2(runId, options.keepRunStatus ? { context: ctx } : { status: "waiting", context: ctx });
+    return true;
+  });
+}
+function calculateBackoff(policy, attempt) {
+  let delay;
+  switch (policy.strategy) {
+    case "exponential": {
+      const base = policy.baseDelayMs * 2 ** attempt;
+      delay = Math.random() * Math.min(base, policy.maxDelayMs);
+      break;
     }
+    case "linear":
+      delay = policy.baseDelayMs * (attempt + 1);
+      break;
+    case "static":
+      delay = policy.baseDelayMs;
+      break;
+    default:
+      delay = policy.baseDelayMs;
   }
-  return edges;
+  return Math.min(delay, policy.maxDelayMs);
 }
-function findEntryNodes(def) {
-  const targets = new Set;
-  for (const node of def.nodes) {
-    if (!node.next)
+
+// src/workflows/foreach-driver.ts
+init_db3();
+
+// src/workflows/constants.ts
+var FAILED_TASK_OUTPUT_PREFIX = "[FAILED:";
+var FOREACH_ITEMS_WAIT_FOR = "foreach.items";
+
+// src/workflows/engine.ts
+init_db3();
+init_workflow_replay();
+init_telemetry();
+
+// src/workflows/completed-step-routing.ts
+init_db3();
+async function loadCompletedStepRouting(def, runId, completedNodeIds) {
+  const activeEdges = new Set;
+  const stepsByNodeId = new Map;
+  for (const nodeId of completedNodeIds) {
+    if (resolveForeachParent(def, nodeId))
       continue;
-    for (const targetId of getNextTargets(node.next)) {
-      targets.add(targetId);
+    const step = await getLatestStepForNode2(runId, nodeId);
+    if (step)
+      stepsByNodeId.set(nodeId, step);
+    const successors = step?.nextPort ? getSuccessors(def, nodeId, step.nextPort) : getSuccessors(def, nodeId);
+    for (const successor of successors) {
+      activeEdges.add(`${nodeId}→${successor.id}`);
     }
   }
-  return def.nodes.filter((n) => !targets.has(n.id));
+  return { activeEdges, stepsByNodeId };
 }
-function resolveValidationPort(next, executorPort, validationPassed) {
-  if (validationPassed === undefined)
-    return executorPort;
-  if (!next || typeof next !== "object" || Array.isArray(next))
-    return executorPort;
-  if (executorPort && Object.hasOwn(next, executorPort))
-    return executorPort;
-  return validationPassed ? "pass" : "fail";
+
+// src/workflows/cooldown.ts
+init_db3();
+function cooldownToMs(cooldown) {
+  let ms = 0;
+  if (cooldown.hours)
+    ms += cooldown.hours * 60 * 60 * 1000;
+  if (cooldown.minutes)
+    ms += cooldown.minutes * 60 * 1000;
+  if (cooldown.seconds)
+    ms += cooldown.seconds * 1000;
+  return ms;
 }
-function getSuccessors(def, nodeId, port) {
-  const node = def.nodes.find((n) => n.id === nodeId);
-  if (!node?.next)
-    return [];
-  const targetIds = [];
-  if (typeof node.next === "string") {
-    targetIds.push(node.next);
-  } else if (Array.isArray(node.next)) {
-    targetIds.push(...node.next);
-  } else {
-    if (port) {
-      const targetId = node.next[port];
-      if (targetId)
-        targetIds.push(targetId);
-    } else {
-      targetIds.push(...Object.values(node.next));
+async function shouldSkipCooldown(workflowId, cooldown) {
+  const cooldownMs = cooldownToMs(cooldown);
+  const now = Date.now();
+  const lastSuccess = await getLastSuccessfulRun2(workflowId);
+  if (lastSuccess?.finishedAt) {
+    const lastFinished = new Date(lastSuccess.finishedAt).getTime();
+    if (now - lastFinished < cooldownMs)
+      return true;
+  }
+  const lastAttempt = await getLastRunStart2(workflowId);
+  if (lastAttempt?.startedAt) {
+    const lastStarted = new Date(lastAttempt.startedAt).getTime();
+    if (now - lastStarted < cooldownMs)
+      return true;
+  }
+  return false;
+}
+
+// src/workflows/input.ts
+init_db3();
+init_secret_scrubber();
+async function resolveInputs(input) {
+  const resolved = {};
+  for (const [key, value] of Object.entries(input)) {
+    resolved[key] = await resolveInputValue(value);
+  }
+  return resolved;
+}
+async function resolveInputValue(value) {
+  const envMatch = /^\$\{(.+)\}$/.exec(value);
+  if (envMatch?.[1]) {
+    const envName = envMatch[1];
+    const envValue = process.env[envName];
+    if (envValue === undefined) {
+      throw new Error(`Environment variable "${envName}" is not set`);
     }
+    return envValue;
+  }
+  if (value.startsWith("secret.")) {
+    const secretName = value.slice("secret.".length);
+    const configs = await getSwarmConfigs2({ scope: "global", key: secretName });
+    const secretConfig = configs.find((c) => c.isSecret);
+    if (!secretConfig) {
+      throw new Error(`Secret "${secretName}" not found in config store`);
+    }
+    return secretConfig.value;
   }
-  return targetIds.map((id) => def.nodes.find((n) => n.id === id)).filter((n) => n != null);
+  return value;
 }
-function isUpstream(def, sourceId, targetId) {
-  const reverseDeps = new Map;
-  for (const node of def.nodes) {
-    if (!node.next)
+var REDACTED_SECRET_VALUE = "***REDACTED***";
+function getSecretInputKeys(input) {
+  const keys = new Set;
+  if (!input)
+    return keys;
+  for (const [key, value] of Object.entries(input)) {
+    if (typeof value !== "string")
+      continue;
+    if (value.startsWith("secret.")) {
+      keys.add(key);
       continue;
-    for (const target of getNextTargets(node.next)) {
-      if (!reverseDeps.has(target))
-        reverseDeps.set(target, []);
-      reverseDeps.get(target).push(node.id);
     }
-  }
-  const visited = new Set;
-  const queue = [targetId];
-  while (queue.length > 0) {
-    const current = queue.shift();
-    const preds = reverseDeps.get(current) || [];
-    for (const pred of preds) {
-      if (visited.has(pred))
-        continue;
-      visited.add(pred);
-      if (pred === sourceId)
-        return true;
-      queue.push(pred);
+    const envMatch = /^\$\{(.+)\}$/.exec(value);
+    if (envMatch?.[1] && isSensitiveKey(envMatch[1])) {
+      keys.add(key);
     }
   }
-  return false;
+  return keys;
 }
-function containsInterpolationToken(value) {
-  if (typeof value === "string")
-    return value.includes("{{") && value.includes("}}");
-  if (Array.isArray(value))
-    return value.some(containsInterpolationToken);
-  if (value && typeof value === "object") {
-    return Object.values(value).some(containsInterpolationToken);
+function redactSecretsForStorage(ctx, secretKeys) {
+  if (secretKeys.size === 0)
+    return ctx;
+  const inputBlock = ctx.input;
+  if (!inputBlock || typeof inputBlock !== "object")
+    return ctx;
+  const redactedInput = { ...inputBlock };
+  let touched = false;
+  for (const key of secretKeys) {
+    if (key in redactedInput) {
+      redactedInput[key] = REDACTED_SECRET_VALUE;
+      touched = true;
+    }
   }
-  return false;
-}
-function definitionNodeIds(def) {
-  return new Set(def.nodes.map((node) => node.id));
+  if (!touched)
+    return ctx;
+  return { ...ctx, input: redactedInput };
 }
-function validateDefinition(def, registry, options = {}) {
+
+// src/workflows/json-schema-validator.ts
+function validateJsonSchema(schema, data) {
   const errors = [];
-  const nodeIds = new Set(def.nodes.map((n) => n.id));
-  for (const node of def.nodes) {
-    if (node.id.includes("#") && !options.legacyNodeIds?.has(node.id)) {
-      errors.push(`Node "${node.id}" contains reserved character "#"`);
-    }
-    if (node.type === "human-in-the-loop" && typeof node.config.questions === "string" && !/^\{\{[^}]+\}\}$/.test(node.config.questions.trim())) {
-      errors.push(`Node "${node.id}" human-in-the-loop config.questions must be an array or one exact {{interpolation}} token`);
+  validate(schema, data, "", errors);
+  return errors;
+}
+function validate(schema, data, path, errors) {
+  const prefix = path || "root";
+  if (schema.type !== undefined) {
+    const expected = schema.type;
+    if (!matchesType(expected, data)) {
+      errors.push(`${prefix}: expected type "${expected}", got ${typeOf(data)}`);
+      return;
     }
-    errors.push(...systemOneStaticShapeViolations(node), ...systemOneExtractionStaticShapeViolations(node), ...systemOneRetryViolations(node));
-    if (node.type === "foreach") {
-      validateForeachNode(node, errors);
-      if (node.id.includes("#")) {
-        errors.push(`Node "${node.id}" cannot be a foreach: its id contains "#", which is reserved for synthetic child ids`);
-      }
-      if (isUpstream(def, node.id, node.id)) {
-        errors.push("foreach inside a loop is not supported in v1");
-      }
-      const collidingSibling = def.nodes.find((other) => other.id !== node.id && other.id.startsWith(`${node.id}#`));
-      if (collidingSibling) {
-        errors.push(`Node "${node.id}" cannot be a foreach: node "${collidingSibling.id}" collides with its synthetic child id space ("${node.id}#…")`);
+  }
+  if (Array.isArray(schema.required) && typeof data === "object" && data !== null) {
+    const obj = data;
+    for (const key of schema.required) {
+      if (!(key in obj)) {
+        errors.push(`${prefix}: missing required property "${key}"`);
       }
     }
   }
-  for (const node of def.nodes) {
-    if (!node.next)
-      continue;
-    if (typeof node.next === "string") {
-      if (!nodeIds.has(node.next)) {
-        errors.push(`Node "${node.id}" references non-existent next target "${node.next}"`);
-      }
-    } else if (Array.isArray(node.next)) {
-      for (const targetId of node.next) {
-        if (!nodeIds.has(targetId)) {
-          errors.push(`Node "${node.id}" fan-out references non-existent target "${targetId}"`);
-        }
-      }
-    } else {
-      for (const [port, targetId] of Object.entries(node.next)) {
-        if (!nodeIds.has(targetId)) {
-          errors.push(`Node "${node.id}" port "${port}" references non-existent target "${targetId}"`);
-        }
-      }
+  if (Array.isArray(schema.enum)) {
+    const allowed = schema.enum;
+    if (!allowed.some((v) => JSON.stringify(v) === JSON.stringify(data))) {
+      errors.push(`${prefix}: value ${JSON.stringify(data)} not in enum [${allowed.map((v) => JSON.stringify(v)).join(", ")}]`);
+      return;
     }
   }
-  const entryNodes = findEntryNodes(def);
+  if ("const" in schema) {
+    if (JSON.stringify(data) !== JSON.stringify(schema.const)) {
+      errors.push(`${prefix}: value ${JSON.stringify(data)} does not match const ${JSON.stringify(schema.const)}`);
+      return;
