@wenathlan/extension 1.1.48 → 1.1.50

package/extension/dist/background.js

@@ -374,6 +374,212 @@ function locationconsentcovers(origin, latitude, longitude, consents) {
   return consents.some((consent) => consent.origin === origin && consent.approved === true && consent.revokedat === void 0 && consent.latitude === latitude && consent.longitude === longitude);
 }
 
+// sessions.ts
+var sessionkinds = ["persiststate", "capturesession", "restoresession", "namedsessions", "diffsessions", "searchsessions", "exportsessions", "importsessions"];
+var sessionfileversion = 1;
+var snapshotsections = ["tabs", "scroll", "forms", "storage", "cookies"];
+var searchfields = ["urls", "titles", "names", "text"];
+function checksumtext(payload) {
+  let hash = 2166136261;
+  for (let index = 0; index < payload.length; index += 1) {
+    hash ^= payload.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash.toString(16).padStart(8, "0");
+}
+function taskstatechecksum(runid, stepcursor, outputs) {
+  return checksumtext(`${runid}:${stepcursor}:${outputs.length}:${outputs.map((output) => `${output.stepid}:${output.ok}:${output.summary.length}`).join("|")}`);
+}
+function taskstateof(input) {
+  return { runid: input.runid, stepcursor: input.stepcursor, outputs: input.outputs, checkpointat: input.checkpointat, checksum: taskstatechecksum(input.runid, input.stepcursor, input.outputs) };
+}
+function taskstatevalid(state) {
+  if (!state || typeof state.runid !== "string" || !state.runid.trim()) return false;
+  if (typeof state.stepcursor !== "number" || !Number.isInteger(state.stepcursor) || state.stepcursor < 0) return false;
+  if (typeof state.checkpointat !== "number" || !Number.isFinite(state.checkpointat)) return false;
+  if (!Array.isArray(state.outputs)) return false;
+  return state.checksum === taskstatechecksum(state.runid, state.stepcursor, state.outputs);
+}
+function sessiontabof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.url !== "string" || !candidate.url.trim()) return void 0;
+  if (typeof candidate.title !== "string") return void 0;
+  if (typeof candidate.index !== "number" || !Number.isInteger(candidate.index) || candidate.index < 0) return void 0;
+  const scrollx = typeof candidate.scrollx === "number" && Number.isFinite(candidate.scrollx) ? candidate.scrollx : 0;
+  const scrolly = typeof candidate.scrolly === "number" && Number.isFinite(candidate.scrolly) ? candidate.scrolly : 0;
+  const forms = Array.isArray(candidate.forms) ? candidate.forms.flatMap((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return [];
+    const form = entry;
+    if (typeof form.selector !== "string" || !form.selector.trim()) return [];
+    return [{ selector: form.selector, value: typeof form.value === "string" ? form.value : "" }];
+  }) : [];
+  return { url: candidate.url, title: candidate.title, index: candidate.index, scrollx, scrolly, forms };
+}
+function autointervalof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.period !== "number" || !Number.isFinite(candidate.period) || candidate.period <= 0) return void 0;
+  if (typeof candidate.maxsnapshots !== "number" || !Number.isInteger(candidate.maxsnapshots) || candidate.maxsnapshots < 1) return void 0;
+  if (typeof candidate.expiry !== "number" || !Number.isFinite(candidate.expiry) || candidate.expiry < 0) return void 0;
+  return { period: candidate.period, maxsnapshots: candidate.maxsnapshots, expiry: candidate.expiry };
+}
+function snapshotplanof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (candidate.scope !== "tab" && candidate.scope !== "run" && candidate.scope !== "all") return void 0;
+  const sections = Array.isArray(candidate.sections) ? candidate.sections.flatMap((section) => typeof section === "string" && snapshotsections.includes(section) ? [section] : []) : [];
+  if (sections.length === 0) return void 0;
+  if (typeof candidate.captures !== "boolean") return void 0;
+  const auto = candidate.auto === void 0 ? void 0 : autointervalof(candidate.auto);
+  if (candidate.auto !== void 0 && auto === void 0) return void 0;
+  return { scope: candidate.scope, sections, captures: candidate.captures, ...auto !== void 0 ? { auto } : {} };
+}
+function restoreplanof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (candidate.tabpolicy !== "reopen" && candidate.tabpolicy !== "skip") return void 0;
+  if (candidate.formpolicy !== "restore" && candidate.formpolicy !== "skip") return void 0;
+  if (candidate.capturepolicy !== "link" && candidate.capturepolicy !== "skip") return void 0;
+  return { tabpolicy: candidate.tabpolicy, formpolicy: candidate.formpolicy, capturepolicy: candidate.capturepolicy };
+}
+function searchqueryof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const terms = Array.isArray(candidate.terms) ? candidate.terms.flatMap((term) => typeof term === "string" && term.trim() ? [term.trim()] : []) : [];
+  if (terms.length === 0) return void 0;
+  const fields = Array.isArray(candidate.fields) ? candidate.fields.flatMap((field) => typeof field === "string" && searchfields.includes(field) ? [field] : []) : [...searchfields];
+  if (fields.length === 0) return void 0;
+  const from = typeof candidate.from === "number" && Number.isFinite(candidate.from) ? candidate.from : void 0;
+  const to = typeof candidate.to === "number" && Number.isFinite(candidate.to) ? candidate.to : void 0;
+  if (from !== void 0 && to !== void 0 && from > to) return void 0;
+  return { terms, fields, ...from !== void 0 ? { from } : {}, ...to !== void 0 ? { to } : {} };
+}
+function sessionfolderof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.name !== "string" || !candidate.name.trim()) return void 0;
+  const parent = typeof candidate.parent === "string" && candidate.parent.trim() ? candidate.parent : void 0;
+  const tags = Array.isArray(candidate.tags) ? candidate.tags.flatMap((tag) => typeof tag === "string" && tag.trim() ? [tag] : []) : [];
+  return { name: candidate.name, ...parent !== void 0 ? { parent } : {}, tags };
+}
+function newsessionrecord(input) {
+  return { id: input.id, name: input.name, createdat: input.createdat, tabs: input.tabs, captures: input.captures, storage: input.storage, cookies: input.cookies, ...input.folder !== void 0 ? { folder: input.folder } : {}, tags: input.tags ?? [], ...input.auto === true ? { auto: true } : {} };
+}
+function diffsessionrecords(left, right) {
+  const changes = [];
+  const leftbyindex = new Map(left.tabs.map((tab) => [tab.index, tab]));
+  const rightbyindex = new Map(right.tabs.map((tab) => [tab.index, tab]));
+  for (const tab of right.tabs) {
+    const prior = leftbyindex.get(tab.index);
+    if (!prior) {
+      changes.push({ class: "added", subject: "tab", detail: `Tab ${tab.index} added: ${tab.url}` });
+      continue;
+    }
+    if (prior.url !== tab.url) changes.push({ class: "changed", subject: "url", detail: `Tab ${tab.index} moved from ${prior.url} to ${tab.url}` });
+    if (prior.title !== tab.title) changes.push({ class: "changed", subject: "tab", detail: `Tab ${tab.index} title changed from "${prior.title}" to "${tab.title}"` });
+    const priorforms = new Map(prior.forms.map((form) => [form.selector, form.value]));
+    for (const form of tab.forms) {
+      const before = priorforms.get(form.selector);
+      if (before === void 0) {
+        changes.push({ class: "added", subject: "form", detail: `Form field ${form.selector} of tab ${tab.index} added with a value` });
+        continue;
+      }
+      if (before !== form.value) changes.push({ class: "changed", subject: "form", detail: `Form field ${form.selector} of tab ${tab.index} changed its captured value` });
+    }
+    for (const form of prior.forms) if (!tab.forms.some((entry) => entry.selector === form.selector)) changes.push({ class: "removed", subject: "form", detail: `Form field ${form.selector} of tab ${tab.index} removed` });
+  }
+  for (const tab of left.tabs) if (!rightbyindex.has(tab.index)) changes.push({ class: "removed", subject: "tab", detail: `Tab ${tab.index} removed: ${tab.url}` });
+  const leftstorage = new Map(left.storage.map((entry) => [entry.origin, entry]));
+  for (const entry of right.storage) {
+    const prior = leftstorage.get(entry.origin);
+    if (!prior) {
+      changes.push({ class: "added", subject: "storage", detail: `Local storage of ${entry.origin} captured with ${entry.keys.length} keys` });
+      continue;
+    }
+    if (prior.keys.join("|") !== entry.keys.join("|") || prior.values.join("|") !== entry.values.join("|")) changes.push({ class: "changed", subject: "storage", detail: `Local storage of ${entry.origin} changed its captured keys or values` });
+  }
+  for (const entry of left.storage) if (!right.storage.some((candidate) => candidate.origin === entry.origin)) changes.push({ class: "removed", subject: "storage", detail: `Local storage of ${entry.origin} left the capture` });
+  return changes;
+}
+function newsessiondiff(input) {
+  return { id: input.id, leftid: input.left.id, rightid: input.right.id, changes: diffsessionrecords(input.left, input.right), at: input.at };
+}
+function searchsessionrecords(query, records) {
+  const matches = [];
+  for (const record2 of records) {
+    if (query.from !== void 0 && record2.createdat < query.from) continue;
+    if (query.to !== void 0 && record2.createdat > query.to) continue;
+    const haystacks = [
+      { field: "urls", text: record2.tabs.map((tab) => tab.url).join(" ") },
+      { field: "titles", text: record2.tabs.map((tab) => tab.title).join(" ") },
+      { field: "names", text: [record2.name, record2.folder ?? "", ...record2.tags].join(" ") },
+      { field: "text", text: record2.tabs.flatMap((tab) => tab.forms.map((form) => form.value)).join(" ") }
+    ];
+    for (const haystack of haystacks) {
+      if (!query.fields.includes(haystack.field)) continue;
+      const lower = haystack.text.toLowerCase();
+      for (const term of query.terms) {
+        const at = lower.indexOf(term.toLowerCase());
+        if (at < 0) continue;
+        const start = Math.max(0, at - 30);
+        matches.push({ sessionid: record2.id, field: haystack.field, term, at: record2.createdat, excerpt: haystack.text.slice(start, start + 80).trim() });
+      }
+    }
+  }
+  return matches;
+}
+function exportsessionfile(records, now) {
+  const recordids = records.map((record2) => record2.id);
+  const payload = JSON.stringify(records);
+  return { formatversion: sessionfileversion, records, recordids, bytesize: payload.length, checksum: checksumtext(`${sessionfileversion}:${recordids.join(",")}:${payload.length}`), exportedat: now };
+}
+function importsessionfile(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (candidate.formatversion !== sessionfileversion) return void 0;
+  const records = Array.isArray(candidate.records) ? candidate.records.flatMap((record2) => sessionrecordvalid(record2) ? [record2] : []) : [];
+  if (records.length === 0) return void 0;
+  if (!Array.isArray(candidate.recordids) || candidate.recordids.length !== records.length || !candidate.recordids.every((id, index) => id === records[index]?.id)) return void 0;
+  const bytesize = typeof candidate.bytesize === "number" && Number.isFinite(candidate.bytesize) ? candidate.bytesize : -1;
+  if (bytesize < 0) return void 0;
+  const checksum2 = typeof candidate.checksum === "string" ? candidate.checksum : "";
+  if (checksum2 !== checksumtext(`${sessionfileversion}:${candidate.recordids.join(",")}:${bytesize}`)) return void 0;
+  return { formatversion: sessionfileversion, records, recordids: candidate.recordids, bytesize, checksum: checksum2, exportedat: typeof candidate.exportedat === "number" && Number.isFinite(candidate.exportedat) ? candidate.exportedat : 0 };
+}
+function sessionrecordvalid(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return false;
+  if (typeof candidate.name !== "string" || !candidate.name.trim()) return false;
+  if (typeof candidate.createdat !== "number" || !Number.isFinite(candidate.createdat)) return false;
+  if (!Array.isArray(candidate.tabs) || !candidate.tabs.every((tab) => sessiontabof(tab) !== void 0)) return false;
+  if (!Array.isArray(candidate.captures) || !candidate.captures.every((id) => typeof id === "string")) return false;
+  if (!Array.isArray(candidate.tags) || !candidate.tags.every((tag) => typeof tag === "string")) return false;
+  return true;
+}
+function expiresessions(records, retention, now) {
+  if (retention === void 0 || !Number.isFinite(retention)) return records;
+  return records.map((record2) => {
+    if (record2.sectionsexpired || now - record2.createdat < retention) return record2;
+    return { id: record2.id, name: record2.name, createdat: record2.createdat, tabs: [], captures: record2.captures, storage: [], cookies: [], ...record2.folder !== void 0 ? { folder: record2.folder } : {}, tags: record2.tags, ...record2.auto === true ? { auto: true } : {}, ...record2.restoredat !== void 0 ? { restoredat: record2.restoredat } : {}, sectionsexpired: true };
+  });
+}
+function filteredsessions(records, filter) {
+  return records.filter((record2) => {
+    if (filter.name !== void 0 && !record2.name.toLowerCase().includes(filter.name.toLowerCase())) return false;
+    if (filter.folder !== void 0 && record2.folder !== filter.folder) return false;
+    if (filter.from !== void 0 && record2.createdat < filter.from) return false;
+    if (filter.to !== void 0 && record2.createdat > filter.to) return false;
+    return true;
+  });
+}
+function crashinterrupted(state, plansteps, now) {
+  if (!state) return void 0;
+  if (state.stepcursor >= plansteps) return state;
+  return { ...state, interrupted: true, crashat: state.crashat ?? now };
+}
+
 // memory.ts
 var sessionmemory = class {
   constructor(adapter) {
@@ -1821,6 +2027,170 @@ var sessionmemory = class {
   async getlocationconsents() {
     return await this.adapter.get("locationconsents") ?? [];
   }
+  /** Returns the persisted task state checkpoint of one run so the run resumes after a service worker restart. */
+  async gettaskstate(runid) {
+    return this.adapter.get(`taskstate${runid}`);
+  }
+  /** Persists one task state checkpoint per run with its corruption checksum. */
+  async settaskstate(state) {
+    return this.adapter.set(`taskstate${state.runid}`, state);
+  }
+  /** Returns the session event history with timestamps, newest first. */
+  async getsessionevents() {
+    return await this.adapter.get("sessionevents") ?? [];
+  }
+  /** Records one session event of the run with its timestamp and detail. */
+  async addsessionevent(event) {
+    const records = await this.getsessionevents();
+    await this.adapter.set("sessionevents", [event, ...records]);
+  }
+  /** Returns every saved session record with its sections, newest first. */
+  async getsessionrecords() {
+    return await this.adapter.get("sessionrecords") ?? [];
+  }
+  /** Adds one saved session record to the library. */
+  async addsessionrecord(record2) {
+    const records = await this.getsessionrecords();
+    await this.adapter.set("sessionrecords", [record2, ...records]);
+  }
+  /** Replaces one saved session record by its id after a filing or restore touches it. */
+  async updatesessionrecord(record2) {
+    const records = await this.getsessionrecords();
+    await this.adapter.set("sessionrecords", records.map((item) => item.id === record2.id ? record2 : item));
+  }
+  /** Lists saved sessions filtered by name substring, folder and time window; the filter stays a user choice with no result cap. */
+  async listsessions(filter) {
+    return filteredsessions(await this.getsessionrecords(), filter);
+  }
+  /** Returns one saved session with every section; an expired record carries its metadata only. */
+  async getsessionrecord(id) {
+    return (await this.getsessionrecords()).find((record2) => record2.id === id);
+  }
+  /** Runs the reviewed search query across every stored session and returns the matches with their session ids and time windows. */
+  async searchmemory(query) {
+    return searchsessionrecords(query, await this.getsessionrecords());
+  }
+  /** Returns the folder tree of the session library. */
+  async getsessionfolders() {
+    return await this.adapter.get("sessionfolders") ?? [];
+  }
+  /** Replaces the folder tree after a reviewed filing adds or moves one folder. */
+  async setsessionfolders(folders) {
+    return this.adapter.set("sessionfolders", folders);
+  }
+  /** Returns every stored session diff result, newest first. */
+  async getsessiondiffs() {
+    return await this.adapter.get("sessiondiffs") ?? [];
+  }
+  /** Stores one session diff result for later review. */
+  async addsessiondiff(diff) {
+    const records = await this.getsessiondiffs();
+    await this.adapter.set("sessiondiffs", [diff, ...records]);
+  }
+  /** Returns the persisted auto snapshot state with the reviewed interval, the last snapshot time and the snapshot count. */
+  async getautosnapshot() {
+    return await this.adapter.get("autosnapshot") ?? void 0;
+  }
+  /** Stores the auto snapshot state of the reviewed interval. */
+  async setautosnapshot(state) {
+    return this.adapter.set("autosnapshot", state);
+  }
+  /** Clears the auto snapshot interval so on demand captures stay the only source of records. */
+  async clearautosnapshot() {
+    return this.adapter.set("autosnapshot", null);
+  }
+  /** Expires the heavy sections of saved sessions after the reviewed retention window while the record metadata survives. */
+  async applysessionexpiry(retention, now) {
+    const records = expiresessions(await this.getsessionrecords(), retention, now);
+    await this.adapter.set("sessionrecords", records);
+    return records;
+  }
+  /** Returns the crash marker of a run interrupted by a browser restart. */
+  async getcrashflag() {
+    return await this.adapter.get("crashed") ?? false;
+  }
+  /** Sets the crash marker so the sessions view offers the crash restore inside the consent model. */
+  async setcrashflag(value) {
+    return this.adapter.set("crashed", value);
+  }
+  /** Stores one composed workflow record version with its timestamp; re-composing the same version replaces it while older versions survive for the audit trail. */
+  async addworkflowrecord(record2) {
+    const records = await this.getworkflowrecordversions();
+    const remaining = records.filter((entry) => !(entry.id === record2.id && entry.version === record2.version));
+    await this.adapter.set("workflowrecords", [record2, ...remaining]);
+  }
+  /** Returns every stored workflow record version, newest first. */
+  async getworkflowrecordversions() {
+    return await this.adapter.get("workflowrecords") ?? [];
+  }
+  /** Returns the latest stored version of one workflow record. */
+  async getworkflowrecord(id) {
+    return (await this.getworkflowrecordversions()).find((entry) => entry.id === id);
+  }
+  /** Lists the saved workflow records, the latest version of each, newest first. */
+  async listworkflows() {
+    const seen = /* @__PURE__ */ new Set();
