@desplega.ai/agent-swarm 2.5.3 → 2.5.4

package/dist/{cli-kxawjrxg.js → cli-jb30dzvk.js}

@@ -40,7 +40,7 @@ import {
   init_identity_field_budget,
   contentSha256,
   init_profile_sync
-} from "./cli-gpv60278.js";
+} from "./cli-e42vss7b.js";
 import {
   isSlackConfigured,
   init_config
@@ -55,15 +55,7 @@ import {
 } from "./cli-zw88zjba.js";
 import {
   init_templates3
-} from "./cli-0ebey9hg.js";
-import {
-  registerTemplate,
-  getAllTemplateDefinitions,
-  init_registry,
-  configureDbResolver,
-  init_resolver,
-  init_session_templates
-} from "./cli-tx00c0h6.js";
+} from "./cli-j6rktc91.js";
 import {
   activeModelBlock,
   init_model_rate_limit_windows
@@ -78,6 +70,14 @@ import {
   getOpenRouterAttributionHeaders,
   init_openrouter_base_url
 } from "./cli-dfyv0jdy.js";
+import {
+  registerTemplate,
+  getAllTemplateDefinitions,
+  init_registry,
+  configureDbResolver,
+  init_resolver,
+  init_session_templates
+} from "./cli-dqygeeh5.js";
 import {
   runtimeHarnessSections,
   init_runtime_model_catalog
@@ -109,7 +109,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-y561h5a9.js";
+} from "./cli-xtrz6bzs.js";
 import {
   realtimeBus,
   init_bus
@@ -4206,7 +4206,8 @@ var init_sealed_json = __esm(() => {
     { table: "script_run_journal", column: "result" },
     { table: "workflow_run_steps", column: "output_replay" },
     { table: "workflow_runs", column: "context_replay" },
-    { table: "approval_requests", column: "responses" }
+    { table: "approval_requests", column: "responses" },
+    { table: "workflow_idempotency_keys", column: "responseBody" }
   ];
 });
 
@@ -4871,7 +4872,7 @@ var init_runtime = __esm(() => {
 // src/telemetry-identity.ts
 async function loadUserRole(userId) {
   try {
-    const { getUserGrant } = await import("./rbac-roles-gfn30fb8.js");
+    const { getUserGrant } = await import("./rbac-roles-prmkdnkw.js");
     const grant = await getUserGrant(userId);
     const role = grant.grantsAll ? "admin" : "member";
     const user = await getDbClient2().get("SELECT json_extract(metadata, '$.jobFunction') AS jobFunction FROM users WHERE id = ? AND json_valid(metadata)", [userId]);
@@ -5625,6 +5626,27 @@ async function getPendingApprovalsForTasks2(taskIds) {
      WHERE sourceTaskId IN (${taskIds.map(() => "?").join(",")}) AND status = 'pending'
      ORDER BY createdAt, id`, taskIds);
 }
+function approvalCancellationNotificationKey(target, messageTs) {
+  return `${target}:${messageTs}`;
+}
+async function listUndeliveredCancelledApprovalRequestIds(runIds) {
+  const ids = [];
+  for (let i = 0;i < runIds.length; i += 500) {
+    const chunk = runIds.slice(i, i + 500);
+    const rows = await getDbClient2().query(`SELECT id, notificationChannels, cancellationNotificationClaims AS claims
+         FROM approval_requests
+        WHERE workflowRunId IN (${chunk.map(() => "?").join(", ")})
+          AND status = 'cancelled' AND notificationChannels IS NOT NULL`, chunk);
+    for (const row of rows) {
+      const claims = row.claims ? JSON.parse(row.claims) : {};
+      const channels = JSON.parse(row.notificationChannels);
+      const undelivered = channels.some((n) => n.channel === "slack" && n.target && n.messageTs && claims[approvalCancellationNotificationKey(n.target, n.messageTs)] !== "delivered");
+      if (undelivered)
+        ids.push(row.id);
+    }
+  }
+  return ids;
+}
 var init_approvals = __esm(() => {
   init_secret_scrubber();
   init_date_utils();
@@ -8026,7 +8048,7 @@ async function overwriteTerminalTaskResultText2(id, patch) {
   });
   return row ? rowToAgentTask(row) : task;
 }
-async function cancelTask2(id, reason) {
+async function cancelTask2(id, reason, options = {}) {
   const oldTask = await getTaskById2(id);
   if (!oldTask)
     return null;
@@ -8077,10 +8099,12 @@ async function cancelTask2(id, reason) {
     } catch (error) {
       console.error("[cancelTask] pending steering promotion error:", scrubSecrets(error instanceof Error ? error.message : String(error)));
     }
-    try {
-      await dependencies3.cascadeFailDependents(id, "cancelled");
-    } catch (err) {
-      console.error("[cancelTask] cascade-fail dependents error:", err);
+    if (options.cascadeDependents !== false) {
+      try {
+        await dependencies3.cascadeFailDependents(id, "cancelled");
+      } catch (err) {
+        console.error("[cancelTask] cascade-fail dependents error:", err);
+      }
     }
   }
   return row ? rowToAgentTask(row) : null;
@@ -8361,18 +8385,257 @@ var init_write = __esm(() => {
   lastAffinityDispatchSkipLoggedAt = new Map;
 });
 
+// src/be/db/workflow-idempotency.ts
+function sha256(text) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(text);
+  return hasher.digest("hex");
+}
+function sortKeys(value) {
+  if (Array.isArray(value))
+    return value.map(sortKeys);
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).filter(([, nested]) => nested !== undefined).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, nested]) => [key, sortKeys(nested)]));
+}
+function workflowRequestFingerprint(operation, body) {
+  return sha256(`${operation}
+${JSON.stringify(sortKeys(body ?? null))}`);
+}
+function scopeParams(scope) {
+  return [scope.principal, scope.operation, scope.targetId, sha256(scope.key)];
+}
+async function findAcceptedWorkflowOperation(scope) {
+  const row = await getDbClient2().get(`SELECT requestFingerprint, responseStatus, responseBody, resourceDeletedAt
+       FROM workflow_idempotency_keys WHERE ${SCOPE_WHERE}`, scopeParams(scope));
+  if (!row)
+    return null;
+  return {
+    fingerprint: row.requestFingerprint,
+    status: row.responseStatus,
+    body: row.responseBody === null ? null : openSealedJson(row.responseBody),
+    resourceDeletedAt: row.resourceDeletedAt
+  };
+}
+async function assertWorkflowIdempotencyKeyUnused(scope) {
+  const taken = await getDbClient2().get(`SELECT 1 FROM workflow_idempotency_keys WHERE ${SCOPE_WHERE}`, scopeParams(scope));
+  if (taken)
+    throw new IdempotencyKeyTakenError;
+}
+async function recordAcceptedWorkflowOperation(claim, accepted) {
+  await assertWorkflowIdempotencyKeyUnused(claim);
+  const actor = getCurrentRequestUserId() ?? null;
+  try {
+    await getDbClient2().run(`INSERT INTO workflow_idempotency_keys
+         (id, principal, operation, targetId, keyHash, requestFingerprint, workflowId, runId,
+          responseStatus, responseBody, createdAt, created_by, updated_by)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      crypto.randomUUID(),
+      ...scopeParams(claim),
+      claim.fingerprint,
+      accepted.workflowId,
+      accepted.runId ?? null,
+      accepted.status,
+      sealJson(accepted.body),
+      new Date().toISOString(),
+      actor,
+      actor
+    ]);
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("UNIQUE constraint failed")) {
+      throw new IdempotencyKeyTakenError;
+    }
+    throw err;
+  }
+}
+async function tombstoneWorkflowIdempotencyKeys(workflowId) {
+  await getDbClient2().run(`UPDATE workflow_idempotency_keys
+        SET responseBody = NULL, resourceDeletedAt = ?, updated_by = ?
+      WHERE workflowId = ? AND resourceDeletedAt IS NULL`, [new Date().toISOString(), getCurrentRequestUserId() ?? null, workflowId]);
+}
+var IdempotencyKeyTakenError, SCOPE_WHERE = "principal = ? AND operation = ? AND targetId = ? AND keyHash = ?";
+var init_workflow_idempotency = __esm(() => {
+  init_request_auth_context();
+  init_sealed_json();
+  init_runtime();
+  IdempotencyKeyTakenError = class IdempotencyKeyTakenError extends Error {
+    constructor() {
+      super("Idempotency-Key was accepted by a concurrent request");
+      this.name = "IdempotencyKeyTakenError";
+    }
+  };
+});
+
 // src/be/db/workflow-runs.ts
+async function getRunLineageBlock(runId) {
+  const rows = await getDbClient2().query(`WITH RECURSIVE lineage(id, status, parentStepId, depth) AS (
+       SELECT id, status, parentStepId, 0 FROM workflow_runs WHERE id = ?