+    }
+  }
+  if (schema.properties !== undefined && typeof schema.properties === "object" && schema.properties !== null && typeof data === "object" && data !== null) {
+    const props = schema.properties;
+    const obj = data;
+    for (const [key, subSchema] of Object.entries(props)) {
+      if (key in obj) {
+        validate(subSchema, obj[key], path ? `${path}.${key}` : key, errors);
+      }
+    }
+  }
+  if (schema.items !== undefined && typeof schema.items === "object" && schema.items !== null && Array.isArray(data)) {
+    const itemSchema = schema.items;
+    for (let i = 0;i < data.length; i++) {
+      validate(itemSchema, data[i], `${prefix}[${i}]`, errors);
+    }
+  }
+}
+function matchesType(expected, data) {
+  switch (expected) {
+    case "string":
+      return typeof data === "string";
+    case "number":
+      return typeof data === "number";
+    case "boolean":
+      return typeof data === "boolean";
+    case "array":
+      return Array.isArray(data);
+    case "object":
+      return typeof data === "object" && data !== null && !Array.isArray(data);
+    default:
+      return true;
+  }
+}
+function typeOf(data) {
+  if (data === null)
+    return "null";
+  if (data === undefined)
+    return "undefined";
+  if (Array.isArray(data))
+    return "array";
+  return typeof data;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function findJsonSchemaShapeErrors(schema, path = "outputSchema") {
+  const errors = [];
+  if (!isPlainObject(schema)) {
+    errors.push(`${path}: must be a JSON Schema object, got ${typeOf(schema)}`);
+    return errors;
+  }
+  if (schema.type !== undefined && typeof schema.type !== "string") {
+    errors.push(`${path}.type: must be a string, got ${typeOf(schema.type)}`);
+  }
+  if (schema.required !== undefined && (!Array.isArray(schema.required) || !schema.required.every((v) => typeof v === "string"))) {
+    errors.push(`${path}.required: must be an array of strings`);
+  }
+  if (schema.enum !== undefined && !Array.isArray(schema.enum)) {
+    errors.push(`${path}.enum: must be an array`);
+  }
+  if (schema.properties !== undefined) {
+    if (!isPlainObject(schema.properties)) {
+      errors.push(`${path}.properties: must be an object mapping property names to schemas`);
+    } else {
+      for (const [key, value] of Object.entries(schema.properties)) {
+        errors.push(...findJsonSchemaShapeErrors(value, `${path}.properties.${key}`));
+      }
+    }
+  }
+  if (schema.items !== undefined) {
+    errors.push(...findJsonSchemaShapeErrors(schema.items, `${path}.items`));
+  }
+  return errors;
+}
+
+// src/workflows/limits.ts
+var DEFAULT_MAX_STEPS_PER_RUN = 500;
+function getMaxWorkflowStepsPerRun() {
+  return Number(process.env.WORKFLOW_MAX_STEPS_PER_RUN) || DEFAULT_MAX_STEPS_PER_RUN;
+}
+
+// src/workflows/node-timeout.ts
+var DEFAULT_NODE_TIMEOUT_MS = 30000;
+function resolveNodeTimeoutMs(node) {
+  const config = node.config ?? {};
+  if (typeof config.timeoutMs === "number")
+    return config.timeoutMs;
+  if (node.type === "script" && typeof config.timeout === "number")
+    return config.timeout;
+  return DEFAULT_NODE_TIMEOUT_MS;
+}
+
+// src/workflows/readiness.ts
+async function findWorkflowReadinessProblems(definition, registry) {
+  const nodesByType = new Map;
+  for (const node of definition.nodes) {
+    if (!registry.has(node.type))
+      continue;
+    const group = nodesByType.get(node.type) ?? [];
+    group.push({ id: node.id, config: node.config });
+    nodesByType.set(node.type, group);
+  }
+  const problems = [];
+  for (const [type, nodes] of nodesByType) {
+    try {
+      for (const problem of await registry.get(type).checkReadiness(nodes)) {
+        problems.push({ type, ...problem });
+      }
+    } catch {
+      problems.push({
+        type,
+        nodeIds: nodes.map((node) => node.id),
+        message: `Could not check whether "${type}" nodes are ready to run`
+      });
+    }
+  }
+  return problems;
+}
+function describeNodes(problem) {
+  const noun = problem.nodeIds.length === 1 ? "node" : "nodes";
+  return `${problem.type} ${noun} ${problem.nodeIds.map((id) => `"${id}"`).join(", ")}`;
+}
+function formatReadinessWarning(problem) {
+  return `${problem.message} Affects ${describeNodes(problem)}. Runs of this workflow fail before any node executes until this is fixed.`;
+}
+function formatReadinessProblems(problems) {
+  return problems.map((problem) => `${problem.message} Needed by ${describeNodes(problem)}.`).join(" ");
+}
+function formatReadinessRunError(problems) {
+  return `Run not started, no node executed: ${formatReadinessProblems(problems)}`;
+}
+async function workflowSaveWarnings(definition, registry) {
+  return (await findWorkflowReadinessProblems(definition, registry)).map(formatReadinessWarning);
+}
+function withSaveWarnings(text, warnings) {
+  return warnings.length === 0 ? text : `${text} ${warnings.map((warning) => `Warning: ${warning}`).join(" ")}`;
+}
+
+// src/workflows/template.ts
+init_template();
+
+// src/workflows/validation.ts
+function extractPassResult(executorType, output) {
+  if (!output || typeof output !== "object")
+    return false;
+  const o = output;
+  switch (executorType) {
+    case "validate":
+      return o.pass === true;
+    case "script":
+      return o.exitCode === 0;
+    case "property-match":
+      return o.passed === true;
+    case "raw-llm":
+      if (typeof o.result === "object" && o.result !== null) {
+        return o.result.pass === true;
+      }
+      return false;
+    default:
+      return o.pass === true || o.passed === true || o.exitCode === 0;
+  }
+}
+async function runStepValidation(registry, stepNode, stepOutput, context, meta) {
+  if (!stepNode.validation) {
+    return { outcome: "pass" };
+  }
+  const validation = stepNode.validation;
+  const executorType = validation.executor || "validate";
+  const executor = registry.get(executorType);
+  const validationConfig = {
+    targetNodeId: meta.nodeId,
+    ...validation.config
+  };
+  const validationContext = {
+    ...context,
+    [meta.nodeId]: stepOutput
+  };
+  const result = await executor.run({
+    config: validationConfig,
+    context: validationContext,
+    meta: {
+      ...meta,
+      stepId: crypto.randomUUID()
+    }
+  });
+  const passed = result.status === "success" && extractPassResult(executorType, result.output);
+  if (passed) {
+    return { outcome: "pass", passed: true };
+  }
+  if (validation.mustPass) {
+    if (validation.retry) {
+      return {
+        outcome: "retry",
+        passed: false,
+        retryContext: {
+          previousOutput: stepOutput,
+          validationResult: result.output
+        }
+      };
+    }
+    return { outcome: "halt", passed: false };
+  }
+  return { outcome: "pass", passed: false };
+}
+
+// src/workflows/engine.ts
+function maxIterations() {
+  return Number(process.env.WORKFLOW_MAX_ITERATIONS) || 100;
+}
+
+class TriggerSchemaError extends Error {
+  validationErrors;
+  constructor(validationErrors) {
+    super(`Trigger schema validation failed: ${validationErrors.join("; ")}`);
+    this.validationErrors = validationErrors;
+    this.name = "TriggerSchemaError";
+  }
+}
+async function resolveRenderedWorkflowInputs(input) {
+  const stringInputs = {};
+  const resolved = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (typeof value === "string")
+      stringInputs[key] = value;
+    else
+      resolved[key] = value;
+  }
+  return { ...resolved, ...await resolveInputs(stringInputs) };
+}
+async function startWorkflowExecution2(workflow, triggerData, registry, options = {}) {
+  const preflight = preflightAutomation(workflowPreflightInput(workflow), await getAutomationSetupStates());
+  if (preflight.state === "needs_setup") {
+    const { runId, recorded } = await recordWorkflowPreflightFailure({
+      workflowId: workflow.id,
+      triggerType: options.triggerType ?? "manual",
+      triggerData,
+      failureReason: preflight.failureReason,
+      createdBy: options.requestedByUserId
+    });
+    if (recorded)
+      await notifyAutomationPreflightFailure(preflight);
+    return runId;
+  }
+  workflow = renderAutomationTokens(workflow, workflow.params ?? {});
+  if (workflow.triggerSchema) {
+    const validationErrors = validateJsonSchema(workflow.triggerSchema, triggerData);
+    if (validationErrors.length > 0) {
+      throw new TriggerSchemaError(validationErrors);
+    }
+  }
+  if (workflow.cooldown && await shouldSkipCooldown(workflow.id, workflow.cooldown)) {
+    const runId = crypto.randomUUID();
+    await createWorkflowRun2({
+      id: runId,
+      workflowId: workflow.id,
+      triggerType: options.triggerType ?? "manual",
+      triggerData,
+      createdBy: options.requestedByUserId,
+      parentStepId: options.parentStepId
+    });
+    await updateWorkflowRun2(runId, {
+      status: "skipped",
+      error: "cooldown",
+      finishedAt: new Date().toISOString()
+    });
+    return runId;
+  }
+  const runId = crypto.randomUUID();
+  await createWorkflowRun2({
+    id: runId,
+    workflowId: workflow.id,
+    triggerType: options.triggerType ?? "manual",
+    triggerData,
+    createdBy: options.requestedByUserId,
+    parentStepId: options.parentStepId
+  });
+  telemetry.workflow("started", {
+    workflowId: workflow.id,
+    nodeCount: workflow.definition.nodes.length,
+    triggerType: options.triggerType ?? "manual"
+  });
+  const notReady = await findWorkflowReadinessProblems(workflow.definition, registry);
+  if (notReady.length > 0) {
+    await updateWorkflowRun2(runId, {
+      status: "failed",
+      error: formatReadinessRunError(notReady),
+      finishedAt: new Date().toISOString()
+    });
+    return runId;
+  }
+  const ctx = { trigger: triggerData };
+  if (options.requestedByUserId) {
+    ctx.swarm = { requestedByUserId: options.requestedByUserId };
+  }
+  if (workflow.dir || workflow.vcsRepo) {
+    ctx.workflow = { dir: workflow.dir, vcsRepo: workflow.vcsRepo };
+  }
+  if (workflow.input) {
+    try {
+      const resolved = await resolveRenderedWorkflowInputs(workflow.input);
+      Object.assign(ctx, { input: resolved });
+    } catch (err) {
+      await updateWorkflowRun2(runId, {
+        status: "failed",
+        error: `Input resolution failed: ${err}`,
