@oxygen-agent/cli 1.377.3 → 1.591.1

package/node_modules/@oxygen/workflows/dist/graph/expression.js

@@ -0,0 +1,700 @@
+// Runtime binding for oxygen-workflows-v2: the one place that turns a declarative
+// WorkflowValueRef or WorkflowCondition into a value, shared by the worker
+// scheduler, the linter, and the visual editor's preview pane.
+//
+// This module must stay BROWSER-SAFE. Its only imports are @oxygen/formula (itself
+// dependency-free and node-free) and ./types.js — never ../index.js, which pulls
+// node:vm and node:crypto.
+//
+// Two invariants hold everywhere below:
+//   - Reading is total. A missing path, a wrong-typed container, or a malformed
+//     path expression resolves to `undefined`; it never throws. A half-drawn graph
+//     and a row with a null field must not crash a run.
+//   - Reading is prototype-safe. Path segments are matched against own properties
+//     only, and the segments that reach JavaScript object internals
+//     (__proto__ / constructor / prototype) are rejected outright.
+import { analyzeFormulaDependencies, evaluateFormulaInScope, formulaExpressionError, } from "@oxygen/formula";
+/** The roots a `ref` path may start from. Anything else is not a scope path. */
+export const SCOPE_PATH_ROOTS = new Set(["trigger", "steps", "loop"]);
+/**
+ * Segments that must never be traversed. They resolve to JavaScript object
+ * internals rather than workflow data, so allowing them would let an authored
+ * path reach (and, in a future writer, mutate) Object.prototype.
+ */
+const BLOCKED_PATH_SEGMENTS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype",
+]);
+export const WORKFLOW_COMPARE_OPS = new Set([
+    "eq",
+    "neq",
+    "gt",
+    "gte",
+    "lt",
+    "lte",
+    "contains",
+    "not_contains",
+    "starts_with",
+    "ends_with",
+    "is_empty",
+    "is_not_empty",
+    "in",
+    "not_in",
+    "matches",
+]);
+/** Operators that take no right operand. */
+export const UNARY_COMPARE_OPS = new Set([
+    "is_empty",
+    "is_not_empty",
+]);
+// ---------------------------------------------------------------------------
+// Paths
+// ---------------------------------------------------------------------------
+/**
+ * Split a path expression into its segments, or return null when the expression
+ * is malformed or reaches a blocked segment.
+ *
+ * Grammar: dotted keys with optional index suffixes —
+ *   steps.find_person.output.emails[0].address
+ *   trigger.input["odd.key"]
+ *
+ * Returning null (rather than throwing) is what lets `resolvePath` stay total;
+ * the linter uses the same parser to reject the path at authoring time, so a
+ * typo surfaces in lint rather than as a silently empty value at run time.
+ */
+export function parseScopePath(path) {
+    const trimmed = path.trim();
+    if (!trimmed || trimmed.startsWith(".") || trimmed.endsWith("."))
+        return null;
+    const segments = [];
+    let current = "";
+    let index = 0;
+    const flush = () => {
+        const segment = current.trim();
+        current = "";
+        if (!segment)
+            return false;
+        segments.push(segment);
+        return true;
+    };
+    while (index < trimmed.length) {
+        const char = trimmed[index] ?? "";
+        if (char === ".") {
+            if (!flush())
+                return null;
+            index += 1;
+            continue;
+        }
+        if (char === "[") {
+            // An index may follow a key ("items[0]") or another index ("matrix[0][1]"),
+            // but never open the expression ("[0].x" has no root).
+            if (current.trim()) {
+                if (!flush())
+                    return null;
+            }
+            else if (segments.length === 0) {
+                return null;
+            }
+            const close = trimmed.indexOf("]", index);
+            if (close < 0)
+                return null;
+            const inner = trimmed.slice(index + 1, close).trim();
+            const quoted = readQuotedSegment(inner);
+            if (quoted !== null)
+                segments.push(quoted);
+            else if (/^\d+$/.test(inner))
+                segments.push(inner);
+            else
+                return null;
+            index = close + 1;
+            if (trimmed[index] === ".")