+    const latest = [];
+    for (const entry of await this.getworkflowrecordversions()) {
+      if (seen.has(entry.id)) continue;
+      seen.add(entry.id);
+      latest.push(entry);
+    }
+    return latest;
+  }
+  /** Stores one workflow run with its state transition; a run replace keeps the full runlog of the same id. */
+  async setworkflowrun(run) {
+    const runs = await this.listworkflowruns();
+    const remaining = runs.filter((entry) => entry.id !== run.id);
+    await this.adapter.set("workflowruns", [run, ...remaining]);
+  }
+  /** Returns every stored workflow run, newest first. */
+  async listworkflowruns() {
+    return await this.adapter.get("workflowruns") ?? [];
+  }
+  /** Returns one run with its full step outcome list so the panel shows the timeline after and during a run. */
+  async getrun(id) {
+    const run = (await this.listworkflowruns()).find((entry) => entry.id === id);
+    if (!run) return void 0;
+    return { run, log: await this.getrunlog(id) };
+  }
+  /** Records one runlog entry of a run; the runlog retention window is a user setting and an absent window keeps every entry. */
+  async addrunlogentry(runid, entry) {
+    const entries = await this.getrunlog(runid);
+    const combined = [...entries, entry];
+    const retention = (await this.getsettings())?.runlogretention;
+    await this.adapter.set(`runlog${runid}`, retention === void 0 ? combined : combined.slice(-retention));
+  }
+  /** Returns the runlog of one run, oldest first. */
+  async getrunlog(runid) {
+    return await this.adapter.get(`runlog${runid}`) ?? [];
+  }
+  /** Stores the variable values per scope of one run for inspection after the run. */
+  async setrunscopes(runid, scopes) {
+    return this.adapter.set(`runscopes${runid}`, scopes);
+  }
+  /** Returns the variable scopes of one run, oldest first. */
+  async getrunscopes(runid) {
+    return await this.adapter.get(`runscopes${runid}`) ?? [];
+  }
+  /** Records one provenance entry of a run: an expression result or a regex capture with its name, value and time. */
+  async addworkflowprovenance(runid, entry) {
+    const entries = await this.getworkflowprovenance(runid);
+    await this.adapter.set(`workflowprovenance${runid}`, [...entries, entry]);
+  }
+  /** Returns every provenance entry of one run, oldest first. */
+  async getworkflowprovenance(runid) {
+    return await this.adapter.get(`workflowprovenance${runid}`) ?? [];
+  }
+  /** Stores one shareable step template under its unique name. */
+  async addsteptemplate(template) {
+    const templates = (await this.getsteptemplates()).filter((entry) => entry.name !== template.name);
+    await this.adapter.set("steptemplates", [template, ...templates]);
+  }
+  /** Returns every stored step template, newest first. */
+  async getsteptemplates() {
+    return await this.adapter.get("steptemplates") ?? [];
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -2807,6 +3177,511 @@ function teardowncdpsession(input) {
   };
 }
 
+// workflow.ts
+var workflowkinds = ["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"];
+function workflowstepof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return void 0;
+  if (typeof candidate.kind !== "string" || !/^[a-z]+$/.test(candidate.kind)) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  if (candidate.target !== void 0 && (typeof candidate.target !== "string" || !candidate.target)) return void 0;
+  if (candidate.value !== void 0 && typeof candidate.value !== "string") return void 0;
+  if (candidate.options !== void 0 && typeof candidate.options !== "string") return void 0;
+  const bindings = Array.isArray(candidate.bindings) ? candidate.bindings.flatMap((binding) => bindingof(binding) !== void 0 ? [bindingof(binding)] : []) : void 0;
+  if (candidate.bindings !== void 0 && bindings === void 0) return void 0;
+  if (Array.isArray(candidate.bindings) && bindings !== void 0 && bindings.length !== candidate.bindings.length) return void 0;
+  const expression = candidate.expression === void 0 ? void 0 : expressionof(candidate.expression);
+  if (candidate.expression !== void 0 && expression === void 0) return void 0;
+  const extract = candidate.extract === void 0 ? void 0 : regexruleof(candidate.extract);
+  if (candidate.extract !== void 0 && extract === void 0) return void 0;
+  return { id: candidate.id, kind: candidate.kind, label: candidate.label, ...candidate.target !== void 0 ? { target: candidate.target } : {}, ...candidate.value !== void 0 ? { value: candidate.value } : {}, ...candidate.options !== void 0 ? { options: candidate.options } : {}, ...bindings !== void 0 && bindings.length > 0 ? { bindings } : {}, ...expression !== void 0 ? { expression } : {}, ...extract !== void 0 ? { extract } : {} };
+}
+function blockinvocationof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.block !== "string" || !candidate.block.trim()) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  return { block: candidate.block, label: candidate.label };
+}
+function workflowblockof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.name !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.name)) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  if (!Array.isArray(candidate.steps)) return void 0;
+  const steps = [];
+  for (const entry of candidate.steps) {
+    const step = workflowstepof(entry);
+    if (step) {
+      steps.push(step);
+      continue;
+    }
+    const invocation = blockinvocationof(entry);
+    if (invocation) {
+      steps.push(invocation);
+      continue;
+    }
+    return void 0;
+  }
+  return { name: candidate.name, label: candidate.label, steps };
+}
+function steptemplateof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return void 0;
+  if (typeof candidate.name !== "string" || !candidate.name.trim()) return void 0;
+  if (typeof candidate.origin !== "string" || !candidate.origin.trim()) return void 0;
+  const step = workflowstepof(candidate.step);
+  if (!step) return void 0;
+  if (typeof candidate.sharedat !== "number" || !Number.isFinite(candidate.sharedat)) return void 0;
+  return { id: candidate.id, name: candidate.name, origin: candidate.origin, step, sharedat: candidate.sharedat };
+}
+function bindingof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.variable !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.variable)) return void 0;
+  if (!variablekinds.includes(candidate.kind)) return void 0;
+  if (typeof candidate.stepid !== "string" || !candidate.stepid.trim()) return void 0;
+  if (candidate.path !== void 0 && (typeof candidate.path !== "string" || !candidate.path.trim())) return void 0;
+  return { variable: candidate.variable, kind: candidate.kind, stepid: candidate.stepid, ...candidate.path !== void 0 ? { path: candidate.path } : {} };
+}
+var variablekinds = ["string", "number", "boolean", "list", "element"];
+var expressionoperators = ["add", "subtract", "multiply", "divide", "modulo", "equal", "notequal", "less", "greater", "lessequal", "greaterequal", "and", "or", "not", "concat", "contains", "length"];
+function expressionof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const left = operandof(candidate.left);
+  if (!left) return void 0;
+  const right = candidate.right === void 0 ? void 0 : operandof(candidate.right);
+  if (candidate.right !== void 0 && right === void 0) return void 0;
+  if (typeof candidate.operator !== "string" || !expressionoperators.includes(candidate.operator)) return void 0;
+  if (typeof candidate.result !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.result)) return void 0;
+  if (!variablekinds.includes(candidate.resultkind)) return void 0;
+  return { left, ...right !== void 0 ? { right } : {}, operator: candidate.operator, result: candidate.result, resultkind: candidate.resultkind };
+}
+function operandof(value) {
+  if (value === void 0) return void 0;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return { literal: value };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.ref === "string" && /^[a-z][a-z0-9]*$/.test(candidate.ref)) return { ref: candidate.ref };
+  if (typeof candidate.literal === "string" || typeof candidate.literal === "number" || typeof candidate.literal === "boolean") return { literal: candidate.literal };
+  return void 0;
+}
+function regexruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.pattern !== "string" || !candidate.pattern.trim()) return void 0;
+  if (typeof candidate.flags !== "string" || !/^[dgimsuvy]*$/.test(candidate.flags)) return void 0;
+  const groups = Array.isArray(candidate.groups) ? candidate.groups.flatMap((group) => typeof group === "string" && /^[a-z][a-z0-9]*$/.test(group) ? [group] : []) : [];
+  if (candidate.groups !== void 0 && groups.length !== candidate.groups.length) return void 0;
+  return { pattern: candidate.pattern, flags: candidate.flags, groups };
+}
+function expandblocks(steps, blocks) {
+  const byname = new Map(blocks.map((block) => [block.name, block]));
+  const expanded = [];
+  const visit = (entries, path, inside) => {
+    for (const entry of entries) {
+      if ("kind" in entry && "label" in entry && !("block" in entry)) {
+        expanded.push(inside === void 0 ? entry : { ...entry, block: inside });
+        continue;
+      }
+      const invocation = blockinvocationof(entry);
+      if (!invocation) throw new Error("The step list entry is neither a reviewed step nor a block invocation.");
+      if (path.includes(invocation.block)) throw new Error(`The block ${invocation.block} recurs inside itself and cannot expand.`);
+      const block = byname.get(invocation.block);
+      if (!block) throw new Error(`The block ${invocation.block} is not defined in the workflow.`);
+      visit(block.steps, [...path, invocation.block], invocation.block);
+    }
+  };
+  visit(steps, [], void 0);
+  if (expanded.length === 0) throw new Error("A workflow needs at least one executable step after block expansion.");
+  return expanded;
+}
+function composeworkflow(input) {
+  if (typeof input.name !== "string" || !input.name.trim()) throw new Error("The workflow name must be a non-empty string.");
+  if (typeof input.version !== "number" || !Number.isInteger(input.version) || input.version < 1) throw new Error("The workflow version must be a positive integer.");
+  if (!Array.isArray(input.origins) || input.origins.length === 0) throw new Error("A workflow needs at least one granted HTTPS origin.");
+  const origins = input.origins.map((origin) => {
+    try {
+      return new URL(origin).origin;
+    } catch {
+      throw new Error(`The workflow origin ${origin} is not a valid url.`);
+    }
+  });
+  if (origins.some((origin) => !origin.startsWith("https://"))) throw new Error("Workflow origins must use HTTPS.");
+  const blocks = input.blocks ?? [];
+  if (blocks.some((block, index) => blocks.findIndex((other) => other.name === block.name) !== index)) throw new Error("Workflow block names must stay unique.");
+  for (const entry of input.steps) {
+    if ("kind" in entry && "label" in entry && !("block" in entry)) {
+      if (input.kindallowed && !input.kindallowed(entry.kind)) throw new Error(`The workflow step kind ${entry.kind} is not a reviewed action kind.`);
+    }
+  }
+  for (const block of blocks) for (const entry of block.steps) {
+    if ("kind" in entry && "label" in entry && !("block" in entry) && input.kindallowed && !input.kindallowed(entry.kind)) throw new Error(`The workflow step kind ${entry.kind} inside block ${block.name} is not a reviewed action kind.`);
+  }
+  const steps = expandblocks(input.steps, blocks);
+  for (const step of steps) {
+    if (input.kindallowed && !input.kindallowed(step.kind)) throw new Error(`The workflow step kind ${step.kind} is not a reviewed action kind.`);
+    if (step.bindings) for (const binding of step.bindings) {
+      if (!steps.some((other) => other.id === binding.stepid)) throw new Error(`The binding of ${binding.variable} references the unknown step ${binding.stepid}.`);
+    }
+  }
+  const riskof = input.riskof ?? (() => "sensitive");
+  const risk = steps.some((step) => riskof(step.kind) === "sensitive") ? "sensitive" : steps.some((step) => riskof(step.kind) === "interaction") ? "interaction" : "read";
+  const record2 = { id: input.id ?? crypto.randomUUID(), name: input.name, version: input.version, origins: [...new Set(origins)], steps, blocks, risk, createdat: input.now };
+  return deepfreeze(record2);
+}
+function deepfreeze(record2) {
+  for (const step of record2.steps) Object.freeze(step);
+  for (const block of record2.blocks) for (const entry of block.steps) if ("kind" in entry && "label" in entry && !("block" in entry)) Object.freeze(entry);
+  Object.freeze(record2.blocks);
+  Object.freeze(record2.steps);
+  return Object.freeze(record2);
+}
+function validateworkflow(record2, options) {
+  if (record2.steps.length === 0) return { allowed: false, reason: "A workflow needs at least one reviewed step." };
+  const defined = new Set(options?.inputs ?? []);
+  const byid = new Map(record2.steps.map((step, index) => [step.id, { step, index }]));
+  for (let index = 0; index < record2.steps.length; index += 1) {
+    const step = record2.steps[index];
+    if (options?.kindallowed && !options.kindallowed(step.kind)) return { allowed: false, reason: `The workflow step kind ${step.kind} is not a reviewed action kind.` };
+    if (step.bindings) for (const binding of step.bindings) {
+      const source = byid.get(binding.stepid);
+      if (!source) return { allowed: false, reason: `The binding of ${binding.variable} references the unknown step ${binding.stepid}.` };
+      if (source.index >= index) return { allowed: false, reason: `The binding of ${binding.variable} must link an earlier step than ${step.id}.` };
+      defined.add(binding.variable);
+    }
+    if (step.expression) {
+      for (const operand of [step.expression.left, step.expression.right]) {
+        if (operand?.ref && !defined.has(operand.ref)) return { allowed: false, reason: `The expression of step ${step.id} references the undefined variable ${operand.ref}.` };
+      }
+      defined.add(step.expression.result);
+    }
+    if (step.extract) for (const group of step.extract.groups) defined.add(group);
+  }
+  return { allowed: true };
+}
+function pushscope(scopes, name, parent) {
+  return [...scopes, { name, variables: [], ...parent !== void 0 ? { parent } : {} }];
+}
+function popscope(scopes) {
+  if (scopes.length === 0) return scopes;
+  return scopes.slice(0, -1);
+}
+function resolvevariable(scopes, name) {
+  for (let index = scopes.length - 1; index >= 0; index -= 1) {
+    const scope = scopes[index];
+    const found = scope.variables.find((variable) => variable.name === name);
+    if (found) return found;
+    if (scope.parent === void 0) continue;
+    const parentindex = scopes.findIndex((candidate) => candidate.name === scope.parent);
+    if (parentindex >= 0 && parentindex < index) {
+      const inherited = resolvevariable([scopes[parentindex]], name);
+      if (inherited) return inherited;
+    }
+  }
+  return void 0;
+}
+function setvariable(scopes, name, kind, value, now) {
+  if (scopes.length === 0) scopes = [{ name: "root", variables: [] }];
+  const target = scopes[scopes.length - 1];
+  const variables = [...target.variables.filter((variable) => variable.name !== name), { name, kind, value, setat: now }];
+  return [...scopes.slice(0, -1), { ...target, variables }];
+}
+function coercevariable(value, kind) {
+  if (kind === "number") {
+    const parsed = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+    if (!Number.isFinite(parsed)) throw new Error("The bound value is not a finite number.");
+    return parsed;
+  }
+  if (kind === "boolean") {
+    if (typeof value === "boolean") return value;
+    if (value === "true") return true;
+    if (value === "false") return false;
+    throw new Error("The bound value is not a boolean.");
+  }
+  if (kind === "list") {
+    if (Array.isArray(value)) return value.map((item) => String(item));
+    if (typeof value === "string") return value.length === 0 ? [] : value.split(",");
+    throw new Error("The bound value is not a list.");
+  }
+  if (kind === "element") {
+    if (typeof value === "string" && value.trim()) return value;
+    throw new Error("The bound value is not an element reference.");
+  }
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  throw new Error("The bound value is not a string.");
+}
+function outcomedetail(outcome, path) {
+  if (!path) return outcome.summary;
+  let current = outcome.details ?? {};
+  for (const segment of path.split(".")) {
+    if (!current || typeof current !== "object" || Array.isArray(current)) return void 0;
+    current = current[segment];
+  }
+  return current;
+}
+function bindvariables(scopes, bindings, outputs, now) {
+  let current = scopes;
+  const produced = [];
+  for (const binding of bindings) {
+    const outcome = outputs[binding.stepid];
+    if (!outcome) continue;
+    const raw = outcomedetail(outcome, binding.path);
+    if (raw === void 0) throw new Error(`The binding of ${binding.variable} found no value at ${binding.path ?? "the summary"} of step ${binding.stepid}.`);
+    current = setvariable(current, binding.variable, binding.kind, coercevariable(raw, binding.kind), now);
+    produced.push(binding.variable);
+  }
+  return { scopes: current, produced };
+}
+function operandvalue(operand, scopes) {
+  if (operand.ref !== void 0) {
+    const resolved = resolvevariable(scopes, operand.ref);
+    if (!resolved) throw new Error(`The expression references the undefined variable ${operand.ref}.`);
+    return resolved.value;
+  }
+  if (operand.literal === void 0) throw new Error("The expression operand needs a variable reference or a literal.");
+  return operand.literal;
+}
+function expressioneval(expression, scopes) {
+  const left = operandvalue(expression.left, scopes);
+  const right = expression.right === void 0 ? void 0 : operandvalue(expression.right, scopes);
+  const operand = (value) => {
+    if (Array.isArray(value)) throw new Error("The expression operand is a list and needs the contains or length operator.");
+    if (value === void 0) throw new Error("The expression operand is missing.");
+    return value;
+  };
+  const numbervalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "number") return primitive;
+    if (typeof primitive === "string" && primitive.trim() !== "") {
+      const parsed = Number(primitive);
+      if (Number.isFinite(parsed)) return parsed;
+    }
+    throw new Error("The arithmetic operand is not a number.");
+  };
+  const booleanvalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "boolean") return primitive;
+    throw new Error("The logic operand is not a boolean.");
+  };
+  const stringvalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "string") return primitive;
+    if (typeof primitive === "number" || typeof primitive === "boolean") return String(primitive);
+    throw new Error("The text operand is not a string.");
