@wenathlan/extension 1.1.48 → 1.1.50

package/dist/index.js

@@ -1331,6 +1331,212 @@ function expireprofilerecords(input) {
   };
 }
 
+// sessions.ts
+var sessionkinds = ["persiststate", "capturesession", "restoresession", "namedsessions", "diffsessions", "searchsessions", "exportsessions", "importsessions"];
+var sessionfileversion = 1;
+var snapshotsections = ["tabs", "scroll", "forms", "storage", "cookies"];
+var searchfields = ["urls", "titles", "names", "text"];
+function checksumtext(payload) {
+  let hash = 2166136261;
+  for (let index = 0; index < payload.length; index += 1) {
+    hash ^= payload.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash.toString(16).padStart(8, "0");
+}
+function taskstatechecksum(runid, stepcursor, outputs) {
+  return checksumtext(`${runid}:${stepcursor}:${outputs.length}:${outputs.map((output) => `${output.stepid}:${output.ok}:${output.summary.length}`).join("|")}`);
+}
+function taskstateof(input) {
+  return { runid: input.runid, stepcursor: input.stepcursor, outputs: input.outputs, checkpointat: input.checkpointat, checksum: taskstatechecksum(input.runid, input.stepcursor, input.outputs) };
+}
+function taskstatevalid(state) {
+  if (!state || typeof state.runid !== "string" || !state.runid.trim()) return false;
+  if (typeof state.stepcursor !== "number" || !Number.isInteger(state.stepcursor) || state.stepcursor < 0) return false;
+  if (typeof state.checkpointat !== "number" || !Number.isFinite(state.checkpointat)) return false;
+  if (!Array.isArray(state.outputs)) return false;
+  return state.checksum === taskstatechecksum(state.runid, state.stepcursor, state.outputs);
+}
+function sessiontabof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.url !== "string" || !candidate.url.trim()) return void 0;
+  if (typeof candidate.title !== "string") return void 0;
+  if (typeof candidate.index !== "number" || !Number.isInteger(candidate.index) || candidate.index < 0) return void 0;
+  const scrollx = typeof candidate.scrollx === "number" && Number.isFinite(candidate.scrollx) ? candidate.scrollx : 0;
+  const scrolly = typeof candidate.scrolly === "number" && Number.isFinite(candidate.scrolly) ? candidate.scrolly : 0;
+  const forms = Array.isArray(candidate.forms) ? candidate.forms.flatMap((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return [];
+    const form = entry;
+    if (typeof form.selector !== "string" || !form.selector.trim()) return [];
+    return [{ selector: form.selector, value: typeof form.value === "string" ? form.value : "" }];
+  }) : [];
+  return { url: candidate.url, title: candidate.title, index: candidate.index, scrollx, scrolly, forms };
+}
+function autointervalof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.period !== "number" || !Number.isFinite(candidate.period) || candidate.period <= 0) return void 0;
+  if (typeof candidate.maxsnapshots !== "number" || !Number.isInteger(candidate.maxsnapshots) || candidate.maxsnapshots < 1) return void 0;
+  if (typeof candidate.expiry !== "number" || !Number.isFinite(candidate.expiry) || candidate.expiry < 0) return void 0;
+  return { period: candidate.period, maxsnapshots: candidate.maxsnapshots, expiry: candidate.expiry };
+}
+function snapshotplanof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (candidate.scope !== "tab" && candidate.scope !== "run" && candidate.scope !== "all") return void 0;
+  const sections = Array.isArray(candidate.sections) ? candidate.sections.flatMap((section) => typeof section === "string" && snapshotsections.includes(section) ? [section] : []) : [];
+  if (sections.length === 0) return void 0;
+  if (typeof candidate.captures !== "boolean") return void 0;
+  const auto = candidate.auto === void 0 ? void 0 : autointervalof(candidate.auto);
+  if (candidate.auto !== void 0 && auto === void 0) return void 0;
+  return { scope: candidate.scope, sections, captures: candidate.captures, ...auto !== void 0 ? { auto } : {} };
+}
+function restoreplanof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (candidate.tabpolicy !== "reopen" && candidate.tabpolicy !== "skip") return void 0;
+  if (candidate.formpolicy !== "restore" && candidate.formpolicy !== "skip") return void 0;
+  if (candidate.capturepolicy !== "link" && candidate.capturepolicy !== "skip") return void 0;
+  return { tabpolicy: candidate.tabpolicy, formpolicy: candidate.formpolicy, capturepolicy: candidate.capturepolicy };
+}
+function searchqueryof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const terms = Array.isArray(candidate.terms) ? candidate.terms.flatMap((term) => typeof term === "string" && term.trim() ? [term.trim()] : []) : [];
+  if (terms.length === 0) return void 0;
+  const fields = Array.isArray(candidate.fields) ? candidate.fields.flatMap((field) => typeof field === "string" && searchfields.includes(field) ? [field] : []) : [...searchfields];
+  if (fields.length === 0) return void 0;
+  const from = typeof candidate.from === "number" && Number.isFinite(candidate.from) ? candidate.from : void 0;
+  const to = typeof candidate.to === "number" && Number.isFinite(candidate.to) ? candidate.to : void 0;
+  if (from !== void 0 && to !== void 0 && from > to) return void 0;
+  return { terms, fields, ...from !== void 0 ? { from } : {}, ...to !== void 0 ? { to } : {} };
+}
+function sessionfolderof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.name !== "string" || !candidate.name.trim()) return void 0;
+  const parent = typeof candidate.parent === "string" && candidate.parent.trim() ? candidate.parent : void 0;
+  const tags = Array.isArray(candidate.tags) ? candidate.tags.flatMap((tag) => typeof tag === "string" && tag.trim() ? [tag] : []) : [];
+  return { name: candidate.name, ...parent !== void 0 ? { parent } : {}, tags };
+}
+function newsessionrecord(input) {
+  return { id: input.id, name: input.name, createdat: input.createdat, tabs: input.tabs, captures: input.captures, storage: input.storage, cookies: input.cookies, ...input.folder !== void 0 ? { folder: input.folder } : {}, tags: input.tags ?? [], ...input.auto === true ? { auto: true } : {} };
+}
+function diffsessionrecords(left, right) {
+  const changes = [];
+  const leftbyindex = new Map(left.tabs.map((tab) => [tab.index, tab]));
+  const rightbyindex = new Map(right.tabs.map((tab) => [tab.index, tab]));
+  for (const tab of right.tabs) {
+    const prior = leftbyindex.get(tab.index);
+    if (!prior) {
+      changes.push({ class: "added", subject: "tab", detail: `Tab ${tab.index} added: ${tab.url}` });
+      continue;
+    }
+    if (prior.url !== tab.url) changes.push({ class: "changed", subject: "url", detail: `Tab ${tab.index} moved from ${prior.url} to ${tab.url}` });
+    if (prior.title !== tab.title) changes.push({ class: "changed", subject: "tab", detail: `Tab ${tab.index} title changed from "${prior.title}" to "${tab.title}"` });
+    const priorforms = new Map(prior.forms.map((form) => [form.selector, form.value]));
+    for (const form of tab.forms) {
+      const before = priorforms.get(form.selector);
+      if (before === void 0) {
+        changes.push({ class: "added", subject: "form", detail: `Form field ${form.selector} of tab ${tab.index} added with a value` });
+        continue;
+      }
+      if (before !== form.value) changes.push({ class: "changed", subject: "form", detail: `Form field ${form.selector} of tab ${tab.index} changed its captured value` });
+    }
+    for (const form of prior.forms) if (!tab.forms.some((entry) => entry.selector === form.selector)) changes.push({ class: "removed", subject: "form", detail: `Form field ${form.selector} of tab ${tab.index} removed` });
+  }
+  for (const tab of left.tabs) if (!rightbyindex.has(tab.index)) changes.push({ class: "removed", subject: "tab", detail: `Tab ${tab.index} removed: ${tab.url}` });
+  const leftstorage = new Map(left.storage.map((entry) => [entry.origin, entry]));
+  for (const entry of right.storage) {
+    const prior = leftstorage.get(entry.origin);
+    if (!prior) {
+      changes.push({ class: "added", subject: "storage", detail: `Local storage of ${entry.origin} captured with ${entry.keys.length} keys` });
+      continue;
+    }
+    if (prior.keys.join("|") !== entry.keys.join("|") || prior.values.join("|") !== entry.values.join("|")) changes.push({ class: "changed", subject: "storage", detail: `Local storage of ${entry.origin} changed its captured keys or values` });
+  }
+  for (const entry of left.storage) if (!right.storage.some((candidate) => candidate.origin === entry.origin)) changes.push({ class: "removed", subject: "storage", detail: `Local storage of ${entry.origin} left the capture` });
+  return changes;
+}
+function newsessiondiff(input) {
+  return { id: input.id, leftid: input.left.id, rightid: input.right.id, changes: diffsessionrecords(input.left, input.right), at: input.at };
+}
+function searchsessionrecords(query, records) {
+  const matches = [];
+  for (const record2 of records) {
+    if (query.from !== void 0 && record2.createdat < query.from) continue;
+    if (query.to !== void 0 && record2.createdat > query.to) continue;
+    const haystacks = [
+      { field: "urls", text: record2.tabs.map((tab) => tab.url).join(" ") },
+      { field: "titles", text: record2.tabs.map((tab) => tab.title).join(" ") },
+      { field: "names", text: [record2.name, record2.folder ?? "", ...record2.tags].join(" ") },
+      { field: "text", text: record2.tabs.flatMap((tab) => tab.forms.map((form) => form.value)).join(" ") }
+    ];
+    for (const haystack of haystacks) {
+      if (!query.fields.includes(haystack.field)) continue;
+      const lower = haystack.text.toLowerCase();
+      for (const term of query.terms) {
+        const at = lower.indexOf(term.toLowerCase());
+        if (at < 0) continue;
+        const start = Math.max(0, at - 30);
+        matches.push({ sessionid: record2.id, field: haystack.field, term, at: record2.createdat, excerpt: haystack.text.slice(start, start + 80).trim() });
+      }
+    }
+  }
+  return matches;
+}
+function exportsessionfile(records, now) {
+  const recordids = records.map((record2) => record2.id);
+  const payload = JSON.stringify(records);
+  return { formatversion: sessionfileversion, records, recordids, bytesize: payload.length, checksum: checksumtext(`${sessionfileversion}:${recordids.join(",")}:${payload.length}`), exportedat: now };
+}
+function importsessionfile(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (candidate.formatversion !== sessionfileversion) return void 0;