+                index += 1;
+            continue;
+        }
+        if (char === "]")
+            return null;
+        current += char;
+        index += 1;
+    }
+    if (current.trim() && !flush())
+        return null;
+    if (segments.length === 0)
+        return null;
+    if (segments.some((segment) => BLOCKED_PATH_SEGMENTS.has(segment)))
+        return null;
+    return segments;
+}
+function readQuotedSegment(inner) {
+    if (inner.length < 2)
+        return null;
+    const quote = inner[0];
+    if ((quote !== "\"" && quote !== "'") || !inner.endsWith(quote))
+        return null;
+    const value = inner.slice(1, -1);
+    return value.length > 0 ? value : null;
+}
+/** Read one segment off a container. Own properties only; never throws. */
+function readSegment(container, segment) {
+    if (container === null || container === undefined)
+        return undefined;
+    // Redundant with parseScopePath's rejection, kept as defence in depth: this is
+    // the only function that dereferences an authored key.
+    if (BLOCKED_PATH_SEGMENTS.has(segment))
+        return undefined;
+    if (Array.isArray(container)) {
+        if (segment === "length")
+            return container.length;
+        if (!/^\d+$/.test(segment))
+            return undefined;
+        return container[Number(segment)];
+    }
+    if (typeof container === "string") {
+        return segment === "length" ? container.length : undefined;
+    }
+    if (typeof container !== "object")
+        return undefined;
+    if (!Object.prototype.hasOwnProperty.call(container, segment))
+        return undefined;
+    return container[segment];
+}
+function walkPath(root, path) {
+    const segments = parseScopePath(path);
+    if (!segments)
+        return undefined;
+    let current = root;
+    for (const segment of segments) {
+        current = readSegment(current, segment);
+        if (current === undefined)
+            return undefined;
+    }
+    return current;
+}
+/**
+ * A null-prototype view of the run scope. Path lookups start here, so even a
+ * segment that slipped past the blocklist cannot climb into Object.prototype.
+ */
+function scopeRoot(scope) {
+    const root = Object.create(null);
+    root.trigger = scope.trigger;
+    root.steps = scope.steps;
+    root.loop = scope.loop;
+    return root;
+}
+/** Resolve a dotted (+ `[n]`) scope path. Missing or malformed → undefined. */
+export function resolvePath(path, scope) {
+    return walkPath(scopeRoot(scope), path);
+}
+// ---------------------------------------------------------------------------
+// Templates
+// ---------------------------------------------------------------------------
+/**
+ * Substitute every `{{ path }}` placeholder. The result is always a string:
+ * blanks render as "", scalars as their text, objects/arrays as compact JSON.
+ * `{{}}` (no path) is literal text, not a binding.
+ */
+export function renderTemplate(template, scope) {
+    return template.replace(/\{\{([^{}]*)\}\}/g, (match, rawPath) => {
+        const path = rawPath.trim();
+        if (!path)
+            return match;
+        return stringifyTemplateValue(resolvePath(path, scope));
+    });
+}
+function stringifyTemplateValue(value) {
+    if (value === null || value === undefined)
+        return "";
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    try {
+        return JSON.stringify(value) ?? "";
+    }
+    catch {
+        // Cyclic structures: a template is presentation, so render nothing rather
+        // than failing the node that happened to reference one.
+        return "";
+    }
+}
+// ---------------------------------------------------------------------------
+// Value refs
+// ---------------------------------------------------------------------------
+/**
+ * Whether a `{{ ... }}` body is one of OUR scope paths, as opposed to somebody
+ * else's templating that happens to share the delimiters.
+ *
+ * This distinction is the whole safety of deep resolution. Oxygen's own
+ * documented merge-tag syntax uses the identical braces — `{{column}}`,
+ * `{{column|fallback}}`, spintax `{{RANDOM|a|b|c}}`, `{% if %}` — and those
+ * strings travel INSIDE structured parameters: a sequence step's subject and
+ * body, an AI column's prompt. Resolving them as scope paths deleted them,
+ * because an unresolvable path stringifies to "". A sequence subject of
+ * "{{RANDOM|Quick q|One question}} about {{company}}" came out as " about ",
+ * i.e. personalization silently stripped from outbound mail.
+ *
+ * So only a token rooted at `trigger`, `steps` or `loop` is ours. Everything
+ * else is passed through untouched for its real consumer to interpret.