+  };
+  switch (expression.operator) {
+    case "add":
+      return numbervalue(left) + numbervalue(right);
+    case "subtract":
+      return numbervalue(left) - numbervalue(right);
+    case "multiply":
+      return numbervalue(left) * numbervalue(right);
+    case "divide": {
+      const divisor = numbervalue(right);
+      if (divisor === 0) throw new Error("The expression divides by zero.");
+      return numbervalue(left) / divisor;
+    }
+    case "modulo": {
+      const divisor = numbervalue(right);
+      if (divisor === 0) throw new Error("The expression divides by zero.");
+      return numbervalue(left) % divisor;
+    }
+    case "equal":
+      return left === right;
+    case "notequal":
+      return left !== right;
+    case "less":
+      return numbervalue(left) < numbervalue(right);
+    case "greater":
+      return numbervalue(left) > numbervalue(right);
+    case "lessequal":
+      return numbervalue(left) <= numbervalue(right);
+    case "greaterequal":
+      return numbervalue(left) >= numbervalue(right);
+    case "and":
+      return booleanvalue(left) && booleanvalue(right);
+    case "or":
+      return booleanvalue(left) || booleanvalue(right);
+    case "not":
+      return !booleanvalue(left);
+    case "concat":
+      return `${stringvalue(left)}${stringvalue(right)}`;
+    case "contains": {
+      if (Array.isArray(left)) return left.includes(stringvalue(right));
+      return stringvalue(left).includes(stringvalue(right));
+    }
+    case "length": {
+      if (Array.isArray(left)) return left.length;
+      return stringvalue(left).length;
+    }
+    default:
+      throw new Error("The reviewed expression operator is unknown.");
+  }
+}
+function regexextract(rule, text2, now) {
+  const pattern = new RegExp(rule.pattern, rule.flags);
+  const match = pattern.exec(text2);
+  if (!match) return { matched: false, variables: [] };
+  const variables = [];
+  for (const group of rule.groups) {
+    const value = match.groups?.[group];
+    variables.push({ name: group, kind: "string", value: typeof value === "string" ? value : "", setat: now });
+  }
+  return { matched: true, variables };
+}
+function waitelementplan(wait) {
+  if (wait.timeout <= 0 || wait.poll <= 0) return { probes: 1, lastwait: 0 };
+  const probes = Math.floor(wait.timeout / wait.poll) + 1;
+  return { probes, lastwait: wait.timeout % wait.poll };
+}
+function delayjitter(delay, seed) {
+  if (delay.jitter <= 0) return Math.max(0, delay.base);
+  const sample = seededrandom(seed);
+  return Math.max(0, delay.base - delay.jitter / 2 + sample * delay.jitter);
+}
+function seededrandom(seed) {
+  let state = seed >>> 0;
+  state ^= state >>> 16;
+  state = Math.imul(state, 2246822507);
+  state ^= state >>> 13;
+  state = Math.imul(state, 3266489909);
+  state ^= state >>> 16;
+  state = state >>> 0 || 1;
+  state ^= state << 13;
+  state >>>= 0;
+  state ^= state >> 17;
+  state ^= state << 5;
+  state >>>= 0;
+  return state / 4294967296;
+}
+function newworkflowrun(input) {
+  return { id: input.id ?? crypto.randomUUID(), workflowid: input.workflowid, state: "pending", cursor: 0, startedat: input.now, ...input.dryrun === true ? { dryrun: true } : {} };
+}
+function pauserun(run, now) {
+  if (run.state !== "running") throw new Error("Only a running workflow can pause.");
+  return { ...run, state: "paused", pausedat: now };
+}
+function cancelrun(run, reason, now) {
+  if (run.state === "done" || run.state === "cancelled") return run;
+  return { ...run, state: "cancelled", cancelreason: reason, endedat: now };
+}
+function interpolate(text2, scopes) {
+  const consumed = [];
+  const resolved = text2.replace(/\$\{([a-z][a-z0-9]*)\}/g, (_whole, name) => {
+    const variable = resolvevariable(scopes, name);
+    if (!variable) throw new Error(`The step references the undefined variable ${name}.`);
+    consumed.push(name);
+    return Array.isArray(variable.value) ? variable.value.join(",") : String(variable.value);
+  });
+  return { text: resolved, consumed };
+}
+function runlogof(step, state, startedat, duration, summary, extra) {
+  return { stepid: step.id, label: step.label, state, startedat, duration, summary, ...extra.block !== void 0 ? { block: extra.block } : {}, ...extra.consumed !== void 0 && extra.consumed.length > 0 ? { consumed: extra.consumed } : {}, ...extra.produced !== void 0 && extra.produced.length > 0 ? { produced: extra.produced } : {}, ...extra.checkpoint === true ? { checkpoint: true } : {}, ...extra.details !== void 0 ? { details: extra.details } : {} };
+}
+async function runstep(input) {
+  const startedat = input.now;
+  let scopes = input.scopes;
+  const consumed = [];
+  if (input.step.bindings) {
+    const bound = bindvariables(scopes, input.step.bindings.filter((binding) => input.outputs[binding.stepid] !== void 0), input.outputs, input.now);
+    scopes = bound.scopes;
+  }
+  let produced = [];
+  try {
+    if (input.step.expression) {
+      const value2 = expressioneval(input.step.expression, scopes);
+      scopes = setvariable(scopes, input.step.expression.result, input.step.expression.resultkind, coercevariable(value2, input.step.expression.resultkind), input.now);
+      produced = [...produced, input.step.expression.result];
+    }
+    let stepvalue = input.step.value;
+    if (input.step.extract) {
+      const text2 = stepvalue ?? "";
+      const interpolated = interpolate(text2, scopes);
+      consumed.push(...interpolated.consumed);
+      const extraction = regexextract(input.step.extract, interpolated.text, input.now);
+      if (extraction.matched) {
+        for (const variable of extraction.variables) scopes = setvariable(scopes, variable.name, "string", variable.value, input.now);
+        produced = [...produced, ...extraction.variables.map((variable) => variable.name)];
+      }
+      stepvalue = interpolated.text;
+    }
+    const target = input.step.target !== void 0 ? interpolate(input.step.target, scopes) : void 0;
+    if (target) consumed.push(...target.consumed);
+    const value = stepvalue !== void 0 ? interpolate(stepvalue, scopes) : void 0;
+    if (value) consumed.push(...value.consumed);
+    const options = input.step.options !== void 0 ? interpolate(input.step.options, scopes) : void 0;
+    if (options) consumed.push(...options.consumed);
+    const dispatchable = { ...input.step, ...target !== void 0 ? { target: target.text } : {}, ...value !== void 0 ? { value: value.text } : {}, ...options !== void 0 ? { options: options.text } : {} };
+    const output = await input.execute(dispatchable, { scopes, ...input.block !== void 0 ? { block: input.block } : {} });
+    if (input.step.bindings) {
+      const bound = bindvariables(scopes, input.step.bindings, { ...input.outputs, [input.step.id]: { stepid: input.step.id, ok: output.ok, summary: output.summary, ...output.details !== void 0 ? { details: output.details } : {}, at: input.now } }, input.now);
+      scopes = bound.scopes;
+      produced = [.../* @__PURE__ */ new Set([...produced, ...bound.produced])];
+    }
+    const duration = Date.now() - startedat;
+    return { scopes, log: runlogof(input.step, output.ok ? "done" : "failed", startedat, duration, output.summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {}, ...produced.length > 0 ? { produced } : {}, ...output.details !== void 0 ? { details: output.details } : {}, ...output.ok ? { checkpoint: true } : {} }), output };
+  } catch (error) {
+    const duration = Date.now() - startedat;
+    const summary = error instanceof Error ? error.message : String(error);
+    return { scopes, log: runlogof(input.step, "failed", startedat, duration, summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {} }), output: { ok: false, summary } };
+  }
+}
+async function runworkflow(input) {
+  if (input.gates && !input.gates.sessionactive) throw new Error("The workflow refuses to run outside an approved session.");
+  if (input.gates && !input.gates.planapproved) throw new Error("The workflow refuses to run without the approved plan review.");
+  if (input.gates) for (const origin of input.record.origins) {
+    if (!input.gates.origingranted(origin)) throw new Error(`The workflow origin ${origin} falls outside the session grants.`);
+  }
+  if (input.run.state === "done" || input.run.state === "failed" || input.run.state === "cancelled") throw new Error(`The workflow run is already ${input.run.state}.`);
+  const { pausedat, ...resumed } = input.run;
+  void pausedat;
+  let run = input.run.state === "paused" ? { ...resumed, state: "running" } : { ...input.run, state: "running" };
+  let scopes = input.scopes ?? [{ name: "root", variables: [] }];
+  const log = [...input.log ?? []];
+  const outputs = { ...input.outputs ?? {} };
+  let activeblock;
+  for (let index = run.cursor; index < input.record.steps.length; index += 1) {
+    const step = input.record.steps[index];
+    if (step.block !== void 0 && step.block !== activeblock) {
+      scopes = pushscope(scopes, step.block, scopes[scopes.length - 1].name);
+      activeblock = step.block;
+    } else if (step.block === void 0 && activeblock !== void 0) {
+      while (scopes.length > 1) scopes = popscope(scopes);
+      activeblock = void 0;
+    }
+    const executed = await runstep({ step, scopes, outputs, execute: input.execute, now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
+    scopes = executed.scopes;
+    log.push(executed.log);
+    outputs[step.id] = { stepid: step.id, ok: executed.output.ok, summary: executed.output.summary, ...executed.output.details !== void 0 ? { details: executed.output.details } : {}, at: Date.now() };
+    if (!executed.output.ok) {
+      run = { ...run, state: "failed", endedat: Date.now(), failreason: executed.output.summary };
+      return { run, scopes, log, outputs };
+    }
+    run = { ...run, cursor: index + 1 };
+    if (input.oncheckpoint) await input.oncheckpoint({ run, scopes, log });
+  }
+  run = { ...run, state: "done", endedat: Date.now() };
+  return { run, scopes, log, outputs };
+}
+function dryrunworkflow(input) {
+  const run = { ...input.run, state: "running", ...input.run.dryrun === true ? { dryrun: true } : { dryrun: true } };
+  let scopes = input.scopes ?? [{ name: "root", variables: [] }];
+  const log = [...input.log ?? []];
+  for (let index = run.cursor; index < input.record.steps.length; index += 1) {
+    const step = input.record.steps[index];
+    const summary = input.projection(step);
+    const entry = summary === void 0 ? runlogof(step, "refused", input.now, 0, `The ${step.kind} step has no read only projection and the dry run refuses it.`, { ...step.block !== void 0 ? { block: step.block } : {} }) : runlogof(step, "done", input.now, 0, summary, { ...step.block !== void 0 ? { block: step.block } : {} });
+    log.push(entry);
+    scopes = setvariable(scopes, `${step.id}outcome`, "boolean", entry.state === "done", input.now);
+  }
+  return { run: { ...run, state: "done", cursor: input.record.steps.length, endedat: input.now }, scopes, log };
+}
+
 // netauth.ts
 function oauthflowof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -3040,9 +3915,9 @@ function consolediff(input) {
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
@@ -3062,6 +3937,8 @@ var debugactions = /* @__PURE__ */ new Set(["watchconsole", "watcherrors", "watc
 var cdpactions = /* @__PURE__ */ new Set(["attachcdp", "detachcdp", "cdpcmd", "watchcdp", "setbreakpoint", "stepcode", "watchexpr", "overridescript"]);
 var profileractions = /* @__PURE__ */ new Set(["measureflow", "heapshot", "trackmemory", "profilecpu", "watchshifts", "traceload", "annotatetrace", "replaytrace", "capturesourcemaps"]);
 var emulationactions = /* @__PURE__ */ new Set(["emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "blackboxscripts"]);
+var sessionactions = /* @__PURE__ */ new Set(["persiststate", "capturesession", "restoresession", "namedsessions", "diffsessions", "searchsessions", "exportsessions", "importsessions"]);
+var workflowactions = /* @__PURE__ */ new Set(["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
 var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
@@ -3077,6 +3954,12 @@ function hostpattern(origin) {
   if (parsed.protocol !== "https:") throw new Error("Only HTTPS origins can be granted.");
   return `${parsed.origin}/*`;
 }
+function issessionkind(kind) {
+  return sessionactions.has(kind);
+}
+function isworkflowkind(kind) {
+  return workflowactions.has(kind);
+}
 function isdebugkind(kind) {
   return debugactions.has(kind);
 }
@@ -3115,6 +3998,8 @@ function requiredcapability(kind) {
   if (kind === "writeclipboard" || kind === "copyscreen") return "clipboardWrite";
   if (kind === "downloadimages") return "downloads";
   if (kind === "authflow") return "tabs";
+  if (kind === "capturesession" || kind === "restoresession") return "tabs";
+  if (kind === "exportsessions") return "downloads";
   if (kind === "openlink" || kind === "openprivate" || kind === "navlist" || kind === "batchopen" || kind === "reopentab" || kind === "deeplink") return "tabs";
   if (tabscommandactions.has(kind)) return "tabs";
   return void 0;
@@ -4520,6 +5405,253 @@ function validateemulationgrammar(step, options) {
   }
   return { allowed: true };
 }
+function validatesessiongrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "persiststate") {
+    if (options.resume !== void 0 && typeof options.resume !== "boolean") return { allowed: false, reason: "The reviewed resume flag must be a boolean." };
+    return { allowed: true };
+  }
+  if (kind === "capturesession") {
+    const plan = snapshotplanof(options.snapshot);
+    if (!plan) return { allowed: false, reason: "The session capture needs a reviewed snapshot plan with its scope, a non-empty section list of the reviewed grammar (tabs, scroll, forms, storage, cookies) and the capture link flag." };
+    if (plan.auto !== void 0) {
+      const interval = autointervalof(options.snapshot.auto);
+      if (interval === void 0) return { allowed: false, reason: "The reviewed auto snapshot interval needs a positive period, a positive maximum snapshot count and a zero or positive expiry window with no code ceiling." };
+    }
+    return { allowed: true };
+  }
+  if (kind === "restoresession") {
+    if (typeof options.sessionid !== "string" || !options.sessionid.trim()) return { allowed: false, reason: "The session restore needs the reviewed session id of the saved record." };
+    if (restoreplanof(options.restore) === void 0) return { allowed: false, reason: "The session restore needs a reviewed restore plan with its tab, form and capture policies." };
+    if (options.reviewed !== true) return { allowed: false, reason: "Every session restore needs the explicit restore review with its tabs, form state and captures listed before it reopens anything." };
+    return { allowed: true };
+  }
+  if (kind === "namedsessions") {
+    if (typeof options.sessionid !== "string" || !options.sessionid.trim()) return { allowed: false, reason: "The session filing needs the reviewed session id of the saved record." };
+    if (typeof options.name !== "string" || !options.name.trim()) return { allowed: false, reason: "The session filing needs a reviewed non-empty session name." };
+    if (options.folder !== void 0 && (typeof options.folder !== "string" || !options.folder.trim())) return { allowed: false, reason: "The reviewed folder name must be a non-empty string." };
+    if (options.tags !== void 0 && (!Array.isArray(options.tags) || !options.tags.every((tag) => typeof tag === "string" && tag.trim()))) return { allowed: false, reason: "The reviewed tag list must be a list of non-empty strings." };
+    return { allowed: true };
+  }
+  if (kind === "diffsessions") {
+    if (typeof options.left !== "string" || !options.left.trim() || typeof options.right !== "string" || !options.right.trim()) return { allowed: false, reason: "The session diff needs the reviewed ids of both saved sessions." };
+    return { allowed: true };
+  }
+  if (kind === "searchsessions") {
+    if (searchqueryof(options.query) === void 0) return { allowed: false, reason: "The session search needs a reviewed query with a non-empty term list, fields of the reviewed grammar (urls, titles, names, text) and an optional time window." };
+    return { allowed: true };
+  }
+  if (kind === "exportsessions") {
+    if (options.reviewed !== true) return { allowed: false, reason: "Session exports need the explicit export review before any session file leaves the device." };
+    if (options.ids !== void 0 && (!Array.isArray(options.ids) || options.ids.length === 0 || !options.ids.every((id) => typeof id === "string" && id.trim()))) return { allowed: false, reason: "The reviewed export id list must be a non-empty list of saved session ids." };
+    return { allowed: true };
+  }
+  if (kind === "importsessions") {
+    if (options.reviewed !== true) return { allowed: false, reason: "Session imports need the explicit full record review before any record joins the library." };
+    if (importsessionfile(options.file) === void 0) return { allowed: false, reason: "The session import needs a reviewed file of the known format version with an intact checksum." };
+    return { allowed: true };
+  }
+  return { allowed: true };
+}
+function restorereviewgranted(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  if (restoreplanof(options.restore) === void 0) return { allowed: false, reason: "Every session restore needs a reviewed restore plan with its tab, form and capture policies." };
+  if (options.reviewed !== true) return { allowed: false, reason: "The session restore needs the explicit restore review of its tabs, form state and captures before it reopens anything." };
+  return { allowed: true };
+}
+function sessionrestoregate(input) {
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now: input.now, action: "run the session memory step" });
+  if (!gate.allowed) return gate;
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Session memory steps need an approved plan before they run." };
+  if (input.step.kind === "restoresession") return restorereviewgranted(input.step);
+  return { allowed: true };
+}
+function restoreoriginsgranted(urls, grants) {
+  const covered = new Set(grants);
+  const skippedorigins = [];
+  for (const url of urls) {
+    let origin = "";
+    try {
+      origin = new URL(url).origin;
+    } catch {
+      origin = "";
+    }
+    if (!origin || !covered.has(origin)) skippedorigins.push(origin || url);
+  }
+  return { allowed: skippedorigins.length === 0, skippedorigins: [...new Set(skippedorigins)] };
+}
+function sessionnameunique(name, records, recordid) {
+  if (records.some((record2) => record2.name === name && record2.id !== recordid)) return { allowed: false, reason: `The session name ${name} already exists in the library; review a unique name.` };
+  return { allowed: true };
+}
+function sessionfolderunique(name, folders) {
