@wenathlan/extension 1.1.49 → 1.1.50

package/extension/dist/background.js

@@ -2113,6 +2113,84 @@ var sessionmemory = class {
   async setcrashflag(value) {
     return this.adapter.set("crashed", value);
   }
+  /** Stores one composed workflow record version with its timestamp; re-composing the same version replaces it while older versions survive for the audit trail. */
+  async addworkflowrecord(record2) {
+    const records = await this.getworkflowrecordversions();
+    const remaining = records.filter((entry) => !(entry.id === record2.id && entry.version === record2.version));
+    await this.adapter.set("workflowrecords", [record2, ...remaining]);
+  }
+  /** Returns every stored workflow record version, newest first. */
+  async getworkflowrecordversions() {
+    return await this.adapter.get("workflowrecords") ?? [];
+  }
+  /** Returns the latest stored version of one workflow record. */
+  async getworkflowrecord(id) {
+    return (await this.getworkflowrecordversions()).find((entry) => entry.id === id);
+  }
+  /** Lists the saved workflow records, the latest version of each, newest first. */
+  async listworkflows() {
+    const seen = /* @__PURE__ */ new Set();
+    const latest = [];
+    for (const entry of await this.getworkflowrecordversions()) {
+      if (seen.has(entry.id)) continue;
+      seen.add(entry.id);
+      latest.push(entry);
+    }
+    return latest;
+  }
+  /** Stores one workflow run with its state transition; a run replace keeps the full runlog of the same id. */
+  async setworkflowrun(run) {
+    const runs = await this.listworkflowruns();
+    const remaining = runs.filter((entry) => entry.id !== run.id);
+    await this.adapter.set("workflowruns", [run, ...remaining]);
+  }
+  /** Returns every stored workflow run, newest first. */
+  async listworkflowruns() {
+    return await this.adapter.get("workflowruns") ?? [];
+  }
+  /** Returns one run with its full step outcome list so the panel shows the timeline after and during a run. */
+  async getrun(id) {
+    const run = (await this.listworkflowruns()).find((entry) => entry.id === id);
+    if (!run) return void 0;
+    return { run, log: await this.getrunlog(id) };
+  }
+  /** Records one runlog entry of a run; the runlog retention window is a user setting and an absent window keeps every entry. */
+  async addrunlogentry(runid, entry) {
+    const entries = await this.getrunlog(runid);
+    const combined = [...entries, entry];
+    const retention = (await this.getsettings())?.runlogretention;
+    await this.adapter.set(`runlog${runid}`, retention === void 0 ? combined : combined.slice(-retention));
+  }
+  /** Returns the runlog of one run, oldest first. */
+  async getrunlog(runid) {
+    return await this.adapter.get(`runlog${runid}`) ?? [];
+  }
+  /** Stores the variable values per scope of one run for inspection after the run. */
+  async setrunscopes(runid, scopes) {
+    return this.adapter.set(`runscopes${runid}`, scopes);
+  }
+  /** Returns the variable scopes of one run, oldest first. */
+  async getrunscopes(runid) {
+    return await this.adapter.get(`runscopes${runid}`) ?? [];
+  }
+  /** Records one provenance entry of a run: an expression result or a regex capture with its name, value and time. */
+  async addworkflowprovenance(runid, entry) {
+    const entries = await this.getworkflowprovenance(runid);
+    await this.adapter.set(`workflowprovenance${runid}`, [...entries, entry]);
+  }
+  /** Returns every provenance entry of one run, oldest first. */
+  async getworkflowprovenance(runid) {
+    return await this.adapter.get(`workflowprovenance${runid}`) ?? [];
+  }
+  /** Stores one shareable step template under its unique name. */
+  async addsteptemplate(template) {
+    const templates = (await this.getsteptemplates()).filter((entry) => entry.name !== template.name);
+    await this.adapter.set("steptemplates", [template, ...templates]);
+  }
+  /** Returns every stored step template, newest first. */
+  async getsteptemplates() {
+    return await this.adapter.get("steptemplates") ?? [];
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -3099,6 +3177,511 @@ function teardowncdpsession(input) {
   };
 }
 
+// workflow.ts
+var workflowkinds = ["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"];
+function workflowstepof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return void 0;
+  if (typeof candidate.kind !== "string" || !/^[a-z]+$/.test(candidate.kind)) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  if (candidate.target !== void 0 && (typeof candidate.target !== "string" || !candidate.target)) return void 0;
+  if (candidate.value !== void 0 && typeof candidate.value !== "string") return void 0;
+  if (candidate.options !== void 0 && typeof candidate.options !== "string") return void 0;