+        finishedAt: new Date().toISOString()
+      });
+      return runId;
+    }
+  }
+  const entryNodes = findEntryNodes(workflow.definition);
+  const secretKeys = getSecretInputKeys(workflow.input);
+  const walk = walkGraph(workflow.definition, runId, ctx, entryNodes, registry, workflow.id, secretKeys, options);
+  if (options.parentStepId) {
+    walk.catch((err) => console.error(`[workflows] Child workflow run ${runId} failed:`, err));
+    return runId;
+  }
+  await walk;
+  return runId;
+}
+var activeWalks = new Map;
+var executingSteps = new Set;
+async function failRunOnUnreadableReplay(runId, err, stepId) {
+  if (!(err instanceof WorkflowReplayStateError))
+    return false;
+  const finishedAt = new Date().toISOString();
+  console.error(`[workflow] ${err.message}`);
+  if (stepId) {
+    await updateWorkflowRunStep2(stepId, {
+      status: "failed",
+      error: err.message,
+      finishedAt,
+      nextRetryAt: null
+    });
+  }
+  await updateWorkflowRun2(runId, { status: "failed", error: err.message, finishedAt });
+  return true;
+}
+function isWorkflowRunActive(runId) {
+  return activeWalks.has(runId);
+}
+function holdWorkflowRun(runId) {
+  activeWalks.set(runId, (activeWalks.get(runId) ?? 0) + 1);
+  let released = false;
+  return () => {
+    if (released)
+      return;
+    released = true;
+    const remaining = activeWalks.get(runId) - 1;
+    if (remaining === 0)
+      activeWalks.delete(runId);
+    else
+      activeWalks.set(runId, remaining);
+  };
+}
+async function walkGraph(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
+  const release = holdWorkflowRun(runId);
+  try {
+    await walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys, options);
+  } catch (err) {
+    if (!await failRunOnUnreadableReplay(runId, err))
+      throw err;
+  } finally {
+    release();
+  }
+}
+async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
+  if (!options.requestedByUserId) {
+    options = {
+      ...options,
+      requestedByUserId: (await getWorkflowRun2(runId))?.createdBy
+    };
+  }
+  let nodeExecutionCount = 0;
+  if (!("run" in ctx)) {
+    ctx.run = { id: runId };
+  }
+  const { completedNodeIds } = await rehydrateCompletedStepOutputs(def, runId, ctx, registry);
+  const { activeEdges } = await loadCompletedStepRouting(def, runId, completedNodeIds);
+  const allSteps = await getWorkflowRunStepsByRunId2(runId);
+  if (allSteps.length >= getMaxWorkflowStepsPerRun()) {
+    await updateWorkflowRun2(runId, {
+      status: "failed",
+      error: `Circuit breaker: run exceeded ${getMaxWorkflowStepsPerRun()} total steps (WORKFLOW_MAX_STEPS_PER_RUN)`,
+      finishedAt: new Date().toISOString()
+    });
+    return;
+  }
+  for (const step of allSteps) {
+    if (step.status !== "waiting")
+      continue;
+    const successors = getSuccessors(def, step.nodeId);
+    for (const succ of successors) {
+      activeEdges.add(`${step.nodeId}→${succ.id}`);
+    }
+  }
+  const awaited = awaitedNodeIds(allSteps, activeEdges);
+  let pendingNodes = startNodes.filter((n) => {
+    const preds = getAllPredecessors(def, n.id);
+    if (preds.length === 0) {
+      return !completedNodeIds.has(n.id);
+    }
+    const activePreds = preds.filter((predId) => activeEdges.has(`${predId}→${n.id}`) || awaited.has(predId));
+    const predsToCheck = activePreds.length > 0 ? activePreds : preds;
+    return predsToCheck.every((p) => completedNodeIds.has(p));
+  });
+  const executedInThisWalk = new Set;
+  while (pendingNodes.length > 0) {
+    nodeExecutionCount += pendingNodes.length;
+    if (nodeExecutionCount > maxIterations()) {
+      await updateWorkflowRun2(runId, {
+        status: "failed",
+        error: `Max node executions (${maxIterations()}) exceeded — possible infinite loop`,
+        finishedAt: new Date().toISOString()
+      });
+      return;
+    }
+    const results = await Promise.all(pendingNodes.map((node) => executeStep(def, runId, ctx, node, registry, workflowId, secretKeys, options).catch(async (err) => {
+      await failRunOnUnreadableReplay(runId, err);
+      return { outcome: "failed", successors: [] };
+    })));
+    const nextBatch = new Map;
+    let hasWaiting = false;
+    for (let i = 0;i < results.length; i++) {
+      const result = results[i];
+      if (result.outcome === "failed") {
+        const currentRun = await getWorkflowRun2(runId);
+        if (currentRun?.status === "failed")
+          return;
+        continue;
+      }
+      if (result.outcome === "waiting") {
+        hasWaiting = true;
+        continue;
+      }
+      const sourceNodeId = pendingNodes[i].id;
+      completedNodeIds.add(sourceNodeId);
+      executedInThisWalk.add(sourceNodeId);
+      for (const succ of result.successors) {
+        activeEdges.add(`${sourceNodeId}→${succ.id}`);
+        nextBatch.set(succ.id, succ);
+      }
+    }
+    if (hasWaiting)
+      return;
+    const readyNext = [];
+    const batchSteps = nextBatch.size > 0 ? await getWorkflowRunStepsByRunId2(runId) : [];
+    const batchAwaited = awaitedNodeIds(batchSteps, activeEdges);
+    const batchLatest = latestStepByNode(batchSteps);
+    for (const [nodeId, node] of nextBatch) {
+      if (executedInThisWalk.has(nodeId))
+        continue;
+      const allPreds = getAllPredecessors(def, nodeId);
+      for (const predId of allPreds) {
+        if (completedNodeIds.has(predId))
+          continue;
+        const latest = batchLatest.get(predId);
+        if (latest?.status !== "completed")
+          continue;
+        completedNodeIds.add(predId);
+        if (latest.output !== undefined)
+          ctx[predId] = latest.output;
+      }
+      const activePreds = allPreds.filter((predId) => activeEdges.has(`${predId}→${nodeId}`) || batchAwaited.has(predId));
+      const allActivePredsCompleted = activePreds.every((p) => completedNodeIds.has(p));
+      if (allActivePredsCompleted) {
+        readyNext.push(node);
+      }
+    }
+    pendingNodes = readyNext;
+  }
+  await getDbClient2().transaction(async () => {
+    const run = await getWorkflowRun2(runId);
+    if (!run || run.status !== "running")
+      return;
+    const finalSteps = await getWorkflowRunStepsByRunId2(runId);
+    if (hasRunningStep(finalSteps))
+      return;
+    const hasWaitingSteps = finalSteps.some((s) => s.status === "waiting");
+    const hasPendingRetries = finalSteps.some((s) => s.status === "failed" && s.nextRetryAt != null);
+    const isForeachChild = (s) => resolveForeachParent(def, s.nodeId) !== null;
+    const failedSteps = finalSteps.filter((s) => s.status === "failed" && s.nextRetryAt == null && !isForeachChild(s));
+    const entryNodeIds = new Set(findEntryNodes(def).map((n) => n.id));
+    const hasCompletedSteps = finalSteps.some((s) => s.status === "completed" && !entryNodeIds.has(s.nodeId) && !isForeachChild(s));
+    if (hasWaitingSteps) {
+      await updateWorkflowRun2(runId, { status: "waiting" });
+    } else if (!hasPendingRetries) {
+      if (failedSteps.length > 0 && !hasCompletedSteps) {
+        const failedNodeIds = failedSteps.map((s) => s.nodeId).join(", ");
+        await updateWorkflowRun2(runId, {
+          status: "failed",
+          error: `All branches failed. Failed nodes: ${failedNodeIds}`,
+          context: ctx,
+          finishedAt: new Date().toISOString()
+        });
+      } else if (failedSteps.length > 0) {
+        const failedNodeIds = failedSteps.map((s) => s.nodeId).join(", ");
+        await updateWorkflowRun2(runId, {
+          status: "completed",
+          error: `Partial failure: nodes [${failedNodeIds}] failed (mustPass validation), but other branches completed successfully`,
+          context: ctx,
+          finishedAt: new Date().toISOString()
+        });
+      } else {
+        await updateWorkflowRun2(runId, {
+          status: "completed",
+          context: ctx,
+          finishedAt: new Date().toISOString()
+        });
+      }
+    }
+  });
+}
+function latestStepByNode(steps) {
+  const latest = new Map;
+  for (const step of steps)
+    latest.set(step.nodeId, step);
+  return latest;
+}
+function awaitedNodeIds(steps, activeEdges) {
+  const latest = latestStepByNode(steps);
+  const awaited = new Set;
+  for (const [nodeId, step] of latest) {
+    if (step.status === "running" || step.status === "waiting")
+      awaited.add(nodeId);
+  }
+  for (const edge of activeEdges) {
+    const target = edge.slice(edge.indexOf("→") + 1);
+    if (!latest.has(target))
+      awaited.add(target);
+  }
+  return awaited;
+}
+function hasRunningStep(steps) {
+  for (const step of latestStepByNode(steps).values()) {
+    if (step.status === "running")
+      return true;
+  }
+  return false;
+}
+async function rehydrateCompletedStepOutputs(def, runId, ctx, registry) {
+  const completedNodeIds = new Set(await getCompletedStepNodeIds2(runId));
+  const latestSteps = new Map;
+  for (const nodeId of completedNodeIds) {
+    if (resolveForeachParent(def, nodeId))
+      continue;
+    const step = await getLatestStepForNode2(runId, nodeId);
+    if (!step)
+      continue;
+    if (step.output !== undefined) {
+      const node = def.nodes.find((candidate) => candidate.id === nodeId);
+      if (node && registry.has(node.type)) {
+        const executor = registry.get(node.type);
+        const parseResult = executor.outputSchema.safeParse(step.output);
+        if (!parseResult.success) {
+          console.warn(`[workflow] Recovery: step ${nodeId} output failed validation: ${parseResult.error.message}`);
+          continue;
+        }
+      }
+      ctx[nodeId] = step.output;
+    }
+    latestSteps.set(nodeId, step);
+  }
+  return { completedNodeIds, latestSteps };
+}
+function getAllPredecessors(def, nodeId) {
+  const preds = [];
+  for (const node of def.nodes) {
+    if (!node.next)
+      continue;
+    if (getNextTargets(node.next).includes(nodeId)) {
+      preds.push(node.id);
+    }
+  }
+  return preds;
+}
+async function executeStep(def, runId, ctx, node, registry, workflowId, secretKeys = new Set, options = {}) {
+  let claimedStepId;
+  const claimStep = async () => {
+    const run = await getWorkflowRun2(runId);
+    if (!run || run.status !== "running" && run.status !== "waiting") {
+      return { halted: true };