+  const records = Array.isArray(candidate.records) ? candidate.records.flatMap((record2) => sessionrecordvalid(record2) ? [record2] : []) : [];
+  if (records.length === 0) return void 0;
+  if (!Array.isArray(candidate.recordids) || candidate.recordids.length !== records.length || !candidate.recordids.every((id, index) => id === records[index]?.id)) return void 0;
+  const bytesize = typeof candidate.bytesize === "number" && Number.isFinite(candidate.bytesize) ? candidate.bytesize : -1;
+  if (bytesize < 0) return void 0;
+  const checksum = typeof candidate.checksum === "string" ? candidate.checksum : "";
+  if (checksum !== checksumtext(`${sessionfileversion}:${candidate.recordids.join(",")}:${bytesize}`)) return void 0;
+  return { formatversion: sessionfileversion, records, recordids: candidate.recordids, bytesize, checksum, exportedat: typeof candidate.exportedat === "number" && Number.isFinite(candidate.exportedat) ? candidate.exportedat : 0 };
+}
+function sessionrecordvalid(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return false;
+  if (typeof candidate.name !== "string" || !candidate.name.trim()) return false;
+  if (typeof candidate.createdat !== "number" || !Number.isFinite(candidate.createdat)) return false;
+  if (!Array.isArray(candidate.tabs) || !candidate.tabs.every((tab) => sessiontabof(tab) !== void 0)) return false;
+  if (!Array.isArray(candidate.captures) || !candidate.captures.every((id) => typeof id === "string")) return false;
+  if (!Array.isArray(candidate.tags) || !candidate.tags.every((tag) => typeof tag === "string")) return false;
+  return true;
+}
+function expiresessions(records, retention, now) {
+  if (retention === void 0 || !Number.isFinite(retention)) return records;
+  return records.map((record2) => {
+    if (record2.sectionsexpired || now - record2.createdat < retention) return record2;
+    return { id: record2.id, name: record2.name, createdat: record2.createdat, tabs: [], captures: record2.captures, storage: [], cookies: [], ...record2.folder !== void 0 ? { folder: record2.folder } : {}, tags: record2.tags, ...record2.auto === true ? { auto: true } : {}, ...record2.restoredat !== void 0 ? { restoredat: record2.restoredat } : {}, sectionsexpired: true };
+  });
+}
+function filteredsessions(records, filter) {
+  return records.filter((record2) => {
+    if (filter.name !== void 0 && !record2.name.toLowerCase().includes(filter.name.toLowerCase())) return false;
+    if (filter.folder !== void 0 && record2.folder !== filter.folder) return false;
+    if (filter.from !== void 0 && record2.createdat < filter.from) return false;
+    if (filter.to !== void 0 && record2.createdat > filter.to) return false;
+    return true;
+  });
+}
+function crashinterrupted(state, plansteps, now) {
+  if (!state) return void 0;
+  if (state.stepcursor >= plansteps) return state;
+  return { ...state, interrupted: true, crashat: state.crashat ?? now };
+}
+
 // memory.ts
 var sessionmemory = class {
   constructor(adapter) {
@@ -2778,6 +2984,170 @@ var sessionmemory = class {
   async getlocationconsents() {
     return await this.adapter.get("locationconsents") ?? [];
   }
+  /** Returns the persisted task state checkpoint of one run so the run resumes after a service worker restart. */
+  async gettaskstate(runid) {
+    return this.adapter.get(`taskstate${runid}`);
+  }
+  /** Persists one task state checkpoint per run with its corruption checksum. */
+  async settaskstate(state) {
+    return this.adapter.set(`taskstate${state.runid}`, state);
+  }
+  /** Returns the session event history with timestamps, newest first. */
+  async getsessionevents() {
+    return await this.adapter.get("sessionevents") ?? [];
+  }
+  /** Records one session event of the run with its timestamp and detail. */
+  async addsessionevent(event) {
+    const records = await this.getsessionevents();
+    await this.adapter.set("sessionevents", [event, ...records]);
+  }
+  /** Returns every saved session record with its sections, newest first. */
+  async getsessionrecords() {
+    return await this.adapter.get("sessionrecords") ?? [];
+  }
+  /** Adds one saved session record to the library. */
+  async addsessionrecord(record2) {
+    const records = await this.getsessionrecords();
+    await this.adapter.set("sessionrecords", [record2, ...records]);
+  }
+  /** Replaces one saved session record by its id after a filing or restore touches it. */
+  async updatesessionrecord(record2) {
+    const records = await this.getsessionrecords();
+    await this.adapter.set("sessionrecords", records.map((item) => item.id === record2.id ? record2 : item));
+  }
+  /** Lists saved sessions filtered by name substring, folder and time window; the filter stays a user choice with no result cap. */
+  async listsessions(filter) {
+    return filteredsessions(await this.getsessionrecords(), filter);
+  }
+  /** Returns one saved session with every section; an expired record carries its metadata only. */
+  async getsessionrecord(id) {
+    return (await this.getsessionrecords()).find((record2) => record2.id === id);
+  }
+  /** Runs the reviewed search query across every stored session and returns the matches with their session ids and time windows. */
+  async searchmemory(query) {
+    return searchsessionrecords(query, await this.getsessionrecords());
+  }
+  /** Returns the folder tree of the session library. */
+  async getsessionfolders() {
+    return await this.adapter.get("sessionfolders") ?? [];
+  }
+  /** Replaces the folder tree after a reviewed filing adds or moves one folder. */
+  async setsessionfolders(folders) {
+    return this.adapter.set("sessionfolders", folders);
+  }
+  /** Returns every stored session diff result, newest first. */
+  async getsessiondiffs() {
+    return await this.adapter.get("sessiondiffs") ?? [];
+  }
+  /** Stores one session diff result for later review. */
+  async addsessiondiff(diff) {
+    const records = await this.getsessiondiffs();
+    await this.adapter.set("sessiondiffs", [diff, ...records]);
+  }
+  /** Returns the persisted auto snapshot state with the reviewed interval, the last snapshot time and the snapshot count. */
+  async getautosnapshot() {
+    return await this.adapter.get("autosnapshot") ?? void 0;
+  }
+  /** Stores the auto snapshot state of the reviewed interval. */
+  async setautosnapshot(state) {
+    return this.adapter.set("autosnapshot", state);
+  }
+  /** Clears the auto snapshot interval so on demand captures stay the only source of records. */
+  async clearautosnapshot() {
+    return this.adapter.set("autosnapshot", null);
+  }
+  /** Expires the heavy sections of saved sessions after the reviewed retention window while the record metadata survives. */
+  async applysessionexpiry(retention, now) {
+    const records = expiresessions(await this.getsessionrecords(), retention, now);
+    await this.adapter.set("sessionrecords", records);
+    return records;
+  }
+  /** Returns the crash marker of a run interrupted by a browser restart. */
+  async getcrashflag() {
+    return await this.adapter.get("crashed") ?? false;
+  }
+  /** Sets the crash marker so the sessions view offers the crash restore inside the consent model. */
+  async setcrashflag(value) {
+    return this.adapter.set("crashed", value);
+  }
+  /** Stores one composed workflow record version with its timestamp; re-composing the same version replaces it while older versions survive for the audit trail. */
+  async addworkflowrecord(record2) {
+    const records = await this.getworkflowrecordversions();
+    const remaining = records.filter((entry) => !(entry.id === record2.id && entry.version === record2.version));
+    await this.adapter.set("workflowrecords", [record2, ...remaining]);
+  }
+  /** Returns every stored workflow record version, newest first. */
+  async getworkflowrecordversions() {
+    return await this.adapter.get("workflowrecords") ?? [];
+  }
+  /** Returns the latest stored version of one workflow record. */
+  async getworkflowrecord(id) {
+    return (await this.getworkflowrecordversions()).find((entry) => entry.id === id);
+  }
+  /** Lists the saved workflow records, the latest version of each, newest first. */
+  async listworkflows() {
+    const seen = /* @__PURE__ */ new Set();
+    const latest = [];
+    for (const entry of await this.getworkflowrecordversions()) {
+      if (seen.has(entry.id)) continue;
+      seen.add(entry.id);
+      latest.push(entry);
+    }
+    return latest;
+  }
+  /** Stores one workflow run with its state transition; a run replace keeps the full runlog of the same id. */
+  async setworkflowrun(run) {
+    const runs = await this.listworkflowruns();
+    const remaining = runs.filter((entry) => entry.id !== run.id);
+    await this.adapter.set("workflowruns", [run, ...remaining]);
+  }
+  /** Returns every stored workflow run, newest first. */
+  async listworkflowruns() {
+    return await this.adapter.get("workflowruns") ?? [];
+  }
+  /** Returns one run with its full step outcome list so the panel shows the timeline after and during a run. */
+  async getrun(id) {
+    const run = (await this.listworkflowruns()).find((entry) => entry.id === id);
+    if (!run) return void 0;
+    return { run, log: await this.getrunlog(id) };
+  }
+  /** Records one runlog entry of a run; the runlog retention window is a user setting and an absent window keeps every entry. */
+  async addrunlogentry(runid, entry) {
+    const entries = await this.getrunlog(runid);
+    const combined = [...entries, entry];
+    const retention = (await this.getsettings())?.runlogretention;
+    await this.adapter.set(`runlog${runid}`, retention === void 0 ? combined : combined.slice(-retention));
+  }
+  /** Returns the runlog of one run, oldest first. */
+  async getrunlog(runid) {
+    return await this.adapter.get(`runlog${runid}`) ?? [];
+  }
+  /** Stores the variable values per scope of one run for inspection after the run. */
+  async setrunscopes(runid, scopes) {
+    return this.adapter.set(`runscopes${runid}`, scopes);
+  }
+  /** Returns the variable scopes of one run, oldest first. */
+  async getrunscopes(runid) {
+    return await this.adapter.get(`runscopes${runid}`) ?? [];
+  }
+  /** Records one provenance entry of a run: an expression result or a regex capture with its name, value and time. */
+  async addworkflowprovenance(runid, entry) {