+  const bindings = Array.isArray(candidate.bindings) ? candidate.bindings.flatMap((binding) => bindingof(binding) !== void 0 ? [bindingof(binding)] : []) : void 0;
+  if (candidate.bindings !== void 0 && bindings === void 0) return void 0;
+  if (Array.isArray(candidate.bindings) && bindings !== void 0 && bindings.length !== candidate.bindings.length) return void 0;
+  const expression = candidate.expression === void 0 ? void 0 : expressionof(candidate.expression);
+  if (candidate.expression !== void 0 && expression === void 0) return void 0;
+  const extract = candidate.extract === void 0 ? void 0 : regexruleof(candidate.extract);
+  if (candidate.extract !== void 0 && extract === void 0) return void 0;
+  return { id: candidate.id, kind: candidate.kind, label: candidate.label, ...candidate.target !== void 0 ? { target: candidate.target } : {}, ...candidate.value !== void 0 ? { value: candidate.value } : {}, ...candidate.options !== void 0 ? { options: candidate.options } : {}, ...bindings !== void 0 && bindings.length > 0 ? { bindings } : {}, ...expression !== void 0 ? { expression } : {}, ...extract !== void 0 ? { extract } : {} };
+}
+function blockinvocationof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.block !== "string" || !candidate.block.trim()) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  return { block: candidate.block, label: candidate.label };
+}
+function workflowblockof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.name !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.name)) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  if (!Array.isArray(candidate.steps)) return void 0;
+  const steps = [];
+  for (const entry of candidate.steps) {
+    const step = workflowstepof(entry);
+    if (step) {
+      steps.push(step);
+      continue;
+    }
+    const invocation = blockinvocationof(entry);
+    if (invocation) {
+      steps.push(invocation);
+      continue;
+    }
+    return void 0;
+  }
+  return { name: candidate.name, label: candidate.label, steps };
+}
+function steptemplateof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return void 0;
+  if (typeof candidate.name !== "string" || !candidate.name.trim()) return void 0;
+  if (typeof candidate.origin !== "string" || !candidate.origin.trim()) return void 0;
+  const step = workflowstepof(candidate.step);
+  if (!step) return void 0;
+  if (typeof candidate.sharedat !== "number" || !Number.isFinite(candidate.sharedat)) return void 0;
+  return { id: candidate.id, name: candidate.name, origin: candidate.origin, step, sharedat: candidate.sharedat };
+}
+function bindingof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.variable !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.variable)) return void 0;
+  if (!variablekinds.includes(candidate.kind)) return void 0;
+  if (typeof candidate.stepid !== "string" || !candidate.stepid.trim()) return void 0;
+  if (candidate.path !== void 0 && (typeof candidate.path !== "string" || !candidate.path.trim())) return void 0;
+  return { variable: candidate.variable, kind: candidate.kind, stepid: candidate.stepid, ...candidate.path !== void 0 ? { path: candidate.path } : {} };
+}
+var variablekinds = ["string", "number", "boolean", "list", "element"];
+var expressionoperators = ["add", "subtract", "multiply", "divide", "modulo", "equal", "notequal", "less", "greater", "lessequal", "greaterequal", "and", "or", "not", "concat", "contains", "length"];
+function expressionof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const left = operandof(candidate.left);
+  if (!left) return void 0;
+  const right = candidate.right === void 0 ? void 0 : operandof(candidate.right);
+  if (candidate.right !== void 0 && right === void 0) return void 0;
+  if (typeof candidate.operator !== "string" || !expressionoperators.includes(candidate.operator)) return void 0;
+  if (typeof candidate.result !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.result)) return void 0;
+  if (!variablekinds.includes(candidate.resultkind)) return void 0;
+  return { left, ...right !== void 0 ? { right } : {}, operator: candidate.operator, result: candidate.result, resultkind: candidate.resultkind };
+}
+function operandof(value) {
+  if (value === void 0) return void 0;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return { literal: value };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.ref === "string" && /^[a-z][a-z0-9]*$/.test(candidate.ref)) return { ref: candidate.ref };
+  if (typeof candidate.literal === "string" || typeof candidate.literal === "number" || typeof candidate.literal === "boolean") return { literal: candidate.literal };
+  return void 0;
+}
+function regexruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.pattern !== "string" || !candidate.pattern.trim()) return void 0;
+  if (typeof candidate.flags !== "string" || !/^[dgimsuvy]*$/.test(candidate.flags)) return void 0;