+    }
+    if (node.type !== "foreach") {
+      const current = await getCurrentStepForNode2(runId, node.id, getAllPredecessors(def, node.id));
+      if (current && (current.status !== "running" || executingSteps.has(current.id))) {
+        return { current };
+      }
+    }
+    const iteration = await getStepCountForNode2(runId, node.id);
+    const idempotencyKey = `${runId}:${node.id}:${iteration}`;
+    const existingStep = await getStepByIdempotencyKey2(idempotencyKey);
+    if (existingStep && (existingStep.status === "completed" || existingStep.status === "waiting")) {
+      return { existingStep, stepId: existingStep.id, deduped: true };
+    }
+    const latestForeachStep = node.type === "foreach" ? await getLatestStepForNode2(runId, node.id) : undefined;
+    const reusableForeachStep = latestForeachStep && !FOREACH_TERMINAL_STEP_STATUSES.has(latestForeachStep.status) ? latestForeachStep : undefined;
+    const stepId = reusableForeachStep?.id ?? crypto.randomUUID();
+    if (!reusableForeachStep) {
+      await createWorkflowRunStep2({
+        id: stepId,
+        runId,
+        nodeId: node.id,
+        nodeType: node.type,
+        input: redactSecretsForStorage(ctx, secretKeys),
+        idempotencyKey
+      });
+    }
+    claimedStepId = stepId;
+    executingSteps.add(stepId);
+    return { existingStep, stepId, deduped: false };
+  };
+  const dedup = await getDbClient2().transaction(claimStep).catch((err) => {
+    if (claimedStepId)
+      executingSteps.delete(claimedStepId);
+    throw err;
+  });
+  if ("halted" in dedup)
+    return { outcome: "completed", successors: [] };
+  if ("current" in dedup && dedup.current) {
+    if (dedup.current.status !== "completed")
+      return { outcome: "waiting", successors: [] };
+    ctx[node.id] = dedup.current.output;
+    return { outcome: "completed", successors: [] };
+  }
+  if (dedup.deduped && dedup.existingStep) {
+    if (dedup.existingStep.status === "completed") {
+      ctx[node.id] = dedup.existingStep.output;
+      const successors = getSuccessors(def, node.id);
+      return { outcome: "completed", successors };
+    }
+    return { outcome: "waiting", successors: [] };
+  }
+  try {
+    return await runClaimedStep(def, runId, ctx, node, registry, dedup.existingStep, dedup.stepId, workflowId, options);
+  } catch (err) {
+    if (await failRunOnUnreadableReplay(runId, err, dedup.stepId)) {
+      return { outcome: "failed", successors: [] };
+    }
+    throw err;
+  } finally {
+    executingSteps.delete(dedup.stepId);
+  }
+}
+async function runClaimedStep(def, runId, ctx, node, registry, existingStep, stepId, workflowId, options = {}) {
+  const executor = registry.get(node.type);
+  const systemOneRetryProblems = systemOneRetryViolations(node);
+  if (systemOneRetryProblems.length > 0) {
+    await checkpointStepFailure(runId, stepId, systemOneRetryProblems.join("; "), 0);
+    return { outcome: "failed", successors: [] };
+  }
+  const interpolationCtx = buildNodeInterpolationCtx(node, ctx);
+  if (node.inputSchema) {
+    const inputErrors = validateJsonSchema(node.inputSchema, interpolationCtx);
+    if (inputErrors.length > 0) {
+      const errorMsg = `Input schema validation failed: ${inputErrors.join("; ")}`;
+      await checkpointStepFailure(runId, stepId, errorMsg, 0);
+      throw new Error(errorMsg);
+    }
+  }
+  const {
+    value: interpolatedValue,
+    unresolved,
+    scriptBodyUnresolved,
+    strictUnresolved
+  } = interpolateNodeConfig(node, interpolationCtx);
+  const interpolatedConfig = interpolatedValue;
+  const executionCtx = { ...ctx, ...interpolationCtx };
+  if (scriptBodyUnresolved && scriptBodyUnresolved.length > 0) {
+    const errorMsg = scriptBodyInterpolationError(node.id, scriptBodyUnresolved);
+    await checkpointStepFailure(runId, stepId, errorMsg, 0);
+    return { outcome: "failed", successors: [] };
+  }
+  if (strictUnresolved && strictUnresolved.length > 0) {
+    await checkpointStepFailure(runId, stepId, systemOneUnresolvedError(node.id, strictUnresolved, node.type), 0);
+    return { outcome: "failed", successors: [] };
+  }
+  if (unresolved.length > 0) {
+    console.warn(`[workflow] Step ${node.id}: unresolved interpolation tokens: ${unresolved.join(", ")}`);
+    await updateWorkflowRunStep2(stepId, {
+      diagnostics: JSON.stringify({ unresolvedTokens: unresolved })
+    });
+  }
+  const meta = {
+    runId,
+    stepId,
+    nodeId: node.id,
+    workflowId: workflowId || "",
+    dryRun: false,
+    requestedByUserId: options.requestedByUserId,
+    inputCtx: interpolationCtx
+  };
+  const timeoutMs = resolveNodeTimeoutMs(node);
+  let result;
+  try {
+    result = await Promise.race([
+      executor.run({
+        config: interpolatedConfig,
+        context: executionCtx,
+        meta
+      }),
+      timeoutPromise(timeoutMs)
+    ]);
+  } catch (err) {
+    const errorMsg = err instanceof Error ? err.message : String(err);
+    const retryPolicy = node.retry || executor.retryPolicy;
+    const currentRetryCount = existingStep?.retryCount || 0;
+    const { shouldRetry } = await checkpointStepFailure(runId, stepId, errorMsg, currentRetryCount, retryPolicy);
+    if (!shouldRetry) {
+      throw err;
+    }
+    return { outcome: "completed", successors: [] };
+  }
+  if (result.status === "failed") {
+    const retryPolicy = node.retry || executor.retryPolicy;
+    const currentRetryCount = existingStep?.retryCount || 0;
+    const { shouldRetry } = await checkpointStepFailure(runId, stepId, result.error || "Executor returned failed status", currentRetryCount, retryPolicy);
+    if (result.output !== undefined) {
+      await updateWorkflowRunStep2(stepId, { output: result.output });
+    }
+    if (!shouldRetry) {
+      throw new Error(result.error || "Step execution failed");
+    }
+    return { outcome: "completed", successors: [] };
+  }
+  if ("async" in result && result.async) {
+    if (result.waitFor === FOREACH_ITEMS_WAIT_FOR) {
+      const drive = await parkAndDriveForeach({
+        runId,
+        stepId,
+        parentNodeId: node.id,
+        ctx,
+        registry
+      });
+      if (drive.joined)
+        return { outcome: "completed", successors: drive.successors };
+      return { outcome: drive.parked ? "waiting" : "completed", successors: [] };
+    }
+    const waiting = await checkpointStepWaiting(runId, stepId, ctx);
+    if (waiting && result.waitFor === "workflow.child.finished") {
+      const { resumeFromChildRun } = await import("./resume-5s2t0dbs.js");
+      await resumeFromChildRun(stepId, registry);
+    }
+    return { outcome: waiting ? "waiting" : "completed", successors: [] };
+  }
+  if (node.outputSchema && result.status === "success") {
+    const outputErrors = validateJsonSchema(node.outputSchema, result.output);
+    if (outputErrors.length > 0) {
+      const errorMsg = `Output schema validation failed: ${outputErrors.join("; ")}`;
+      await checkpointStepFailure(runId, stepId, errorMsg, 0);
+      throw new Error(errorMsg);
+    }
+  }
+  let validationResult;
+  if (node.validation) {
+    validationResult = await runStepValidation(registry, node, result.output, executionCtx, meta);
+    if (validationResult.outcome === "halt") {
+      const errorMsg = "Validation failed (mustPass)";
+      await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, { markRunFailed: false });
+      return { outcome: "failed", successors: [] };
+    }
+    if (validationResult.outcome === "retry") {
+      if (validationResult.retryContext) {
+        const historyKey = `${node.id}_validations`;
+        const existing = ctx[historyKey] || [];
+        ctx[historyKey] = [...existing, validationResult.retryContext];
+      }
+      const retryPolicy = node.validation.retry || node.retry;
+      const currentRetryCount = existingStep?.retryCount || 0;
+      await checkpointStepFailure(runId, stepId, "Validation failed, retrying", currentRetryCount, retryPolicy);
+      return { outcome: "completed", successors: [] };
+    }
+  }
+  result.nextPort = resolveValidationPort(node.next, result.nextPort, validationResult?.passed);
+  await checkpointStep(runId, stepId, node.id, result, ctx);
+  const successors = result.nextPort ? getSuccessors(def, node.id, result.nextPort) : getSuccessors(def, node.id);
+  return { outcome: "completed", successors };
+}
+function findReadyNodes(def, completedNodeIds, activeEdges) {
+  const predecessors = new Map;
+  for (const node of def.nodes) {
+    if (!predecessors.has(node.id)) {
+      predecessors.set(node.id, new Set);
+    }
+  }
+  for (const node of def.nodes) {
+    if (!node.next)
+      continue;
+    for (const target of getNextTargets(node.next)) {
+      if (!predecessors.has(target)) {
+        predecessors.set(target, new Set);
+      }
+      predecessors.get(target).add(node.id);
+    }
+  }
+  return def.nodes.filter((node) => {
+    if (completedNodeIds.has(node.id))
+      return false;
+    const preds = predecessors.get(node.id);
+    if (!preds || preds.size === 0)
+      return true;
+    if (activeEdges) {
+      const activePreds = [...preds].filter((predId) => activeEdges.has(`${predId}→${node.id}`));
+      if (activePreds.length === 0)
+        return false;
+      return activePreds.every((pred) => completedNodeIds.has(pred));
+    }
+    for (const pred of preds) {
+      if (!completedNodeIds.has(pred))
+        return false;
+    }
+    return true;
+  });
+}
+function buildNodeInterpolationCtx(node, ctx) {
+  const interpolationCtx = {};
+  if (ctx.trigger !== undefined)
+    interpolationCtx.trigger = ctx.trigger;
+  if (ctx.input !== undefined)
+    interpolationCtx.input = ctx.input;
+  if (ctx.workflow !== undefined)
+    interpolationCtx.workflow = ctx.workflow;
+  if (ctx.swarm !== undefined)
+    interpolationCtx.swarm = ctx.swarm;
+  if (ctx.run !== undefined)
+    interpolationCtx.run = ctx.run;
+  if (!node.inputs)
+    return interpolationCtx;
+  for (const [localName, sourcePath] of Object.entries(node.inputs)) {
+    const keys = sourcePath.split(".");
+    let value = ctx;
+    for (const key of keys) {
+      if (value == null || typeof value !== "object") {
+        value = undefined;
+        break;
+      }
+      value = value[key];
+    }