+    const entries = await this.getworkflowprovenance(runid);
+    await this.adapter.set(`workflowprovenance${runid}`, [...entries, entry]);
+  }
+  /** Returns every provenance entry of one run, oldest first. */
+  async getworkflowprovenance(runid) {
+    return await this.adapter.get(`workflowprovenance${runid}`) ?? [];
+  }
+  /** Stores one shareable step template under its unique name. */
+  async addsteptemplate(template) {
+    const templates = (await this.getsteptemplates()).filter((entry) => entry.name !== template.name);
+    await this.adapter.set("steptemplates", [template, ...templates]);
+  }
+  /** Returns every stored step template, newest first. */
+  async getsteptemplates() {
+    return await this.adapter.get("steptemplates") ?? [];
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -3314,6 +3684,511 @@ function extractvalues(body, paths) {
   return fields.map((field) => ({ path: field.path, ...field.value !== void 0 ? { value: field.value } : {}, ...field.missing ? { missing: true } : {} }));
 }
 
+// workflow.ts
+var workflowkinds = ["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"];
+function workflowstepof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return void 0;
+  if (typeof candidate.kind !== "string" || !/^[a-z]+$/.test(candidate.kind)) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  if (candidate.target !== void 0 && (typeof candidate.target !== "string" || !candidate.target)) return void 0;
+  if (candidate.value !== void 0 && typeof candidate.value !== "string") return void 0;
+  if (candidate.options !== void 0 && typeof candidate.options !== "string") return void 0;
+  const bindings = Array.isArray(candidate.bindings) ? candidate.bindings.flatMap((binding) => bindingof(binding) !== void 0 ? [bindingof(binding)] : []) : void 0;
+  if (candidate.bindings !== void 0 && bindings === void 0) return void 0;
+  if (Array.isArray(candidate.bindings) && bindings !== void 0 && bindings.length !== candidate.bindings.length) return void 0;
+  const expression = candidate.expression === void 0 ? void 0 : expressionof(candidate.expression);
+  if (candidate.expression !== void 0 && expression === void 0) return void 0;
+  const extract = candidate.extract === void 0 ? void 0 : regexruleof(candidate.extract);
+  if (candidate.extract !== void 0 && extract === void 0) return void 0;
+  return { id: candidate.id, kind: candidate.kind, label: candidate.label, ...candidate.target !== void 0 ? { target: candidate.target } : {}, ...candidate.value !== void 0 ? { value: candidate.value } : {}, ...candidate.options !== void 0 ? { options: candidate.options } : {}, ...bindings !== void 0 && bindings.length > 0 ? { bindings } : {}, ...expression !== void 0 ? { expression } : {}, ...extract !== void 0 ? { extract } : {} };
+}
+function blockinvocationof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.block !== "string" || !candidate.block.trim()) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  return { block: candidate.block, label: candidate.label };
+}
+function workflowblockof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.name !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.name)) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  if (!Array.isArray(candidate.steps)) return void 0;
+  const steps = [];
+  for (const entry of candidate.steps) {
+    const step = workflowstepof(entry);
+    if (step) {
+      steps.push(step);
+      continue;
+    }
+    const invocation = blockinvocationof(entry);
+    if (invocation) {
+      steps.push(invocation);
+      continue;
+    }
+    return void 0;
+  }
+  return { name: candidate.name, label: candidate.label, steps };
+}
+function steptemplateof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return void 0;
+  if (typeof candidate.name !== "string" || !candidate.name.trim()) return void 0;
+  if (typeof candidate.origin !== "string" || !candidate.origin.trim()) return void 0;
+  const step = workflowstepof(candidate.step);
+  if (!step) return void 0;
+  if (typeof candidate.sharedat !== "number" || !Number.isFinite(candidate.sharedat)) return void 0;
+  return { id: candidate.id, name: candidate.name, origin: candidate.origin, step, sharedat: candidate.sharedat };
+}
+function bindingof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.variable !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.variable)) return void 0;
+  if (!variablekinds.includes(candidate.kind)) return void 0;
+  if (typeof candidate.stepid !== "string" || !candidate.stepid.trim()) return void 0;
+  if (candidate.path !== void 0 && (typeof candidate.path !== "string" || !candidate.path.trim())) return void 0;
+  return { variable: candidate.variable, kind: candidate.kind, stepid: candidate.stepid, ...candidate.path !== void 0 ? { path: candidate.path } : {} };
+}
+var variablekinds = ["string", "number", "boolean", "list", "element"];
+var expressionoperators = ["add", "subtract", "multiply", "divide", "modulo", "equal", "notequal", "less", "greater", "lessequal", "greaterequal", "and", "or", "not", "concat", "contains", "length"];
+function expressionof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const left = operandof(candidate.left);
+  if (!left) return void 0;
+  const right = candidate.right === void 0 ? void 0 : operandof(candidate.right);
+  if (candidate.right !== void 0 && right === void 0) return void 0;
+  if (typeof candidate.operator !== "string" || !expressionoperators.includes(candidate.operator)) return void 0;
+  if (typeof candidate.result !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.result)) return void 0;
+  if (!variablekinds.includes(candidate.resultkind)) return void 0;
+  return { left, ...right !== void 0 ? { right } : {}, operator: candidate.operator, result: candidate.result, resultkind: candidate.resultkind };
+}
+function operandof(value) {
+  if (value === void 0) return void 0;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return { literal: value };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.ref === "string" && /^[a-z][a-z0-9]*$/.test(candidate.ref)) return { ref: candidate.ref };
+  if (typeof candidate.literal === "string" || typeof candidate.literal === "number" || typeof candidate.literal === "boolean") return { literal: candidate.literal };
+  return void 0;
+}
+function regexruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.pattern !== "string" || !candidate.pattern.trim()) return void 0;
+  if (typeof candidate.flags !== "string" || !/^[dgimsuvy]*$/.test(candidate.flags)) return void 0;
+  const groups = Array.isArray(candidate.groups) ? candidate.groups.flatMap((group) => typeof group === "string" && /^[a-z][a-z0-9]*$/.test(group) ? [group] : []) : [];
+  if (candidate.groups !== void 0 && groups.length !== candidate.groups.length) return void 0;
+  return { pattern: candidate.pattern, flags: candidate.flags, groups };
+}
+function expandblocks(steps, blocks) {
+  const byname = new Map(blocks.map((block) => [block.name, block]));
+  const expanded = [];
+  const visit = (entries, path, inside) => {
+    for (const entry of entries) {
+      if ("kind" in entry && "label" in entry && !("block" in entry)) {
+        expanded.push(inside === void 0 ? entry : { ...entry, block: inside });
+        continue;
+      }
+      const invocation = blockinvocationof(entry);
+      if (!invocation) throw new Error("The step list entry is neither a reviewed step nor a block invocation.");
+      if (path.includes(invocation.block)) throw new Error(`The block ${invocation.block} recurs inside itself and cannot expand.`);
+      const block = byname.get(invocation.block);
+      if (!block) throw new Error(`The block ${invocation.block} is not defined in the workflow.`);
+      visit(block.steps, [...path, invocation.block], invocation.block);
+    }
+  };
+  visit(steps, [], void 0);
+  if (expanded.length === 0) throw new Error("A workflow needs at least one executable step after block expansion.");
+  return expanded;
+}
+function composeworkflow(input) {
+  if (typeof input.name !== "string" || !input.name.trim()) throw new Error("The workflow name must be a non-empty string.");
+  if (typeof input.version !== "number" || !Number.isInteger(input.version) || input.version < 1) throw new Error("The workflow version must be a positive integer.");
+  if (!Array.isArray(input.origins) || input.origins.length === 0) throw new Error("A workflow needs at least one granted HTTPS origin.");
+  const origins = input.origins.map((origin) => {
+    try {
+      return new URL(origin).origin;
+    } catch {
+      throw new Error(`The workflow origin ${origin} is not a valid url.`);
+    }
+  });
+  if (origins.some((origin) => !origin.startsWith("https://"))) throw new Error("Workflow origins must use HTTPS.");
+  const blocks = input.blocks ?? [];
+  if (blocks.some((block, index) => blocks.findIndex((other) => other.name === block.name) !== index)) throw new Error("Workflow block names must stay unique.");
+  for (const entry of input.steps) {
+    if ("kind" in entry && "label" in entry && !("block" in entry)) {
+      if (input.kindallowed && !input.kindallowed(entry.kind)) throw new Error(`The workflow step kind ${entry.kind} is not a reviewed action kind.`);
+    }
+  }
+  for (const block of blocks) for (const entry of block.steps) {
+    if ("kind" in entry && "label" in entry && !("block" in entry) && input.kindallowed && !input.kindallowed(entry.kind)) throw new Error(`The workflow step kind ${entry.kind} inside block ${block.name} is not a reviewed action kind.`);
+  }
+  const steps = expandblocks(input.steps, blocks);
+  for (const step of steps) {
+    if (input.kindallowed && !input.kindallowed(step.kind)) throw new Error(`The workflow step kind ${step.kind} is not a reviewed action kind.`);
+    if (step.bindings) for (const binding of step.bindings) {
+      if (!steps.some((other) => other.id === binding.stepid)) throw new Error(`The binding of ${binding.variable} references the unknown step ${binding.stepid}.`);
+    }
+  }
+  const riskof = input.riskof ?? (() => "sensitive");
+  const risk = steps.some((step) => riskof(step.kind) === "sensitive") ? "sensitive" : steps.some((step) => riskof(step.kind) === "interaction") ? "interaction" : "read";
+  const record2 = { id: input.id ?? crypto.randomUUID(), name: input.name, version: input.version, origins: [...new Set(origins)], steps, blocks, risk, createdat: input.now };
+  return deepfreeze(record2);
+}