+  if (folders.some((folder) => folder.name === name)) return { allowed: false, reason: `The folder name ${name} already exists in the library; review a unique folder name.` };
+  return { allowed: true };
+}
+function snapshotretentionwindow(settings) {
+  return settings?.sessionretention;
+}
+function validateworkflowgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "composeworkflow") {
+    const payload = options.workflow;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { allowed: false, reason: "The workflow composition needs the reviewed workflow payload with its name, version, origins, steps and blocks." };
+    const candidate = payload;
+    if (typeof candidate.name !== "string" || !candidate.name.trim()) return { allowed: false, reason: "The workflow composition needs a reviewed non-empty name." };
+    if (typeof candidate.version !== "number" || !Number.isInteger(candidate.version) || candidate.version < 1) return { allowed: false, reason: "The workflow version must be a positive integer." };
+    if (!Array.isArray(candidate.origins) || candidate.origins.length === 0 || !candidate.origins.every((origin) => typeof origin === "string" && origin.startsWith("https://"))) return { allowed: false, reason: "The workflow needs at least one granted HTTPS origin so every step stays inside the grants." };
+    if (!Array.isArray(candidate.steps) || candidate.steps.length === 0 || !candidate.steps.every((entry) => workflowstepof(entry) !== void 0 || entry && typeof entry === "object" && typeof entry.block === "string")) return { allowed: false, reason: "The workflow needs a non-empty reviewed step list of the workflow step grammar or block invocations." };
+    const blocks = Array.isArray(candidate.blocks) ? candidate.blocks.flatMap((block) => {
+      const parsed = workflowblockof(block);
+      return parsed !== void 0 ? [parsed] : [];
+    }) : [];
+    if (Array.isArray(candidate.blocks) && blocks.length !== candidate.blocks.length) return { allowed: false, reason: "The reviewed block list must carry unique lowercase names, labels and valid child steps." };
+    try {
+      const record2 = composeworkflow({ name: candidate.name, version: candidate.version, origins: candidate.origins, steps: candidate.steps.map((entry) => "block" in entry ? { block: entry.block, label: typeof entry.label === "string" ? entry.label : entry.block } : workflowstepof(entry)), blocks, now: 0, kindallowed: (candidatekind) => {
+        try {
+          actionrisk(candidatekind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, riskof: (candidatekind) => actionrisk(candidatekind) });
+      const inputs = Array.isArray(candidate.inputs) ? candidate.inputs.flatMap((name) => typeof name === "string" ? [name] : []) : void 0;
+      const checked = validateworkflow(record2, { kindallowed: (workflowkind) => {
+        try {
+          actionrisk(workflowkind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, ...inputs !== void 0 ? { inputs } : {} });
+      if (!checked.allowed) return checked;
+    } catch (error) {
+      return { allowed: false, reason: error instanceof Error ? error.message : "The workflow payload failed its composition validation." };
+    }
+    return { allowed: true };
+  }
+  if (kind === "savetemplate") {
+    const payload = options.template && typeof options.template === "object" && !Array.isArray(options.template) ? options.template : {};
+    const template = steptemplateof({ id: "templatereview", origin: "https://example.com", sharedat: 0, ...payload });
+    if (!template) return { allowed: false, reason: "The step template needs a reviewed name and a valid workflow step it shares across workflows." };
+    return { allowed: true };
+  }
+  if (kind === "runworkflow") {
+    if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "The workflow run needs the reviewed id of the composed workflow." };
+    if (options.reviewed !== true) return { allowed: false, reason: "Every real workflow run needs the explicit run review with its expanded step list shown before the first step executes." };
+    if (options.variables !== void 0 && (!options.variables || typeof options.variables !== "object" || Array.isArray(options.variables) || !Object.values(options.variables).every((value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean"))) return { allowed: false, reason: "The reviewed run variables must be an object of string, number or boolean values." };
+    return { allowed: true };
+  }
+  if (kind === "dryrun") {
+    if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "The dry run needs the reviewed id of the composed workflow." };
+    return { allowed: true };
+  }
+  if (kind === "delay") {
+    const delay = options.delay;
+    if (!delay || typeof delay !== "object" || Array.isArray(delay)) return { allowed: false, reason: "The delay needs a reviewed base and jitter window in options." };
+    const reviewed = delay;
+    if (typeof reviewed.base !== "number" || !Number.isFinite(reviewed.base) || reviewed.base < 0) return { allowed: false, reason: "The reviewed delay base must be zero or a positive number of milliseconds." };
+    if (typeof reviewed.jitter !== "number" || !Number.isFinite(reviewed.jitter) || reviewed.jitter < 0) return { allowed: false, reason: "The reviewed delay jitter window must be zero or a positive number of milliseconds with no code ceiling." };
+    return { allowed: true };
+  }
+  if (kind === "waitelement") {
+    const wait = options.wait;
+    if (!wait || typeof wait !== "object" || Array.isArray(wait)) return { allowed: false, reason: "The element wait needs a reviewed selector, timeout and poll interval in options." };
+    const reviewed = wait;
+    if (typeof reviewed.selector !== "string" || !reviewed.selector.trim()) return { allowed: false, reason: "The element wait needs a reviewed non-empty selector." };
+    if (typeof reviewed.timeout !== "number" || !Number.isFinite(reviewed.timeout) || reviewed.timeout < 0) return { allowed: false, reason: "The reviewed element wait timeout must be zero or a positive number of milliseconds with no code ceiling." };
+    if (typeof reviewed.poll !== "number" || !Number.isFinite(reviewed.poll) || reviewed.poll < 0) return { allowed: false, reason: "The reviewed element wait poll interval must be zero or a positive number of milliseconds with no code ceiling." };
+    return { allowed: true };
+  }
+  if (kind === "compute") {
+    const expression = expressionof(options.expression);
+    if (!expression) return { allowed: false, reason: `The expression step needs a reviewed expression with operands, an operator of the reviewed set (${expressionoperators.join(", ")}) and a result variable of a reviewed kind.` };
+    const operatorcheck = validatexpressionoperators(expression);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return { allowed: true };
+  }
+  if (kind === "extractvars") {
+    const rule = regexruleof(options.rule);
+    if (!rule) return { allowed: false, reason: "The variable extraction needs a reviewed regex rule with its pattern, flags and named capture groups." };
+    const shapecheck = validateregexrule(rule.pattern);
+    if (!shapecheck.allowed) return shapecheck;
+    if (typeof options.text !== "string") return { allowed: false, reason: "The variable extraction needs the reviewed text the regex rule applies to." };
+    return { allowed: true };
+  }
+  return { allowed: true };
+}
+function validateregexrule(pattern) {
+  try {
+    new RegExp(pattern);
+  } catch {
+    return { allowed: false, reason: "The reviewed regex pattern does not compile." };
+  }
+  const nestedquantifier = /\((?:[^()\\]|\\.)*[+*}]\)[+*{]/.test(pattern) || /\(\)[+*{]/.test(pattern);
+  if (nestedquantifier) return { allowed: false, reason: "The reviewed regex pattern nests an unbounded quantifier inside a quantified group and is refused because adversarial text could explode the backtracking." };
+  const unboundedrepeat = /\{\d+,\}/.test(pattern);
+  if (unboundedrepeat && /\([^)]*\{\d+,\}[^)]*\)[+*{]/.test(pattern)) return { allowed: false, reason: "The reviewed regex pattern repeats an unbounded group and is refused because adversarial text could explode the backtracking." };
+  return { allowed: true };
+}
+function validatexpressionoperators(expression) {
+  const numeric = /* @__PURE__ */ new Set(["add", "subtract", "multiply", "divide", "modulo"]);
+  const logic = /* @__PURE__ */ new Set(["and", "or", "not"]);
+  const comparison = /* @__PURE__ */ new Set(["less", "greater", "lessequal", "greaterequal"]);
+  const text2 = /* @__PURE__ */ new Set(["concat", "contains"]);
+  const operator = expression.operator;
+  if (numeric.has(operator)) {
+    for (const operand of [expression.left, expression.right]) {
+      if (operand === void 0) continue;
+      if (operand.literal !== void 0 && typeof operand.literal === "boolean") return { allowed: false, reason: `The ${operator} operator needs numeric operands; boolean literals are refused.` };
+    }
+    if (expression.resultkind !== "number" && expression.resultkind !== "string") return { allowed: false, reason: `The ${operator} operator needs a number result kind.` };
+  }
+  if (logic.has(operator)) {
+    for (const operand of [expression.left, expression.right]) {
+      if (operand === void 0) continue;
+      if (operand.literal !== void 0 && typeof operand.literal !== "boolean") return { allowed: false, reason: `The ${operator} operator needs boolean operands; non boolean literals are refused.` };
+    }
+    if (expression.resultkind !== "boolean") return { allowed: false, reason: `The ${operator} operator needs a boolean result kind.` };
+    if (operator === "not" && expression.right !== void 0) return { allowed: false, reason: "The not operator takes one operand only." };
+  }
+  if (comparison.has(operator) && expression.resultkind !== "boolean") return { allowed: false, reason: `The ${operator} operator needs a boolean result kind.` };
+  if (text2.has(operator) && expression.resultkind !== "boolean" && expression.resultkind !== "string") return { allowed: false, reason: `The ${operator} operator needs a string or boolean result kind.` };
+  if (operator === "contains" && expression.resultkind !== "boolean") return { allowed: false, reason: "The contains operator needs a boolean result kind." };
+  if (operator === "length") {
+    if (expression.right !== void 0) return { allowed: false, reason: "The length operator takes one operand only." };
+    if (expression.resultkind !== "number") return { allowed: false, reason: "The length operator needs a number result kind." };
+  }
+  if ((operator === "equal" || operator === "notequal") && !(/* @__PURE__ */ new Set(["boolean", "string", "number"])).has(expression.resultkind)) return { allowed: false, reason: "The equality operator needs a primitive result kind." };
+  return { allowed: true };
+}
+function workflowgate(input) {
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now: input.now, action: "run the workflow step" });
+  if (!gate.allowed) return gate;
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Workflow steps need the approved plan review before they run." };
+  if (input.step.kind === "runworkflow") {
+    let runoptions = {};
+    try {
+      runoptions = parseoptions(input.step);
+    } catch {
+      runoptions = {};
+    }
+    if (runoptions.reviewed !== true) return { allowed: false, reason: "Every real workflow run needs the explicit run review with its expanded step list shown before the first step executes." };
+  }
+  return { allowed: true };
+}
+function dryrunprojection(step) {
+  const risk = resolvedrisk({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.target !== void 0 ? { target: step.target } : {}, ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  if (risk !== "read") return void 0;
+  if (step.kind === "delay") return `The delay step would sleep its reviewed base inside the jitter window.`;
+  if (step.kind === "waitelement") return `The element wait step would poll ${step.target ?? "the reviewed selector"} until appearance or the reviewed timeout.`;
+  if (step.kind === "compute") return `The compute step would evaluate its reviewed expression into the result variable.`;
+  if (step.kind === "extractvars") return `The variable extraction step would apply its reviewed regex rule and store the named captures.`;
+  return `The ${step.kind} step would run read only and mutate nothing.`;
+}
 function validatecdpgrammar(step, options) {
   const kind = step.kind;
   if (kind === "attachcdp") {
@@ -5085,6 +6217,14 @@ function validatestep(step, origin) {
     const emulationcheck = validateemulationgrammar(step, options);
     if (!emulationcheck.allowed) return emulationcheck;
   }
+  if (issessionkind(step.kind)) {
+    const sessioncheck = validatesessiongrammar(step, options);
+    if (!sessioncheck.allowed) return sessioncheck;
+  }
+  if (isworkflowkind(step.kind)) {
+    const workflowcheck = validateworkflowgrammar(step, options);
+    if (!workflowcheck.allowed) return workflowcheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -5258,6 +6398,27 @@ function canexecute(input) {
     const emugatecheck = emugate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
     if (!emugatecheck.allowed) return emugatecheck;
   }
+  if (issessionkind(input.step.kind)) {
+    const sessiongatecheck = sessionrestoregate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
+    if (!sessiongatecheck.allowed) return sessiongatecheck;
+    if (input.step.kind === "restoresession") {
+      let restoreoptions = {};
+      try {
+        restoreoptions = parseoptions(input.step);
+      } catch {
+        restoreoptions = {};
+      }
+      for (const url of Array.isArray(restoreoptions.origins) ? restoreoptions.origins : []) {
+        if (typeof url !== "string" || !url) continue;
+        const origingate = origincheck(input.session, url);
+        if (!origingate.allowed) return { allowed: false, reason: `The session restore reopens ${url} outside the session origin grants; review the restore record or grant the origin.` };
+      }
+    }
+  }
+  if (isworkflowkind(input.step.kind)) {
+    const workflowgatecheck = workflowgate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
+    if (!workflowgatecheck.allowed) return workflowgatecheck;
+  }
   if (iscontrolkind(input.step.kind)) {
     const controlgate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "control the network" });
     if (!controlgate.allowed) return controlgate;
@@ -5508,9 +6669,21 @@ function recordemulation(progress, planid, stepid, entry, now) {
   const outcome = { stepid, ok: true, summary: `${entry.reason}: ${entry.applied.length} applied layer${entry.applied.length === 1 ? "" : "s"}${entry.applied.length > 0 ? ` (${entry.applied.join(", ")})` : ""} and ${entry.reverted.length} reverted layer${entry.reverted.length === 1 ? "" : "s"}${entry.reverted.length > 0 ? ` (${entry.reverted.join(", ")})` : ""}.`, details: { emulation: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function recordsession(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const counts = `${entry.sections !== void 0 ? `${entry.sections} section${entry.sections === 1 ? "" : "s"}, ` : ""}${entry.matches !== void 0 ? `${entry.matches} match${entry.matches === 1 ? "" : "es"}, ` : ""}${entry.restored !== void 0 ? `${entry.restored} restored tab${entry.restored === 1 ? "" : "s"}, ` : ""}${entry.skipped !== void 0 ? `${entry.skipped} skipped origin${entry.skipped === 1 ? "" : "s"}, ` : ""}${entry.cursor !== void 0 ? `cursor ${entry.cursor}, ` : ""}${entry.bytes !== void 0 ? `${entry.bytes} byte${entry.bytes === 1 ? "" : "s"}, ` : ""}`.replace(/, $/, "");
+  const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { session: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordworkflow(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const counts = `${entry.executed !== void 0 ? `${entry.executed} executed step${entry.executed === 1 ? "" : "s"}, ` : ""}${entry.refused !== void 0 ? `${entry.refused} refused step${entry.refused === 1 ? "" : "s"}, ` : ""}${entry.total !== void 0 ? `${entry.total} total step${entry.total === 1 ? "" : "s"}, ` : ""}`.replace(/, $/, "");
+  const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { workflow: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.48";
+var packageversion = "1.1.50";
 
 // types.ts
 var protocolversion = packageversion;
@@ -5704,6 +6877,51 @@ function parseproposal(value, origin, grants) {
       }
       if (step.kind === "overridepermission" && permissiongrantof(emulationoptions.permission) === void 0) throw new Error("Permission overrides of unknown permission names are refused.");
     }
+    if (issessionkind(step.kind)) {
+      let sessionoptions = {};
+      try {
+        sessionoptions = parseoptions(step);
+      } catch {
+        sessionoptions = {};
+      }
+      if (step.kind === "restoresession") {
+        for (const url of Array.isArray(sessionoptions.origins) ? sessionoptions.origins : []) {
+          if (typeof url !== "string" || !url) continue;
+          const granted = covered.some((pattern) => {
+            try {
+              return new URL(url).origin === new URL(pattern).origin;
+            } catch {
+              return false;
+            }
+          });
+          if (!granted) throw new Error(`The session restore reopens ${url} outside the grants.`);
+        }
+      }
+      if (step.kind === "importsessions" && importsessionfile(sessionoptions.file) === void 0) throw new Error("Session import files of unknown format versions are refused.");
+    }
+    if (isworkflowkind(step.kind)) {
+      let workflowoptions = {};
+      try {
+        workflowoptions = parseoptions(step);
+      } catch {
+        workflowoptions = {};
+      }
+      if (step.kind === "composeworkflow") {
+        const payload = workflowoptions.workflow && typeof workflowoptions.workflow === "object" && !Array.isArray(workflowoptions.workflow) ? workflowoptions.workflow : void 0;
+        const origins = payload && Array.isArray(payload.origins) ? payload.origins.filter((originvalue) => typeof originvalue === "string") : [];
+        for (const workfloworigin of origins) {
+          const granted = covered.some((pattern) => {
+            try {
+              return new URL(workfloworigin).origin === new URL(pattern).origin;
+            } catch {
+              return false;
+            }
+          });
+          if (!granted) throw new Error(`The workflow origin ${workfloworigin} stays outside the grants.`);
+        }
+      }
+      if (step.kind === "runworkflow" && workflowoptions.reviewed !== true) throw new Error("Workflow runs without the explicit run review of the expanded step list are refused.");
+    }
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
     const target = outboundtarget(step);
@@ -5763,6 +6981,11 @@ function parseproposal(value, origin, grants) {
   };
   return { version: protocolversion, plan };
 }
+function workflowoutcome(input) {