+    interpolationCtx[localName] = value;
+  }
+  return interpolationCtx;
+}
+var SCRIPT_BODY_ALLOWED_SOURCES = new Set(["input", "workflow", "swarm", "run"]);
+function buildScriptBodyCtx(node, interpolationCtx) {
+  const aliases = node.inputs ?? {};
+  const safe = {};
+  for (const [key, value] of Object.entries(interpolationCtx)) {
+    const sourcePath = aliases[key];
+    const root = sourcePath === undefined ? key : sourcePath.split(".")[0] ?? "";
+    if (SCRIPT_BODY_ALLOWED_SOURCES.has(root))
+      safe[key] = value;
+  }
+  return safe;
+}
+var SYSTEM_ONE_DATA_FIELDS = new Set(["state", "questions", "fields", "images"]);
+function interpolateNodeConfig(node, interpolationCtx) {
+  if (isSystemOneNodeType(node.type)) {
+    const rest = {};
+    const dynamic = {};
+    for (const [key, value] of Object.entries(node.config)) {
+      if (SYSTEM_ONE_DATA_FIELDS.has(key))
+        dynamic[key] = value;
+      else
+        rest[key] = value;
+    }
+    const restResult = deepInterpolate(rest, interpolationCtx);
+    const dynamicResult = deepInterpolate(dynamic, interpolationCtx, { preserveRawTokens: true });
+    const unresolved = [...restResult.unresolved, ...dynamicResult.unresolved];
+    return {
+      value: {
+        ...restResult.value,
+        ...dynamicResult.value
+      },
+      unresolved,
+      strictUnresolved: unresolved
+    };
+  }
+  if (node.type === "foreach" && Object.hasOwn(node.config, "over")) {
+    const { over, body, ...configWithoutOverAndBody } = node.config;
+    const configResult = deepInterpolate(configWithoutOverAndBody, interpolationCtx);
+    const overResult = deepInterpolate(over, interpolationCtx, { preserveRawTokens: true });
+    return {
+      value: {
+        ...configResult.value,
+        over: overResult.value,
+        body
+      },
+      unresolved: [...configResult.unresolved, ...overResult.unresolved]
+    };
+  }
+  if (node.type === "human-in-the-loop" && typeof node.config.questions === "string") {
+    const { questions, ...configWithoutQuestions } = node.config;
+    const configResult = deepInterpolate(configWithoutQuestions, interpolationCtx);
+    const questionsResult = deepInterpolate(questions, interpolationCtx, {
+      preserveRawTokens: true
+    });
+    return {
+      value: {
+        ...configResult.value,
+        questions: questionsResult.value
+      },
+      unresolved: [...configResult.unresolved, ...questionsResult.unresolved]
+    };
+  }
+  if (node.type === "script" && typeof node.config.script === "string") {
+    const { script, ...configWithoutScript } = node.config;
+    const restResult = deepInterpolate(configWithoutScript, interpolationCtx);
+    const scriptResult = deepInterpolate(script, buildScriptBodyCtx(node, interpolationCtx));
+    return {
+      value: {
+        ...restResult.value,
+        script: scriptResult.unresolved.length > 0 ? script : scriptResult.value
+      },
+      unresolved: [...restResult.unresolved, ...scriptResult.unresolved],
+      scriptBodyUnresolved: scriptResult.unresolved
+    };
+  }
+  if (node.type !== "swarm-script" || !Object.hasOwn(node.config, "args")) {
+    return deepInterpolate(node.config, interpolationCtx);
+  }
+  const { args, ...configWithoutArgs } = node.config;
+  const configResult = deepInterpolate(configWithoutArgs, interpolationCtx);
+  const argsResult = deepInterpolate(args, interpolationCtx, { preserveRawTokens: true });
+  return {
+    value: {
+      ...configResult.value,
+      args: argsResult.value
+    },
+    unresolved: [...configResult.unresolved, ...argsResult.unresolved]
+  };
+}
+function scriptBodyInterpolationError(nodeId, tokens) {
+  const renderedTokens = [...new Set(tokens)].map((token) => `{{${token}}}`).join(", ");
+  return `Script body interpolation failed for node "${nodeId}": unresolved or disallowed token(s): ${renderedTokens}. Executable source may interpolate only input, workflow, swarm, or run values. Pass dynamic trigger or upstream values through config.args and read them from argv.`;
+}
+function timeoutPromise(ms) {
+  return new Promise((_, reject) => {
+    setTimeout(() => reject(new Error(`Step timed out after ${ms}ms`)), ms);
+  });
+}
+
+// src/workflows/executors/foreach.ts
+init_zod();
+init_workflow_runs();
+var ForeachBodySchema = object2({
+  type: string2().min(1),
+  config: record2(string2(), unknown())
+});
+var ForeachConfigSchema = object2({
+  over: array2(record2(string2(), unknown())),
+  itemKey: string2().min(1),
+  body: ForeachBodySchema,
+  concurrency: number2().int().min(1).optional(),
+  failurePolicy: _enum2(["fail-fast", "collect-outcomes"]).optional()
+});
+var ForeachResultSchema = object2({
+  itemKey: string2(),
+  status: _enum2(["completed", "failed", "cancelled", "skipped"]),
+  output: unknown().optional()
+});
+var ForeachOutputSchema = object2({
+  results: array2(ForeachResultSchema),
+  okCount: number2().int().nonnegative(),
+  failedCount: number2().int().nonnegative(),
+  cancelledCount: number2().int().nonnegative().optional()
+});
+
+class ForeachExecutor extends BaseExecutor {
+  type = "foreach";
+  mode = "async";
+  configSchema = ForeachConfigSchema;
+  outputSchema = ForeachOutputSchema;
+  async execute(config, _context, meta) {
+    if (config.over.length === 0) {
+      return {
+        status: "success",
+        output: { results: [], okCount: 0, failedCount: 0 }
+      };
+    }
+    const items = config.over.map((item, index) => {
+      const rawItemKey = item[config.itemKey];
+      if (typeof rawItemKey !== "string" || rawItemKey.length === 0) {
+        throw new Error(`foreach item at index ${index} is missing non-empty string itemKey property "${config.itemKey}"`);
+      }
+      return { item, index, itemKey: rawItemKey };
+    });
+    const seenItemKeys = new Set;
+    for (const { itemKey } of items) {
+      if (seenItemKeys.has(itemKey)) {
+        throw new Error(`foreach itemKey "${itemKey}" is duplicated`);
+      }
+      seenItemKeys.add(itemKey);
+    }
+    const bodyTypeError = foreachBodyTypeError(meta.nodeId, config.body.type);
+    if (bodyTypeError)
+      return { status: "failed", error: bodyTypeError };
+    const runSteps = await this.deps.db.getWorkflowRunStepsByRunId(meta.runId);
+    const existingChildNodeIds = new Set(runSteps.filter((step) => parseSyntheticNodeId(step.nodeId)?.parentNodeId === meta.nodeId).map((step) => step.nodeId));
+    const missingItems = items.filter(({ itemKey }) => !existingChildNodeIds.has(`${meta.nodeId}#${itemKey}`));
+    const childCountToCreate = missingItems.length;
+    const maxSteps = getMaxWorkflowStepsPerRun();
+    const workflow = await this.deps.db.getWorkflow(meta.workflowId);
+    const hasSuccessors = workflow ? getSuccessors(workflow.definition, meta.nodeId).length > 0 : true;
+    const totalSteps = runSteps.length + childCountToCreate;
+    const capBreached = hasSuccessors ? totalSteps >= maxSteps : totalSteps > maxSteps;
+    if (childCountToCreate > 0 && capBreached) {
+      return {
+        status: "failed",
+        error: `foreach would reach ${maxSteps} total steps (WORKFLOW_MAX_STEPS_PER_RUN): ${runSteps.length} existing + ${childCountToCreate} children${hasSuccessors ? " leaves no room for the post-join walk" : " exceeds the per-run cap"}`
+      };
+    }
+    await createForeachChildSteps(meta.runId, meta.nodeId, missingItems.map(({ index, itemKey }) => {
+      const childNodeId = `${meta.nodeId}#${itemKey}`;
+      return {
+        id: crypto.randomUUID(),
+        nodeId: childNodeId,
+        nodeType: config.body.type,
+        input: { itemKey, index, attempt: 0 },
+        idempotencyKey: `${meta.runId}:${childNodeId}:0`
+      };
+    }));
+    const childSteps = (await this.deps.db.getWorkflowRunStepsByRunId(meta.runId)).filter((step) => parseSyntheticNodeId(step.nodeId)?.parentNodeId === meta.nodeId);
+    if (childSteps.every((step) => FOREACH_TERMINAL_STEP_STATUSES.has(step.status))) {
+      return { status: "success", output: buildForeachAggregate(childSteps) };
+    }
+    return {
+      status: "success",
+      async: true,
+      waitFor: FOREACH_ITEMS_WAIT_FOR,
+      correlationId: meta.stepId
+    };
+  }
+}
+
+// src/workflows/step-input.ts
+async function rebuildNodeExecutionInput(def, run, node, registry, options = {}) {
+  const ctx = options.ctx ?? (run.context ?? {});
+  if (!("run" in ctx))
+    ctx.run = { id: run.id };
+  if (!options.ctx)
+    await rehydrateCompletedStepOutputs(def, run.id, ctx, registry);
+  const inputCtx = buildNodeInterpolationCtx(node, ctx);
+  const { value, unresolved, scriptBodyUnresolved, strictUnresolved } = interpolateNodeConfig(node, inputCtx);
+  return {
+    ctx,
+    inputCtx,
+    config: value,
+    unresolved,
+    scriptBodyUnresolved,
+    strictUnresolved
+  };
+}
+
+// src/workflows/foreach-driver.ts
+var ownedChildren = new Set;
+var activeDrives = new Set;
+var NOT_JOINED = { joined: false, successors: [], claimed: 0 };
+function isForeachChildOwned(stepId) {
+  return ownedChildren.has(stepId);
+}
+async function parkAndDriveForeach(input) {
+  const parked = await checkpointStepWaiting(input.runId, input.stepId, input.ctx, {
+    keepRunStatus: true
+  }) || (await getWorkflowRunStep2(input.stepId))?.status === "waiting";
+  if (!parked)
+    return { ...NOT_JOINED, parked: false };
+  const drive = await driveForeach(input.runId, input.parentNodeId, input.registry, {
+    ctx: input.ctx
+  });
+  if (!drive.joined)
+    await parkRunIfRunning(input.runId);
+  return { ...drive, parked: true };
+}
+async function driveForeach(runId, parentNodeId, registry, options = {}) {
+  const run = await getWorkflowRun2(runId);
+  if (!run || run.status !== "running" && run.status !== "waiting")
+    return NOT_JOINED;
+  const workflow = await getRenderedWorkflow(run.workflowId);
+  if (!workflow)
+    return NOT_JOINED;
+  const def = workflow.definition;
+  const parentNode = def.nodes.find((node) => node.id === parentNodeId);
+  if (!parentNode || parentNode.type !== "foreach")
+    return NOT_JOINED;
+  const parentStep = await getLatestStepForNode2(runId, parentNodeId);
+  if (!parentStep || FOREACH_TERMINAL_STEP_STATUSES.has(parentStep.status))
+    return NOT_JOINED;
+  const body = parentNode.config.body;