+function deepfreeze(record2) {
+  for (const step of record2.steps) Object.freeze(step);
+  for (const block of record2.blocks) for (const entry of block.steps) if ("kind" in entry && "label" in entry && !("block" in entry)) Object.freeze(entry);
+  Object.freeze(record2.blocks);
+  Object.freeze(record2.steps);
+  return Object.freeze(record2);
+}
+function validateworkflow(record2, options) {
+  if (record2.steps.length === 0) return { allowed: false, reason: "A workflow needs at least one reviewed step." };
+  const defined = new Set(options?.inputs ?? []);
+  const byid = new Map(record2.steps.map((step, index) => [step.id, { step, index }]));
+  for (let index = 0; index < record2.steps.length; index += 1) {
+    const step = record2.steps[index];
+    if (options?.kindallowed && !options.kindallowed(step.kind)) return { allowed: false, reason: `The workflow step kind ${step.kind} is not a reviewed action kind.` };
+    if (step.bindings) for (const binding of step.bindings) {
+      const source = byid.get(binding.stepid);
+      if (!source) return { allowed: false, reason: `The binding of ${binding.variable} references the unknown step ${binding.stepid}.` };
+      if (source.index >= index) return { allowed: false, reason: `The binding of ${binding.variable} must link an earlier step than ${step.id}.` };
+      defined.add(binding.variable);
+    }
+    if (step.expression) {
+      for (const operand of [step.expression.left, step.expression.right]) {
+        if (operand?.ref && !defined.has(operand.ref)) return { allowed: false, reason: `The expression of step ${step.id} references the undefined variable ${operand.ref}.` };
+      }
+      defined.add(step.expression.result);
+    }
+    if (step.extract) for (const group of step.extract.groups) defined.add(group);
+  }
+  return { allowed: true };
+}
+function pushscope(scopes, name, parent) {
+  return [...scopes, { name, variables: [], ...parent !== void 0 ? { parent } : {} }];
+}
+function popscope(scopes) {
+  if (scopes.length === 0) return scopes;
+  return scopes.slice(0, -1);
+}
+function resolvevariable(scopes, name) {
+  for (let index = scopes.length - 1; index >= 0; index -= 1) {
+    const scope = scopes[index];
+    const found = scope.variables.find((variable) => variable.name === name);
+    if (found) return found;
+    if (scope.parent === void 0) continue;
+    const parentindex = scopes.findIndex((candidate) => candidate.name === scope.parent);
+    if (parentindex >= 0 && parentindex < index) {
+      const inherited = resolvevariable([scopes[parentindex]], name);
+      if (inherited) return inherited;
+    }
+  }
+  return void 0;
+}
+function setvariable(scopes, name, kind, value, now) {
+  if (scopes.length === 0) scopes = [{ name: "root", variables: [] }];
+  const target = scopes[scopes.length - 1];
+  const variables = [...target.variables.filter((variable) => variable.name !== name), { name, kind, value, setat: now }];
+  return [...scopes.slice(0, -1), { ...target, variables }];
+}
+function coercevariable(value, kind) {
+  if (kind === "number") {
+    const parsed = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+    if (!Number.isFinite(parsed)) throw new Error("The bound value is not a finite number.");
+    return parsed;
+  }
+  if (kind === "boolean") {
+    if (typeof value === "boolean") return value;
+    if (value === "true") return true;
+    if (value === "false") return false;
+    throw new Error("The bound value is not a boolean.");
+  }
+  if (kind === "list") {
+    if (Array.isArray(value)) return value.map((item) => String(item));
+    if (typeof value === "string") return value.length === 0 ? [] : value.split(",");
+    throw new Error("The bound value is not a list.");
+  }
+  if (kind === "element") {
+    if (typeof value === "string" && value.trim()) return value;
+    throw new Error("The bound value is not an element reference.");
+  }
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  throw new Error("The bound value is not a string.");
+}
+function outcomedetail(outcome, path) {
+  if (!path) return outcome.summary;
+  let current = outcome.details ?? {};
+  for (const segment of path.split(".")) {
+    if (!current || typeof current !== "object" || Array.isArray(current)) return void 0;
+    current = current[segment];
+  }
+  return current;
+}
+function bindvariables(scopes, bindings, outputs, now) {
+  let current = scopes;
+  const produced = [];
+  for (const binding of bindings) {
+    const outcome = outputs[binding.stepid];
+    if (!outcome) continue;
+    const raw = outcomedetail(outcome, binding.path);
+    if (raw === void 0) throw new Error(`The binding of ${binding.variable} found no value at ${binding.path ?? "the summary"} of step ${binding.stepid}.`);
+    current = setvariable(current, binding.variable, binding.kind, coercevariable(raw, binding.kind), now);
+    produced.push(binding.variable);
+  }
+  return { scopes: current, produced };
+}
+function operandvalue(operand, scopes) {
+  if (operand.ref !== void 0) {
+    const resolved = resolvevariable(scopes, operand.ref);
+    if (!resolved) throw new Error(`The expression references the undefined variable ${operand.ref}.`);
+    return resolved.value;
+  }
+  if (operand.literal === void 0) throw new Error("The expression operand needs a variable reference or a literal.");
+  return operand.literal;
+}
+function expressioneval(expression, scopes) {
+  const left = operandvalue(expression.left, scopes);
+  const right = expression.right === void 0 ? void 0 : operandvalue(expression.right, scopes);
+  const operand = (value) => {
+    if (Array.isArray(value)) throw new Error("The expression operand is a list and needs the contains or length operator.");
+    if (value === void 0) throw new Error("The expression operand is missing.");
+    return value;
+  };
+  const numbervalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "number") return primitive;
+    if (typeof primitive === "string" && primitive.trim() !== "") {
+      const parsed = Number(primitive);
+      if (Number.isFinite(parsed)) return parsed;
+    }
+    throw new Error("The arithmetic operand is not a number.");
+  };
+  const booleanvalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "boolean") return primitive;
+    throw new Error("The logic operand is not a boolean.");
+  };
+  const stringvalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "string") return primitive;
+    if (typeof primitive === "number" || typeof primitive === "boolean") return String(primitive);
+    throw new Error("The text operand is not a string.");
+  };
+  switch (expression.operator) {
+    case "add":
+      return numbervalue(left) + numbervalue(right);
+    case "subtract":
+      return numbervalue(left) - numbervalue(right);
+    case "multiply":
+      return numbervalue(left) * numbervalue(right);
+    case "divide": {
+      const divisor = numbervalue(right);
+      if (divisor === 0) throw new Error("The expression divides by zero.");
+      return numbervalue(left) / divisor;
+    }
+    case "modulo": {
+      const divisor = numbervalue(right);
+      if (divisor === 0) throw new Error("The expression divides by zero.");
+      return numbervalue(left) % divisor;
+    }
+    case "equal":
+      return left === right;
+    case "notequal":
+      return left !== right;
+    case "less":
+      return numbervalue(left) < numbervalue(right);
+    case "greater":
+      return numbervalue(left) > numbervalue(right);
+    case "lessequal":
+      return numbervalue(left) <= numbervalue(right);
+    case "greaterequal":
+      return numbervalue(left) >= numbervalue(right);
+    case "and":
+      return booleanvalue(left) && booleanvalue(right);
+    case "or":
+      return booleanvalue(left) || booleanvalue(right);
+    case "not":
+      return !booleanvalue(left);
+    case "concat":
+      return `${stringvalue(left)}${stringvalue(right)}`;
+    case "contains": {
+      if (Array.isArray(left)) return left.includes(stringvalue(right));
+      return stringvalue(left).includes(stringvalue(right));
+    }
+    case "length": {
+      if (Array.isArray(left)) return left.length;
+      return stringvalue(left).length;
+    }
+    default:
+      throw new Error("The reviewed expression operator is unknown.");
+  }
+}
+function regexextract(rule, text2, now) {
+  const pattern = new RegExp(rule.pattern, rule.flags);
+  const match = pattern.exec(text2);
+  if (!match) return { matched: false, variables: [] };
+  const variables = [];
+  for (const group of rule.groups) {
+    const value = match.groups?.[group];
+    variables.push({ name: group, kind: "string", value: typeof value === "string" ? value : "", setat: now });
+  }
+  return { matched: true, variables };
+}
+function waitelementplan(wait) {
+  if (wait.timeout <= 0 || wait.poll <= 0) return { probes: 1, lastwait: 0 };
+  const probes = Math.floor(wait.timeout / wait.poll) + 1;
+  return { probes, lastwait: wait.timeout % wait.poll };
+}
+function delayjitter(delay, seed) {
+  if (delay.jitter <= 0) return Math.max(0, delay.base);
+  const sample = seededrandom(seed);
+  return Math.max(0, delay.base - delay.jitter / 2 + sample * delay.jitter);
+}
+function seededrandom(seed) {
+  let state = seed >>> 0;
+  state ^= state >>> 16;
+  state = Math.imul(state, 2246822507);
+  state ^= state >>> 13;
+  state = Math.imul(state, 3266489909);
+  state ^= state >>> 16;
+  state = state >>> 0 || 1;
+  state ^= state << 13;
+  state >>>= 0;
+  state ^= state >> 17;
+  state ^= state << 5;
+  state >>>= 0;
+  return state / 4294967296;
+}
+function newworkflowrun(input) {
+  return { id: input.id ?? crypto.randomUUID(), workflowid: input.workflowid, state: "pending", cursor: 0, startedat: input.now, ...input.dryrun === true ? { dryrun: true } : {} };
+}
+function pauserun(run, now) {
+  if (run.state !== "running") throw new Error("Only a running workflow can pause.");
+  return { ...run, state: "paused", pausedat: now };
+}
+function cancelrun(run, reason, now) {
+  if (run.state === "done" || run.state === "cancelled") return run;
+  return { ...run, state: "cancelled", cancelreason: reason, endedat: now };
+}
+function interpolate(text2, scopes) {
+  const consumed = [];
+  const resolved = text2.replace(/\$\{([a-z][a-z0-9]*)\}/g, (_whole, name) => {
+    const variable = resolvevariable(scopes, name);
+    if (!variable) throw new Error(`The step references the undefined variable ${name}.`);