+  const selected = input.stepid !== void 0 ? input.entries.filter((entry) => entry.stepid === input.stepid) : input.entries;
+  const steps = selected.map((entry) => ({ stepid: entry.stepid, label: entry.label, state: entry.state, duration: entry.duration, summary: entry.summary, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.produced !== void 0 ? { produced: entry.produced } : {}, ...entry.consumed !== void 0 ? { consumed: entry.consumed } : {}, ...entry.checkpoint === true ? { checkpoint: true } : {} }));
+  return { version: protocolversion, runid: input.run.id, workflowid: input.run.workflowid, state: input.run.state, ...input.run.dryrun === true ? { dryrun: true } : {}, steps };
+}
 function stepof(kind, candidate, index) {
   return { id: typeof candidate.id === "string" ? candidate.id : `candidate${index + 1}`, kind, summary: typeof candidate.summary === "string" ? candidate.summary : "", risk: "read", ...typeof candidate.options === "string" ? { options: candidate.options } : {} };
 }
@@ -5778,7 +7001,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed } } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -5909,6 +7132,12 @@ function emulationreport(input) {
   });
   return { version: protocolversion, ...input.state !== void 0 ? { state: input.state } : {}, layers: input.state?.layers ?? [], devices: input.devices, networks: input.networks, locations: input.locations, agents: input.agents, blackbox: input.blackbox, permissions: input.permissions, consents };
 }
+function sessionreport(input) {
+  return { version: protocolversion, records: input.records, events: input.events, folders: input.folders, diffs: input.diffs, ...input.auto !== void 0 ? { auto: input.auto } : {}, ...input.crashed === true ? { crashed: true } : {} };
+}
+function workflowreport(input) {
+  return { version: protocolversion, workflows: input.workflows, runs: input.runs, templates: input.templates, log: input.log ?? [], scopes: input.scopes ?? [], provenance: input.provenance ?? [] };
+}
 
 // capture.ts
 var capturekinds = ["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"];
@@ -6485,6 +7714,46 @@ async function runbrowseraction(step, sessiontabid, windowid) {
   }
 }
 
+// extension/pagesession.ts
+function capturepagestate(sections) {
+  const wants = (section) => sections.includes(section);
+  const forms = [];
+  if (wants("forms")) {
+    const elements = Array.from(document.querySelectorAll("input, textarea, select"));
+    elements.forEach((element, index) => {
+      if (element.type === "password") return;
+      const selector = element.id ? `#${element.id}` : element.name ? `[name="${element.name}"]` : `${element.tagName.toLowerCase()}:nth-of-type(${index + 1})`;
+      forms.push({ selector, value: element.value });
+    });
+  }
+  const storagekeys = [];
+  const storagevalues = [];
+  if (wants("storage")) {
+    for (let index = 0; index < localStorage.length; index += 1) {
+      const key = localStorage.key(index);
+      if (key === null) continue;
+      storagekeys.push(key);
+      storagevalues.push(localStorage.getItem(key) ?? "");
+    }
+  }
+  const cookienames = wants("cookies") ? document.cookie.split(";").map((part) => part.split("=")[0]?.trim() ?? "").filter((name) => name.length > 0) : [];
+  return { scrollx: window.scrollX, scrolly: window.scrollY, forms, storagekeys, storagevalues, cookienames };
+}
+function restorepagestate(state) {
+  window.scrollTo(state.scrollx, state.scrolly);
+  let restored = 0;
+  for (const form of Array.isArray(state.forms) ? state.forms : []) {
+    const element = document.querySelector(form.selector);
+    if (element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement || element instanceof HTMLSelectElement) {
+      element.value = form.value;
+      element.dispatchEvent(new Event("input", { bubbles: true }));
+      element.dispatchEvent(new Event("change", { bubbles: true }));
+      restored += 1;
+    }
+  }
+  return { restored, summary: `Restored the scroll position and ${restored} form field${restored === 1 ? "" : "s"} of the reopened tab.` };
+}
+
 // extension/tabscommand.ts
 function parsetabquery(step) {
   let options = {};
@@ -7385,15 +8654,15 @@ function remainingpages(sessionvalue, planned) {
 function provenancefor(artifact, url, stepid, at) {
   return { artifact: artifact.id, name: artifact.name, url, stepid, rowstart: artifact.rowcount > 0 ? 1 : 0, rowend: artifact.rowcount, checksum: artifact.checksum, at };
 }
-function interpolate(text2, row) {
+function interpolate2(text2, row) {
   return text2.replace(/\{\{([^}]+)\}\}/g, (_, key) => row[key.trim()] ?? "");
 }
 function loopstep(step, row) {
   return {
     ...step,
-    ...step.target !== void 0 ? { target: interpolate(step.target, row) } : {},
-    ...step.value !== void 0 ? { value: interpolate(step.value, row) } : {},
-    ...step.options !== void 0 ? { options: interpolate(step.options, row) } : {}
+    ...step.target !== void 0 ? { target: interpolate2(step.target, row) } : {},
+    ...step.value !== void 0 ? { value: interpolate2(step.value, row) } : {},
+    ...step.options !== void 0 ? { options: interpolate2(step.options, row) } : {}
   };
 }
 function loopvariables(row) {
@@ -7597,7 +8866,7 @@ function stepoptions2(step) {
 }
 async function refreshcapabilities() {
   const report = await readcapabilities();
-  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds] };
+  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds], sessions: [...sessionkinds], workflow: [...workflowkinds] };
   await memory.setcapabilities(withmedia);
   return withmedia;
 }
@@ -7736,6 +9005,7 @@ function browserauditkind(step) {
   return "tab";
 }
 function stepauditkind(step, ok) {
+  if (issessionkind(step.kind)) return "session";
   if (isbrowserkind(step.kind)) return browserauditkind(step);
   if (istabscommandkind(step.kind)) {
     if (step.kind === "grouptabs" || step.kind === "colorgroup" || step.kind === "collapsegroup") return "group";
@@ -11711,7 +12981,8 @@ async function refreshbadge() {
   const locationprompts = (await memory.getlocationconsents()).filter((consent) => consent.approved === void 0).length;
   const emulatedlayers = [...activeemulation.values()].reduce((total2, state) => total2 + activelayers(state).length, 0);
   const tasktabs2 = new Set(badges.map((badge) => badge.tabid)).size;
-  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts + consoleprompts + debuggerprompts + locationprompts + emulatedlayers + observedrequests + livechannels + activerulescount;
+  const runningworkflows = (await memory.listworkflowruns()).filter((run) => run.state === "running").length + activeworkflowruns.size;
+  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts + consoleprompts + debuggerprompts + locationprompts + emulatedlayers + observedrequests + livechannels + activerulescount + runningworkflows;
   await chrome.action.setBadgeText({ text: total > 0 ? String(total) : "" }).catch(() => {
   });
 }
@@ -11818,6 +13089,429 @@ async function executeemulationstep(step, session, plan, tabid2, origin) {
   await refreshbadge();
   return { ok: true, summary: output.summary, details: { ...output.details ?? {}, emulation: { applied: [name], reverted: [] } } };
 }
+var restoreloadwindow = 4e3;
+var restorepollstep = 200;
+async function waittabloaded(tabid2) {
+  const started = Date.now();
+  while (Date.now() - started < restoreloadwindow) {
+    const tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+    if (!tab || tab.status === "complete") return;
+    await new Promise((resolve) => setTimeout(resolve, restorepollstep));
+  }
+}
+async function capturesessionrecord(plan, session, runid) {
+  const grants = session.grants ?? [session.origin];
+  const query = plan.scope === "all" ? {} : plan.scope === "run" ? { currentWindow: true } : { active: true, currentWindow: true };
+  const tabs = await chrome.tabs.query(query).catch(() => []);
+  const capturedtabs = [];
+  const storage = [];
+  const cookies = [];
+  for (const tab of tabs) {
+    const url = tab.url ?? "";
+    if (!url.startsWith("http")) continue;
+    let taborigin = "";
+    try {
+      taborigin = new URL(url).origin;
+    } catch {
+      taborigin = "";
+    }
+    let state;
+    if (tab.id !== void 0 && (plan.sections.includes("scroll") || plan.sections.includes("forms") || plan.sections.includes("storage") || plan.sections.includes("cookies"))) {
+      state = await chrome.scripting.executeScript({ target: { tabId: tab.id }, func: capturepagestate, args: [plan.sections] }).then((result) => result[0]?.result).catch(() => void 0);
+    }
+    capturedtabs.push({ url, title: tab.title ?? "", index: tab.index ?? 0, scrollx: state?.scrollx ?? 0, scrolly: state?.scrolly ?? 0, forms: plan.sections.includes("forms") ? state?.forms ?? [] : [] });
+    if (state && taborigin && grants.includes(taborigin)) {
+      if (plan.sections.includes("storage") && state.storagekeys.length > 0) storage.push({ origin: taborigin, keys: state.storagekeys, values: state.storagevalues });
+      if (plan.sections.includes("cookies") && state.cookienames.length > 0) cookies.push({ origin: taborigin, names: state.cookienames });
+    }
+  }
+  const captures = plan.captures ? (await memory.getcaptures()).filter((record2) => record2.runid === runid).map((record2) => record2.id) : [];
+  return newsessionrecord({ id: randomid(), name: `session ${new Date(Date.now()).toISOString()}`, createdat: Date.now(), tabs: capturedtabs.sort((left, right) => left.index - right.index), captures, storage, cookies });
+}
+async function performrestore(record2, restore, session) {
+  const grants = session.grants ?? [session.origin];
+  const grantscheck = restoreoriginsgranted(record2.tabs.map((tab) => tab.url), grants);
+  const restored = [];
+  for (const tab of [...record2.tabs].sort((left, right) => left.index - right.index)) {
+    if (restore.tabpolicy !== "reopen") break;
+    let taborigin = "";
+    try {
+      taborigin = new URL(tab.url).origin;
+    } catch {
+      taborigin = "";
+    }
+    if (!taborigin || !grants.includes(taborigin)) continue;
+    const created = await chrome.tabs.create({ url: tab.url, index: tab.index, active: false }).catch(() => void 0);
+    if (!created?.id) continue;
+    await waittabloaded(created.id);
+    if (restore.formpolicy === "restore") {
+      await chrome.scripting.executeScript({ target: { tabId: created.id }, func: restorepagestate, args: [{ scrollx: tab.scrollx, scrolly: tab.scrolly, forms: tab.forms }] }).catch(() => {
+      });
+    }
+    restored.push(tab);
+  }
+  await memory.updatesessionrecord({ ...record2, restoredat: Date.now() });
+  return { restored, skippedorigins: grantscheck.skippedorigins };
+}
+async function executesessionstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const extra = { sessionid: session.id, planid: plan.id, stepid: step.id };
+  if (step.kind === "persiststate") {
+    const progress = await memory.getprogress();
+    const tracked = progress && progress.planid === plan.id ? progress : void 0;
+    const state = taskstateof({ runid: plan.id, stepcursor: tracked?.completedsteps.length ?? 0, outputs: tracked?.outcomes ?? [], checkpointat: Date.now() });
+    await memory.settaskstate(state);
+    await memory.addsessionevent({ id: randomid(), kind: "persist", at: Date.now(), tabid: tabid2, detail: `Checkpointed the run at step cursor ${state.stepcursor} of ${plan.steps.length}.` });
+    await memory.setprogress(recordsession(await memory.getprogress(), plan.id, step.id, { family: "persist", detail: "Checkpointed the task state of the run", cursor: state.stepcursor }, Date.now()));
+    await audit("session", `Persisted the task state checkpoint of run ${plan.id} at step cursor ${state.stepcursor} of ${plan.steps.length}; the checksum detects corruption before any resume and the run resumes from it after a service worker restart.`, extra);
+    return { ok: true, summary: `Task state checkpointed at step cursor ${state.stepcursor}.`, details: { session: { family: "persist", detail: "Task state checkpoint", cursor: state.stepcursor } } };
+  }
+  if (step.kind === "capturesession") {
+    const snapshot2 = snapshotplanof(options.snapshot);
+    if (!snapshot2) throw new Error("A reviewed snapshot plan is required before the session capture runs.");
+    const record2 = await capturesessionrecord(snapshot2, session, plan.id);
+    await memory.addsessionrecord(record2);
+    if (snapshot2.auto) {
+      const current = await memory.getautosnapshot();
+      await memory.setautosnapshot({ interval: snapshot2.auto, lastat: Date.now(), count: current?.count ?? 0 });
+    }
+    await memory.addsessionevent({ id: randomid(), kind: "capture", at: Date.now(), tabid: tabid2, detail: `Captured ${record2.tabs.length} tabs with the ${snapshot2.sections.join(", ")} sections into record ${record2.id}.` });
+    await memory.setprogress(recordsession(await memory.getprogress(), plan.id, step.id, { family: "capture", detail: `Captured the browsing session record ${record2.id}`, recordid: record2.id, sections: snapshot2.sections.length }, Date.now()));
+    await audit("session", `Captured the browsing session record ${record2.id} of ${record2.tabs.length} tab${record2.tabs.length === 1 ? "" : "s"} with the ${snapshot2.sections.join(", ")} sections${snapshot2.captures ? ` linking ${record2.captures.length} capture record${record2.captures.length === 1 ? "" : "s"}` : ""}${snapshot2.auto ? ` and the reviewed auto interval of ${snapshot2.auto.period} milliseconds with at most ${snapshot2.auto.maxsnapshots} snapshot${snapshot2.auto.maxsnapshots === 1 ? "" : "s"}` : ""}; the local storage and cookie names of ungranted origins stayed out of the capture.`, extra);
+    return { ok: true, summary: `Captured ${record2.tabs.length} tabs into the session record ${record2.id}.`, details: { snapshotid: record2.id, session: { family: "capture", detail: `Session record ${record2.id}`, recordid: record2.id, sections: snapshot2.sections.length } } };
+  }
+  if (step.kind === "restoresession") {
+    const restore = restoreplanof(options.restore);
+    if (!restore) throw new Error("A reviewed restore plan is required before the session restore runs.");
+    const record2 = await memory.getsessionrecord(String(options.sessionid ?? ""));
+    if (!record2) throw new Error(`No saved session matches ${String(options.sessionid ?? "")}.`);
+    if (record2.sectionsexpired) throw new Error("The saved session sections expired after the retention window; only the record metadata survives for review.");
+    const outcome = await performrestore(record2, restore, session);
+    await memory.addsessionevent({ id: randomid(), kind: "restore", at: Date.now(), tabid: tabid2, detail: `Restored ${outcome.restored.length} tabs of record ${record2.id}${outcome.skippedorigins.length > 0 ? ` and skipped ${outcome.skippedorigins.join(", ")}` : ""}.` });
+    await memory.setprogress(recordsession(await memory.getprogress(), plan.id, step.id, { family: "restore", detail: `Restored the session record ${record2.id}`, recordid: record2.id, sections: record2.tabs.length, restored: outcome.restored.length, skipped: outcome.skippedorigins.length }, Date.now()));
+    await audit("session", `Restored the saved session ${record2.id} on demand: ${outcome.restored.length} tab${outcome.restored.length === 1 ? "" : "s"} reopened in their recorded order with the ${restore.formpolicy} form policy and the ${restore.capturepolicy} capture policy${outcome.skippedorigins.length > 0 ? ` while ${outcome.skippedorigins.join(", ")} stayed skipped because their grants expired` : ""}.`, extra);
+    return { ok: true, summary: `Restored ${outcome.restored.length} of ${record2.tabs.length} tabs${outcome.skippedorigins.length > 0 ? `; skipped ${outcome.skippedorigins.join(", ")} outside the grants` : ""}.`, details: { restoreid: record2.id, skippedorigins: outcome.skippedorigins, session: { family: "restore", detail: `Session restore of ${record2.id}`, recordid: record2.id, sections: record2.tabs.length, restored: outcome.restored.length, skipped: outcome.skippedorigins.length } } };
+  }
+  if (step.kind === "namedsessions") {
+    const record2 = await memory.getsessionrecord(String(options.sessionid ?? ""));
+    if (!record2) throw new Error(`No saved session matches ${String(options.sessionid ?? "")}.`);
+    const name = String(options.name ?? "");
+    const records = await memory.getsessionrecords();
+    const unique = sessionnameunique(name, records, record2.id);
+    if (!unique.allowed) throw new Error(unique.reason);
+    const folder = typeof options.folder === "string" && options.folder.trim() ? options.folder : record2.folder;
+    const tags = Array.isArray(options.tags) ? options.tags.filter((tag) => typeof tag === "string" && tag.trim()) : record2.tags;
+    await memory.updatesessionrecord({ ...record2, name, ...folder !== void 0 ? { folder } : {}, tags });
+    if (folder !== void 0) {
+      const folders = await memory.getsessionfolders();
+      if (sessionfolderunique(folder, folders).allowed) await memory.setsessionfolders([...folders, ...sessionfolderof({ name: folder, tags }) !== void 0 ? [sessionfolderof({ name: folder, tags })] : []]);
+    }
+    await memory.addsessionevent({ id: randomid(), kind: "name", at: Date.now(), tabid: tabid2, detail: `Filed the session record ${record2.id} as ${name}${folder !== void 0 ? ` under ${folder}` : ""}.` });
+    await memory.setprogress(recordsession(await memory.getprogress(), plan.id, step.id, { family: "name", detail: `Filed the session record ${record2.id} as ${name}`, recordid: record2.id }, Date.now()));
+    await audit("session", `Filed the saved session ${record2.id} under the reviewed name ${name}${folder !== void 0 ? ` inside the ${folder} folder` : ""}${tags.length > 0 ? ` with the tags ${tags.join(", ")}` : ""}; the filing stays read only organization.`, extra);
+    return { ok: true, summary: `Filed the session record ${record2.id} as ${name}.`, details: { session: { family: "name", detail: `Session filed as ${name}`, recordid: record2.id } } };
+  }
+  if (step.kind === "diffsessions") {
+    const left = await memory.getsessionrecord(String(options.left ?? ""));
+    const right = await memory.getsessionrecord(String(options.right ?? ""));
+    if (!left || !right) throw new Error("The session diff needs both saved sessions in the library.");
+    const diff = newsessiondiff({ id: randomid(), left, right, at: Date.now() });
+    await memory.addsessiondiff(diff);
+    await memory.addsessionevent({ id: randomid(), kind: "diff", at: Date.now(), tabid: tabid2, detail: `Diffed ${left.id} and ${right.id} with ${diff.changes.length} changes.` });
+    await memory.setprogress(recordsession(await memory.getprogress(), plan.id, step.id, { family: "diff", detail: `Diffed the sessions ${left.id} and ${right.id}`, recordid: diff.id, sections: diff.changes.length }, Date.now()));