+  const bodyType = typeof body?.type === "string" ? body.type : "";
+  let parentInput;
+  let claimedTotal = 0;
+  const notJoined = () => ({ ...NOT_JOINED, claimed: claimedTotal });
+  for (;; ) {
+    const current = await getWorkflowRun2(runId);
+    if (!current || current.status !== "running" && current.status !== "waiting") {
+      return notJoined();
+    }
+    const claimed = await claimChildren(def, runId, parentNode);
+    if (claimed.length === 0)
+      return notJoined();
+    claimedTotal += claimed.length;
+    const started = new Set;
+    let failedFast;
+    try {
+      parentInput ??= await loadParentInput(def, run, parentNode, registry, workflow.id, options);
+      const { ctx, items, itemKeyField, meta } = parentInput;
+      for (const child of claimed) {
+        const liveness = await childLiveness(runId, child.id);
+        if (liveness === "run-ended")
+          return notJoined();
+        if (liveness === "child-ended")
+          continue;
+        started.add(child.id);
+        const outcome = await startChild({
+          def,
+          child,
+          registry,
+          ctx,
+          meta,
+          bodyType,
+          item: items.find((candidate) => candidate[itemKeyField] === childItemKey(child))
+        });
+        if (!outcome)
+          continue;
+        const settled = await settleForeachChild(def, runId, child.id, outcome, ctx, {
+          from: ["running"]
+        });
+        ownedChildren.delete(child.id);
+        if (settled.joined) {
+          return { joined: true, successors: settled.successors, claimed: claimedTotal };
+        }
+        if (settled.runFailed) {
+          failedFast = child.nodeId;
+          return notJoined();
+        }
+      }
+    } finally {
+      for (const child of claimed) {
+        ownedChildren.delete(child.id);
+        if (!started.has(child.id))
+          await requeueChild(child.id);
+      }
+      if (effectiveFailurePolicy(parentNode, def) === "fail-fast" && (failedFast || (await getWorkflowRun2(runId))?.status === "failed")) {
+        await cancelQueuedForeachChildren(def, runId, parentNodeId, failedFast);
+      }
+    }
+  }
+}
+async function loadParentInput(def, run, parentNode, registry, workflowId, options) {
+  const input = await rebuildNodeExecutionInput(def, run, parentNode, registry, {
+    ctx: options.ctx
+  });
+  const parsed = ForeachConfigSchema.safeParse(input.config);
+  return {
+    ctx: input.ctx,
+    items: parsed.success ? parsed.data.over : [],
+    itemKeyField: parsed.success ? parsed.data.itemKey : "",
+    meta: {
+      runId: run.id,
+      workflowId,
+      dryRun: false,
+      requestedByUserId: run.createdBy,
+      inputCtx: input.inputCtx
+    }
+  };
+}
+function startForeachDrive(runId, parentNodeId, registry) {
+  const drive = runForeachDrive(runId, parentNodeId, registry).then(() => {
+    return;
+  }).catch((err) => {
+    console.error(`[workflows] foreach drive of ${parentNodeId} in run ${runId} failed:`, err);
+  }).finally(() => {
+    activeDrives.delete(drive);
+  });
+  activeDrives.add(drive);
+}
+async function runForeachDrive(runId, parentNodeId, registry) {
+  const release = holdWorkflowRun(runId);
+  try {
+    const drive = await driveForeach(runId, parentNodeId, registry);
+    if (!drive.joined) {
+      await parkRunIfRunning(runId);
+      return drive;
+    }
+    const run = await getWorkflowRun2(runId);
+    const workflow = run ? await getRenderedWorkflow(run.workflowId) : null;
+    if (!run || !workflow)
+      return drive;
+    const ctx = run.context ?? {};
+    if (drive.successors.length > 0) {
+      await walkGraph(workflow.definition, runId, ctx, drive.successors, registry, workflow.id, getSecretInputKeys(workflow.input));
+    } else {
+      const { finalizeOrWait } = await import("./resume-5s2t0dbs.js");
+      await finalizeOrWait(runId);
+    }
+    return drive;
+  } finally {
+    release();
+  }
+}
+async function getRenderedWorkflow(workflowId) {
+  const workflow = await getWorkflow2(workflowId);
+  return workflow ? renderAutomationTokens(workflow, workflow.params ?? {}) : null;
+}
+async function childLiveness(runId, stepId) {
+  const run = await getWorkflowRun2(runId);
+  if (!run || run.status !== "running" && run.status !== "waiting")
+    return "run-ended";
+  const step = await getWorkflowRunStep2(stepId);
+  return step?.status === "running" ? "live" : "child-ended";
+}
+async function requeueChild(stepId) {
+  await getDbClient2().run("UPDATE workflow_run_steps SET status = 'pending' WHERE id = ? AND status = 'running'", [stepId]);
+}
+async function parkRunIfRunning(runId) {
+  await getDbClient2().transaction(async () => {
+    const run = await getWorkflowRun2(runId);
+    if (run?.status !== "running")
+      return;
+    const steps = await getWorkflowRunStepsByRunId2(runId);
+    if (hasRunningStep(steps))
+      return;
+    if (!steps.some((step) => step.status === "waiting"))
+      return;
+    await updateWorkflowRun2(runId, { status: "waiting" });
+  });
+}
+async function claimChildren(def, runId, parentNode) {
+  const claimed = [];
+  try {
+    await getDbClient2().transaction(async () => {
+      const children = latestForeachChildren(def, parentNode.id, await getWorkflowRunStepsByRunId2(runId));
+      for (const child of children) {
+        if (child.status === "running" && !ownedChildren.has(child.id)) {
+          ownedChildren.add(child.id);
+          claimed.push(child);
+        }
+      }
+      const inFlight = children.filter((child) => child.status === "running" || child.status === "waiting").length;
+      let free = foreachConcurrencyCap(parentNode) - inFlight;
+      for (const child of children) {
+        if (free <= 0)
+          break;
+        if (child.status !== "pending")
+          continue;
+        const row = await getDbClient2().get("UPDATE workflow_run_steps SET status = 'running' WHERE id = ? AND status = 'pending' RETURNING id", [child.id]);
+        if (!row)
+          continue;
+        ownedChildren.add(child.id);
+        claimed.push({ ...child, status: "running" });
+        free--;
+      }
+    });
+  } catch (err) {
+    for (const child of claimed)
+      ownedChildren.delete(child.id);
+    throw err;
+  }
+  return claimed;
+}
+async function startChild(input) {
+  const { def, child, registry, ctx, meta, bodyType, item } = input;
+  if (!item) {
+    return {
+      status: "failed",
+      error: `item "${childItemKey(child)}" is no longer present in over`
+    };
+  }
+  if (!isForeachBodyType(bodyType, registry)) {
+    return { status: "failed", error: `foreach body type "${bodyType}" cannot run` };
+  }
+  const bodyNode = resolveStepNode(def, child.nodeId);
+  if (!bodyNode)
+    return { status: "failed", error: `foreach child ${child.nodeId} has no body` };
+  const index = childIndex(child);
+  const bodyCtx = { ...meta.inputCtx, item, index };
+  const interpolation = interpolateNodeConfig(bodyNode, bodyCtx);
+  if (interpolation.scriptBodyUnresolved && interpolation.scriptBodyUnresolved.length > 0) {
+    return {
+      status: "failed",
+      error: scriptBodyInterpolationError(child.nodeId, interpolation.scriptBodyUnresolved)
+    };
+  }
+  if (interpolation.strictUnresolved && interpolation.strictUnresolved.length > 0) {
+    return {
+      status: "failed",
+      error: systemOneUnresolvedError(child.nodeId, interpolation.strictUnresolved, bodyType)
+    };
+  }
+  if (interpolation.unresolved.length > 0) {
+    console.warn(`[workflow] Step ${child.nodeId}: unresolved interpolation tokens: ${interpolation.unresolved.join(", ")}`);
+    await updateWorkflowRunStep2(child.id, {
+      diagnostics: JSON.stringify({ unresolvedTokens: interpolation.unresolved })
+    });
+  }
+  const config = interpolation.value;
+  if (bodyType === "agent-task") {
+    const linkedTask = await getTaskByWorkflowRunStepId2(child.id);
+    if (linkedTask?.status === "failed" || linkedTask?.status === "cancelled") {
+      await detachTaskFromWorkflowRunStep2(linkedTask.id);
+    }
+  }
+  const executor = registry.get(bodyType);
+  const timeoutMs = resolveNodeTimeoutMs({ type: bodyType, config });
+  let timer;
+  let result;
+  try {
+    result = await Promise.race([
+      executor.run({
+        config,
+        context: { ...ctx, ...bodyCtx },
+        meta: { ...meta, stepId: child.id, nodeId: child.nodeId }
+      }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`Step timed out after ${timeoutMs}ms`)), timeoutMs);
+      })
+    ]);
+  } catch (err) {
+    return { status: "failed", error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+  if (result.status === "failed") {
+    return {
+      status: "failed",
+      error: result.error || "Executor returned failed status",
+      ...result.output !== undefined ? { output: result.output } : {}
+    };
+  }
+  if ("async" in result && result.async) {
+    const parked = await getDbClient2().get("UPDATE workflow_run_steps SET status = 'waiting' WHERE id = ? AND status = 'running' RETURNING id", [child.id]);
+    if (parked && result.waitFor === "workflow.child.finished") {
+      ownedChildren.delete(child.id);
+      const { resumeFromChildRun } = await import("./resume-5s2t0dbs.js");
+      await resumeFromChildRun(child.id, registry);
+    }
+    return null;
+  }
+  return {
+    status: "completed",
+    output: bodyType === "agent-task" ? normalizeExistingTaskOutput(result.output) : result.output,
+    ...result.nextPort ? { nextPort: result.nextPort } : {}
+  };
+}
+function childItemKey(child) {
+  const input = child.input;
+  return typeof input?.itemKey === "string" ? input.itemKey : undefined;
+}
+function childIndex(child) {
+  const input = child.input;
+  return typeof input?.index === "number" ? input.index : 0;
+}
+function normalizeExistingTaskOutput(output) {
+  if (typeof output !== "object" || output === null)
+    return output;
+  const record = output;
+  if (typeof record.taskOutput !== "string")
+    return output;
+  try {
+    const parsed = JSON.parse(record.taskOutput);
+    if (typeof parsed === "object" && parsed !== null) {
+      return { ...record, taskOutput: parsed };
+    }
+  } catch {}
+  return output;
+}
+
+// src/workflows/foreach-join.ts
+var FOREACH_TERMINAL_STEP_STATUSES = new Set([