+       UNION ALL
+       SELECT r.id, r.status, r.parentStepId, l.depth + 1
+         FROM lineage l
+         JOIN workflow_run_steps s ON s.id = l.parentStepId
+         JOIN workflow_runs r ON r.id = s.runId
+        WHERE l.depth < ?
+     )
+     SELECT id, status, parentStepId, depth FROM lineage ORDER BY depth`, [runId, WORKFLOW_RUN_TREE_MAX_DEPTH]);
+  if (rows.length === 0)
+    return `Workflow run ${runId} is missing`;
+  const seen = new Set;
+  for (const row of rows) {
+    if (seen.has(row.id))
+      return `Workflow run ${runId} has a cycle in its parent links`;
+    seen.add(row.id);
+    if (row.status === "cancelled") {
+      return row.id === runId ? `Workflow run ${runId} is cancelled` : `Ancestor workflow run ${row.id} is cancelled`;
+    }
+  }
+  const top = rows[rows.length - 1];
+  if (top.parentStepId == null)
+    return null;
+  if (top.depth >= WORKFLOW_RUN_TREE_MAX_DEPTH) {
+    return `Workflow run ${runId} is nested deeper than ${WORKFLOW_RUN_TREE_MAX_DEPTH} levels`;
+  }
+  return `Parent step ${top.parentStepId} of workflow run ${top.id} is missing`;
+}
+async function getWorkflowRunTreeIds(rootId, bounds = {}) {
+  const maxDepth = bounds.maxDepth ?? WORKFLOW_RUN_TREE_MAX_DEPTH;
+  const ids = [rootId];
+  const seen = new Set(ids);
+  let level = [rootId];
+  for (let depth = 1;level.length > 0; depth++) {
+    const next = [];
+    for (let i = 0;i < level.length; i += TREE_QUERY_CHUNK) {
+      const chunk = level.slice(i, i + TREE_QUERY_CHUNK);
+      const rows = await getDbClient2().query(`SELECT c.id
+           FROM workflow_run_steps s
+           JOIN workflow_runs c ON c.parentStepId = s.id
+          WHERE s.runId IN (${chunk.map(() => "?").join(", ")})`, chunk);
+      for (const { id } of rows) {
+        if (seen.has(id)) {
+          throw new WorkflowRunTreeError(`Workflow run tree of ${rootId} has a cycle at run ${id}`);
+        }
+        seen.add(id);
+        next.push(id);
+      }
+    }
+    if (next.length > 0 && depth > maxDepth) {
+      throw new WorkflowRunTreeError(`Workflow run tree of ${rootId} is nested deeper than ${maxDepth} levels`);
+    }
+    ids.push(...next);
+    level = next;
+  }
+  return ids;
+}
+async function getWorkflowRunStatus(runId) {
+  const row = await getDbClient2().get("SELECT status FROM workflow_runs WHERE id = ?", [runId]);
+  return row?.status ?? null;
+}
+async function forEachChunk(ids, fn) {
+  for (let i = 0;i < ids.length; i += TREE_QUERY_CHUNK) {
+    const chunk = ids.slice(i, i + TREE_QUERY_CHUNK);
+    await fn(chunk, chunk.map(() => "?").join(", "));
+  }
+}
+async function getOpenWorkflowTreeTaskIds(runIds) {
+  const ids = [];
+  const terminal = TERMINAL_TASK_STATUSES.map(() => "?").join(", ");
+  await forEachChunk(runIds, async (chunk, placeholders) => {
+    const rows = await getDbClient2().query(`SELECT id FROM agent_tasks
+        WHERE workflowRunId IN (${placeholders}) AND status NOT IN (${terminal})`, [...chunk, ...TERMINAL_TASK_STATUSES]);
+    for (const row of rows)
+      ids.push(row.id);
+  });
+  return ids;
+}
+async function getTaskIdsWithDependents() {
+  const rows = await getDbClient2().query(`SELECT DISTINCT dep.value AS id
+       FROM agent_tasks t, json_each(t.dependsOn) AS dep
+      WHERE t.status NOT IN (${TERMINAL_TASK_STATUSES.map(() => "?").join(", ")})
+        AND t.dependsOn IS NOT NULL AND t.dependsOn != '[]'`, [...TERMINAL_TASK_STATUSES]);
+  return new Set(rows.map((row) => row.id));
+}
+async function workflowRunTreeHasOpenWork(runIds) {
+  const terminal = TERMINAL_TASK_STATUSES.map(() => "?").join(", ");
+  const probes = [
+    {
+      sql: (ids) => `SELECT 1 FROM workflow_runs WHERE id IN (${ids}) AND status IN ('running', 'waiting') LIMIT 1`,
+      params: []
+    },
+    {
+      sql: (ids) => `SELECT 1 FROM workflow_run_steps
+        WHERE runId IN (${ids})
+          AND (status IN ('pending', 'running', 'waiting')
+               OR (status = 'failed' AND nextRetryAt IS NOT NULL))
+        LIMIT 1`,
+      params: []
+    },
+    {
+      sql: (ids) => `SELECT 1 FROM agent_tasks WHERE workflowRunId IN (${ids}) AND status NOT IN (${terminal}) LIMIT 1`,
+      params: [...TERMINAL_TASK_STATUSES]
+    },
+    {
+      sql: (ids) => `SELECT 1 FROM approval_requests WHERE workflowRunId IN (${ids}) AND status = 'pending' LIMIT 1`,
+      params: []
+    }
+  ];
+  let open = false;
+  await forEachChunk(runIds, async (chunk, placeholders) => {
+    for (const probe of probes) {
+      if (open)
+        return;
+      if (await getDbClient2().get(probe.sql(placeholders), [...chunk, ...probe.params])) {
+        open = true;
+      }
+    }
+  });
+  return open;
+}
+async function cancelOpenWorkflowTreeSteps(runIds, reason, finishedAt) {
+  await forEachChunk(runIds, async (chunk, placeholders) => {
+    await getDbClient2().run(`UPDATE workflow_run_steps
+          SET status = 'cancelled', error = ?, finishedAt = ?
+        WHERE runId IN (${placeholders}) AND status IN ('pending', 'running', 'waiting')`, [scrubSecrets(reason), finishedAt, ...chunk]);
+  });
+}
+async function disarmWorkflowTreeRetries(runIds, finishedAt) {
+  await forEachChunk(runIds, async (chunk, placeholders) => {
+    await getDbClient2().run(`UPDATE workflow_run_steps
+          SET nextRetryAt = NULL, finishedAt = COALESCE(finishedAt, ?)
+        WHERE runId IN (${placeholders}) AND status = 'failed' AND nextRetryAt IS NOT NULL`, [finishedAt, ...chunk]);
+  });
+}
+async function cancelLiveWorkflowTreeRuns(runIds, reason, finishedAt) {
+  await forEachChunk(runIds, async (chunk, placeholders) => {
+    await getDbClient2().run(`UPDATE workflow_runs
+          SET status = 'cancelled', error = ?, finishedAt = ?, lastUpdatedAt = ?
+        WHERE id IN (${placeholders}) AND status IN ('running', 'waiting')`, [scrubSecrets(reason), finishedAt, finishedAt, ...chunk]);
+  });
+}
 async function getChildWorkflowRunId(parentStepId, attempt) {
   const row = await getDbClient2().get("SELECT id FROM workflow_runs WHERE parentStepId = ? AND parentStepAttempt = ?", [parentStepId, attempt]);
   return row?.id ?? null;
 }
 async function isParentStepAttemptCurrent(parentStepId, attempt) {
-  const row = await getDbClient2().get(`SELECT 1 AS found
+  const row = await getDbClient2().get(`SELECT r.id AS runId
        FROM workflow_run_steps s
        JOIN workflow_runs r ON r.id = s.runId
       WHERE s.id = ? AND s.status = 'running' AND s.retryCount = ?