+    await audit("session", `Compared the saved sessions ${left.id} and ${right.id}: ${diff.changes.length} tab, url, form and storage change${diff.changes.length === 1 ? "" : "s"} classified as read only comparison evidence.`, extra);
+    return { ok: true, summary: `Diffed the sessions: ${diff.changes.length} change${diff.changes.length === 1 ? "" : "s"}.`, details: { diffid: diff.id, changes: diff.changes, session: { family: "diff", detail: `Session diff ${diff.id}`, recordid: diff.id, sections: diff.changes.length } } };
+  }
+  if (step.kind === "searchsessions") {
+    const query = searchqueryof(options.query);
+    if (!query) throw new Error("A reviewed search query is required before the session search runs.");
+    const matches = await memory.searchmemory(query);
+    await memory.addsessionevent({ id: randomid(), kind: "search", at: Date.now(), tabid: tabid2, detail: `Searched ${query.terms.join(", ")} across the saved sessions with ${matches.length} matches.` });
+    await memory.setprogress(recordsession(await memory.getprogress(), plan.id, step.id, { family: "search", detail: `Searched ${query.terms.join(", ")} across the saved sessions`, matches: matches.length }, Date.now()));
+    await audit("session", `Searched the terms ${query.terms.join(", ")} across the saved sessions on the ${query.fields.join(", ")} fields${query.from !== void 0 || query.to !== void 0 ? ` inside the reviewed time window` : ""}: ${matches.length} match${matches.length === 1 ? "" : "es"} returned with their session ids.`, extra);
+    return { ok: true, summary: `Found ${matches.length} match${matches.length === 1 ? "" : "es"} across the saved sessions.`, details: { matches, matchcount: matches.length, session: { family: "search", detail: `Session search of ${query.terms.join(", ")}`, matches: matches.length } } };
+  }
+  if (step.kind === "exportsessions") {
+    if (options.reviewed !== true) throw new Error("Session exports need the explicit export review before any session file leaves the device.");
+    const records = await memory.getsessionrecords();
+    const selected = Array.isArray(options.ids) && options.ids.length > 0 ? records.filter((record2) => options.ids.includes(record2.id)) : records;
+    if (selected.length === 0) throw new Error("No saved session matches the reviewed export ids.");
+    const file = exportsessionfile(selected, Date.now());
+    const payload = JSON.stringify(file);
+    await chrome.downloads.download({ url: `data:application/json;charset=utf-8,${encodeURIComponent(payload)}`, filename: `devthink-sessions-${Date.now()}.json` }).catch(() => {
+      throw new Error("The session file download was refused by the browser.");
+    });
+    await memory.addsessionevent({ id: randomid(), kind: "export", at: Date.now(), tabid: tabid2, detail: `Exported ${file.records.length} session records as a ${file.bytesize} byte file.` });
+    await memory.setprogress(recordsession(await memory.getprogress(), plan.id, step.id, { family: "export", detail: `Exported ${file.records.length} session records`, bytes: file.bytesize }, Date.now()));
+    await audit("export", `Exported ${file.records.length} saved session record${file.records.length === 1 ? "" : "s"} as one ${file.bytesize} byte session file of format version ${file.formatversion} with its checksum, through the reviewed download flow.`, extra);
+    return { ok: true, summary: `Exported ${file.records.length} session record${file.records.length === 1 ? "" : "s"} as a ${file.bytesize} byte file.`, details: { session: { family: "export", detail: `Session export of ${file.records.length} records`, bytes: file.bytesize } } };
+  }
+  if (step.kind === "importsessions") {
+    if (options.reviewed !== true) throw new Error("Session imports need the explicit full record review before any record joins the library.");
+    const file = importsessionfile(options.file);
+    if (!file) throw new Error(`The reviewed session file failed its format version or checksum validation; only format version ${sessionfileversion} imports.`);
+    const records = await memory.getsessionrecords();
+    let added = 0;
+    for (const record2 of file.records) {
+      if (records.some((existing) => existing.id === record2.id)) continue;
+      const unique = sessionnameunique(record2.name, [...records, ...file.records.filter((candidate) => candidate.id !== record2.id).map((candidate) => ({ id: candidate.id, name: candidate.name }))]);
+      const name = unique.allowed ? record2.name : `${record2.name} (${record2.id.slice(0, 6)})`;
+      await memory.addsessionrecord({ ...record2, name });
+      added += 1;
+    }
+    await memory.addsessionevent({ id: randomid(), kind: "import", at: Date.now(), tabid: tabid2, detail: `Imported ${added} session records from a reviewed file of format version ${file.formatversion}.` });
+    await memory.setprogress(recordsession(await memory.getprogress(), plan.id, step.id, { family: "import", detail: `Imported ${added} session records`, sections: added }, Date.now()));
+    await audit("session", `Imported ${added} of ${file.records.length} reviewed session record${file.records.length === 1 ? "" : "s"} from a session file of format version ${file.formatversion}; every record was listed in the full record review before it joined the library.`, extra);
+    return { ok: true, summary: `Imported ${added} session record${added === 1 ? "" : "s"} after review.`, details: { session: { family: "import", detail: `Session import of ${added} records`, sections: added } } };
+  }
+  throw new Error(`The ${step.kind} step has no session memory executor.`);
+}
+var activeworkflowruns = /* @__PURE__ */ new Map();
+function runscopes(variables) {
+  const root = { name: "root", variables: [] };
+  if (!variables || typeof variables !== "object" || Array.isArray(variables)) return [root];
+  for (const [name, value] of Object.entries(variables)) {
+    if (typeof value === "number") root.variables.push({ name, kind: "number", value, setat: Date.now() });
+    else if (typeof value === "boolean") root.variables.push({ name, kind: "boolean", value, setat: Date.now() });
+    else if (typeof value === "string") root.variables.push({ name, kind: "string", value, setat: Date.now() });
+  }
+  return [root];
+}
+async function dispatchworkflowstep(step, context) {
+  const settings = await memory.getsettings();
+  const verdicts = await memory.getsafeties();
+  const action = {
+    id: step.id,
+    kind: step.kind,
+    summary: step.label,
+    risk: actionrisk(step.kind),
+    ...step.target !== void 0 ? { target: step.target } : {},
+    ...step.value !== void 0 ? { value: step.value } : {},
+    ...step.options !== void 0 ? { options: step.options } : {}
+  };
+  const gate = canexecute({ session: context.session, plan: context.plan, step: action, tabid: context.tabid, origin: context.origin, ...verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
+  if (!gate.allowed) return { ok: false, summary: `The workflow step ${step.label} was refused: ${gate.reason}` };
+  if (step.kind === "delay") return await executedelaystep(step);
+  if (step.kind === "waitelement") return await executewaitelement(step, context.tabid);
+  if (step.kind === "compute") return await executecomputestep(step, context.session);
+  if (step.kind === "extractvars") return await executeextractvarsstep(step, context.session);
+  const output = await executeaction(action, context.session, context.plan, context.tabid, context.origin, settings, verdicts.length > 0 ? verdicts : void 0, "run");
+  return { ok: Boolean(output.ok), summary: output.summary, ...output.details !== void 0 ? { details: output.details } : {} };
+}
+async function executedelaystep(step) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.options !== void 0 ? { options: step.options } : {} });
+  const delay = delayof(options.delay);
+  const sampled = delayjitter(delay, hashseed(`${step.id}:${Date.now()}`));
+  const transport = await sleepreviewed(sampled, step.id);
+  return { ok: true, summary: `Slept ${Math.round(sampled)} milliseconds inside the reviewed window of base ${delay.base} and jitter ${delay.jitter}${transport === "alarm" ? " through the alarms api" : ""}.`, details: { sampled: Math.round(sampled), base: delay.base, jitter: delay.jitter, transport } };
+}
+function delayof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("The delay needs a reviewed base and jitter window.");
+  const candidate = value;
+  if (typeof candidate.base !== "number" || !Number.isFinite(candidate.base) || candidate.base < 0) throw new Error("The reviewed delay base must be zero or a positive number of milliseconds.");
+  if (typeof candidate.jitter !== "number" || !Number.isFinite(candidate.jitter) || candidate.jitter < 0) throw new Error("The reviewed delay jitter window must be zero or a positive number of milliseconds.");
+  return { base: candidate.base, jitter: candidate.jitter };
+}
+function hashseed(text2) {
+  let hash = 2166136261;
+  for (let index = 0; index < text2.length; index += 1) {
+    hash ^= text2.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash >>> 0;
+}
+async function sleepreviewed(sampled, stepid) {
+  const alarmname = `devthinkdelay${stepid}`;
+  if (sampled > 3e4 && typeof chrome.alarms?.create === "function" && typeof chrome.alarms.onAlarm?.addListener === "function") {
+    try {
+      await new Promise((resolve) => {
+        const fallback = setTimeout(() => {
+          chrome.alarms.onAlarm.removeListener(listener);
+          resolve();
+        }, sampled + 5e3);
+        const listener = (alarm) => {
+          if (alarm.name !== alarmname) return;
+          clearTimeout(fallback);
+          chrome.alarms.onAlarm.removeListener(listener);
+          resolve();
+        };
+        chrome.alarms.onAlarm.addListener(listener);
+        void chrome.alarms.create(alarmname, { when: Date.now() + sampled });
+      });
+      return "alarm";
+    } catch {
+    }
+  }
+  await waitsome(sampled);
+  return "timer";
+}
+async function executewaitelement(step, tabid2) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.target !== void 0 ? { target: step.target } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  const wait = waitof(options.wait, step.target);
+  const startedat = Date.now();
+  const starttab = await chrome.tabs.get(tabid2).catch(() => void 0);
+  const starturl = starttab?.url ?? "";
+  const plan = waitelementplan(wait);
+  const singlepass = plan.probes === 1;
+  const deadline = startedat + wait.timeout;
+  for (let pass = 0; pass < plan.probes; pass += 1) {
+    const tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+    if (!tab || starturl !== "" && (tab.url ?? "") !== starturl) return { ok: false, summary: `The tab navigated away and the element wait for ${wait.selector} aborted cleanly after ${Date.now() - startedat} milliseconds.` };
+    const probe = await bridgecall(tabid2, "elementrect", wait.selector).catch(() => void 0);
+    if (probe?.ok) return { ok: true, summary: `Selector ${wait.selector} appeared after ${Date.now() - startedat} milliseconds of polling every ${wait.poll} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat, poll: wait.poll } };
+    if (singlepass || Date.now() >= deadline) break;
+    await waitsome(pass + 1 < plan.probes ? wait.poll : plan.lastwait);
+  }
+  return { ok: false, summary: `Selector ${wait.selector} did not appear within the reviewed timeout of ${wait.timeout} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat } };
+}
+function waitof(value, target) {
+  const candidate = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const selector = typeof candidate.selector === "string" && candidate.selector.trim() ? candidate.selector : target;
+  if (!selector || !selector.trim()) throw new Error("The element wait needs a reviewed non-empty selector.");
+  const timeout = typeof candidate.timeout === "number" && Number.isFinite(candidate.timeout) && candidate.timeout >= 0 ? candidate.timeout : -1;
+  const poll = typeof candidate.poll === "number" && Number.isFinite(candidate.poll) && candidate.poll >= 0 ? candidate.poll : -1;
+  if (timeout < 0 || poll < 0) throw new Error("The element wait needs a reviewed timeout and poll interval of zero or more milliseconds.");
+  return { selector, timeout, poll };
+}
+async function executecomputestep(step, session) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.options !== void 0 ? { options: step.options } : {} });
+  const expression = options.expression;
+  if (!expression || typeof expression !== "object") throw new Error("The compute step needs a reviewed expression.");
+  const scopes = runscopes(options.variables);
+  const value = expressioneval(expression, scopes);
+  await audit("workflow", `Evaluated the reviewed expression into ${expression.result} with the value ${typeof value === "string" ? `"${value}"` : String(value)}.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Computed ${expression.result} = ${typeof value === "string" ? `"${value}"` : String(value)} through the ${expression.operator} operator.`, details: { result: expression.result, kind: expression.resultkind, value } };
+}
+async function executeextractvarsstep(step, session) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  const rule = options.rule;
+  if (!rule || typeof rule !== "object" || typeof rule.pattern !== "string") throw new Error("The variable extraction needs a reviewed regex rule.");
+  const text2 = typeof options.text === "string" ? options.text : step.value ?? "";
+  const extraction = regexextract(rule, text2, Date.now());
+  if (!extraction.matched) {
+    await audit("workflow", `The reviewed regex rule of the ${step.id} step matched nothing; no variable was stored.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+    return { ok: true, summary: "The reviewed regex rule matched nothing; no variable was stored.", details: { matched: false, groups: rule.groups } };
+  }
+  await audit("workflow", `The reviewed regex rule captured ${extraction.variables.map((variable) => variable.name).join(", ")} as variables.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Captured ${extraction.variables.length} variable${extraction.variables.length === 1 ? "" : "s"} from the reviewed text.`, details: { matched: true, variables: extraction.variables } };
+}
+async function executeworkflowstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  if (step.kind === "composeworkflow") {
+    const payload = options.workflow;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("The workflow composition needs the reviewed workflow payload.");
+    const candidate = payload;
+    const record2 = composeworkflow({
+      ...typeof candidate.id === "string" && candidate.id.trim() ? { id: candidate.id } : {},
+      name: String(candidate.name ?? ""),
+      version: Number(candidate.version ?? 0),
+      origins: Array.isArray(candidate.origins) ? candidate.origins.filter((entry) => typeof entry === "string") : [],
+      steps: (Array.isArray(candidate.steps) ? candidate.steps : []).flatMap((entry) => {
+        const parsed = workflowstepofentry(entry);
+        return parsed !== void 0 ? [parsed] : [];
+      }),
+      blocks: (Array.isArray(candidate.blocks) ? candidate.blocks : []).flatMap((block) => {
+        const parsed = workflowblockof(block);
+        return parsed !== void 0 ? [parsed] : [];
+      }),
+      now: Date.now(),
+      kindallowed: (kind) => {
+        try {
+          actionrisk(kind);
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      riskof: (kind) => actionrisk(kind)
+    });
+    await memory.addworkflowrecord(record2);
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "compose", detail: `Composed the workflow ${record2.name} version ${record2.version}`, total: record2.steps.length }, Date.now()));
+    await audit("workflow", `Composed the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"} graded ${record2.risk} for review; blocks expanded so no step stayed hidden.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    return { ok: true, summary: `Composed the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} expanded steps graded ${record2.risk}.`, details: { workflow: { recordid: record2.id, steps: record2.steps.length, risk: record2.risk } } };
+  }
+  if (step.kind === "savetemplate") {
+    const template = steptemplateof({ ...options.template ?? {}, id: randomid(), origin, sharedat: Date.now() });
+    if (!template) throw new Error("The step template needs a reviewed name and a valid workflow step.");
+    await memory.addsteptemplate(template);
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "template", detail: `Shared the step template ${template.name}` }, Date.now()));
+    await audit("workflow", `Shared the step template ${template.name} of the ${template.step.kind} kind for reuse across workflows.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    return { ok: true, summary: `Shared the step template ${template.name}.`, details: { workflow: { recordid: template.name, steps: 1 } } };
+  }
+  if (step.kind === "runworkflow") return await executeworkflowrun(step, session, plan, tabid2, origin, false);
+  if (step.kind === "dryrun") return await executeworkflowrun(step, session, plan, tabid2, origin, true);
+  if (step.kind === "delay") return await executedelaystep({ id: step.id, kind: "delay", label: step.summary });
+  if (step.kind === "waitelement") return await executewaitelement({ id: step.id, kind: "waitelement", label: step.summary, ...step.target !== void 0 ? { target: step.target } : {}, ...step.options !== void 0 ? { options: step.options } : {} }, tabid2);
+  if (step.kind === "compute") return await executecomputestep({ id: step.id, kind: "compute", label: step.summary, ...step.options !== void 0 ? { options: step.options } : {} }, session);
+  if (step.kind === "extractvars") return await executeextractvarsstep({ id: step.id, kind: "extractvars", label: step.summary, ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} }, session);
+  throw new Error(`The ${step.kind} step has no workflow executor.`);
+}
+function workflowstepofentry(value) {
+  const parsed = workflowstepof(value);
+  if (parsed) return parsed;
+  return blockinvocationof(value);
+}
+async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
+  const options = stepoptions2(step);
+  const workflowid = typeof options.workflowid === "string" ? options.workflowid : "";
+  const record2 = await memory.getworkflowrecord(workflowid);
+  if (!record2) throw new Error(`No composed workflow matches ${workflowid || "the reviewed id"}.`);
+  for (const workfloworigin of record2.origins) {
+    if (!origingranted(session, workfloworigin)) throw new Error(`The workflow origin ${workfloworigin} falls outside the session grants.`);
+  }
+  const run = newworkflowrun({ workflowid: record2.id, dryrun: dry, now: Date.now() });
+  await memory.setworkflowrun(run);
+  await memory.setrunscopes(run.id, runscopes(options.variables));
+  if (dry) {
+    const evaluated = dryrunworkflow({ record: record2, run, now: Date.now(), projection: dryrunprojection });