+  "completed",
+  "failed",
+  "cancelled",
+  "skipped"
+]);
+function parseSyntheticNodeId(nodeId) {
+  const separatorIndex = nodeId.indexOf("#");
+  if (separatorIndex <= 0 || separatorIndex === nodeId.length - 1)
+    return null;
+  return {
+    parentNodeId: nodeId.slice(0, separatorIndex),
+    itemKey: nodeId.slice(separatorIndex + 1)
+  };
+}
+function resolveForeachParent(def, nodeId) {
+  const parsed = parseSyntheticNodeId(nodeId);
+  if (!parsed)
+    return null;
+  const parent = def.nodes.find((node) => node.id === parsed.parentNodeId);
+  return parent?.type === "foreach" ? parent : null;
+}
+async function joinForeach(def, runId, childStep, ctx) {
+  const parent = resolveForeachParent(def, childStep.nodeId);
+  if (!parent) {
+    throw new Error(`Step "${childStep.nodeId}" is not a foreach child`);
+  }
+  const children = latestForeachChildren(def, parent.id, await getWorkflowRunStepsByRunId2(runId));
+  if (children.some((step) => !FOREACH_TERMINAL_STEP_STATUSES.has(step.status))) {
+    return { joined: false, parentNodeId: parent.id, successors: [] };
+  }
+  const parentStep = await getLatestStepForNode2(runId, parent.id);
+  if (!parentStep) {
+    throw new Error(`Waiting foreach parent step "${parent.id}" was not found`);
+  }
+  if (parentStep.status === "completed") {
+    return { joined: false, parentNodeId: parent.id, successors: [] };
+  }
+  const aggregate = buildForeachAggregate(children);
+  await checkpointStep(runId, parentStep.id, parent.id, { output: aggregate }, ctx);
+  return {
+    joined: true,
+    parentNodeId: parent.id,
+    successors: getSuccessors(def, parent.id)
+  };
+}
+function latestForeachChildren(def, parentNodeId, steps) {
+  const latest = new Map;
+  for (const step of steps) {
+    if (resolveForeachParent(def, step.nodeId)?.id === parentNodeId)
+      latest.set(step.nodeId, step);
+  }
+  return [...latest.values()].sort((a, b) => childIndex2(a) - childIndex2(b));
+}
+function buildForeachAggregate(children) {
+  const latest = new Map;
+  for (const step of children)
+    latest.set(step.nodeId, step);
+  const orderedChildren = [...latest.values()].sort((a, b) => childIndex2(a) - childIndex2(b));
+  const results = orderedChildren.map((step) => {
+    const parsed = parseSyntheticNodeId(step.nodeId);
+    const status = resultStatus(step);
+    return {
+      itemKey: parsed.itemKey,
+      status,
+      output: step.output
+    };
+  });
+  const failedCount = results.filter((result) => result.status !== "completed").length;
+  const cancelledCount = results.filter((result) => result.status === "cancelled").length;
+  const aggregate = {
+    results,
+    okCount: results.length - failedCount,
+    failedCount,
+    ...cancelledCount > 0 ? { cancelledCount } : {}
+  };
+  return aggregate;
+}
+function childIndex2(step) {
+  if (typeof step.input !== "object" || step.input === null)
+    return Number.MAX_SAFE_INTEGER;
+  const index = step.input.index;
+  return typeof index === "number" ? index : Number.MAX_SAFE_INTEGER;
+}
+function resultStatus(step) {
+  if (step.status !== "completed")
+    return step.status;
+  return step.error ? "failed" : "completed";
+}
+async function settleForeachChild(def, runId, childStepId, outcome, ctx, options = {}) {
+  const from = options.from ?? ["waiting"];
+  return await getDbClient2().transaction(async () => {
+    const unclaimed = {
+      claimed: false,
+      foreachChild: true,
+      joined: false,
+      successors: [],
+      runFailed: false
+    };
+    const current = await getWorkflowRunStep2(childStepId);
+    if (!current || !from.includes(current.status))
+      return unclaimed;
+    const parent = resolveForeachParent(def, current.nodeId);
+    if (!parent)
+      throw new Error(`Step "${current.nodeId}" is not a foreach child`);
+    const run = await getWorkflowRun2(runId);
+    if (!run)
+      return unclaimed;
+    const finishedAt = new Date().toISOString();
+    await updateWorkflowRunStep2(childStepId, {
+      status: outcome.status,
+      ...outcome.output !== undefined ? { output: outcome.output } : {},
+      ...outcome.error !== undefined ? { error: outcome.error } : {},
+      ...outcome.nextPort ? { nextPort: outcome.nextPort } : {},
+      finishedAt
+    });
+    if (run.status !== "running" && run.status !== "waiting")
+      return unclaimed;
+    if (outcome.status !== "completed" && effectiveFailurePolicy(parent, def) === "fail-fast") {
+      const reason = options.runError ?? outcome.error ?? `foreach item ${current.nodeId} failed`;
+      await cancelQueuedForeachChildren(def, runId, parent.id, current.nodeId);
+      await updateWorkflowRun2(runId, { status: "failed", error: reason, finishedAt });
+      return { ...unclaimed, claimed: true, runFailed: true };
+    }
+    const join = await joinForeach(def, runId, current, ctx);
+    await updateWorkflowRun2(runId, { status: "running" });
+    const registry = options.registry;
+    if (!join.joined && registry && await hasQueuedChild(def, runId, parent.id)) {
+      getDbClient2().afterCommit(() => startForeachDrive(runId, parent.id, registry));
+    }
+    return {
+      claimed: true,
+      foreachChild: true,
+      joined: join.joined,
+      successors: join.successors,
+      runFailed: false
+    };
+  });
+}
+async function cancelQueuedForeachChildren(def, runId, parentNodeId, failedChildNodeId) {
+  const failedKey = failedChildNodeId ? parseSyntheticNodeId(failedChildNodeId)?.itemKey ?? failedChildNodeId : undefined;
+  const error = failedKey ? `not started: fail-fast after item ${failedKey} failed` : "not started: fail-fast after the run failed";
+  const finishedAt = new Date().toISOString();
+  let cancelled = 0;
+  await getDbClient2().transaction(async () => {
+    const children = latestForeachChildren(def, parentNodeId, await getWorkflowRunStepsByRunId2(runId));
+    for (const child of children) {
+      if (child.status !== "pending")
+        continue;
+      const row = await getDbClient2().get("UPDATE workflow_run_steps SET status = 'cancelled', error = ?, finishedAt = ? WHERE id = ? AND status = 'pending' RETURNING id", [error, finishedAt, child.id]);
+      if (row)
+        cancelled++;
+    }
+  });
+  return cancelled;
+}
+async function hasQueuedChild(def, runId, parentNodeId) {
+  return latestForeachChildren(def, parentNodeId, await getWorkflowRunStepsByRunId2(runId)).some((child) => child.status === "pending");
+}
+
+// src/workflows/foreach-body.ts
+var FOREACH_BODY_REJECTED = {
+  foreach: "nested fan-out is not supported: synthetic ids and the join resolve one level only"
+};
+var FOREACH_BODY_ACCEPTED = {
+  script: "inline",
+  "swarm-script": "inline",
+  "raw-llm": "inline",
+  notify: "inline",
+  "property-match": "inline",
+  "code-match": "inline",
+  validate: "inline",
+  vcs: "inline",
+  "system-one-extraction": "inline",
+  "agent-task": "parks",
+  "sub-workflow": "parks",
+  "human-in-the-loop": "parks",
+  wait: "parks",
+  "system-one-decision": "parks"
+};
+function isForeachBodyType(type, registry) {
+  if (Object.hasOwn(FOREACH_BODY_REJECTED, type))
+    return false;
+  return registry ? registry.has(type) : Object.hasOwn(FOREACH_BODY_ACCEPTED, type);
+}
+function foreachBodyTypeError(nodeId, type, registry) {
+  const reason = FOREACH_BODY_REJECTED[type];
+  if (reason !== undefined) {
+    return `Node "${nodeId}" foreach config.body.type "${type}" is not supported: ${reason} (a ${type} body inside foreach "${nodeId}" is rejected)`;
+  }
+  if (registry && !registry.has(type)) {
+    return `Node "${nodeId}" foreach config.body.type "${type}" is not a registered executor`;
+  }
+  return null;
+}
+function resolveStepNode(def, nodeId) {
+  const node = def.nodes.find((candidate) => candidate.id === nodeId);
+  if (node)
+    return node;
+  const parent = resolveForeachParent(def, nodeId);
+  if (!parent)
+    return null;
+  const body = parent.config.body;
+  if (!isRecord3(body) || typeof body.type !== "string")
+    return null;
+  const inputs = parent.inputs ? Object.fromEntries(Object.entries(parent.inputs).filter(([alias]) => !FOREACH_ITEM_BINDINGS.has(alias))) : undefined;
+  return {
+    id: nodeId,
+    type: body.type,
+    config: isRecord3(body.config) ? body.config : {},
+    ...inputs ? { inputs } : {}
+  };
+}
+var FOREACH_ITEM_BINDINGS = new Set(["item", "index"]);
+var FOREACH_FAILURE_POLICIES = ["fail-fast", "collect-outcomes"];
+function effectiveFailurePolicy(node, def) {
+  const configured = node.config.failurePolicy;
+  if (configured === "fail-fast" || configured === "collect-outcomes")
+    return configured;
+  return def.onNodeFailure === "continue" ? "collect-outcomes" : "fail-fast";
+}
+function foreachConcurrencyCap(node) {
+  const cap = node.config.concurrency;
+  return typeof cap === "number" && Number.isInteger(cap) && cap >= 1 ? cap : Number.POSITIVE_INFINITY;
+}
+function stepFailureMode(def, nodeId) {
+  const parent = resolveForeachParent(def, nodeId);
+  if (parent)
+    return effectiveFailurePolicy(parent, def) === "fail-fast" ? "fail" : "continue";
+  return def.onNodeFailure ?? "fail";
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/workflows/definition.ts
+function getNextTargets(next) {
+  if (typeof next === "string")
+    return [next];
+  if (Array.isArray(next))
+    return next;
+  return Object.values(next);
+}
+function generateEdges(def) {
+  const edges = [];
+  for (const node of def.nodes) {
+    if (!node.next)
+      continue;
+    if (typeof node.next === "string") {
+      edges.push({
+        id: `${node.id}→${node.next}`,
+        source: node.id,
+        target: node.next,
+        sourcePort: "default"
+      });
+    } else if (Array.isArray(node.next)) {
+      for (const targetId of node.next) {
+        edges.push({
+          id: `${node.id}→${targetId}`,
+          source: node.id,
+          target: targetId,
+          sourcePort: "default"
+        });
+      }
+    } else {
+      for (const [port, targetId] of Object.entries(node.next)) {
+        edges.push({
+          id: `${node.id}→${targetId}:${port}`,
+          source: node.id,
+          target: targetId,
+          sourcePort: port
+        });
+      }
+    }
+  }
+  return edges;
+}
+function findEntryNodes(def) {
+  const targets = new Set;