+ */
+function isScopeToken(body) {
+    const path = body.trim();
+    if (!path)
+        return false;
+    const root = path.split(/[.[]/, 1)[0];
+    return root !== undefined && SCOPE_PATH_ROOTS.has(root);
+}
+/** Render only OUR tokens in a string, leaving every foreign one verbatim. */
+function renderScopeTokens(value, scope) {
+    return value.replace(/\{\{([^{}]*)\}\}/g, (match, rawBody) => (isScopeToken(rawBody)
+        ? stringifyTemplateValue(resolvePath(rawBody.trim(), scope))
+        : match));
+}
+/** An object or array — the shapes whose interiors are worth walking. */
+function isStructured(value) {
+    return typeof value === "object" && value !== null;
+}
+/**
+ * Render every `{{ ... }}` token inside a structured literal, preserving shape.
+ *
+ * A token that is the ENTIRE string resolves to its real value — so
+ * `"{{ loop.each.item.score }}"` becomes the number 70, not `"70"`, which matters
+ * because a provider that declares a numeric field rejects the string. A token
+ * embedded in surrounding text renders as text, exactly as `template` does.
+ *
+ * Bounded in depth: a hostile or accidental deep structure must not recurse
+ * without limit, and no real tool parameter is nested more than a few levels.
+ */
+function resolveTokensDeep(value, scope, depth = 0) {
+    if (depth > 12)
+        return value;
+    if (typeof value === "string") {
+        const whole = /^\s*\{\{([^{}]*)\}\}\s*$/.exec(value);
+        if (whole) {
+            const path = (whole[1] ?? "").trim();
+            return isScopeToken(path) ? resolvePath(path, scope) : value;
+        }
+        return value.includes("{{") ? renderScopeTokens(value, scope) : value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => resolveTokensDeep(entry, scope, depth + 1));
+    }
+    if (isStructured(value)) {
+        const out = {};
+        for (const [key, entry] of Object.entries(value)) {
+            out[key] = resolveTokensDeep(entry, scope, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
+export function resolveValueRef(ref, scope) {
+    switch (ref.type) {
+        case "literal":
+            // A literal OBJECT or ARRAY may carry `{{ ... }}` tokens inside it, and
+            // they resolve. This is what makes a structured parameter bindable at all:
+            // `leads: [{ table_row_id: "{{ loop.each.item._row_id }}" }]` is the only
+            // way to hand a per-row value to a capability whose input is an array, and
+            // the editor renders such a parameter as a JSON editor. Without this the
+            // token reached the provider verbatim and the step failed, so the whole
+            // shape was unauthorable except by dropping into a `code` node.
+            //
+            // A top-level literal STRING is deliberately left alone: `template` is the
+            // ref type for that, and quietly interpolating a plain string would change
+            // what an existing manifest means.
+            return isStructured(ref.value)
+                ? resolveTokensDeep(ref.value, scope)
+                : ref.value;
+        case "template":
+            return renderTemplate(ref.value, scope);
+        case "ref":
+            return resolvePath(ref.path, scope);
+        case "formula":
+            return evaluateFormulaInScope(ref.expression, formulaScopeFor(scope), { paths: true });
+        case "context_profile":
+            return ref.path === undefined
+                ? scope.contextProfile
+                : walkPath(scope.contextProfile, ref.path);
+        case "context_asset": {
+            const asset = readSegment(scope.contextAssets, ref.assetId);
+            return ref.path === undefined ? asset : walkPath(asset, ref.path);
+        }
+    }
+}
+/**
+ * Bind the formula language's identifiers to the run scope.
+ *
+ * Two shapes resolve here, and the DOTTED one is tried first (v1.555.0):
+ *
+ *   steps.enrich.output.email   the same scope path a ref or template binding
+ *                               uses — so the three binding kinds finally agree
+ *                               about how to name one value
+ *   enrich                      a bare name, looked up in a fixed order:
+ *                               trigger.input.<name> → steps.<name>.output
+ *                               → loop.<name>.item
+ *
+ * The bare form stays because it is what shipped and what `referencedNodeIds` and
+ * remap.ts already understand; dropping it would break every formula written before
+ * paths existed.