+    consumed.push(name);
+    return Array.isArray(variable.value) ? variable.value.join(",") : String(variable.value);
+  });
+  return { text: resolved, consumed };
+}
+function runlogof(step, state, startedat, duration, summary, extra) {
+  return { stepid: step.id, label: step.label, state, startedat, duration, summary, ...extra.block !== void 0 ? { block: extra.block } : {}, ...extra.consumed !== void 0 && extra.consumed.length > 0 ? { consumed: extra.consumed } : {}, ...extra.produced !== void 0 && extra.produced.length > 0 ? { produced: extra.produced } : {}, ...extra.checkpoint === true ? { checkpoint: true } : {}, ...extra.details !== void 0 ? { details: extra.details } : {} };
+}
+async function runstep(input) {
+  const startedat = input.now;
+  let scopes = input.scopes;
+  const consumed = [];
+  if (input.step.bindings) {
+    const bound = bindvariables(scopes, input.step.bindings.filter((binding) => input.outputs[binding.stepid] !== void 0), input.outputs, input.now);
+    scopes = bound.scopes;
+  }
+  let produced = [];
+  try {
+    if (input.step.expression) {
+      const value2 = expressioneval(input.step.expression, scopes);
+      scopes = setvariable(scopes, input.step.expression.result, input.step.expression.resultkind, coercevariable(value2, input.step.expression.resultkind), input.now);
+      produced = [...produced, input.step.expression.result];
+    }
+    let stepvalue = input.step.value;
+    if (input.step.extract) {
+      const text2 = stepvalue ?? "";
+      const interpolated = interpolate(text2, scopes);
+      consumed.push(...interpolated.consumed);
+      const extraction = regexextract(input.step.extract, interpolated.text, input.now);
+      if (extraction.matched) {
+        for (const variable of extraction.variables) scopes = setvariable(scopes, variable.name, "string", variable.value, input.now);
+        produced = [...produced, ...extraction.variables.map((variable) => variable.name)];
+      }
+      stepvalue = interpolated.text;
+    }
+    const target = input.step.target !== void 0 ? interpolate(input.step.target, scopes) : void 0;
+    if (target) consumed.push(...target.consumed);
+    const value = stepvalue !== void 0 ? interpolate(stepvalue, scopes) : void 0;
+    if (value) consumed.push(...value.consumed);
+    const options = input.step.options !== void 0 ? interpolate(input.step.options, scopes) : void 0;
+    if (options) consumed.push(...options.consumed);
+    const dispatchable = { ...input.step, ...target !== void 0 ? { target: target.text } : {}, ...value !== void 0 ? { value: value.text } : {}, ...options !== void 0 ? { options: options.text } : {} };
+    const output = await input.execute(dispatchable, { scopes, ...input.block !== void 0 ? { block: input.block } : {} });
+    if (input.step.bindings) {
+      const bound = bindvariables(scopes, input.step.bindings, { ...input.outputs, [input.step.id]: { stepid: input.step.id, ok: output.ok, summary: output.summary, ...output.details !== void 0 ? { details: output.details } : {}, at: input.now } }, input.now);
+      scopes = bound.scopes;
+      produced = [.../* @__PURE__ */ new Set([...produced, ...bound.produced])];
+    }
+    const duration = Date.now() - startedat;
+    return { scopes, log: runlogof(input.step, output.ok ? "done" : "failed", startedat, duration, output.summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {}, ...produced.length > 0 ? { produced } : {}, ...output.details !== void 0 ? { details: output.details } : {}, ...output.ok ? { checkpoint: true } : {} }), output };
+  } catch (error) {
+    const duration = Date.now() - startedat;
+    const summary = error instanceof Error ? error.message : String(error);
+    return { scopes, log: runlogof(input.step, "failed", startedat, duration, summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {} }), output: { ok: false, summary } };
+  }
+}
+async function runworkflow(input) {
+  if (input.gates && !input.gates.sessionactive) throw new Error("The workflow refuses to run outside an approved session.");
+  if (input.gates && !input.gates.planapproved) throw new Error("The workflow refuses to run without the approved plan review.");
+  if (input.gates) for (const origin of input.record.origins) {
+    if (!input.gates.origingranted(origin)) throw new Error(`The workflow origin ${origin} falls outside the session grants.`);
+  }
+  if (input.run.state === "done" || input.run.state === "failed" || input.run.state === "cancelled") throw new Error(`The workflow run is already ${input.run.state}.`);
+  const { pausedat, ...resumed } = input.run;
+  void pausedat;
+  let run = input.run.state === "paused" ? { ...resumed, state: "running" } : { ...input.run, state: "running" };
+  let scopes = input.scopes ?? [{ name: "root", variables: [] }];
+  const log = [...input.log ?? []];
+  const outputs = { ...input.outputs ?? {} };
+  let activeblock;
+  for (let index = run.cursor; index < input.record.steps.length; index += 1) {
+    const step = input.record.steps[index];
+    if (step.block !== void 0 && step.block !== activeblock) {
+      scopes = pushscope(scopes, step.block, scopes[scopes.length - 1].name);
+      activeblock = step.block;
+    } else if (step.block === void 0 && activeblock !== void 0) {
+      while (scopes.length > 1) scopes = popscope(scopes);
+      activeblock = void 0;
+    }
+    const executed = await runstep({ step, scopes, outputs, execute: input.execute, now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
+    scopes = executed.scopes;
+    log.push(executed.log);
+    outputs[step.id] = { stepid: step.id, ok: executed.output.ok, summary: executed.output.summary, ...executed.output.details !== void 0 ? { details: executed.output.details } : {}, at: Date.now() };
+    if (!executed.output.ok) {
+      run = { ...run, state: "failed", endedat: Date.now(), failreason: executed.output.summary };
+      return { run, scopes, log, outputs };
+    }
+    run = { ...run, cursor: index + 1 };
+    if (input.oncheckpoint) await input.oncheckpoint({ run, scopes, log });
+  }
+  run = { ...run, state: "done", endedat: Date.now() };
+  return { run, scopes, log, outputs };
+}
+function dryrunworkflow(input) {
+  const run = { ...input.run, state: "running", ...input.run.dryrun === true ? { dryrun: true } : { dryrun: true } };
+  let scopes = input.scopes ?? [{ name: "root", variables: [] }];
+  const log = [...input.log ?? []];
+  for (let index = run.cursor; index < input.record.steps.length; index += 1) {
+    const step = input.record.steps[index];
+    const summary = input.projection(step);
+    const entry = summary === void 0 ? runlogof(step, "refused", input.now, 0, `The ${step.kind} step has no read only projection and the dry run refuses it.`, { ...step.block !== void 0 ? { block: step.block } : {} }) : runlogof(step, "done", input.now, 0, summary, { ...step.block !== void 0 ? { block: step.block } : {} });
+    log.push(entry);
+    scopes = setvariable(scopes, `${step.id}outcome`, "boolean", entry.state === "done", input.now);
+  }
+  return { run: { ...run, state: "done", cursor: input.record.steps.length, endedat: input.now }, scopes, log };
+}
+
 // runtimeline.ts
 var timelinekinds = ["watchconsole", "watcherrors", "watchtasks"];
 var loglevels = ["error", "warn", "info", "log", "debug", "trace"];
@@ -3724,9 +4599,9 @@ function polldecision(input) {
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
@@ -3746,6 +4621,8 @@ var debugactions = /* @__PURE__ */ new Set(["watchconsole", "watcherrors", "watc
 var cdpactions = /* @__PURE__ */ new Set(["attachcdp", "detachcdp", "cdpcmd", "watchcdp", "setbreakpoint", "stepcode", "watchexpr", "overridescript"]);
 var profileractions = /* @__PURE__ */ new Set(["measureflow", "heapshot", "trackmemory", "profilecpu", "watchshifts", "traceload", "annotatetrace", "replaytrace", "capturesourcemaps"]);
 var emulationactions = /* @__PURE__ */ new Set(["emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "blackboxscripts"]);
+var sessionactions = /* @__PURE__ */ new Set(["persiststate", "capturesession", "restoresession", "namedsessions", "diffsessions", "searchsessions", "exportsessions", "importsessions"]);
+var workflowactions = /* @__PURE__ */ new Set(["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
 var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
@@ -3761,6 +4638,12 @@ function hostpattern(origin) {
   if (parsed.protocol !== "https:") throw new Error("Only HTTPS origins can be granted.");
   return `${parsed.origin}/*`;
 }
+function issessionkind(kind) {
+  return sessionactions.has(kind);
+}
+function isworkflowkind(kind) {
+  return workflowactions.has(kind);
+}
 function iswatchkind(kind) {
   return watchactions.has(kind);
 }
@@ -5135,6 +6018,253 @@ function permissionnamevalid(name) {
   if (!browserpermissions.includes(name)) return { allowed: false, reason: `The permission ${name} stays outside the reviewed browser permission set: ${browserpermissions.join(", ")}.` };
   return { allowed: true };
 }
+function validatesessiongrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "persiststate") {
+    if (options.resume !== void 0 && typeof options.resume !== "boolean") return { allowed: false, reason: "The reviewed resume flag must be a boolean." };
+    return { allowed: true };
+  }
+  if (kind === "capturesession") {
+    const plan = snapshotplanof(options.snapshot);
+    if (!plan) return { allowed: false, reason: "The session capture needs a reviewed snapshot plan with its scope, a non-empty section list of the reviewed grammar (tabs, scroll, forms, storage, cookies) and the capture link flag." };
+    if (plan.auto !== void 0) {
+      const interval = autointervalof(options.snapshot.auto);
+      if (interval === void 0) return { allowed: false, reason: "The reviewed auto snapshot interval needs a positive period, a positive maximum snapshot count and a zero or positive expiry window with no code ceiling." };
+    }
+    return { allowed: true };
+  }
+  if (kind === "restoresession") {
+    if (typeof options.sessionid !== "string" || !options.sessionid.trim()) return { allowed: false, reason: "The session restore needs the reviewed session id of the saved record." };
+    if (restoreplanof(options.restore) === void 0) return { allowed: false, reason: "The session restore needs a reviewed restore plan with its tab, form and capture policies." };