+  for (const node of def.nodes) {
+    if (!node.next)
+      continue;
+    for (const targetId of getNextTargets(node.next)) {
+      targets.add(targetId);
+    }
+  }
+  return def.nodes.filter((n) => !targets.has(n.id));
+}
+function resolveValidationPort(next, executorPort, validationPassed) {
+  if (validationPassed === undefined)
+    return executorPort;
+  if (!next || typeof next !== "object" || Array.isArray(next))
+    return executorPort;
+  if (executorPort && Object.hasOwn(next, executorPort))
+    return executorPort;
+  return validationPassed ? "pass" : "fail";
+}
+function getSuccessors(def, nodeId, port) {
+  const node = def.nodes.find((n) => n.id === nodeId);
+  if (!node?.next)
+    return [];
+  const targetIds = [];
+  if (typeof node.next === "string") {
+    targetIds.push(node.next);
+  } else if (Array.isArray(node.next)) {
+    targetIds.push(...node.next);
+  } else {
+    if (port) {
+      const targetId = node.next[port];
+      if (targetId)
+        targetIds.push(targetId);
+    } else {
+      targetIds.push(...Object.values(node.next));
+    }
+  }
+  return targetIds.map((id) => def.nodes.find((n) => n.id === id)).filter((n) => n != null);
+}
+function isUpstream(def, sourceId, targetId) {
+  const reverseDeps = new Map;
+  for (const node of def.nodes) {
+    if (!node.next)
+      continue;
+    for (const target of getNextTargets(node.next)) {
+      if (!reverseDeps.has(target))
+        reverseDeps.set(target, []);
+      reverseDeps.get(target).push(node.id);
+    }
+  }
+  const visited = new Set;
+  const queue = [targetId];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    const preds = reverseDeps.get(current) || [];
+    for (const pred of preds) {
+      if (visited.has(pred))
+        continue;
+      visited.add(pred);
+      if (pred === sourceId)
+        return true;
+      queue.push(pred);
+    }
+  }
+  return false;
+}
+function containsInterpolationToken(value) {
+  if (typeof value === "string")
+    return value.includes("{{") && value.includes("}}");
+  if (Array.isArray(value))
+    return value.some(containsInterpolationToken);
+  if (value && typeof value === "object") {
+    return Object.values(value).some(containsInterpolationToken);
+  }
+  return false;
+}
+function definitionNodeIds(def) {
+  return new Set(def.nodes.map((node) => node.id));
+}
+function validateDefinition(def, registry, options = {}) {
+  const errors = [];
+  const nodeIds = new Set(def.nodes.map((n) => n.id));
+  for (const node of def.nodes) {
+    if (node.id.includes("#") && !options.legacyNodeIds?.has(node.id)) {
+      errors.push(`Node "${node.id}" contains reserved character "#"`);
+    }
+    if (node.type === "human-in-the-loop" && typeof node.config.questions === "string" && !/^\{\{[^}]+\}\}$/.test(node.config.questions.trim())) {
+      errors.push(`Node "${node.id}" human-in-the-loop config.questions must be an array or one exact {{interpolation}} token`);
+    }
+    errors.push(...systemOneStaticShapeViolations(node), ...systemOneExtractionStaticShapeViolations(node), ...systemOneRetryViolations(node));
+    if (node.type === "foreach") {
+      validateForeachNode(node, errors, registry);
+      if (node.id.includes("#")) {
+        errors.push(`Node "${node.id}" cannot be a foreach: its id contains "#", which is reserved for synthetic child ids`);
+      }
+      if (isUpstream(def, node.id, node.id)) {
+        errors.push("foreach inside a loop is not supported in v1");
+      }
+      const collidingSibling = def.nodes.find((other) => other.id !== node.id && other.id.startsWith(`${node.id}#`));
+      if (collidingSibling) {
+        errors.push(`Node "${node.id}" cannot be a foreach: node "${collidingSibling.id}" collides with its synthetic child id space ("${node.id}#…")`);
+      }
+    }
+  }
+  for (const node of def.nodes) {
+    if (!node.next)
+      continue;
+    if (typeof node.next === "string") {
+      if (!nodeIds.has(node.next)) {
+        errors.push(`Node "${node.id}" references non-existent next target "${node.next}"`);
+      }
+    } else if (Array.isArray(node.next)) {
+      for (const targetId of node.next) {
+        if (!nodeIds.has(targetId)) {
+          errors.push(`Node "${node.id}" fan-out references non-existent target "${targetId}"`);
+        }
+      }
+    } else {
+      for (const [port, targetId] of Object.entries(node.next)) {
+        if (!nodeIds.has(targetId)) {
+          errors.push(`Node "${node.id}" port "${port}" references non-existent target "${targetId}"`);
+        }
+      }
+    }
+  }
+  const entryNodes = findEntryNodes(def);
   if (entryNodes.length === 0) {
     errors.push("No entry node found (every node is a target of some other node)");
   } else if (entryNodes.length > 1) {
@@ -2750,11 +4945,12 @@ function validateDefinition(def, registry, options = {}) {
         continue;
       }
       reportStaticConfigIssues(node, registry.get(node.type).configSchema, node.config, errors);
-      if (node.type === "foreach" && registry.has("agent-task")) {
-        const body = node.config.body;
-        const bodyConfig = typeof body === "object" && body !== null && !Array.isArray(body) ? body.config : undefined;
+      const body = node.type === "foreach" ? node.config.body : undefined;
+      const bodyRecord = typeof body === "object" && body !== null && !Array.isArray(body) ? body : undefined;
+      if (bodyRecord && typeof bodyRecord.type === "string" && isForeachBodyType(bodyRecord.type, registry)) {
+        const bodyConfig = bodyRecord.config;
         if (typeof bodyConfig === "object" && bodyConfig !== null && !Array.isArray(bodyConfig)) {
-          reportStaticConfigIssues(node, registry.get("agent-task").configSchema, bodyConfig, errors, "config.body.config");
+          reportStaticConfigIssues(node, registry.get(bodyRecord.type).configSchema, bodyConfig, errors, "config.body.config");
         }
       }
     }
@@ -2802,10 +4998,13 @@ function reportStaticConfigIssues(node, schema, config, errors, pathPrefix = "co
     errors.push(`Node "${node.id}" (${node.type}) ${path} has invalid value ${renderedValue}: ${issue.message}`);
   }
 }
-function validateForeachNode(node, errors) {
+function validateForeachNode(node, errors, registry) {
   const config = node.config;
-  if (Object.hasOwn(config, "concurrency")) {
-    errors.push(`Node "${node.id}" foreach concurrency is not supported in v1`);
+  if (config.concurrency !== undefined && !(Number.isInteger(config.concurrency) && config.concurrency >= 1)) {
+    errors.push(`Node "${node.id}" foreach config.concurrency must be an integer of 1 or more, got ${JSON.stringify(config.concurrency)}`);
+  }
+  if (config.failurePolicy !== undefined && !FOREACH_FAILURE_POLICIES.includes(config.failurePolicy)) {
+    errors.push(`Node "${node.id}" foreach config.failurePolicy must be one of ${FOREACH_FAILURE_POLICIES.map((p) => `"${p}"`).join(", ")}, got ${JSON.stringify(config.failurePolicy)}`);
   }
   if (node.outputSchema !== undefined || node.validation !== undefined) {
     errors.push(`Node "${node.id}" foreach node-level outputSchema/validation is not supported in v1`);
@@ -2824,15 +5023,19 @@ function validateForeachNode(node, errors) {
     return;
   }
   const bodyRecord = body;
-  if (bodyRecord.type !== "agent-task") {
-    errors.push(`Node "${node.id}" foreach config.body.type must be "agent-task" in v1`);
+  if (typeof bodyRecord.type !== "string" || bodyRecord.type.length === 0) {
+    errors.push(`Node "${node.id}" foreach config.body.type must be a non-empty string`);
+  } else {
+    const typeError = foreachBodyTypeError(node.id, bodyRecord.type, registry);
+    if (typeError)
+      errors.push(typeError);
   }
   if (typeof bodyRecord.config !== "object" || bodyRecord.config === null || Array.isArray(bodyRecord.config)) {
     errors.push(`Node "${node.id}" foreach config.body.config must be an object`);
     return;
   }
   const bodyConfig = bodyRecord.config;
-  if (typeof bodyConfig.template !== "string") {
+  if (bodyRecord.type === "agent-task" && typeof bodyConfig.template !== "string") {
     errors.push(`Node "${node.id}" foreach agent-task body.config.template must be a string`);
   }
 }
@@ -2880,4 +5083,4 @@ function applyDefinitionPatch(def, patch) {
   return { definition: patchedDef, errors };
 }
 
-export { BaseExecutor, postApprovalCancellationUpdates, createApprovalFollowUpTask, HumanInTheLoopExecutor, resolveWorkflowLlmConfig, SYSTEM_ONE_PROVIDER_IDS, SystemOneExtractionExecutor, SYSTEM_ONE_DECISION_NODE_TYPE, SystemOneDecisionConfigSchema, isSystemOneNodeType, systemOneRetryViolations, systemOneUnresolvedError, SystemOneDecisionExecutor, getNextTargets, generateEdges, findEntryNodes, resolveValidationPort, getSuccessors, definitionNodeIds, validateDefinition, applyDefinitionPatch };
+export { notifyAutomationPreflightFailure, automationIntegrationFixUrl, isNeedsSetupFailure, preflightAutomation, renderAutomationTokens, getAutomationSetupStates, schedulePreflightInput, listEnabledAutomationPreflightInputs, recordSchedulePreflightFailure, BaseExecutor, postApprovalCancellationUpdates, createApprovalFollowUpTask, HumanInTheLoopExecutor, resolveWorkflowLlmConfig, SYSTEM_ONE_PROVIDER_IDS, SystemOneExtractionExecutor, SYSTEM_ONE_DECISION_NODE_TYPE, SystemOneDecisionConfigSchema, SystemOneDecisionExecutor, checkpointStep, checkpointStepFailure, checkpointStepWaiting, FAILED_TASK_OUTPUT_PREFIX, FOREACH_ITEMS_WAIT_FOR, loadCompletedStepRouting, resolveInputValue, getSecretInputKeys, validateJsonSchema, findJsonSchemaShapeErrors, getMaxWorkflowStepsPerRun, findWorkflowReadinessProblems, formatReadinessProblems, workflowSaveWarnings, withSaveWarnings, runStepValidation, TriggerSchemaError, startWorkflowExecution2, failRunOnUnreadableReplay, isWorkflowRunActive, holdWorkflowRun, walkGraph, hasRunningStep, findReadyNodes, scriptBodyInterpolationError, ForeachExecutor, rebuildNodeExecutionInput, isForeachChildOwned, parkAndDriveForeach, startForeachDrive, runForeachDrive, FOREACH_TERMINAL_STEP_STATUSES, parseSyntheticNodeId, resolveForeachParent, settleForeachChild, resolveStepNode, stepFailureMode, getNextTargets, generateEdges, resolveValidationPort, getSuccessors, definitionNodeIds, validateDefinition, applyDefinitionPatch };