+    for (const entry of evaluated.log) await memory.addrunlogentry(run.id, entry);
+    await memory.setworkflowrun(evaluated.run);
+    const refused = evaluated.log.filter((entry) => entry.state === "refused").length;
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "dryrun", detail: `Dry ran the workflow ${record2.name}`, runid: run.id, executed: evaluated.log.length - refused, refused, total: record2.steps.length }, Date.now()));
+    await audit("workflow", `The dry run of the workflow ${record2.name} evaluated ${evaluated.log.length} step${evaluated.log.length === 1 ? "" : "s"} read only; ${refused} step${refused === 1 ? "" : "s"} refused for lacking a read only projection and nothing was mutated.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    return { ok: true, summary: `The dry run evaluated ${evaluated.log.length} steps read only; ${refused} refused for lacking a read only projection.`, details: { runid: run.id, state: evaluated.run.state, dryrun: true, executed: evaluated.log.length - refused, refused, total: record2.steps.length } };
+  }
+  const guards = { cancelled: false };
+  activeworkflowruns.set(run.id, guards);
+  await audit("workflow", `Started the run ${run.id} of the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} reviewed steps; every step passes the session, plan review and origin gates.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+  const context = { session, plan, tabid: tabid2, origin };
+  const execute = async (workflowstep) => {
+    if (guards.cancelled) return { ok: false, summary: `The run was cancelled before the ${workflowstep.label} step dispatched.` };
+    return await dispatchworkflowstep(workflowstep, context);
+  };
+  let result;
+  try {
+    result = await runworkflow({
+      record: record2,
+      run,
+      scopes: runscopes(options.variables),
+      execute,
+      now: Date.now(),
+      gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) },
+      oncheckpoint: async (state) => {
+        await memory.setworkflowrun(state.run);
+        const last = state.log[state.log.length - 1];
+        if (last) await memory.addrunlogentry(state.run.id, last);
+        await memory.setrunscopes(state.run.id, state.scopes);
+        for (const scope of state.scopes) for (const variable of scope.variables) await memory.addworkflowprovenance(state.run.id, { runid: state.run.id, kind: "binding", name: variable.name, value: variable.value, at: variable.setat });
+        await refreshbadge();
+      }
+    });
+  } finally {
+    activeworkflowruns.delete(run.id);
+  }
+  await memory.setworkflowrun(result.run);
+  for (const entry of result.log) {
+    const stored = await memory.getrunlog(run.id);
+    if (!stored.some((candidate) => candidate.stepid === entry.stepid && candidate.startedat === entry.startedat)) await memory.addrunlogentry(run.id, entry);
+  }
+  await memory.setrunscopes(run.id, result.scopes);
+  const executed = result.run.cursor;
+  await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "run", detail: `Ran the workflow ${record2.name}`, runid: run.id, executed, total: record2.steps.length }, Date.now()));
+  await audit("workflow", `The run ${run.id} of the workflow ${record2.name} ended ${result.run.state} after ${executed} of ${record2.steps.length} steps${result.run.failreason !== void 0 ? ` with the failure ${result.run.failreason}` : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+  await refreshbadge();
+  return { ok: result.run.state === "done", summary: `The workflow run ended ${result.run.state} after ${executed} of ${record2.steps.length} steps.`, details: { runid: run.id, state: result.run.state, executed, total: record2.steps.length, ...result.run.failreason !== void 0 ? { failreason: result.run.failreason } : {} } };
+}
 async function executestep(stepid) {
   const session = await memory.getsession();
   const plan = await memory.getplan();
@@ -11826,7 +13520,10 @@ async function executestep(stepid) {
   if (!step) throw new Error("Reviewed step was not found.");
   const settings = await memory.getsettings();
   const verdicts = await memory.getsafeties();
-  const gate = canexecute({ session, plan, step, tabid: tab.id, origin, ...verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
+  return executeaction(step, session, plan, tab.id, origin, settings, verdicts.length > 0 ? verdicts : void 0, "plan");
+}
+async function executeaction(step, session, plan, tabid2, origin, settings, verdicts, mode) {
+  const gate = canexecute({ session, plan, step, tabid: tabid2, origin, ...verdicts !== void 0 && verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
   if (!gate.allowed) throw new Error(gate.reason);
   const capability = requiredcapability(step.kind);
   if (capability) {
@@ -11840,76 +13537,82 @@ async function executestep(stepid) {
       await enforcewindowreview(step, session, plan);
     }
     if (istabscommandkind(step.kind)) {
-      output = await executetabscommand(step, session, plan, tab.id);
+      output = await executetabscommand(step, session, plan, tabid2);
     } else if (isdatasetkind(step.kind)) {
-      output = await executedatastep(step, session, plan, tab.id, origin);
+      output = await executedatastep(step, session, plan, tabid2, origin);
     } else if (isfileskind(step.kind)) {
-      output = await executefilesstep(step, session, plan, tab.id, origin);
+      output = await executefilesstep(step, session, plan, tabid2, origin);
     } else if (isformkind(step.kind)) {
-      output = await executeformstep(step, session, plan, tab.id, origin);
+      output = await executeformstep(step, session, plan, tabid2, origin);
     } else if (isbrowserkind(step.kind)) {
-      output = await runbrowseraction(step, tab.id, tab.windowId ?? chrome.windows.WINDOW_ID_CURRENT);
+      output = await runbrowseraction(step, tabid2, chrome.windows.WINDOW_ID_CURRENT);
     } else if (step.kind === "keyhold") {
-      output = await executekeyhold(step, session, plan, tab.id, origin);
+      output = await executekeyhold(step, session, plan, tabid2, origin);
     } else if (step.kind === "keyrelease") {
-      output = await executekeyrelease(step, session, plan, tab.id, origin);
+      output = await executekeyrelease(step, session, plan, tabid2, origin);
     } else if (step.kind === "dismissdialog") {
-      output = await executedismissdialog(step, session, plan, tab.id, origin);
+      output = await executedismissdialog(step, session, plan, tabid2, origin);
     } else if (step.kind === "retryaction") {
-      output = await executeretryaction(step, session, plan, tab.id, origin);
+      output = await executeretryaction(step, session, plan, tabid2, origin);
     } else if (step.kind === "mapclicks") {
-      output = await executemapclicks(step, plan, tab.id, origin);
+      output = await executemapclicks(step, plan, tabid2, origin);
     } else if (step.kind === "enterframe") {
-      output = await executeenterframe(step, plan, tab.id, origin);
+      output = await executeenterframe(step, plan, tabid2, origin);
     } else if (watchstepkinds.has(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Watch kinds refuse to run outside an approved session plan.");
-      const watched = await executewatchstep(step, session, plan, tab.id, origin);
+      const watched = await executewatchstep(step, session, plan, tabid2, origin);
       output = watched.output;
       watchwindow = { startedat: watched.watch.startedat, lifetime: watched.watch.lifetime };
     } else if (step.kind === "diffsnapshots") {
-      output = await executediffsnapshots(step, session, plan, tab.id, origin);
+      output = await executediffsnapshots(step, session, plan, tabid2, origin);
     } else if (navigationstepkinds.has(step.kind)) {
-      output = await executenavigationkind(step, session, plan, tab.id, origin);
+      output = await executenavigationkind(step, session, plan, tabid2, origin);
     } else if (iscapturekind(step.kind)) {
-      output = await executecapturestep(step, session, plan, tab.id, origin);
+      output = await executecapturestep(step, session, plan, tabid2, origin);
     } else if (ismediakind(step.kind)) {
-      output = await executemediastep(step, session, plan, tab.id, origin);
+      output = await executemediastep(step, session, plan, tabid2, origin);
     } else if (ishttpkind(step.kind)) {
-      output = await executehttpstep(step, session, plan, tab.id, origin);
+      output = await executehttpstep(step, session, plan, tabid2, origin);
     } else if (issocketkind(step.kind)) {
-      output = await executesocketstep(step, session, plan, tab.id, origin);
+      output = await executesocketstep(step, session, plan, tabid2, origin);
     } else if (isnetwatchkind(step.kind)) {
-      output = await executenetwatchstep(step, session, plan, tab.id, origin);
+      output = await executenetwatchstep(step, session, plan, tabid2, origin);
     } else if (iscontrolkind(step.kind)) {
-      output = await executenetcontrolstep(step, session, plan, tab.id, origin);
+      output = await executenetcontrolstep(step, session, plan, tabid2, origin);
     } else if (isdebugkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Debugging kinds refuse to run outside an approved session plan.");
-      output = await executetimelinestep(step, session, plan, tab.id, origin);
+      output = await executetimelinestep(step, session, plan, tabid2, origin);
     } else if (iscdpkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Devtools protocol kinds refuse to run outside an approved session plan.");
-      output = await executecdpstep(step, session, plan, tab.id, origin);
+      output = await executecdpstep(step, session, plan, tabid2, origin);
     } else if (isprofilekind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Profiling kinds refuse to run outside an approved session plan.");
-      output = await executeprofilestep(step, session, plan, tab.id, origin);
+      output = await executeprofilestep(step, session, plan, tabid2, origin);
     } else if (isemulationkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Emulation kinds refuse to run outside an approved session plan.");
-      output = await executeemulationstep(step, session, plan, tab.id, origin);
+      output = await executeemulationstep(step, session, plan, tabid2, origin);
+    } else if (issessionkind(step.kind)) {
+      if (!session || !plan || plan.state !== "approved") throw new Error("Session memory kinds refuse to run outside an approved session plan.");
+      output = await executesessionstep(step, session, plan, tabid2, origin);
+    } else if (isworkflowkind(step.kind)) {
+      if (!session || !plan || plan.state !== "approved") throw new Error("Workflow kinds refuse to run outside an approved session plan.");
+      output = await executeworkflowstep(step, session, plan, tabid2, origin);
     } else {
       if (step.target && freshcheckkinds.has(step.kind)) {
-        const fresh = await snapshot(tab.id);
+        const fresh = await snapshot(tabid2);
         if (!fresh.interactive.some((item) => item.selector === step.target)) throw new Error("The page changed and the target must be reviewed again.");
       }
-      output = await dispatchpagestep(step, tab.id, origin, plan);
+      output = await dispatchpagestep(step, tabid2, origin, plan);
     }
     return output;
   };
   const runplan = plan;
   const capturepolicystate = await runcapturepolicy();
   if (capturepolicystate === "beforeafter" && session && step.risk !== "read" && beforeafterwrapallowed(step.kind)) {
-    const before = await grabstateshot(step, session, runplan, tab.id, "before");
+    const before = await grabstateshot(step, session, runplan, tabid2, "before");
     output = await dispatchreviewedstep();
     if (output?.ok) {
-      const after = await grabstateshot(step, session, runplan, tab.id, "after");
+      const after = await grabstateshot(step, session, runplan, tabid2, "after");
       const domversion = await memory.getobservationversion();
       const paired = capturestates({ policy: "beforeafter", before, after, actionkind: step.kind, ...step.target ? { target: step.target } : {}, ...domversion !== void 0 ? { domsnapshotid: String(domversion) } : {}, at: Date.now(), id: randomid() });
       if (paired.pair) {
@@ -11921,7 +13624,7 @@ async function executestep(stepid) {
   } else {
     output = await dispatchreviewedstep();
   }
-  if (["navigate", "back", "forward"].includes(step.kind)) await recordnavigation(step, session, tab.id);
+  if (["navigate", "back", "forward"].includes(step.kind)) await recordnavigation(step, session, tabid2);
   await recordevidence(step, output, session, plan, origin);
   if (output?.ok && plan && typeof output.details?.tabid === "number") {
     await memory.setprogress(assigntasktab(await memory.getprogress(), plan.id, output.details.tabid, Date.now()));
@@ -11929,19 +13632,20 @@ async function executestep(stepid) {
   const summary = output?.summary ?? "The page action returned no result.";
   const resolved = output?.details?.resolvedtarget;
   if (resolved) {
-    await memory.addresolution({ stepid, mode: resolved.mode, selector: resolved.selector, label: resolved.label, at: Date.now() });
+    await memory.addresolution({ stepid: step.id, mode: resolved.mode, selector: resolved.selector, label: resolved.label, at: Date.now() });
   }
-  const outcome = { stepid, ok: Boolean(output?.ok), summary, ...output?.details ? { details: output.details } : {}, at: Date.now() };
+  const outcome = { stepid: step.id, ok: Boolean(output?.ok), summary, ...output?.details ? { details: output.details } : {}, at: Date.now() };
   const auditkind = stepauditkind(step, Boolean(output?.ok));
-  await audit(auditkind, summary, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid });
+  await audit(auditkind, summary, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid: step.id });
   await memory.addoutcome(outcome);
-  if (output?.ok && plan) {
+  if (output?.ok && plan && mode === "plan") {
     const base = await memory.getprogress();
-    const completed = watchwindow ? recordwatchcompletion(base, plan.id, stepid, watchwindow.startedat, watchwindow.lifetime, Date.now()) : recordstep(base, plan.id, stepid, Date.now());
+    const completed = watchwindow ? recordwatchcompletion(base, plan.id, step.id, watchwindow.startedat, watchwindow.lifetime, Date.now()) : recordstep(base, plan.id, step.id, Date.now());
     const tracked = recordoutcome(completed, plan.id, outcome, Date.now());
     await memory.setprogress(tracked);
+    await memory.settaskstate(taskstateof({ runid: plan.id, stepcursor: tracked.completedsteps.length, outputs: tracked.outcomes ?? [], checkpointat: Date.now() }));
     const tracker = activememorytrackers.get(plan.id);
-    if (tracker) await sampleheapforstep(tracker, stepid, tab.id, origin, plan).catch(() => {
+    if (tracker) await sampleheapforstep(tracker, step.id, tabid2, origin, plan).catch(() => {
     });
     await updatetaskbadges(plan, tracked);
     await refreshbadge();
@@ -12133,10 +13837,15 @@ async function handlerequest(message, sender) {
       const clones = clonetabs(tabs);
       const taskgauge = tasktabgauge(tabs.filter((tab) => badges.some((badge) => badge.tabid === tab.tabid)).length, tasktabceiling(await memory.getsettings()));
       const report = await buildtabreport(tabs);
+      const autosnapshot = await memory.getautosnapshot();
+      const crashed = await memory.getcrashflag();
+      const sessionrecords = await memory.applysessionexpiry(snapshotretentionwindow(runsettings), Date.now());
+      const newestworkflowrun = (await memory.listworkflowruns())[0];
+      const taskstate = plan ? await memory.gettaskstate(plan.id) : void 0;
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -12182,7 +13891,8 @@ async function handlerequest(message, sender) {
       const media = outcome.details?.media;
       const network = outcome.details?.network;
       const timeline = outcome.details?.timeline;
-      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...capture ? { capture } : {}, ...media ? { media } : {}, ...network ? { network } : {}, ...timeline ? { timeline } : {} }));
+      const sessionblock = outcome.details?.session;
+      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...capture ? { capture } : {}, ...media ? { media } : {}, ...network ? { network } : {}, ...timeline ? { timeline } : {}, ...sessionblock !== void 0 ? { session: { recordid: sessionblock.recordid ?? "", sections: sessionblock.sections ?? 0, ...sessionblock.matches !== void 0 ? { matches: sessionblock.matches } : {}, ...sessionblock.restored !== void 0 ? { restored: sessionblock.restored } : {}, ...sessionblock.skipped !== void 0 ? { skipped: sessionblock.skipped } : {}, ...sessionblock.cursor !== void 0 ? { cursor: sessionblock.cursor } : {}, ...sessionblock.bytes !== void 0 ? { bytes: sessionblock.bytes } : {} } } : {} }));
     }
     case "map": {
       const plan = await memory.getplan();
@@ -13195,6 +14905,204 @@ async function handlerequest(message, sender) {
       await audit("stop", "The user stopped the browser session.", { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {} });
       return { stopped: true };
     }
+    case "sessionreview": {
+      const inputreview = message;
+      const record2 = await memory.getsessionrecord(inputreview.sessionid?.trim() ?? "");
+      if (!record2) throw new Error(`No saved session matches ${inputreview.sessionid ?? ""}.`);
+      return { record: record2, tabs: record2.tabs.map((tab) => ({ url: tab.url, title: tab.title, index: tab.index, forms: tab.forms.length })), captures: record2.captures, storage: record2.storage.map((entry) => ({ origin: entry.origin, keys: entry.keys.length })), cookies: record2.cookies };
+    }
+    case "approverestore": {
+      const inputrestore = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("The crash restore needs an active browser session before it reopens anything.");
+      const record2 = await memory.getsessionrecord(inputrestore.sessionid?.trim() ?? "");
+      if (!record2) throw new Error(`No saved session matches ${inputrestore.sessionid ?? ""}.`);
+      if (record2.sectionsexpired) throw new Error("The saved session sections expired after the retention window; only the record metadata survives for review.");
+      const restore = { tabpolicy: "reopen", formpolicy: "restore", capturepolicy: "link" };
+      const outcome = await performrestore(record2, restore, session);
+      await memory.addsessionevent({ id: randomid(), kind: "restore", at: Date.now(), tabid: session.tabid, detail: `Crash restore reopened ${outcome.restored.length} tabs of record ${record2.id}${outcome.skippedorigins.length > 0 ? ` and skipped ${outcome.skippedorigins.join(", ")}` : ""}.` });