+ *
+ * `resolve` stays strict per the FormulaScope contract (an unresolvable
+ * identifier throws, so a typo fails loudly instead of evaluating to null);
+ * `resolveOptional` is the lenient read cross-row functions use.
+ */
+function formulaScopeFor(scope) {
+    return {
+        resolve(identifier) {
+            const found = lookupFormulaIdentifier(scope, identifier);
+            if (found.found)
+                return found.value;
+            throw formulaExpressionError("Unknown identifier in workflow formula.", {
+                identifier,
+                hint: "Reference a workflow input, a node id, or a loop node id.",
+            });
+        },
+        resolveOptional(identifier) {
+            const found = lookupFormulaIdentifier(scope, identifier);
+            return found.found ? found.value : undefined;
+        },
+    };
+}
+function lookupFormulaIdentifier(scope, identifier) {
+    // A rooted dotted path is unambiguous, so it wins before any bare-name guessing.
+    // resolvePath owns the traversal (including its prototype-pollution refusals), so
+    // a formula reads exactly what a `ref` binding with the same path would.
+    if (identifier.includes(".") || identifier.includes("[")) {
+        const root = identifier.split(/[.[]/, 1)[0];
+        if (root !== undefined && SCOPE_PATH_ROOTS.has(root)) {
+            const value = resolvePath(identifier, scope);
+            return value === undefined ? { found: false } : { found: true, value };
+        }
+        return { found: false };
+    }
+    if (BLOCKED_PATH_SEGMENTS.has(identifier))
+        return { found: false };
+    const input = scope.trigger?.input;
+    if (isPlainObject(input) && Object.prototype.hasOwnProperty.call(input, identifier)) {
+        return { found: true, value: input[identifier] };
+    }
+    const node = readSegment(scope.steps, identifier);
+    if (node !== undefined)
+        return { found: true, value: readSegment(node, "output") };
+    const loop = readSegment(scope.loop, identifier);
+    if (loop !== undefined)
+        return { found: true, value: readSegment(loop, "item") };
+    return { found: false };
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// ---------------------------------------------------------------------------
+// Conditions
+// ---------------------------------------------------------------------------
+export function evaluateCondition(condition, scope) {
+    if (condition.type === "group") {
+        // An empty group is vacuous: `all` holds, `any` does not — the same identity
+        // Array.every / Array.some give, so no special case is needed at run time.
+        const result = condition.op === "all"
+            ? condition.children.every((child) => evaluateCondition(child, scope))
+            : condition.children.some((child) => evaluateCondition(child, scope));
+        return condition.not === true ? !result : result;
+    }
+    const left = resolveValueRef(condition.left, scope);
+    const right = condition.right === undefined ? undefined : resolveValueRef(condition.right, scope);
+    return compareValues(left, condition.op, right);
+}
+function compareValues(left, op, right) {
+    switch (op) {
+        case "eq":
+            return valuesEqual(left, right);
+        case "neq":
+            return !valuesEqual(left, right);
+        case "gt":
+            return orderingOf(left, right) > 0;
+        case "gte":
+            return orderingOf(left, right) >= 0;
+        case "lt":
+            return orderingOf(left, right) < 0;
+        case "lte":
+            return orderingOf(left, right) <= 0;
+        case "contains":
+            return containsValue(left, right);
+        case "not_contains":
+            return !containsValue(left, right);
+        case "starts_with":
+            return textOf(left).startsWith(textOf(right));
+        case "ends_with":
+            return textOf(left).endsWith(textOf(right));
+        case "is_empty":
+            return isEmptyValue(left);
+        case "is_not_empty":
+            return !isEmptyValue(left);
+        case "in":
+            return containsValue(right, left);
+        case "not_in":
+            return !containsValue(right, left);
+        case "matches":
+            return matchesPattern(left, right);
+    }
+}
+/**
+ * Numeric when both sides read as numbers, otherwise strict identity with
+ * null/undefined treated as one blank. Deliberately NOT the formula language's
+ * `formulaValuesEqual`, which throws on non-numeric input: a condition gates
+ * routing, and a run must not fail because a provider returned an object where
+ * the author expected a string.
+ */
+function valuesEqual(left, right) {
+    if (left === right)
+        return true;
+    if (left === null || left === undefined)
+        return right === null || right === undefined;
+    if (right === null || right === undefined)
+        return false;
+    const leftNumber = numberOf(left);
+    const rightNumber = numberOf(right);
+    if (leftNumber !== null && rightNumber !== null)
+        return leftNumber === rightNumber;
+    if (Array.isArray(left) && Array.isArray(right)) {
+        return left.length === right.length
+            && left.every((entry, index) => valuesEqual(entry, right[index]));
+    }
+    return false;
+}
+/**
+ * Ordering for the relational operators. Incomparable operands sort as 0, so
+ * `gt`/`lt` are false and `gte`/`lte` are true — the same shape JavaScript gives
+ * for equal values, and never an exception.
+ */
+function orderingOf(left, right) {
+    const leftNumber = numberOf(left);
+    const rightNumber = numberOf(right);
+    if (leftNumber !== null && rightNumber !== null) {
+        if (leftNumber === rightNumber)
+            return 0;
+        return leftNumber < rightNumber ? -1 : 1;
+    }
+    if (typeof left === "string" && typeof right === "string") {
+        return left.localeCompare(right);
+    }
+    return 0;
+}
+function numberOf(value) {
+    if (typeof value === "number")
+        return Number.isFinite(value) ? value : null;
+    if (typeof value === "string" && value.trim()) {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : null;
+    }
+    return null;
+}
+/** Membership for arrays, case-sensitive substring for text. */
+function containsValue(haystack, needle) {
+    if (Array.isArray(haystack))
+        return haystack.some((entry) => valuesEqual(entry, needle));
+    if (haystack === null || haystack === undefined)
+        return false;
+    if (needle === null || needle === undefined)
+        return false;
+    return textOf(haystack).includes(textOf(needle));
+}
+function isEmptyValue(value) {
+    if (value === null || value === undefined)
+        return true;
+    if (typeof value === "string")
+        return value.trim().length === 0;
+    if (Array.isArray(value))
+        return value.length === 0;
+    // 0 and false are values an author chose, not emptiness.
+    if (typeof value === "object")
+        return Object.keys(value).length === 0;
+    return false;
+}
+function textOf(value) {
+    if (value === null || value === undefined)
+        return "";
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    try {
+        return JSON.stringify(value) ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+// ---------------------------------------------------------------------------
+// `matches`
+// ---------------------------------------------------------------------------
+const MAX_CONDITION_PATTERN_LENGTH = 200;
+/**
+ * Compile a `matches` pattern, or return null when it is unsafe or invalid.
+ *
+ * Choice: conservative STATIC REJECTION rather than a linear (Thompson NFA)
+ * matcher. A linear engine would be several hundred lines of new, security-load-
+ * bearing code in a module the browser also bundles, whereas the patterns real
+ * GTM authors write (domain suffixes, job-title keywords, ID formats) never need
+ * the constructs rejected here. Rejected: sources over 200 characters,
+ * lookaround, backreferences, and a quantified group whose body itself contains
+ * an unbounded quantifier — the `(a+)+` family that drives catastrophic
+ * backtracking. Everything else compiles as a normal RegExp.
+ *
+ * The linter calls this at authoring time and reports `invalid_condition`, so a
+ * rejected pattern is a lint error the author sees, not a silent run-time false.
+ */
+export function compileConditionPattern(pattern) {
+    if (!isSafeRegExpSource(pattern))
+        return null;
+    try {
+        return new RegExp(pattern);
+    }
+    catch {
+        return null;
+    }
+}
+function isSafeRegExpSource(source) {
+    if (!source || source.length > MAX_CONDITION_PATTERN_LENGTH)
+        return false;
+    if (/\(\?<?[=!]/.test(source))
+        return false; // lookahead / lookbehind
+    if (/\\[1-9]/.test(source))
+        return false; // backreference
+    return !hasNestedQuantifier(source);
+}
+function isUnboundedQuantifier(char) {
+    // `?` alone is bounded and cannot blow up; `*`, `+` and `{n,m}` can.
+    return char === "*" || char === "+" || char === "{";
+}
+function hasNestedQuantifier(source) {
+    // One frame per open group, plus a base frame for the top level. A frame is
+    // "quantified" once anything inside it repeats.