         AND r.status IN ('running', 'waiting')`, [parentStepId, attempt]);
-  return row != null;
+  return row != null && await getRunLineageBlock(row.runId) == null;
+}
+async function getStepExecutionBlock(stepId) {
+  const row = await getDbClient2().get(`SELECT s.status AS stepStatus, r.id AS runId, r.status AS runStatus
+       FROM workflow_run_steps s
+       JOIN workflow_runs r ON r.id = s.runId
+      WHERE s.id = ?`, [stepId]);
+  if (!row)
+    return "the step or its run is missing";
+  if (row.runStatus !== "running" && row.runStatus !== "waiting") {
+    return `its run is ${row.runStatus}`;
+  }
+  if (row.stepStatus !== "running")
+    return `the step is ${row.stepStatus}`;
+  return getRunLineageBlock(row.runId);
 }
 async function getRunningSubWorkflowSteps() {
   return getDbClient2().query(`SELECT s.id AS stepId, s.runId AS runId, s.nodeId AS nodeId
@@ -8485,8 +8748,9 @@ async function createForeachAttemptSteps(runId, rows) {
     return created;
   });
 }
-var TERMINAL_STATUSES;
+var TERMINAL_STATUSES, WORKFLOW_RUN_TREE_MAX_DEPTH = 32, WorkflowRunTreeError, WorkflowStepNotExecutableError, TREE_QUERY_CHUNK = 500;
 var init_workflow_runs = __esm(() => {
+  init_types();
   init_secret_scrubber();
   init_scrub_json();
   init_runtime();
@@ -8496,6 +8760,18 @@ var init_workflow_runs = __esm(() => {
     "cancelled",
     "skipped"
   ]);
+  WorkflowRunTreeError = class WorkflowRunTreeError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "WorkflowRunTreeError";
+    }
+  };
+  WorkflowStepNotExecutableError = class WorkflowStepNotExecutableError extends Error {
+    constructor(stepId, reason) {
+      super(`Workflow step ${stepId} may not start new work: ${reason}`);
+      this.name = "WorkflowStepNotExecutableError";
+    }
+  };
 });
 
 // src/integrations/chat-sdk/schema.ts
@@ -9298,6 +9574,7 @@ var init_swarm_config_guard = __esm(() => {
     ...boundedIntegerValidators(["CHAT_SDK_BUFFER_MS"], 1, 600000),
     ...boundedIntegerValidators(["CHAT_SDK_OWNER_WINDOW_MIN"], 0, 1440),
     ...boundedIntegerValidators(["CONTEXT_PREAMBLE_MAX_TOKENS"], 100, 20000),
+    ...boundedIntegerValidators(["CONTEXT_BOUND_NOTE_TOKENS"], 0, 1e7),
     MEMORY_MIN_SIMILARITY: (value) => validateFloatRange("MEMORY_MIN_SIMILARITY", value, 0, 1, "between 0 and 1 inclusive"),
     MEMORY_ACCESS_BOOST_MAX: (value) => validateFloatRange("MEMORY_ACCESS_BOOST_MAX", value, 1, Number.POSITIVE_INFINITY, "a number >= 1")
   };
@@ -19887,7 +20164,7 @@ async function loadSecretRegistry() {
     result.failed += 1;
   }
   try {
-    const { loadRuntimeControllerSecrets } = await import("./db-a4m7haw0.js");
+    const { loadRuntimeControllerSecrets } = await import("./db-47vj40dy.js");
     const loaded = await loadRuntimeControllerSecrets();
     result.runtimeController = loaded.count;
     result.failed += loaded.failed;
@@ -22071,6 +22348,11 @@ async function createTaskExtended2(task, options) {
   const auditUserId = getCurrentRequestUserId() ?? null;
   const assetKey = normalizeAssetKey(options?.key ?? defaultAssetKey("task", id));
   const claim = await getDbClient2().transaction(async () => {
+    if (options?.workflowRunStepId) {
+      const blocked = await getStepExecutionBlock(options.workflowRunStepId);
+      if (blocked)
+        throw new WorkflowStepNotExecutableError(options.workflowRunStepId, blocked);
+    }
     const existingTrackerWork = options?.bypassTrackerContextDedup ? null : await findExistingLinearTrackerContextWork2(options?.contextKey);
     if (existingTrackerWork)
       return { existing: existingTrackerWork };
@@ -23201,10 +23483,13 @@ async function createSessionLogs2(logs) {
       const line = logs.lines[i];
       if (line === undefined)
         continue;
-      batch.push({ content: scrubSecrets(line), lineNumber: i });
+      batch.push(scrubSecrets(line));
     }
     await getDbClient2().transaction(async (tx) => {
-      for (const { content, lineNumber } of batch) {
+      const last = await tx.get(`SELECT lineNumber FROM session_logs WHERE sessionId = ? AND iteration = ?
+         ORDER BY rowid DESC LIMIT 1`, [logs.sessionId, logs.iteration]);
+      let lineNumber = last ? last.lineNumber + 1 : 0;
+      for (const content of batch) {
         await tx.run(`INSERT INTO session_logs (id, taskId, sessionId, iteration, cli, content, lineNumber, createdAt)
            VALUES (?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))`, [
           crypto.randomUUID(),
@@ -23213,7 +23498,7 @@ async function createSessionLogs2(logs) {
           logs.iteration,
           logs.cli,
           content,
-          lineNumber
+          lineNumber++
         ]);
       }
     });
@@ -23222,17 +23507,17 @@ async function createSessionLogs2(logs) {
 async function getSessionLogsByTaskId2(taskId, limit) {
   if (typeof limit === "number" && limit > 0) {
     const rows = await getDbClient2().query(`SELECT * FROM (
-         SELECT * FROM session_logs WHERE taskId = ?
-         ORDER BY iteration DESC, lineNumber DESC
+         SELECT rowid AS seq, * FROM session_logs WHERE taskId = ?
+         ORDER BY rowid DESC
          LIMIT ?
-       ) ORDER BY iteration ASC, lineNumber ASC`, [taskId, limit]);
+       ) ORDER BY seq ASC`, [taskId, limit]);
     return rows.map(rowToSessionLog);
   }
-  const rows = await getDbClient2().query("SELECT * FROM session_logs WHERE taskId = ? ORDER BY iteration ASC, lineNumber ASC", [taskId]);
+  const rows = await getDbClient2().query("SELECT * FROM session_logs WHERE taskId = ? ORDER BY rowid ASC", [taskId]);
   return rows.map(rowToSessionLog);
 }
 async function getSessionLogsBySession2(sessionId, iteration) {
-  const rows = await getDbClient2().query("SELECT * FROM session_logs WHERE sessionId = ? AND iteration = ? ORDER BY lineNumber ASC", [sessionId, iteration]);
+  const rows = await getDbClient2().query("SELECT * FROM session_logs WHERE sessionId = ? AND iteration = ? ORDER BY rowid ASC", [sessionId, iteration]);
   return rows.map(rowToSessionLog);
 }
 function rowToSessionCost(row) {
@@ -24797,6 +25082,7 @@ async function deleteWorkflowRows(id, source) {
   await client.run("DELETE FROM workflow_runs WHERE workflowId = ?", [id]);
   await reclassifyTaskHumanFree(linkedTaskIds);
   await client.run("DELETE FROM user_favorites WHERE itemType = 'workflow' AND itemId = ?", [id]);
+  await tombstoneWorkflowIdempotencyKeys(id);
   const result = await client.run("DELETE FROM workflows WHERE id = ?", [id]);
   const deleted = result.changes > 0;
   if (deleted) {
@@ -25752,15 +26038,22 @@ async function createApprovalRequest2(data) {
   const row = await getDbClient2().transaction(async () => {
     let status = "pending";
     let resolutionReason = null;
-    if (data.requireActionableWorkflow && data.workflowRunId && data.workflowRunStepId) {
-      const run = await getWorkflowRun2(data.workflowRunId);
-      const step = await getWorkflowRunStep2(data.workflowRunStepId);
+    const actionable = data.requireActionableWorkflow && data.workflowRunStepId;
+    const run = data.workflowRunId ? await getWorkflowRun2(data.workflowRunId, "display") : null;
+    if (data.workflowRunId && (run || actionable)) {