+    if (options.reviewed !== true) return { allowed: false, reason: "Every session restore needs the explicit restore review with its tabs, form state and captures listed before it reopens anything." };
+    return { allowed: true };
+  }
+  if (kind === "namedsessions") {
+    if (typeof options.sessionid !== "string" || !options.sessionid.trim()) return { allowed: false, reason: "The session filing needs the reviewed session id of the saved record." };
+    if (typeof options.name !== "string" || !options.name.trim()) return { allowed: false, reason: "The session filing needs a reviewed non-empty session name." };
+    if (options.folder !== void 0 && (typeof options.folder !== "string" || !options.folder.trim())) return { allowed: false, reason: "The reviewed folder name must be a non-empty string." };
+    if (options.tags !== void 0 && (!Array.isArray(options.tags) || !options.tags.every((tag) => typeof tag === "string" && tag.trim()))) return { allowed: false, reason: "The reviewed tag list must be a list of non-empty strings." };
+    return { allowed: true };
+  }
+  if (kind === "diffsessions") {
+    if (typeof options.left !== "string" || !options.left.trim() || typeof options.right !== "string" || !options.right.trim()) return { allowed: false, reason: "The session diff needs the reviewed ids of both saved sessions." };
+    return { allowed: true };
+  }
+  if (kind === "searchsessions") {
+    if (searchqueryof(options.query) === void 0) return { allowed: false, reason: "The session search needs a reviewed query with a non-empty term list, fields of the reviewed grammar (urls, titles, names, text) and an optional time window." };
+    return { allowed: true };
+  }
+  if (kind === "exportsessions") {
+    if (options.reviewed !== true) return { allowed: false, reason: "Session exports need the explicit export review before any session file leaves the device." };
+    if (options.ids !== void 0 && (!Array.isArray(options.ids) || options.ids.length === 0 || !options.ids.every((id) => typeof id === "string" && id.trim()))) return { allowed: false, reason: "The reviewed export id list must be a non-empty list of saved session ids." };
+    return { allowed: true };
+  }
+  if (kind === "importsessions") {
+    if (options.reviewed !== true) return { allowed: false, reason: "Session imports need the explicit full record review before any record joins the library." };
+    if (importsessionfile(options.file) === void 0) return { allowed: false, reason: "The session import needs a reviewed file of the known format version with an intact checksum." };
+    return { allowed: true };
+  }
+  return { allowed: true };
+}
+function restorereviewgranted(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  if (restoreplanof(options.restore) === void 0) return { allowed: false, reason: "Every session restore needs a reviewed restore plan with its tab, form and capture policies." };
+  if (options.reviewed !== true) return { allowed: false, reason: "The session restore needs the explicit restore review of its tabs, form state and captures before it reopens anything." };
+  return { allowed: true };
+}
+function sessionrestoregate(input) {
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now: input.now, action: "run the session memory step" });
+  if (!gate.allowed) return gate;
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Session memory steps need an approved plan before they run." };
+  if (input.step.kind === "restoresession") return restorereviewgranted(input.step);
+  return { allowed: true };
+}
+function restoreoriginsgranted(urls, grants) {
+  const covered = new Set(grants);
+  const skippedorigins = [];
+  for (const url of urls) {
+    let origin = "";
+    try {
+      origin = new URL(url).origin;
+    } catch {
+      origin = "";
+    }
+    if (!origin || !covered.has(origin)) skippedorigins.push(origin || url);
+  }
+  return { allowed: skippedorigins.length === 0, skippedorigins: [...new Set(skippedorigins)] };
+}
+function sessionnameunique(name, records, recordid) {
+  if (records.some((record2) => record2.name === name && record2.id !== recordid)) return { allowed: false, reason: `The session name ${name} already exists in the library; review a unique name.` };
+  return { allowed: true };
+}
+function sessionfolderunique(name, folders) {
+  if (folders.some((folder) => folder.name === name)) return { allowed: false, reason: `The folder name ${name} already exists in the library; review a unique folder name.` };
+  return { allowed: true };
+}
+function snapshotretentionwindow(settings) {
+  return settings?.sessionretention;
+}
+function validateworkflowgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "composeworkflow") {
+    const payload = options.workflow;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { allowed: false, reason: "The workflow composition needs the reviewed workflow payload with its name, version, origins, steps and blocks." };
+    const candidate = payload;
+    if (typeof candidate.name !== "string" || !candidate.name.trim()) return { allowed: false, reason: "The workflow composition needs a reviewed non-empty name." };
+    if (typeof candidate.version !== "number" || !Number.isInteger(candidate.version) || candidate.version < 1) return { allowed: false, reason: "The workflow version must be a positive integer." };
+    if (!Array.isArray(candidate.origins) || candidate.origins.length === 0 || !candidate.origins.every((origin) => typeof origin === "string" && origin.startsWith("https://"))) return { allowed: false, reason: "The workflow needs at least one granted HTTPS origin so every step stays inside the grants." };
+    if (!Array.isArray(candidate.steps) || candidate.steps.length === 0 || !candidate.steps.every((entry) => workflowstepof(entry) !== void 0 || entry && typeof entry === "object" && typeof entry.block === "string")) return { allowed: false, reason: "The workflow needs a non-empty reviewed step list of the workflow step grammar or block invocations." };
+    const blocks = Array.isArray(candidate.blocks) ? candidate.blocks.flatMap((block) => {
+      const parsed = workflowblockof(block);
+      return parsed !== void 0 ? [parsed] : [];
+    }) : [];
+    if (Array.isArray(candidate.blocks) && blocks.length !== candidate.blocks.length) return { allowed: false, reason: "The reviewed block list must carry unique lowercase names, labels and valid child steps." };
+    try {
+      const record2 = composeworkflow({ name: candidate.name, version: candidate.version, origins: candidate.origins, steps: candidate.steps.map((entry) => "block" in entry ? { block: entry.block, label: typeof entry.label === "string" ? entry.label : entry.block } : workflowstepof(entry)), blocks, now: 0, kindallowed: (candidatekind) => {
+        try {
+          actionrisk(candidatekind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, riskof: (candidatekind) => actionrisk(candidatekind) });
+      const inputs = Array.isArray(candidate.inputs) ? candidate.inputs.flatMap((name) => typeof name === "string" ? [name] : []) : void 0;
+      const checked = validateworkflow(record2, { kindallowed: (workflowkind) => {
+        try {
+          actionrisk(workflowkind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, ...inputs !== void 0 ? { inputs } : {} });
+      if (!checked.allowed) return checked;
+    } catch (error) {
+      return { allowed: false, reason: error instanceof Error ? error.message : "The workflow payload failed its composition validation." };
+    }
+    return { allowed: true };
+  }
+  if (kind === "savetemplate") {
+    const payload = options.template && typeof options.template === "object" && !Array.isArray(options.template) ? options.template : {};
+    const template = steptemplateof({ id: "templatereview", origin: "https://example.com", sharedat: 0, ...payload });
+    if (!template) return { allowed: false, reason: "The step template needs a reviewed name and a valid workflow step it shares across workflows." };
+    return { allowed: true };
+  }
+  if (kind === "runworkflow") {
+    if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "The workflow run needs the reviewed id of the composed workflow." };
+    if (options.reviewed !== true) return { allowed: false, reason: "Every real workflow run needs the explicit run review with its expanded step list shown before the first step executes." };
+    if (options.variables !== void 0 && (!options.variables || typeof options.variables !== "object" || Array.isArray(options.variables) || !Object.values(options.variables).every((value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean"))) return { allowed: false, reason: "The reviewed run variables must be an object of string, number or boolean values." };
+    return { allowed: true };
+  }
+  if (kind === "dryrun") {
+    if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "The dry run needs the reviewed id of the composed workflow." };
+    return { allowed: true };
+  }
+  if (kind === "delay") {
+    const delay = options.delay;
+    if (!delay || typeof delay !== "object" || Array.isArray(delay)) return { allowed: false, reason: "The delay needs a reviewed base and jitter window in options." };
+    const reviewed = delay;
+    if (typeof reviewed.base !== "number" || !Number.isFinite(reviewed.base) || reviewed.base < 0) return { allowed: false, reason: "The reviewed delay base must be zero or a positive number of milliseconds." };
+    if (typeof reviewed.jitter !== "number" || !Number.isFinite(reviewed.jitter) || reviewed.jitter < 0) return { allowed: false, reason: "The reviewed delay jitter window must be zero or a positive number of milliseconds with no code ceiling." };
+    return { allowed: true };
+  }
+  if (kind === "waitelement") {
+    const wait = options.wait;
+    if (!wait || typeof wait !== "object" || Array.isArray(wait)) return { allowed: false, reason: "The element wait needs a reviewed selector, timeout and poll interval in options." };
+    const reviewed = wait;
+    if (typeof reviewed.selector !== "string" || !reviewed.selector.trim()) return { allowed: false, reason: "The element wait needs a reviewed non-empty selector." };
+    if (typeof reviewed.timeout !== "number" || !Number.isFinite(reviewed.timeout) || reviewed.timeout < 0) return { allowed: false, reason: "The reviewed element wait timeout must be zero or a positive number of milliseconds with no code ceiling." };