+      await audit("session", `The user approved the crash restore of the saved session ${record2.id}: ${outcome.restored.length} tab${outcome.restored.length === 1 ? "" : "s"} reopened in their recorded order with the scroll and form state restored${outcome.skippedorigins.length > 0 ? ` while ${outcome.skippedorigins.join(", ")} stayed skipped because their grants expired` : ""}.`, { sessionid: session.id });
+      await refreshbadge();
+      return { restored: outcome.restored.length, skippedorigins: outcome.skippedorigins };
+    }
+    case "sessiondiff": {
+      const inputdiff = message;
+      const left = await memory.getsessionrecord(inputdiff.left?.trim() ?? "");
+      const right = await memory.getsessionrecord(inputdiff.right?.trim() ?? "");
+      if (!left || !right) throw new Error("The session diff needs both saved sessions in the library.");
+      return { changes: diffsessionrecords(left, right), leftid: left.id, rightid: right.id };
+    }
+    case "loadsessionfile": {
+      const inputfile = message;
+      let parsed;
+      try {
+        parsed = JSON.parse(inputfile.content ?? "");
+      } catch {
+        throw new Error("The selected file is not a valid session file.");
+      }
+      const file = importsessionfile(parsed);
+      if (!file) throw new Error(`The selected session file failed its format version or checksum validation; only format version ${sessionfileversion} imports.`);
+      return { formatversion: file.formatversion, records: file.records.map((record2) => ({ id: record2.id, name: record2.name, tabs: record2.tabs.length, folder: record2.folder, tags: record2.tags })), bytesize: file.bytesize };
+    }
+    case "importsessionrecords": {
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Session imports need an active browser session behind the consent gates.");
+      const inputimport = message;
+      const file = importsessionfile(inputimport.file);
+      if (!file) throw new Error(`The reviewed session file failed its format version or checksum validation; only format version ${sessionfileversion} imports.`);
+      const records = await memory.getsessionrecords();
+      let added = 0;
+      for (const record2 of file.records) {
+        if (records.some((existing) => existing.id === record2.id)) continue;
+        const unique = sessionnameunique(record2.name, [...records, ...file.records.filter((candidate) => candidate.id !== record2.id).map((candidate) => ({ id: candidate.id, name: candidate.name }))]);
+        const name = unique.allowed ? record2.name : `${record2.name} (${record2.id.slice(0, 6)})`;
+        await memory.addsessionrecord({ ...record2, name });
+        added += 1;
+      }
+      await memory.addsessionevent({ id: randomid(), kind: "import", at: Date.now(), tabid: session.tabid, detail: `Imported ${added} session records from a reviewed file of format version ${file.formatversion}.` });
+      await audit("session", `The review panel imported ${added} of ${file.records.length} reviewed session record${file.records.length === 1 ? "" : "s"} from a session file of format version ${file.formatversion}; every record was listed before it joined the library.`, { sessionid: session.id });
+      return { imported: added };
+    }
+    case "resumerun": {
+      const plan = await memory.getplan();
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("The run resume needs an active browser session.");
+      if (!plan || plan.state !== "approved") throw new Error("The run resume needs the approved plan of the interrupted run.");
+      const state = await memory.gettaskstate(plan.id);
+      if (!state || !taskstatevalid(state)) throw new Error("The persisted task state is missing or corrupted; the checksum refused the resume.");
+      const remaining = plan.steps.slice(state.stepcursor);
+      await memory.addsessionevent({ id: randomid(), kind: "resume", at: Date.now(), tabid: session.tabid, detail: `Resumed the run ${plan.id} from step cursor ${state.stepcursor} with ${remaining.length} remaining reviewed steps.` });
+      await audit("resume", `Resumed the run ${plan.id} from the persisted task state checkpoint at step cursor ${state.stepcursor}; ${remaining.length} reviewed step${remaining.length === 1 ? "" : "s"} remain and every one still passes the consent gates.`, { sessionid: session.id, planid: plan.id });
+      await memory.setcrashflag(false);
+      let executed = 0;
+      for (const step of remaining) {
+        const output = await executestep(step.id).catch(() => void 0);
+        if (output === void 0) break;
+        executed += 1;
+      }
+      return { resumed: true, stepcursor: state.stepcursor, remaining: remaining.length, executed };
+    }
+    case "setsessionretention": {
+      const inputretention = message;
+      const settings = await memory.getsettings();
+      const retention = typeof inputretention.retention === "number" && Number.isInteger(inputretention.retention) && inputretention.retention >= 0 ? inputretention.retention : void 0;
+      await memory.setsettings({ ...settings, ...retention !== void 0 ? { sessionretention: retention } : {} });
+      await memory.applysessionexpiry(retention, Date.now());
+      await audit("configure", `The user set the session retention to ${retention === void 0 ? "keep every section" : `${retention} millisecond${retention === 1 ? "" : "s"}`}; the record metadata always survives and no code ceiling applies.`);
+      return { sessionretention: retention };
+    }
+    case "exportsessionfile": {
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Session exports need an active browser session behind the consent gates.");
+      const inputexport = message;
+      const records = await memory.getsessionrecords();
+      const selected = Array.isArray(inputexport.ids) && inputexport.ids.length > 0 ? records.filter((record2) => inputexport.ids.includes(record2.id)) : records;
+      if (selected.length === 0) throw new Error("No saved session matches the reviewed export ids.");
+      const file = exportsessionfile(selected, Date.now());
+      const payload = JSON.stringify(file);
+      await chrome.downloads.download({ url: `data:application/json;charset=utf-8,${encodeURIComponent(payload)}`, filename: `devthink-sessions-${Date.now()}.json` }).catch(() => {
+        throw new Error("The session file download was refused by the browser.");
+      });
+      await memory.addsessionevent({ id: randomid(), kind: "export", at: Date.now(), tabid: session.tabid, detail: `The review panel exported ${file.records.length} session records as a ${file.bytesize} byte file.` });
+      await audit("export", `The review panel exported ${file.records.length} saved session record${file.records.length === 1 ? "" : "s"} as one ${file.bytesize} byte session file of format version ${file.formatversion} after the explicit export review.`, { sessionid: session.id });
+      return { exported: file.records.length, bytes: file.bytesize };
+    }
+    case "clearautosnapshot": {
+      await memory.clearautosnapshot();
+      await audit("session", "The user cleared the reviewed auto snapshot interval; on demand captures stay the only source of session records.");
+      return { cleared: true };
+    }
+    case "workflowreview": {
+      const inputreview = message;
+      const record2 = await memory.getworkflowrecord(inputreview.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputreview.workflowid ?? ""}.`);
+      return { record: record2, steps: record2.steps.map((entry) => ({ id: entry.id, kind: entry.kind, label: entry.label, ...entry.target !== void 0 ? { target: entry.target } : {}, ...entry.value !== void 0 ? { value: entry.value } : {}, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.bindings !== void 0 ? { bindings: entry.bindings } : {}, ...entry.expression !== void 0 ? { expression: entry.expression } : {}, ...entry.extract !== void 0 ? { extract: entry.extract } : {} })), blocks: record2.blocks, risk: record2.risk, origins: record2.origins };
+    }
+    case "approveworkflowrun": {
+      const inputapprove = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Workflow runs need an active browser session behind the consent gates.");
+      const record2 = await memory.getworkflowrecord(inputapprove.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputapprove.workflowid ?? ""}.`);
+      await audit("workflow", `The user approved the run review of the workflow ${record2.name} version ${record2.version} with its ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"} shown; the run still passes every consent gate per step.`, { sessionid: session.id });
+      return { approved: true, steps: record2.steps.length, risk: record2.risk };
+    }
+    case "executeworkflowstep": {
+      const inputsingle = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || !plan || plan.state !== "approved") throw new Error("Single step execution needs an approved session plan.");
+      const stored = await memory.getrun(inputsingle.runid?.trim() ?? "");
+      if (!stored) throw new Error(`No workflow run matches ${inputsingle.runid ?? ""}.`);
+      const record2 = await memory.getworkflowrecord(stored.run.workflowid);
+      if (!record2) throw new Error("The workflow of the run is no longer composed in the library.");
+      const step = record2.steps.find((entry) => entry.id === (inputsingle.stepid ?? ""));
+      if (!step) throw new Error(`No step of the workflow matches ${inputsingle.stepid ?? ""}.`);
+      const { tab, origin } = await activecontext();
+      const executed = await runstep({ step, scopes: await memory.getrunscopes(stored.run.id), outputs: {}, execute: async (dispatched) => dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin }), now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
+      await memory.addrunlogentry(stored.run.id, executed.log);
+      await memory.setrunscopes(stored.run.id, executed.scopes);
+      const stepindex = record2.steps.findIndex((entry) => entry.id === step.id);
+      const isthenext = stepindex === stored.run.cursor && executed.output.ok;
+      if (isthenext) await memory.setworkflowrun({ ...stored.run, cursor: stored.run.cursor + 1 });
+      await audit("workflow", `Executed the single step ${step.label} of the run ${stored.run.id} outside the run loop${isthenext ? " and advanced its checkpoint" : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+      return workflowoutcome({ run: { ...stored.run, ...isthenext ? { cursor: stored.run.cursor + 1 } : {} }, entries: await memory.getrunlog(stored.run.id), stepid: step.id });
+    }
+    case "pauseworkflowrun": {
+      const inputpause = message;
+      const stored = (await memory.listworkflowruns()).find((entry) => entry.id === (inputpause.runid ?? ""));
+      if (!stored) throw new Error(`No workflow run matches ${inputpause.runid ?? ""}.`);
+      const guards = activeworkflowruns.get(stored.id);
+      if (guards) guards.cancelled = true;
+      const paused = pauserun(stored, Date.now());
+      await memory.setworkflowrun(paused);
+      await audit("workflow", `Paused the workflow run ${paused.id} at the checkpoint of step cursor ${paused.cursor}; the resume continues exactly there.`, {});
+      await refreshbadge();
+      return { runid: paused.id, state: paused.state, cursor: paused.cursor };
+    }
+    case "resumeworkflowrun": {
+      const inputresume = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || !plan || plan.state !== "approved") throw new Error("The run resume needs an approved session plan.");
+      const stored = await memory.getrun(inputresume.runid?.trim() ?? "");
+      if (!stored) throw new Error(`No workflow run matches ${inputresume.runid ?? ""}.`);
+      if (stored.run.state !== "paused" && stored.run.state !== "running") throw new Error(`The workflow run is already ${stored.run.state}.`);
+      const record2 = await memory.getworkflowrecord(stored.run.workflowid);
+      if (!record2) throw new Error("The workflow of the run is no longer composed in the library.");
+      const scopes = await memory.getrunscopes(stored.run.id);
+      const log = await memory.getrunlog(stored.run.id);
+      const { tab, origin } = await activecontext();
+      const resumed = await runworkflow({ record: record2, run: stored.run, scopes, log, execute: async (dispatched) => dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin }), now: Date.now(), gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) }, oncheckpoint: async (state) => {
+        await memory.setworkflowrun(state.run);
+        const last = state.log[state.log.length - 1];
+        if (last) await memory.addrunlogentry(state.run.id, last);
+        await memory.setrunscopes(state.run.id, state.scopes);
+      } });
+      await memory.setworkflowrun(resumed.run);
+      await memory.setrunscopes(stored.run.id, resumed.scopes);
+      await audit("workflow", `Resumed the workflow run ${stored.run.id} from the checkpoint at step cursor ${stored.run.cursor}; the run ended ${resumed.run.state} at cursor ${resumed.run.cursor}.`, { sessionid: session.id, planid: plan.id });
+      await refreshbadge();
+      return { runid: resumed.run.id, state: resumed.run.state, cursor: resumed.run.cursor };
+    }
+    case "cancelworkflowrun": {
+      const inputcancel = message;
+      const stored = (await memory.listworkflowruns()).find((entry) => entry.id === (inputcancel.runid ?? ""));
+      if (!stored) throw new Error(`No workflow run matches ${inputcancel.runid ?? ""}.`);
+      const guards = activeworkflowruns.get(stored.id);
+      if (guards) guards.cancelled = true;
+      const cancelled = cancelrun(stored, typeof inputcancel.reason === "string" && inputcancel.reason.trim() ? inputcancel.reason.trim() : "user cancel", Date.now());
+      await memory.setworkflowrun(cancelled);
+      await audit("workflow", `Cancelled the workflow run ${cancelled.id} with the reason ${cancelled.cancelreason ?? "user cancel"} at step cursor ${cancelled.cursor}.`, {});
+      await refreshbadge();
+      return { runid: cancelled.id, state: cancelled.state, cancelreason: cancelled.cancelreason };
+    }
+    case "workflowoutcome": {
+      const inputoutcome = message;
+      const stored = await memory.getrun(inputoutcome.runid?.trim() ?? "");
+      if (!stored) throw new Error(`No workflow run matches ${inputoutcome.runid ?? ""}.`);
+      return workflowoutcome({ run: stored.run, entries: stored.log, ...inputoutcome.stepid !== void 0 && inputoutcome.stepid !== "" ? { stepid: inputoutcome.stepid } : {} });
+    }
     default:
       throw new Error("Unknown Devthink request.");
   }
@@ -13203,6 +15111,75 @@ chrome.runtime.onMessage.addListener((message, sender, sendresponse) => {
   handlerequest(message, sender).then((value) => sendresponse({ ok: true, value })).catch((error) => sendresponse({ ok: false, error: error instanceof Error ? error.message : String(error) }));
   return true;
 });
+async function detectcrash() {
+  const plan = await memory.getplan();
+  if (!plan || plan.state !== "approved") return;
+  const state = await memory.gettaskstate(plan.id);
+  if (!state || !taskstatevalid(state)) return;
+  const marked = crashinterrupted(state, plan.steps.length, Date.now());
+  if (marked === state || marked === void 0) return;
+  await memory.settaskstate(marked);
+  await memory.setcrashflag(true);
+  await memory.addsessionevent({ id: randomid(), kind: "crash", at: Date.now(), detail: `Run ${plan.id} was interrupted by a browser restart at step cursor ${state.stepcursor} of ${plan.steps.length}.` });
+  await audit("session", `The crash detector marked the run ${plan.id} interrupted by a browser restart at step cursor ${state.stepcursor} of ${plan.steps.length}; the crash restore prompt stays inside the session consent model.`, { planid: plan.id });
+  await refreshbadge().catch(() => {
+  });
+}
+chrome.runtime.onStartup.addListener(() => {
+  void detectcrash();
+  void pauseinterruptedworkflowruns();
+});
+async function pauseinterruptedworkflowruns() {
+  for (const run of await memory.listworkflowruns()) {
+    if (run.state !== "running") continue;
+    await memory.setworkflowrun({ ...run, state: "paused", pausedat: Date.now() });
+    await audit("workflow", `The service worker restart paused the workflow run ${run.id} at its last checkpoint of step cursor ${run.cursor}; the resume continues exactly there.`, {});
+  }
+}
+async function maybeautosnapshot() {
+  const state = await memory.getautosnapshot();
+  if (!state || !Number.isFinite(state.interval.period)) return;
+  const now = Date.now();
+  if (now - state.lastat < state.interval.period) return;
+  const session = await memory.getsession();
+  const plan = await memory.getplan();
+  if (!session || session.stoppedat || session.expiresat <= now || session.pausedat || !plan || plan.state !== "approved") return;
+  const step = plan.steps.find((candidate) => candidate.kind === "capturesession");
+  if (!step) return;
+  const autorecords = (await memory.getsessionrecords()).filter((record3) => record3.auto);
+  if (autorecords.length >= state.interval.maxsnapshots) {
+    await memory.clearautosnapshot();
+    await audit("session", `The reviewed auto snapshot interval stopped after ${state.interval.maxsnapshots} snapshot${state.interval.maxsnapshots === 1 ? "" : "s"}; the retention window of ${state.interval.expiry} millisecond${state.interval.expiry === 1 ? "" : "s"} expires them by user choice.`, { sessionid: session.id, planid: plan.id });
+    return;
+  }
+  const options = stepoptions2(step);
+  const snapshot2 = snapshotplanof(options.snapshot);
+  if (!snapshot2) return;
+  const record2 = await capturesessionrecord({ ...snapshot2, ...snapshot2.auto !== void 0 ? { auto: snapshot2.auto } : {} }, session, plan.id).catch(() => void 0);
+  if (!record2) return;
+  const auto = { ...record2, auto: true };
+  await memory.addsessionrecord(auto);
+  await memory.setautosnapshot({ interval: state.interval, lastat: now, count: state.count + 1 });
+  await memory.addsessionevent({ id: randomid(), kind: "auto", at: now, tabid: session.tabid, detail: `Auto snapshot ${record2.id} captured ${record2.tabs.length} tabs on the reviewed interval.` });
+  await memory.applysessionexpiry(state.interval.expiry > 0 ? state.interval.expiry : snapshotretentionwindow(await memory.getsettings()), now);
+  await audit("session", `The reviewed auto snapshot interval of ${state.interval.period} milliseconds captured the session record ${record2.id} of ${record2.tabs.length} tab${record2.tabs.length === 1 ? "" : "s"}; snapshot ${state.count + 1} of the reviewed maximum of ${state.interval.maxsnapshots}.`, { sessionid: session.id, planid: plan.id });
+}
+setInterval(() => {
+  void maybeautosnapshot().catch(() => {
+  });
+}, 3e4);
+function schedulewakes() {
+  const alarms = chrome.alarms;
+  try {
+    alarms?.create("devthinkautosnapshot", { periodInMinutes: 1 });
+    alarms?.onAlarm?.addListener(() => {
+      void maybeautosnapshot().catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+schedulewakes();
 async function reconcilewatches() {
   for (const watch of await memory.getwatches()) {
     if (watch.closedat !== void 0) continue;