+      const step = actionable ? await getWorkflowRunStep2(data.workflowRunStepId) : undefined;
       if (!run || run.status !== "running" && run.status !== "waiting") {
         status = "cancelled";
         resolutionReason = run?.error ?? `Workflow run is ${run?.status ?? "missing"}`;
-      } else if (!step || step.runId !== run.id || step.status !== "running") {
+      } else if (step !== undefined && (!step || step.runId !== run.id || step.status !== "running")) {
         status = "cancelled";
         resolutionReason = `Human-in-the-loop step is ${step?.status ?? "missing"}`;
+      } else {
+        const blocked = await getRunLineageBlock(run.id);
+        if (blocked) {
+          status = "cancelled";
+          resolutionReason = blocked;
+        }
       }
     }
     return getDbClient2().get(`INSERT INTO approval_requests
@@ -27517,7 +27810,9 @@ async function getRootTaskChain2(rootTaskId) {
          SELECT t.id FROM agent_tasks t
          JOIN chain c ON t.parentTaskId = c.id
        )
-       SELECT t.* FROM chain
+       SELECT t.*,
+         (SELECT SUM(totalCostUsd) FROM session_costs WHERE session_costs.taskId = t.id) AS totalCostUsd
+       FROM chain
        CROSS JOIN agent_tasks t ON t.id = chain.id
        ORDER BY t.createdAt, t.rowid`, [rootTaskId]);
   return rows.map(rowToAgentTask);
@@ -28283,6 +28578,7 @@ var init_db3 = __esm(() => {
   init_human_free();
   init_read();
   init_write();
+  init_workflow_idempotency();
   init_workflow_runs();
   init_scrub_json();
   init_sealed_json();
@@ -28357,4 +28653,4 @@ var init_db3 = __esm(() => {
   };
 });
 
-export { slackContextKey, chatSdkContextKey, chatThreadOfContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, azureDevOpsContextKey, azureDevOpsWorkItemContextKey, bitbucketContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, init_catalog, catalog_default, COMPANY_TEAM_SIZES, COMPANY_USE_CASES, USER_FUNCTIONS, init_company_profile, mapTriggerSurface, init_telemetry_context, TELEMETRY_PROXY_ORIGIN, normalizeOrgWebsite, orgLogoUrl, isFilledOrgLogoUrl, init_org_website, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, getCurrentRequestUserId, init_request_auth_context, setTelemetryIngestObserver, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, setTelemetryRoleResolver, setTelemetryFunctionResolver, isTelemetryReady, track, trackRelayed, telemetry, emitIntegrationConnected, init_telemetry, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, assertUrlSafe, parseEgressAllowlist, init_egress_guard, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, isInTransaction, init_db_client, breaksJsonValidity, scrubJsonValue, init_scrub_json, sealJson, init_sealed_json, getPromptTemplateDefaultDrift, init_default_drift, init_templates, init_templates2, isSqliteVecAvailable2, resolveSqliteVecExtensionPath2, __resetSqliteVecExtensionPathCacheForTests2, initDb2, getDb2, closeDb2, getDbClient2, init_runtime, cachedUserRole, cachedUserFunction, invalidateTelemetryUserRole, configureOrgDomainPersistence, recomputeOrgDomain, scheduleOrgDomainRecompute, init_telemetry_identity, resolveTriggerSurface, emitTaskTelemetry, init_telemetry_trigger, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, isEnvExportRestrictedKey, init_config_env_export, MASKED_SECRET_VALUE, init_config_secrets, HeartbeatExpiryError, init_heartbeat_expiry, isRuntimePoolsEnabled, init_runtime_pools_flag, normalizeDate, normalizeDateRequired, init_date_utils, rowToAgent, updateAgentCredentialState2, updateAgentCredentialMissing2, createAgent2, getAgentById2, EXTENSION_AGENT_ROLE2, NOT_EXTENSION_AGENT_SQL2, isExtensionAgent2, extensionAgentAssignmentError2, ReservedAgentRoleError2, reservedRoleViolation2, ExtensionAgentAssignmentError2, getAllAgents2, getAgentStatusCounts2, getLeadAgent2, updateAgentStatus2, updateAgentMaxTasks2, updateAgentProvider2, setAgentHarnessProvider2, updateAgentCredStatus2, listAgentsWithCredStatusByProvider2, getAgentHarnessProviders2, updateAgentActivity2, MAX_EMPTY_POLLS2, incrementEmptyPollCount2, resetEmptyPollCount2, shouldBlockPolling2, deleteAgent2, getActiveTaskCount2, hasCapacity2, getRemainingCapacity2, updateAgentStatusFromCapacity2, isPoolAffinityEnforcementEnabled2, buildRoutingAffinityFromAgent2, isAgentEligibleForTask2, getAgentDailyTaskCounts2, init_agents, listApprovalRequestSummaries2, getPendingApprovalVoteState2, recordApprovalVotes2, getPendingApprovalsForTasks2, computeContentHash2, createContextVersion2, getLatestContextVersion2, getContextVersion2, getContextVersionHistory2, vcsRepoName, vcsRepoUrlMatches, init_vcs_repo_match, rowToAgentTask, getTaskById2, getChildTasks2, TASK_LINEAGE_LIMITS2, getTaskLineage2, hasNonTerminalResumeChild2, SUPERSEDED_RESUME_REPAIR_WINDOW_MS2, getSupersededTasksWithoutResume2, getSupersededTasksWithUnsettledDependents2, hasNonTerminalRerouteDecisionChild2, getTasksByAgentId2, getAgentCurrentTask2, getTasksByStatus2, findTaskByVcs2, findActiveTasksByVcs2, findTaskByGitHub2, readableSessionCondition, getAllTasks2, getTasksCount2, getTaskStats2, getCompletedSlackTasks2, getPendingSlackRelayTasks2, markSlackRelayAttempted2, markSlackRelayDelivered2, markFinalizedSlackRelaysDelivered2, getPendingChatRelayTasks2, giveUpStaleChatRelays2, markChatRelayAttempted2, recordChatRelayError2, markChatRelayDelivered2, markChatRelayGivenUp2, getRecentlyFinishedWorkerTasks2, markTasksNotified2, resetTasksNotified2, getInProgressSlackTasks2, getSlackTasksMissingTree2, getInProgressTasksByContextKey2, isLinearTrackerContextKey2, findExistingLinearTrackerContextWork2, getLatestTaskByContextKey2, getLatestScriptRunStepTaskByContextKey2, getAgentWorkingOnThread2, getLatestActiveTaskInThread2, getLatestLeadTaskInThread2, getAgentWorkingOnContextKey2, getLatestActiveTaskByContextKey2, getLatestLeadTaskByContextKey2, getMostRecentTaskInThread2, findCompletedTaskInThread2, findRecentCancelledTaskInThread2, init_read, MODEL_PROFILE_CONFIG_KEY, listModelProfiles, getModelProfileByName, createModelProfile, updateModelProfile, modelProfileReferences, modelProfileRefError, deleteModelProfile, getAgentDefaultProfileName, repoModelOverrideKeys, taskProfileError, init_model_profiles, AssetKeyMovesBlockedError2, assertAssetKeyMovesAllowed2, moveTaskChainKeyInTx2, moveSessionChains, listPrefixRoots, listSharedPrefixRoots, init_session_moves, getSessionReadState, getSessionTree, triageSessionList, init_session_tree, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, onTaskStarted, init_task_lifecycle_events, channelTopic, addWorkerSubscription, removeWorkerSubscription, listSubscribedWorkerAgents, init_channels, publishWorkerNudge, init_worker_nudges, createTask2, getPendingTaskForAgent2, assignUnassignedTaskPending2, startTask2, updateTaskClaudeSessionId2, recordTaskProviderIfUnset2, updateTaskTitle2, completeTask2, failTask2, overwriteTerminalTaskResultText2, cancelTask2, supersedeTask2, settleSupersededTaskDependents2, backfillSupersedeTaskResumeTaskId2, pauseTask2, resumeTask2, getPausedTasksForAgent2, getOrphanedInProgressTasksForAgent2, resetOrphanedInProgressTasksForAgent2, getRecentlyCancelledTasksForAgent2, deleteTask2, updateTaskProgress2, getChildWorkflowRunId, isParentStepAttemptCurrent, getRunningSubWorkflowSteps, getWorkflowRunParent, getWorkflowRunLineage, getSettledChildRunParentSteps, createForeachChildSteps, createForeachAttemptSteps, init_workflow_runs, CHAT_SDK_ADAPTER_NAMES, CHAT_SDK_ADAPTER_SCHEMAS, ChatSdkAdaptersDraftSchema, firstIssueText, isAdapterEntryEnabled, init_schema, TELEMETRY_RANKING_KEY, PUBLIC_RANKING_ENABLED_KEY, RANKING_CATEGORIES, readTelemetryRanking, rankingFormSchema, buildListing, init_telemetry_ranking, resolveQuickJSPoolSize, init_quickjs_pool_config, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, completedStatusIcon, init_reaction_shortcode, API_DRAINING_HEADER, API_DRAIN_MAX_MS_LIMIT, isApiDrainingResponse, init_api_drain, parseEnabledTools, init_enabled_tools, parseTaskToolManifest, CHAT_TASK_ONLY_TOOLS, isChatSdkTask, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isApiOnlyConfigKey, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, APPS_JSON_COLUMN_MAX_BYTES_BOUNDS, CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS, validateRuntimeTokenTtlHours, validateControllerTokenTtlDays, validateControllerGraceSec, validateConfigValue, validateConfigEntry, validateExportToEnv, init_swarm_config_guard, getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, createOAuthPending, consumeOAuthPending, gcOAuthPending, markAuthorizationRefreshFailed, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, init_oauth, OpenAI2, init_openai, CANDIDATE_SET_MULTIPLIER, isGraphExpansionEnabled, EMBEDDING_DIMENSIONS, init_constants, LONGTERM_ROOT, MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE, MEMORY_KEY_MAX_LENGTH, isLongtermKey, longtermKeyError, isConsolidatedKey, consolidatedKeyMessage, resolveStoreKey, init_key_paths, computeScore, rerank, init_reranker, searchMemoryCandidates, init_search_candidates, rowToCandidate, init_sqlite_store, getEmbeddingProvider2, resetEmbeddingProvider2, getMemoryStore2, init_memory, embeddingProvider, embedScript, searchScripts, reembedAllScripts, init_embeddings, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, init_db2, oauthSecretName, registerStoredSecret, loadSecretRegistry, init_secret_registry, STEERING_MOVED_ERROR, SteeringRequestError, isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, carryUnhandledSteering, requestSteering, init_steering, WorkflowReplayStateError, init_workflow_replay, SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS2, refreshActiveSessionOnActivity2, getActiveSessionById, init_active_sessions, recordKeySeatMismatch2, getScriptRunExecutionArgs2, literalPrefixPattern2, getSlackRenderV2ActivatedAt2, ensureSlackRenderV2Activation2, getSlackDelegationActivatedAt2, ensureSlackDelegationActivation2, isPendingSlackMessage2, isSettledSlackMessage2, recordSlackMessage2, reserveSlackMessage2, bindSlackMessageTimestamp2, updateSlackMessageRecord2, markSlackTreeRendered2, deleteSlackMessageRecord2, getSlackTreeMessage2, getSlackTreeMessageByThread2, getSlackOutcomeMessage2, getResolvableDeferralOutcomes2, markSlackDeferralResolved2, noteSlackOutcomeDeliveryFailure2, abandonSlackOutcomeDelivery2, getSlackTreeMessages2, getSlackMessageByChannelTs2, getSlackTasksInThread2, listSlackThreadsAwaitingHuman2, isSlackThreadAwaitingHuman2, markTaskSlackReplySent2, setSlackMessageTracking2, updateTaskVcs2, insertTaskAttachment2, recordTaskPullRequestAttachments2, getAssetKeyMappingByProvider2, upsertAssetKeyMapping2, getAssetKeyMapping2, listAssetSummaries2, moveAssetKey2, deleteTaskAttachment2, replaceTaskAttachment2, getTaskAttachments2, createSteeringMessage2, getSteeringMessagesForTask2, getSteeringMessageById2, getPendingSteeringForTask2, getPendingSteeringForAgent2, markSteeringDelivered2, markSteeringHandled2, markSteeringPromoted2, cancelPendingSteeringForTask2, hasPendingSteering2, getAgentWithTasks2, getAllAgentsWithTasks2, createLogEntry2, getLogsByAgentId2, getLogsByTaskId2, getLogsByTaskIdAndEventType2, getLogsByTaskIdChronological2, getLogsByEventType2, getAllLogs2, findRecentSimilarTasks2, createTaskExtended2, claimTask2, releaseTask2, acceptTask2, rejectTask2, moveTaskToBacklog2, moveTaskFromBacklog2, promoteDraftTask2, refreshDraftTaskLease2, promoteAbandonedDraftTasks2, releaseStaleReviewingTasks2, releaseStaleOfferedTasksForOfflineAgents2, getOfferedTasksForAgent2, claimOfferedTask2, getUnassignedTasksCount2, getUnassignedTaskIds2, getUnassignedTaskIdsForAgent2, checkDependencies2, getDependentTasks2, cascadeFailDependents2, updateAgentProfile2, updateAgentName2, createChannel2, getMessageById2, getChannelById2, getChannelByName2, getAllChannels2, deleteChannel2, postMessage2, getChannelMessages2, updateReadState2, getLastReadAt2, getUnreadMessages2, getMentionsForAgent2, getInboxSummary2, claimMentions2, releaseMentionProcessing2, releaseStaleMentionProcessing2, createService2, getServiceById2, getServiceByAgentAndName2, getServicesByAgentId2, getAllServices2, updateServiceStatus2, deleteService2, upsertService2, deleteServicesByAgentId2, createSessionLogs2, getSessionLogsByTaskId2, getSessionLogsBySession2, createSessionCost2, getSessionCostsByTaskId2, getSessionCostsByAgentId2, getAllSessionCosts2, getSessionCostsFiltered2, UNATTRIBUTED_USER_ID2, getSessionCostSummary2, getAttributionByPerson2, getDashboardCostSummary2, createInboxMessage2, getInboxMessageById2, getUnreadInboxMessages2, claimInboxMessages2, markInboxMessageRead2, markInboxMessageResponded2, markInboxMessageDelegated2, releaseStaleProcessingInbox2, getConcurrentContext2, getScheduledTasks2, getScheduledTaskById2, getScheduledTaskByName2, createScheduledTask2, updateScheduledTask2, deleteScheduledTask2, getDueScheduledTasks2, autoEncryptLegacyPlaintextSecrets2, maskSecrets2, getSwarmConfigs2, getInjectableGlobalConfigs2, getSwarmConfigById2, getSwarmConfigLookupById2, upsertSwarmConfig2, emitBuiltInIntegrationConnectedOnce2, deleteSwarmConfig2, deleteSwarmConfigByKey2, getResolvedConfig2, getSwarmRepos2, getSwarmRepoById2, getSwarmRepoByName2, getSwarmRepoByUrl2, createSwarmRepo2, updateSwarmRepo2, deleteSwarmRepo2, getAgentMailInboxMapping2, getAgentMailInboxMappingsByAgent2, getAllAgentMailInboxMappings2, createAgentMailInboxMapping2, deleteAgentMailInboxMapping2, findTaskByAgentMailThread2, insertActiveSession2, deleteActiveSession2, deleteActiveSessionById2, getActiveSessions2, heartbeatActiveSession2, cleanupStaleSessions2, cleanupAgentSessions2, updateActiveSessionProviderSessionId2, getActiveSessionForTask2, reassociateSessionLogs2, getStalledInProgressTasks2, getStalePinnedResumes2, failPendingResumeIfUnclaimed2, getIdleWorkersWithCapacity2, getUnassignedPoolTasks2, getStaleUnassignedAffinityTasks2, getRecentFailedTasks2, getRecentCompletedCount2, getRecentFailedCount2, createWorkflow2, getWorkflow2, listWorkflows2, updateWorkflow2, deleteWorkflow2, getWorkflowsByScheduleId2, createWorkflowRun2, getWorkflowRun2, updateWorkflowRun2, listWorkflowRuns2, countWorkflowRuns2, listWorkflowRunsPage2, createWorkflowRunStep2, getWorkflowRunStep2, updateWorkflowRunStep2, getWorkflowRunStepsByRunId2, getStuckWorkflowRuns2, getLastSuccessfulRun2, getLastRunStart2, getRetryableSteps2, getCompletedStepNodeIds2, getTaskByWorkflowRunStepId2, detachTaskFromWorkflowRunStep2, getStepByIdempotencyKey2, getStepCountForNode2, getLatestStepForNode2, getCurrentStepForNode2, createWorkflowVersion2, getWorkflowVersions2, getWorkflowVersion2, createAppVersion2, getAppVersions2, getAppVersion2, createPage2, getPage2, getPageBySlug2, getLatestPageBySlug2, listPagesByAgent2, listAllPages2, countAllPages2, countPagesByAgent2, updatePage2, deletePage2, incrementPageViewCount2, createPageVersion2, getPageVersions2, getPageVersion2, createMetric2, getMetric2, getMetricBySlug2, listMetricsByAgent2, listAllMetrics2, countAllMetrics2, countMetricsByAgent2, updateMetric2, deleteMetric2, createMetricVersion2, getMetricVersions2, getMetricVersion2, getPromptTemplates2, getPromptTemplateById2, upsertPromptTemplate2, deletePromptTemplate2, resetPromptTemplateToDefault2, getPromptTemplateHistory2, resolvePromptTemplate2, checkoutPromptTemplate2, getAllChannelActivityCursors2, getChannelActivityCursor2, upsertChannelActivityCursor2, createApprovalRequest2, getApprovalRequestById2, resolveApprovalRequest2, cancelApprovalRequestById2, cancelPendingApprovalRequestsForRun2, listCancelledApprovalRequestsForRun2, listCancelledApprovalRequestsForStep2, claimApprovalCancellationNotification2, completeApprovalCancellationNotificationClaim2, releaseApprovalCancellationNotificationClaim2, updateApprovalRequestNotifications2, listApprovalRequests2, getStuckApprovalRuns2, getApprovalRequestByStepId2, getExpiredPendingApprovals2, getStaleApprovalRequests2, createWaitState2, getWaitStateById2, getWaitStateByStepId2, getDueWaitStates2, getPendingEventWaitNames2, getPendingWaitsByEvent2, resolveWaitState2, getStuckWaitRuns2, SKILL_FILE_LIMITS2, normalizeSkillFilePath2, createSkill2, updateSkill2, listSkillFileManifest2, getSkillFiles2, getSkillFile2, upsertSkillFile2, upsertSkillFiles2, deleteSkillFile2, deleteSkill2, getSkillById2, getSkillByName2, listSkills2, searchSkills2, installSkill2, getSystemDefaultSkills2, installSystemDefaultSkillsForAgent2, uninstallSkill2, getAgentSkills2, toggleAgentSkill2, createMcpServer2, emitMcpServerConnectedTelemetry2, updateMcpServer2, deleteMcpServer2, getMcpServerById2, getMcpServerByName2, listMcpServers2, installMcpServer2, uninstallMcpServer2, getAgentMcpServers2, createContextSnapshot2, getContextSnapshotsByTaskId2, getContextSnapshotsBySessionId2, getContextSummaryByTaskId2, getAvailableKeyIndices2, recordKeyUsage2, setApiKeyPlan2, markKeyRateLimited2, recordKeyAuthFailure2, recordKeyRateLimitWindows2, setApiKeyName2, clearKeyRateLimit2, getKeyStatuses2, getKeyCostSummary2, getUserById2, getAllUsers2, createUser2, updateUser2, deleteUser2, listInboxState2, upsertInboxState2, listFavorites2, listUserFavorites2, getFavoriteItemIdSet2, setFavorite2, setUserFavorite2, withFavoriteFlags2, listTaskTemplates2, getRootTaskChain2, listRecentSessions2, countSessions2, getBudget2, getBudgets2, upsertBudget2, deleteBudget2, getAllPricingRows2, getPricingRows2, getActivePricingRow2, insertPricingRow2, deletePricingRow2, getDailySpendForAgent2, getDailySpendGlobal2, getDailySpendForUser2, recordBudgetRefusalNotification2, getBudgetRefusalNotification2, getRecentBudgetRefusalNotifications2, hasBudgetRefusalNotificationToday2, setBudgetRefusalFollowUpTaskId2, getLiveAgentCounts2, getReadyAgentCounts2, getInstanceActivity2, getSwarmMetrics2, hasFirstCompletedTask2, getKv2, sweepExpiredKv2, sweepExpiredKvPrefix2, upsertKv2, claimKv2, deleteKv2, KvTypeCollisionError2, incrKv2, kvPrefixUpperBound2, listKv2, countKv2, createScriptRun2, recordInlineScriptRun2, getScriptRun2, getScriptRunByIdempotencyKey2, listScriptRuns2, countScriptRuns2, countActiveScriptRuns2, updateScriptRun2, updateScriptRunIfNotTerminal2, updateScriptRunIfRunning2, getRunningScriptRuns2, getScriptRunJournalStep2, upsertScriptRunJournalStep2, listScriptRunJournalSteps2, countScriptRunJournalSteps2, countScriptRunJournalAgentTaskSteps2, exports_db, init_db3 };
+export { slackContextKey, chatSdkContextKey, chatThreadOfContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, azureDevOpsContextKey, azureDevOpsWorkItemContextKey, bitbucketContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, init_catalog, catalog_default, COMPANY_TEAM_SIZES, COMPANY_USE_CASES, USER_FUNCTIONS, init_company_profile, mapTriggerSurface, init_telemetry_context, TELEMETRY_PROXY_ORIGIN, normalizeOrgWebsite, orgLogoUrl, isFilledOrgLogoUrl, init_org_website, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, getCurrentRequestUserId, init_request_auth_context, setTelemetryIngestObserver, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, setTelemetryRoleResolver, setTelemetryFunctionResolver, isTelemetryReady, track, trackRelayed, telemetry, emitIntegrationConnected, init_telemetry, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, assertUrlSafe, parseEgressAllowlist, init_egress_guard, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, isInTransaction, init_db_client, breaksJsonValidity, scrubJsonValue, init_scrub_json, sealJson, init_sealed_json, getPromptTemplateDefaultDrift, init_default_drift, init_templates, init_templates2, isSqliteVecAvailable2, resolveSqliteVecExtensionPath2, __resetSqliteVecExtensionPathCacheForTests2, initDb2, getDb2, closeDb2, getDbClient2, init_runtime, cachedUserRole, cachedUserFunction, invalidateTelemetryUserRole, configureOrgDomainPersistence, recomputeOrgDomain, scheduleOrgDomainRecompute, init_telemetry_identity, resolveTriggerSurface, emitTaskTelemetry, init_telemetry_trigger, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, isEnvExportRestrictedKey, init_config_env_export, MASKED_SECRET_VALUE, init_config_secrets, HeartbeatExpiryError, init_heartbeat_expiry, isRuntimePoolsEnabled, init_runtime_pools_flag, normalizeDate, normalizeDateRequired, init_date_utils, rowToAgent, updateAgentCredentialState2, updateAgentCredentialMissing2, createAgent2, getAgentById2, EXTENSION_AGENT_ROLE2, NOT_EXTENSION_AGENT_SQL2, isExtensionAgent2, extensionAgentAssignmentError2, ReservedAgentRoleError2, reservedRoleViolation2, ExtensionAgentAssignmentError2, getAllAgents2, getAgentStatusCounts2, getLeadAgent2, updateAgentStatus2, updateAgentMaxTasks2, updateAgentProvider2, setAgentHarnessProvider2, updateAgentCredStatus2, listAgentsWithCredStatusByProvider2, getAgentHarnessProviders2, updateAgentActivity2, MAX_EMPTY_POLLS2, incrementEmptyPollCount2, resetEmptyPollCount2, shouldBlockPolling2, deleteAgent2, getActiveTaskCount2, hasCapacity2, getRemainingCapacity2, updateAgentStatusFromCapacity2, isPoolAffinityEnforcementEnabled2, buildRoutingAffinityFromAgent2, isAgentEligibleForTask2, getAgentDailyTaskCounts2, init_agents, listApprovalRequestSummaries2, getPendingApprovalVoteState2, recordApprovalVotes2, getPendingApprovalsForTasks2, approvalCancellationNotificationKey, listUndeliveredCancelledApprovalRequestIds, init_approvals, computeContentHash2, createContextVersion2, getLatestContextVersion2, getContextVersion2, getContextVersionHistory2, vcsRepoName, vcsRepoUrlMatches, init_vcs_repo_match, rowToAgentTask, getTaskById2, getChildTasks2, TASK_LINEAGE_LIMITS2, getTaskLineage2, hasNonTerminalResumeChild2, SUPERSEDED_RESUME_REPAIR_WINDOW_MS2, getSupersededTasksWithoutResume2, getSupersededTasksWithUnsettledDependents2, hasNonTerminalRerouteDecisionChild2, getTasksByAgentId2, getAgentCurrentTask2, getTasksByStatus2, findTaskByVcs2, findActiveTasksByVcs2, findTaskByGitHub2, readableSessionCondition, getAllTasks2, getTasksCount2, getTaskStats2, getCompletedSlackTasks2, getPendingSlackRelayTasks2, markSlackRelayAttempted2, markSlackRelayDelivered2, markFinalizedSlackRelaysDelivered2, getPendingChatRelayTasks2, giveUpStaleChatRelays2, markChatRelayAttempted2, recordChatRelayError2, markChatRelayDelivered2, markChatRelayGivenUp2, getRecentlyFinishedWorkerTasks2, markTasksNotified2, resetTasksNotified2, getInProgressSlackTasks2, getSlackTasksMissingTree2, getInProgressTasksByContextKey2, isLinearTrackerContextKey2, findExistingLinearTrackerContextWork2, getLatestTaskByContextKey2, getLatestScriptRunStepTaskByContextKey2, getAgentWorkingOnThread2, getLatestActiveTaskInThread2, getLatestLeadTaskInThread2, getAgentWorkingOnContextKey2, getLatestActiveTaskByContextKey2, getLatestLeadTaskByContextKey2, getMostRecentTaskInThread2, findCompletedTaskInThread2, findRecentCancelledTaskInThread2, init_read, MODEL_PROFILE_CONFIG_KEY, listModelProfiles, getModelProfileByName, createModelProfile, updateModelProfile, modelProfileReferences, modelProfileRefError, deleteModelProfile, getAgentDefaultProfileName, repoModelOverrideKeys, taskProfileError, init_model_profiles, AssetKeyMovesBlockedError2, assertAssetKeyMovesAllowed2, moveTaskChainKeyInTx2, moveSessionChains, listPrefixRoots, listSharedPrefixRoots, init_session_moves, getSessionReadState, getSessionTree, triageSessionList, init_session_tree, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, onTaskStarted, init_task_lifecycle_events, channelTopic, addWorkerSubscription, removeWorkerSubscription, listSubscribedWorkerAgents, init_channels, publishWorkerNudge, init_worker_nudges, createTask2, getPendingTaskForAgent2, assignUnassignedTaskPending2, startTask2, updateTaskClaudeSessionId2, recordTaskProviderIfUnset2, updateTaskTitle2, completeTask2, failTask2, overwriteTerminalTaskResultText2, cancelTask2, supersedeTask2, settleSupersededTaskDependents2, backfillSupersedeTaskResumeTaskId2, pauseTask2, resumeTask2, getPausedTasksForAgent2, getOrphanedInProgressTasksForAgent2, resetOrphanedInProgressTasksForAgent2, getRecentlyCancelledTasksForAgent2, deleteTask2, updateTaskProgress2, IdempotencyKeyTakenError, workflowRequestFingerprint, findAcceptedWorkflowOperation, assertWorkflowIdempotencyKeyUnused, recordAcceptedWorkflowOperation, init_workflow_idempotency, getRunLineageBlock, getWorkflowRunTreeIds, getWorkflowRunStatus, getOpenWorkflowTreeTaskIds, getTaskIdsWithDependents, workflowRunTreeHasOpenWork, cancelOpenWorkflowTreeSteps, disarmWorkflowTreeRetries, cancelLiveWorkflowTreeRuns, getChildWorkflowRunId, isParentStepAttemptCurrent, getRunningSubWorkflowSteps, getWorkflowRunParent, getWorkflowRunLineage, getSettledChildRunParentSteps, createForeachChildSteps, createForeachAttemptSteps, init_workflow_runs, CHAT_SDK_ADAPTER_NAMES, CHAT_SDK_ADAPTER_SCHEMAS, ChatSdkAdaptersDraftSchema, firstIssueText, isAdapterEntryEnabled, init_schema, TELEMETRY_RANKING_KEY, PUBLIC_RANKING_ENABLED_KEY, RANKING_CATEGORIES, readTelemetryRanking, rankingFormSchema, buildListing, init_telemetry_ranking, resolveQuickJSPoolSize, init_quickjs_pool_config, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, completedStatusIcon, init_reaction_shortcode, API_DRAINING_HEADER, API_DRAIN_MAX_MS_LIMIT, isApiDrainingResponse, init_api_drain, parseEnabledTools, init_enabled_tools, parseTaskToolManifest, CHAT_TASK_ONLY_TOOLS, isChatSdkTask, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isApiOnlyConfigKey, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, APPS_JSON_COLUMN_MAX_BYTES_BOUNDS, CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS, validateRuntimeTokenTtlHours, validateControllerTokenTtlDays, validateControllerGraceSec, validateConfigValue, validateConfigEntry, validateExportToEnv, init_swarm_config_guard, getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, createOAuthPending, consumeOAuthPending, gcOAuthPending, markAuthorizationRefreshFailed, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, init_oauth, OpenAI2, init_openai, CANDIDATE_SET_MULTIPLIER, isGraphExpansionEnabled, EMBEDDING_DIMENSIONS, init_constants, LONGTERM_ROOT, MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE, MEMORY_KEY_MAX_LENGTH, isLongtermKey, longtermKeyError, isConsolidatedKey, consolidatedKeyMessage, resolveStoreKey, init_key_paths, computeScore, rerank, init_reranker, searchMemoryCandidates, init_search_candidates, rowToCandidate, init_sqlite_store, getEmbeddingProvider2, resetEmbeddingProvider2, getMemoryStore2, init_memory, embeddingProvider, embedScript, searchScripts, reembedAllScripts, init_embeddings, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, init_db2, oauthSecretName, registerStoredSecret, loadSecretRegistry, init_secret_registry, STEERING_MOVED_ERROR, SteeringRequestError, isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, carryUnhandledSteering, requestSteering, init_steering, WorkflowReplayStateError, init_workflow_replay, SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS2, refreshActiveSessionOnActivity2, getActiveSessionById, init_active_sessions, recordKeySeatMismatch2, getScriptRunExecutionArgs2, literalPrefixPattern2, getSlackRenderV2ActivatedAt2, ensureSlackRenderV2Activation2, getSlackDelegationActivatedAt2, ensureSlackDelegationActivation2, isPendingSlackMessage2, isSettledSlackMessage2, recordSlackMessage2, reserveSlackMessage2, bindSlackMessageTimestamp2, updateSlackMessageRecord2, markSlackTreeRendered2, deleteSlackMessageRecord2, getSlackTreeMessage2, getSlackTreeMessageByThread2, getSlackOutcomeMessage2, getResolvableDeferralOutcomes2, markSlackDeferralResolved2, noteSlackOutcomeDeliveryFailure2, abandonSlackOutcomeDelivery2, getSlackTreeMessages2, getSlackMessageByChannelTs2, getSlackTasksInThread2, listSlackThreadsAwaitingHuman2, isSlackThreadAwaitingHuman2, markTaskSlackReplySent2, setSlackMessageTracking2, updateTaskVcs2, insertTaskAttachment2, recordTaskPullRequestAttachments2, getAssetKeyMappingByProvider2, upsertAssetKeyMapping2, getAssetKeyMapping2, listAssetSummaries2, moveAssetKey2, deleteTaskAttachment2, replaceTaskAttachment2, getTaskAttachments2, createSteeringMessage2, getSteeringMessagesForTask2, getSteeringMessageById2, getPendingSteeringForTask2, getPendingSteeringForAgent2, markSteeringDelivered2, markSteeringHandled2, markSteeringPromoted2, cancelPendingSteeringForTask2, hasPendingSteering2, getAgentWithTasks2, getAllAgentsWithTasks2, createLogEntry2, getLogsByAgentId2, getLogsByTaskId2, getLogsByTaskIdAndEventType2, getLogsByTaskIdChronological2, getLogsByEventType2, getAllLogs2, findRecentSimilarTasks2, createTaskExtended2, claimTask2, releaseTask2, acceptTask2, rejectTask2, moveTaskToBacklog2, moveTaskFromBacklog2, promoteDraftTask2, refreshDraftTaskLease2, promoteAbandonedDraftTasks2, releaseStaleReviewingTasks2, releaseStaleOfferedTasksForOfflineAgents2, getOfferedTasksForAgent2, claimOfferedTask2, getUnassignedTasksCount2, getUnassignedTaskIds2, getUnassignedTaskIdsForAgent