+    if (typeof reviewed.poll !== "number" || !Number.isFinite(reviewed.poll) || reviewed.poll < 0) return { allowed: false, reason: "The reviewed element wait poll interval must be zero or a positive number of milliseconds with no code ceiling." };
+    return { allowed: true };
+  }
+  if (kind === "compute") {
+    const expression = expressionof(options.expression);
+    if (!expression) return { allowed: false, reason: `The expression step needs a reviewed expression with operands, an operator of the reviewed set (${expressionoperators.join(", ")}) and a result variable of a reviewed kind.` };
+    const operatorcheck = validatexpressionoperators(expression);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return { allowed: true };
+  }
+  if (kind === "extractvars") {
+    const rule = regexruleof(options.rule);
+    if (!rule) return { allowed: false, reason: "The variable extraction needs a reviewed regex rule with its pattern, flags and named capture groups." };
+    const shapecheck = validateregexrule(rule.pattern);
+    if (!shapecheck.allowed) return shapecheck;
+    if (typeof options.text !== "string") return { allowed: false, reason: "The variable extraction needs the reviewed text the regex rule applies to." };
+    return { allowed: true };
+  }
+  return { allowed: true };
+}
+function validateregexrule(pattern) {
+  try {
+    new RegExp(pattern);
+  } catch {
+    return { allowed: false, reason: "The reviewed regex pattern does not compile." };
+  }
+  const nestedquantifier = /\((?:[^()\\]|\\.)*[+*}]\)[+*{]/.test(pattern) || /\(\)[+*{]/.test(pattern);
+  if (nestedquantifier) return { allowed: false, reason: "The reviewed regex pattern nests an unbounded quantifier inside a quantified group and is refused because adversarial text could explode the backtracking." };
+  const unboundedrepeat = /\{\d+,\}/.test(pattern);
+  if (unboundedrepeat && /\([^)]*\{\d+,\}[^)]*\)[+*{]/.test(pattern)) return { allowed: false, reason: "The reviewed regex pattern repeats an unbounded group and is refused because adversarial text could explode the backtracking." };
+  return { allowed: true };
+}
+function validatexpressionoperators(expression) {
+  const numeric = /* @__PURE__ */ new Set(["add", "subtract", "multiply", "divide", "modulo"]);
+  const logic = /* @__PURE__ */ new Set(["and", "or", "not"]);
+  const comparison = /* @__PURE__ */ new Set(["less", "greater", "lessequal", "greaterequal"]);
+  const text2 = /* @__PURE__ */ new Set(["concat", "contains"]);
+  const operator = expression.operator;
+  if (numeric.has(operator)) {
+    for (const operand of [expression.left, expression.right]) {
+      if (operand === void 0) continue;
+      if (operand.literal !== void 0 && typeof operand.literal === "boolean") return { allowed: false, reason: `The ${operator} operator needs numeric operands; boolean literals are refused.` };
+    }
+    if (expression.resultkind !== "number" && expression.resultkind !== "string") return { allowed: false, reason: `The ${operator} operator needs a number result kind.` };
+  }
+  if (logic.has(operator)) {
+    for (const operand of [expression.left, expression.right]) {
+      if (operand === void 0) continue;
+      if (operand.literal !== void 0 && typeof operand.literal !== "boolean") return { allowed: false, reason: `The ${operator} operator needs boolean operands; non boolean literals are refused.` };
+    }
+    if (expression.resultkind !== "boolean") return { allowed: false, reason: `The ${operator} operator needs a boolean result kind.` };
+    if (operator === "not" && expression.right !== void 0) return { allowed: false, reason: "The not operator takes one operand only." };
+  }
+  if (comparison.has(operator) && expression.resultkind !== "boolean") return { allowed: false, reason: `The ${operator} operator needs a boolean result kind.` };
+  if (text2.has(operator) && expression.resultkind !== "boolean" && expression.resultkind !== "string") return { allowed: false, reason: `The ${operator} operator needs a string or boolean result kind.` };
+  if (operator === "contains" && expression.resultkind !== "boolean") return { allowed: false, reason: "The contains operator needs a boolean result kind." };
+  if (operator === "length") {
+    if (expression.right !== void 0) return { allowed: false, reason: "The length operator takes one operand only." };
+    if (expression.resultkind !== "number") return { allowed: false, reason: "The length operator needs a number result kind." };
+  }
+  if ((operator === "equal" || operator === "notequal") && !(/* @__PURE__ */ new Set(["boolean", "string", "number"])).has(expression.resultkind)) return { allowed: false, reason: "The equality operator needs a primitive result kind." };
+  return { allowed: true };
+}
+function workflowgate(input) {
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now: input.now, action: "run the workflow step" });
+  if (!gate.allowed) return gate;
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Workflow steps need the approved plan review before they run." };
+  if (input.step.kind === "runworkflow") {
+    let runoptions = {};
+    try {
+      runoptions = parseoptions(input.step);
+    } catch {
+      runoptions = {};
+    }
+    if (runoptions.reviewed !== true) return { allowed: false, reason: "Every real workflow run needs the explicit run review with its expanded step list shown before the first step executes." };
+  }
+  return { allowed: true };
+}
+function dryrunprojection(step) {
+  const risk = resolvedrisk({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.target !== void 0 ? { target: step.target } : {}, ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  if (risk !== "read") return void 0;
+  if (step.kind === "delay") return `The delay step would sleep its reviewed base inside the jitter window.`;
+  if (step.kind === "waitelement") return `The element wait step would poll ${step.target ?? "the reviewed selector"} until appearance or the reviewed timeout.`;
+  if (step.kind === "compute") return `The compute step would evaluate its reviewed expression into the result variable.`;
+  if (step.kind === "extractvars") return `The variable extraction step would apply its reviewed regex rule and store the named captures.`;
+  return `The ${step.kind} step would run read only and mutate nothing.`;
+}
 function permissionstatevalid(state) {
   if (!permissionstates.includes(state)) return { allowed: false, reason: `The reviewed permission state must be one of ${permissionstates.join(", ")}.` };
   return { allowed: true };
@@ -5700,6 +6830,14 @@ function validatestep(step, origin) {
     const emulationcheck = validateemulationgrammar(step, options);
     if (!emulationcheck.allowed) return emulationcheck;
   }
+  if (issessionkind(step.kind)) {
+    const sessioncheck = validatesessiongrammar(step, options);
+    if (!sessioncheck.allowed) return sessioncheck;
+  }
+  if (isworkflowkind(step.kind)) {
+    const workflowcheck = validateworkflowgrammar(step, options);
+    if (!workflowcheck.allowed) return workflowcheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -5873,6 +7011,27 @@ function canexecute(input) {
     const emugatecheck = emugate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
     if (!emugatecheck.allowed) return emugatecheck;
   }
+  if (issessionkind(input.step.kind)) {
+    const sessiongatecheck = sessionrestoregate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
+    if (!sessiongatecheck.allowed) return sessiongatecheck;
+    if (input.step.kind === "restoresession") {
+      let restoreoptions = {};
+      try {
+        restoreoptions = parseoptions(input.step);
+      } catch {
+        restoreoptions = {};
+      }
+      for (const url of Array.isArray(restoreoptions.origins) ? restoreoptions.origins : []) {
+        if (typeof url !== "string" || !url) continue;
+        const origingate = origincheck(input.session, url);
+        if (!origingate.allowed) return { allowed: false, reason: `The session restore reopens ${url} outside the session origin grants; review the restore record or grant the origin.` };
+      }
+    }
+  }
+  if (isworkflowkind(input.step.kind)) {
+    const workflowgatecheck = workflowgate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
+    if (!workflowgatecheck.allowed) return workflowgatecheck;
+  }
   if (iscontrolkind(input.step.kind)) {
     const controlgate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "control the network" });
     if (!controlgate.allowed) return controlgate;
@@ -5956,7 +7115,7 @@ function canexecute(input) {
 }
 
 // version.ts
-var packageversion = "1.1.48";
+var packageversion = "1.1.50";
 
 // types.ts
 var protocolversion = packageversion;
@@ -6150,6 +7309,51 @@ function parseproposal(value, origin, grants) {
       }
       if (step.kind === "overridepermission" && permissiongrantof(emulationoptions.permission) === void 0) throw new Error("Permission overrides of unknown permission names are refused.");
     }
+    if (issessionkind(step.kind)) {
+      let sessionoptions = {};
+      try {
+        sessionoptions = parseoptions(step);
+      } catch {
+        sessionoptions = {};
+      }
+      if (step.kind === "restoresession") {
+        for (const url of Array.isArray(sessionoptions.origins) ? sessionoptions.origins : []) {
+          if (typeof url !== "string" || !url) continue;
+          const granted = covered.some((pattern) => {
+            try {
+              return new URL(url).origin === new URL(pattern).origin;
+            } catch {
+              return false;
+            }
+          });
+          if (!granted) throw new Error(`The session restore reopens ${url} outside the grants.`);
+        }
+      }
+      if (step.kind === "importsessions" && importsessionfile(sessionoptions.file) === void 0) throw new Error("Session import files of unknown format versions are refused.");
+    }
+    if (isworkflowkind(step.kind)) {
+      let workflowoptions = {};
+      try {
+        workflowoptions = parseoptions(step);
+      } catch {
+        workflowoptions = {};
+      }
+      if (step.kind === "composeworkflow") {
+        const payload = workflowoptions.workflow && typeof workflowoptions.workflow === "object" && !Array.isArray(workflowoptions.workflow) ? workflowoptions.workflow : void 0;
+        const origins = payload && Array.isArray(payload.origins) ? payload.origins.filter((originvalue) => typeof originvalue === "string") : [];
+        for (const workfloworigin of origins) {