+    const stack = [{ quantified: false }];
+    let inCharacterClass = false;
+    let index = 0;
+    while (index < source.length) {
+        const char = source[index] ?? "";
+        if (char === "\\") {
+            index += 2;
+            continue;
+        }
+        if (inCharacterClass) {
+            if (char === "]")
+                inCharacterClass = false;
+            index += 1;
+            continue;
+        }
+        if (char === "[") {
+            inCharacterClass = true;
+            index += 1;
+            continue;
+        }
+        if (char === "(") {
+            stack.push({ quantified: false });
+            index += 1;
+            continue;
+        }
+        if (char === ")") {
+            index += 1;
+            // Unbalanced ")" — leave it to RegExp construction to reject.
+            if (stack.length === 1)
+                continue;
+            const frame = stack.pop();
+            const repeated = isUnboundedQuantifier(source[index] ?? "");
+            if (repeated && frame?.quantified === true)
+                return true;
+            const parent = stack[stack.length - 1];
+            if (parent && (repeated || frame?.quantified === true))
+                parent.quantified = true;
+            continue;
+        }
+        if (isUnboundedQuantifier(char)) {
+            const top = stack[stack.length - 1];
+            if (top)
+                top.quantified = true;
+        }
+        index += 1;
+    }
+    return false;
+}
+function matchesPattern(value, pattern) {
+    if (typeof pattern !== "string")
+        return false;
+    const regex = compileConditionPattern(pattern);
+    if (!regex)
+        return false;
+    return regex.test(textOf(value));
+}
+// ---------------------------------------------------------------------------
+// Static analysis
+// ---------------------------------------------------------------------------
+/**
+ * Node ids a ref or condition reads, in first-seen order.
+ *
+ * `steps.<id>...` and `loop.<id>...` paths name a node exactly. Formula refs are
+ * a superset: the tokenizer's bare identifiers may name a node, a workflow
+ * input, or a loop, and nothing in the expression distinguishes them — callers
+ * that need certainty (edge inference, dependency ordering) intersect the result
+ * with the manifest's declared node ids.
+ */
+export function referencedNodeIds(ref) {
+    const ids = [];
+    collectNodeIds(ref, ids);
+    return [...new Set(ids)];
+}
+function collectNodeIds(entry, into) {
+    switch (entry.type) {
+        case "group":
+            for (const child of entry.children)
+                collectNodeIds(child, into);
+            return;
+        case "compare":
+            collectNodeIds(entry.left, into);
+            if (entry.right !== undefined)
+                collectNodeIds(entry.right, into);
+            return;
+        case "ref":
+            pushPathNodeId(entry.path, into);
+            return;
+        case "template":
+            for (const match of entry.value.matchAll(/\{\{([^{}]*)\}\}/g)) {
+                const path = (match[1] ?? "").trim();
+                if (path)
+                    pushPathNodeId(path, into);
+            }
+            return;
+        case "formula":
+            try {
+                // `paths: true` to match how the expression is EVALUATED. Parsing it the
+                // other way threw on every dotted identifier, and the catch below swallowed
+                // it — so a formula reading `steps.enrich.email` reported no node reference
+                // at all, and the upstream-only check and duplicate-remap both went blind
+                // to it.
+                for (const identifier of analyzeFormulaDependencies(entry.expression, { paths: true }).identifiers) {
+                    // A rooted dotted identifier names its node in the second segment, the
+                    // same as a ref path; a bare one IS the node id.
+                    if (identifier.includes(".") || identifier.includes("[")) {
+                        pushPathNodeId(identifier, into);
+                    }
+                    else {
+                        into.push(identifier);
+                    }
+                }
+            }
+            catch {
+                // An unparseable expression has no analysable dependencies; the linter
+                // reports it as invalid_formula.
+            }
+            return;
+        default:
+            return;
+    }
+}
+function pushPathNodeId(path, into) {
+    const segments = parseScopePath(path);
+    const root = segments?.[0];
+    const id = segments?.[1];
+    if (!root || !id)
+        return;
+    if (root === "steps" || root === "loop")
+        into.push(id);
+}