2, checkDependencies2, getDependentTasks2, cascadeFailDependents2, updateAgentProfile2, updateAgentName2, createChannel2, getMessageById2, getChannelById2, getChannelByName2, getAllChannels2, deleteChannel2, postMessage2, getChannelMessages2, updateReadState2, getLastReadAt2, getUnreadMessages2, getMentionsForAgent2, getInboxSummary2, claimMentions2, releaseMentionProcessing2, releaseStaleMentionProcessing2, createService2, getServiceById2, getServiceByAgentAndName2, getServicesByAgentId2, getAllServices2, updateServiceStatus2, deleteService2, upsertService2, deleteServicesByAgentId2, createSessionLogs2, getSessionLogsByTaskId2, getSessionLogsBySession2, createSessionCost2, getSessionCostsByTaskId2, getSessionCostsByAgentId2, getAllSessionCosts2, getSessionCostsFiltered2, UNATTRIBUTED_USER_ID2, getSessionCostSummary2, getAttributionByPerson2, getDashboardCostSummary2, createInboxMessage2, getInboxMessageById2, getUnreadInboxMessages2, claimInboxMessages2, markInboxMessageRead2, markInboxMessageResponded2, markInboxMessageDelegated2, releaseStaleProcessingInbox2, getConcurrentContext2, getScheduledTasks2, getScheduledTaskById2, getScheduledTaskByName2, createScheduledTask2, updateScheduledTask2, deleteScheduledTask2, getDueScheduledTasks2, autoEncryptLegacyPlaintextSecrets2, maskSecrets2, getSwarmConfigs2, getInjectableGlobalConfigs2, getSwarmConfigById2, getSwarmConfigLookupById2, upsertSwarmConfig2, emitBuiltInIntegrationConnectedOnce2, deleteSwarmConfig2, deleteSwarmConfigByKey2, getResolvedConfig2, getSwarmRepos2, getSwarmRepoById2, getSwarmRepoByName2, getSwarmRepoByUrl2, createSwarmRepo2, updateSwarmRepo2, deleteSwarmRepo2, getAgentMailInboxMapping2, getAgentMailInboxMappingsByAgent2, getAllAgentMailInboxMappings2, createAgentMailInboxMapping2, deleteAgentMailInboxMapping2, findTaskByAgentMailThread2, insertActiveSession2, deleteActiveSession2, deleteActiveSessionById2, getActiveSessions2, heartbeatActiveSession2, cleanupStaleSessions2, cleanupAgentSessions2, updateActiveSessionProviderSessionId2, getActiveSessionForTask2, reassociateSessionLogs2, getStalledInProgressTasks2, getStalePinnedResumes2, failPendingResumeIfUnclaimed2, getIdleWorkersWithCapacity2, getUnassignedPoolTasks2, getStaleUnassignedAffinityTasks2, getRecentFailedTasks2, getRecentCompletedCount2, getRecentFailedCount2, createWorkflow2, getWorkflow2, listWorkflows2, updateWorkflow2, deleteWorkflow2, getWorkflowsByScheduleId2, createWorkflowRun2, getWorkflowRun2, updateWorkflowRun2, listWorkflowRuns2, countWorkflowRuns2, listWorkflowRunsPage2, createWorkflowRunStep2, getWorkflowRunStep2, updateWorkflowRunStep2, getWorkflowRunStepsByRunId2, getStuckWorkflowRuns2, getLastSuccessfulRun2, getLastRunStart2, getRetryableSteps2, getCompletedStepNodeIds2, getTaskByWorkflowRunStepId2, detachTaskFromWorkflowRunStep2, getStepByIdempotencyKey2, getStepCountForNode2, getLatestStepForNode2, getCurrentStepForNode2, createWorkflowVersion2, getWorkflowVersions2, getWorkflowVersion2, createAppVersion2, getAppVersions2, getAppVersion2, createPage2, getPage2, getPageBySlug2, getLatestPageBySlug2, listPagesByAgent2, listAllPages2, countAllPages2, countPagesByAgent2, updatePage2, deletePage2, incrementPageViewCount2, createPageVersion2, getPageVersions2, getPageVersion2, createMetric2, getMetric2, getMetricBySlug2, listMetricsByAgent2, listAllMetrics2, countAllMetrics2, countMetricsByAgent2, updateMetric2, deleteMetric2, createMetricVersion2, getMetricVersions2, getMetricVersion2, getPromptTemplates2, getPromptTemplateById2, upsertPromptTemplate2, deletePromptTemplate2, resetPromptTemplateToDefault2, getPromptTemplateHistory2, resolvePromptTemplate2, checkoutPromptTemplate2, getAllChannelActivityCursors2, getChannelActivityCursor2, upsertChannelActivityCursor2, createApprovalRequest2, getApprovalRequestById2, resolveApprovalRequest2, cancelApprovalRequestById2, cancelPendingApprovalRequestsForRun2, listCancelledApprovalRequestsForRun2, listCancelledApprovalRequestsForStep2, claimApprovalCancellationNotification2, completeApprovalCancellationNotificationClaim2, releaseApprovalCancellationNotificationClaim2, updateApprovalRequestNotifications2, listApprovalRequests2, getStuckApprovalRuns2, getApprovalRequestByStepId2, getExpiredPendingApprovals2, getStaleApprovalRequests2, createWaitState2, getWaitStateById2, getWaitStateByStepId2, getDueWaitStates2, getPendingEventWaitNames2, getPendingWaitsByEvent2, resolveWaitState2, getStuckWaitRuns2, SKILL_FILE_LIMITS2, normalizeSkillFilePath2, createSkill2, updateSkill2, listSkillFileManifest2, getSkillFiles2, getSkillFile2, upsertSkillFile2, upsertSkillFiles2, deleteSkillFile2, deleteSkill2, getSkillById2, getSkillByName2, listSkills2, searchSkills2, installSkill2, getSystemDefaultSkills2, installSystemDefaultSkillsForAgent2, uninstallSkill2, getAgentSkills2, toggleAgentSkill2, createMcpServer2, emitMcpServerConnectedTelemetry2, updateMcpServer2, deleteMcpServer2, getMcpServerById2, getMcpServerByName2, listMcpServers2, installMcpServer2, uninstallMcpServer2, getAgentMcpServers2, createContextSnapshot2, getContextSnapshotsByTaskId2, getContextSnapshotsBySessionId2, getContextSummaryByTaskId2, getAvailableKeyIndices2, recordKeyUsage2, setApiKeyPlan2, markKeyRateLimited2, recordKeyAuthFailure2, recordKeyRateLimitWindows2, setApiKeyName2, clearKeyRateLimit2, getKeyStatuses2, getKeyCostSummary2, getUserById2, getAllUsers2, createUser2, updateUser2, deleteUser2, listInboxState2, upsertInboxState2, listFavorites2, listUserFavorites2, getFavoriteItemIdSet2, setFavorite2, setUserFavorite2, withFavoriteFlags2, listTaskTemplates2, getRootTaskChain2, listRecentSessions2, countSessions2, getBudget2, getBudgets2, upsertBudget2, deleteBudget2, getAllPricingRows2, getPricingRows2, getActivePricingRow2, insertPricingRow2, deletePricingRow2, getDailySpendForAgent2, getDailySpendGlobal2, getDailySpendForUser2, recordBudgetRefusalNotification2, getBudgetRefusalNotification2, getRecentBudgetRefusalNotifications2, hasBudgetRefusalNotificationToday2, setBudgetRefusalFollowUpTaskId2, getLiveAgentCounts2, getReadyAgentCounts2, getInstanceActivity2, getSwarmMetrics2, hasFirstCompletedTask2, getKv2, sweepExpiredKv2, sweepExpiredKvPrefix2, upsertKv2, claimKv2, deleteKv2, KvTypeCollisionError2, incrKv2, kvPrefixUpperBound2, listKv2, countKv2, createScriptRun2, recordInlineScriptRun2, getScriptRun2, getScriptRunByIdempotencyKey2, listScriptRuns2, countScriptRuns2, countActiveScriptRuns2, updateScriptRun2, updateScriptRunIfNotTerminal2, updateScriptRunIfRunning2, getRunningScriptRuns2, getScriptRunJournalStep2, upsertScriptRunJournalStep2, listScriptRunJournalSteps2, countScriptRunJournalSteps2, countScriptRunJournalAgentTaskSteps2, exports_db, init_db3 };

package/dist/{cli-25j01dpj.js → cli-jbnn4vxb.js}

@@ -2,17 +2,17 @@ import {
   getKv2,
   upsertKv2,
   init_db3
-} from "./cli-kxawjrxg.js";
+} from "./cli-jb30dzvk.js";
 import {
   resolveIdentity,
   recordUnmappedIdentity
-} from "./cli-aecdcr77.js";
+} from "./cli-asq5ydm4.js";
 import {
   findUserByExternalId,
   findOrCreateUserByEmail,
   linkIdentity,
   init_users
-} from "./cli-e8jyq7d8.js";
+} from "./cli-6a1xg1p7.js";
 
 // src/slack/enrich.ts
 init_db3();