+          const granted = covered.some((pattern) => {
+            try {
+              return new URL(workfloworigin).origin === new URL(pattern).origin;
+            } catch {
+              return false;
+            }
+          });
+          if (!granted) throw new Error(`The workflow origin ${workfloworigin} stays outside the grants.`);
+        }
+      }
+      if (step.kind === "runworkflow" && workflowoptions.reviewed !== true) throw new Error("Workflow runs without the explicit run review of the expanded step list are refused.");
+    }
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
     const target = outboundtarget(step);
@@ -6209,6 +7413,70 @@ function parseproposal(value, origin, grants) {
   };
   return { version: protocolversion, plan };
 }
+function parseworkflowproposal(value, origin, grants, dryrun) {
+  const root = record(value);
+  if (root.version !== protocolversion) throw new Error("Unsupported protocol version.");
+  const covered = grants !== void 0 && grants.length > 0 ? grants : [origin];
+  const candidate = record(root.workflow);
+  const name = text(candidate.name, "workflow name");
+  const version = typeof candidate.version === "number" && Number.isInteger(candidate.version) && candidate.version >= 1 ? candidate.version : void 0;
+  if (version === void 0) throw new Error("The workflow version must be a positive integer.");
+  const origins = Array.isArray(candidate.origins) ? candidate.origins : [];
+  if (origins.length === 0 || !origins.every((workfloworigin) => typeof workfloworigin === "string" && workfloworigin.startsWith("https://"))) throw new Error("The workflow needs at least one granted HTTPS origin.");
+  for (const workfloworigin of origins) {
+    const granted = covered.some((pattern) => {
+      try {
+        return new URL(workfloworigin).origin === new URL(pattern).origin;
+      } catch {
+        return false;
+      }
+    });
+    if (!granted) throw new Error(`The workflow origin ${workfloworigin} stays outside the grants.`);
+  }
+  const steps = Array.isArray(candidate.steps) ? candidate.steps : [];
+  if (steps.length === 0) throw new Error("A workflow proposal needs at least one step or block invocation.");
+  const blocks = Array.isArray(candidate.blocks) ? candidate.blocks.flatMap((block) => workflowblockof(block) !== void 0 ? [workflowblockof(block)] : []) : [];
+  if (Array.isArray(candidate.blocks) && blocks.length !== candidate.blocks.length) throw new Error("The reviewed block list must carry unique lowercase names, labels and valid child steps.");
+  const composed = composeworkflow({
+    name,
+    version,
+    origins,
+    steps: steps.map((entry) => {
+      const step = workflowstepof(entry);
+      if (step) return step;
+      const invocation = blockinvocationof(entry);
+      if (invocation) return invocation;
+      throw new Error("Every workflow entry must be a reviewed step or a block invocation.");
+    }),
+    blocks,
+    now: Date.now(),
+    kindallowed: (kind) => {
+      try {
+        actionrisk(kind);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    riskof: (kind) => actionrisk(kind)
+  });
+  const inputs = Array.isArray(candidate.inputs) ? candidate.inputs.flatMap((inputname) => typeof inputname === "string" ? [inputname] : []) : void 0;
+  const checked = validateworkflow(composed, { kindallowed: (kind) => {
+    try {
+      actionrisk(kind);
+      return true;
+    } catch {
+      return false;
+    }
+  }, ...inputs !== void 0 ? { inputs } : {} });
+  if (!checked.allowed) throw new Error(checked.reason ?? "The workflow proposal failed its validation.");
+  return { version: protocolversion, workflow: composed, ...dryrun === true ? { dryrun: true } : {} };
+}
+function workflowoutcome(input) {
+  const selected = input.stepid !== void 0 ? input.entries.filter((entry) => entry.stepid === input.stepid) : input.entries;
+  const steps = selected.map((entry) => ({ stepid: entry.stepid, label: entry.label, state: entry.state, duration: entry.duration, summary: entry.summary, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.produced !== void 0 ? { produced: entry.produced } : {}, ...entry.consumed !== void 0 ? { consumed: entry.consumed } : {}, ...entry.checkpoint === true ? { checkpoint: true } : {} }));
+  return { version: protocolversion, runid: input.run.id, workflowid: input.run.workflowid, state: input.run.state, ...input.run.dryrun === true ? { dryrun: true } : {}, steps };
+}
 function stepof(kind, candidate, index) {
   return { id: typeof candidate.id === "string" ? candidate.id : `candidate${index + 1}`, kind, summary: typeof candidate.summary === "string" ? candidate.summary : "", risk: "read", ...typeof candidate.options === "string" ? { options: candidate.options } : {} };
 }
@@ -6224,7 +7492,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed } } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -6370,6 +7638,12 @@ function emulationreport(input) {
   });
   return { version: protocolversion, ...input.state !== void 0 ? { state: input.state } : {}, layers: input.state?.layers ?? [], devices: input.devices, networks: input.networks, locations: input.locations, agents: input.agents, blackbox: input.blackbox, permissions: input.permissions, consents };
 }
+function sessionreport(input) {
+  return { version: protocolversion, records: input.records, events: input.events, folders: input.folders, diffs: input.diffs, ...input.auto !== void 0 ? { auto: input.auto } : {}, ...input.crashed === true ? { crashed: true } : {} };
+}
+function workflowreport(input) {
+  return { version: protocolversion, workflows: input.workflows, runs: input.runs, templates: input.templates, log: input.log ?? [], scopes: input.scopes ?? [], provenance: input.provenance ?? [] };
+}
 export {
   activelayers,
   agentgrammarvalid,
@@ -6391,12 +7665,15 @@ export {
   authconsentgranted,
   authorizeurl,
   authreport,
+  autointervalof,
+  bindvariables,
   blackboxedurls,
   blackboxmatches,
   blackboxruleof,
   blendrows,
   blockgate,
   blockingduration,
+  blockinvocationof,
   blockruleof,
   bodyfilterof,
   bodymatches,
@@ -6411,6 +7688,7 @@ export {
   callgraphql,
   callrest,
   callsreport,
+  cancelrun,
   canexecute,
   capturebody,
   capturecode,
@@ -6436,6 +7714,7 @@ export {
   channelorigin,
   closechannel,
   collectmessages,
+  composeworkflow,
   consolecapture,
   consoleconsentcovers,
   consolediff,
@@ -6449,6 +7728,7 @@ export {
   cookierecordof,
   correlationid,
   cpusnap,
+  crashinterrupted,
   croprect,
   crossesviewport,
   cursorfrom,
@@ -6457,12 +7737,16 @@ export {
   debuggerconsentcovers,
   debugwaitbudgetallowed,
   dedupeimages,
+  delayjitter,
   actionrisk as deriveactionrisk,
   detachcdpsession,
   devicepresetof,
   diffresponse,
   diffreviewgrade,
+  diffsessionrecords,
   downloadreport,
+  dryrunprojection,
+  dryrunworkflow,
   emugate,
   emulationkinds,
   emulationreport,
@@ -6473,15 +7757,22 @@ export {
   errorreportresponse,
   eventresponse,
   exchangesreport,
+  expandblocks,
   expirelayers,
   expireprofilerecords,
+  expiresessions,
   exportpresetlibrary,
+  exportsessionfile,
+  expressioneval,
+  expressionof,
+  expressionoperators,
   extractionreport,
   extractvalues,
   failureclass,
   familyofkind,
   fetchoptionsof,
   fetchrequestof,
+  filteredsessions,
   filterentries,
   filterexchanges,
   finishrecording,
@@ -6509,6 +7800,7 @@ export {
   imagematches,
   imagenames,
   importpresetlibrary,
+  importsessionfile,
   iscdpkind,
   iscontrolkind,
   isdebugkind,
@@ -6516,8 +7808,10 @@ export {
   isformkind,
   isnetwatchkind,
   isprofilekind,
+  issessionkind,
   issocketkind,
   iswatchkind,
+  isworkflowkind,
   jsonpathrulesof,
   lapseframes,
   lapseplanof,
@@ -6556,6 +7850,9 @@ export {
   newlayer,
   newmockspec,
   newrecording,
+  newsessiondiff,
+  newsessionrecord,
+  newworkflowrun,
   normalizeendpoint,
   oauthflowof,
   observationmodeof,
@@ -6570,9 +7867,11 @@ export {
   parseproposal,
   parsessetext,
   parsetokens,
+  parseworkflowproposal,
   passwordconsentgranted,
   patternorigin,
   pauseretentionwindow,
+  pauserun,
   payloadshapeof,
   payloadvalid,
   payloadwithdefaults,
@@ -6589,6 +7888,7 @@ export {
   pollcursorof,
   polldecision,
   pollurl,
+  popscope,
   privatemime,
   profilegrantgranted,
   profilereport,
@@ -6599,6 +7899,7 @@ export {
   proxygate,
   proxyrouteof,
   publishmessage,
+  pushscope,
   quarantinereport,
   randomid,
   rankapis,
@@ -6613,6 +7914,8 @@ export {
   recordwatchvalue,
   redactconsoletext,
   redactedcookies,
+  regexextract,
+  regexruleof,
   regionsteps,
   rejectioncapture,
   replaytrace,
@@ -6620,7 +7923,11 @@ export {
   requestbody,
   resolutionverdict,
   resolvedrisk,
+  resolvevariable,
   resourcefacts,
+  restoreoriginsgranted,
+  restoreplanof,
+  restorereviewgranted,
   retryafterof,
   revertalllayers,
   revertlayer,
@@ -6630,18 +7937,34 @@ export {
   rewritesourcelocation,
   rotatelogs,
   rotationruleof,
+  runstep,
+  runworkflow,
   safetyresponse,
   scaledrect,
   seamweights,
+  searchfields,
+  searchqueryof,
+  searchsessionrecords,
   selectorresponse,
   sendcdpcommand,
   sendfetch,
   sequenceintegrity,
   serializearg,
   serializecdpcommand,
+  sessionfileversion,
+  sessionfolderof,
+  sessionfolderunique,
+  sessionkinds,
   sessionmemory,
+  sessionnameunique,
+  sessionreport,
+  sessionrestoregate,
+  sessiontabof,
   shiftentryof,
   signalsreport,
+  snapshotplanof,
+  snapshotretentionwindow,
+  snapshotsections,
   socketgate,
   socketkinds,
   sourcemapconsentcovers,
@@ -6653,6 +7976,7 @@ export {
   stackgate,
   statusclassof,
   stepmodeof,
+  steptemplateof,
   stepwindows,
   streamsummaries,
   streamwindowof,
@@ -6660,6 +7984,9 @@ export {
   subscriptionoptionsof,
   tabreportresponse,
   targetgate,
+  taskstatechecksum,
+  taskstateof,
+  taskstatevalid,
   teardowncdpsession,
   teardownplanof,
   templateurl,
@@ -6683,13 +8010,22 @@ export {
   validatebreakpointcondition,
   validatefieldmatch,
   validateformrecord,
+  validateregexrule,
   validatestep,
   validatetargetref,
   validatevaluegen,
+  validateworkflow,
+  waitelementplan,
   watchcdpevents,
   watcherdetached,
   watchexpressionof,
   watchgate,
-  wizardreport
+  wizardreport,
+  workflowblockof,
+  workflowgate,
+  workflowkinds,
+  workflowoutcome,
+  workflowreport,
+  workflowstepof
 };
 //# sourceMappingURL=index.js.map