+  const groups = Array.isArray(candidate.groups) ? candidate.groups.flatMap((group) => typeof group === "string" && /^[a-z][a-z0-9]*$/.test(group) ? [group] : []) : [];
+  if (candidate.groups !== void 0 && groups.length !== candidate.groups.length) return void 0;
+  return { pattern: candidate.pattern, flags: candidate.flags, groups };
+}
+function expandblocks(steps, blocks) {
+  const byname = new Map(blocks.map((block) => [block.name, block]));
+  const expanded = [];
+  const visit = (entries, path, inside) => {
+    for (const entry of entries) {
+      if ("kind" in entry && "label" in entry && !("block" in entry)) {
+        expanded.push(inside === void 0 ? entry : { ...entry, block: inside });
+        continue;
+      }
+      const invocation = blockinvocationof(entry);
+      if (!invocation) throw new Error("The step list entry is neither a reviewed step nor a block invocation.");
+      if (path.includes(invocation.block)) throw new Error(`The block ${invocation.block} recurs inside itself and cannot expand.`);
+      const block = byname.get(invocation.block);
+      if (!block) throw new Error(`The block ${invocation.block} is not defined in the workflow.`);
+      visit(block.steps, [...path, invocation.block], invocation.block);
+    }
+  };
+  visit(steps, [], void 0);
+  if (expanded.length === 0) throw new Error("A workflow needs at least one executable step after block expansion.");
+  return expanded;
+}
+function composeworkflow(input) {
+  if (typeof input.name !== "string" || !input.name.trim()) throw new Error("The workflow name must be a non-empty string.");
+  if (typeof input.version !== "number" || !Number.isInteger(input.version) || input.version < 1) throw new Error("The workflow version must be a positive integer.");
+  if (!Array.isArray(input.origins) || input.origins.length === 0) throw new Error("A workflow needs at least one granted HTTPS origin.");
+  const origins = input.origins.map((origin) => {
+    try {
+      return new URL(origin).origin;
+    } catch {
+      throw new Error(`The workflow origin ${origin} is not a valid url.`);
+    }
+  });
+  if (origins.some((origin) => !origin.startsWith("https://"))) throw new Error("Workflow origins must use HTTPS.");
+  const blocks = input.blocks ?? [];
+  if (blocks.some((block, index) => blocks.findIndex((other) => other.name === block.name) !== index)) throw new Error("Workflow block names must stay unique.");
+  for (const entry of input.steps) {
+    if ("kind" in entry && "label" in entry && !("block" in entry)) {
+      if (input.kindallowed && !input.kindallowed(entry.kind)) throw new Error(`The workflow step kind ${entry.kind} is not a reviewed action kind.`);
+    }
+  }
+  for (const block of blocks) for (const entry of block.steps) {
+    if ("kind" in entry && "label" in entry && !("block" in entry) && input.kindallowed && !input.kindallowed(entry.kind)) throw new Error(`The workflow step kind ${entry.kind} inside block ${block.name} is not a reviewed action kind.`);
+  }
+  const steps = expandblocks(input.steps, blocks);
+  for (const step of steps) {
+    if (input.kindallowed && !input.kindallowed(step.kind)) throw new Error(`The workflow step kind ${step.kind} is not a reviewed action kind.`);
+    if (step.bindings) for (const binding of step.bindings) {
+      if (!steps.some((other) => other.id === binding.stepid)) throw new Error(`The binding of ${binding.variable} references the unknown step ${binding.stepid}.`);
+    }
+  }
+  const riskof = input.riskof ?? (() => "sensitive");
+  const risk = steps.some((step) => riskof(step.kind) === "sensitive") ? "sensitive" : steps.some((step) => riskof(step.kind) === "interaction") ? "interaction" : "read";
+  const record2 = { id: input.id ?? crypto.randomUUID(), name: input.name, version: input.version, origins: [...new Set(origins)], steps, blocks, risk, createdat: input.now };
+  return deepfreeze(record2);
+}
+function deepfreeze(record2) {
+  for (const step of record2.steps) Object.freeze(step);
+  for (const block of record2.blocks) for (const entry of block.steps) if ("kind" in entry && "label" in entry && !("block" in entry)) Object.freeze(entry);
+  Object.freeze(record2.blocks);
+  Object.freeze(record2.steps);
+  return Object.freeze(record2);
+}
+function validateworkflow(record2, options) {
+  if (record2.steps.length === 0) return { allowed: false, reason: "A workflow needs at least one reviewed step." };
+  const defined = new Set(options?.inputs ?? []);
+  const byid = new Map(record2.steps.map((step, index) => [step.id, { step, index }]));
+  for (let index = 0; index < record2.steps.length; index += 1) {
+    const step = record2.steps[index];
+    if (options?.kindallowed && !options.kindallowed(step.kind)) return { allowed: false, reason: `The workflow step kind ${step.kind} is not a reviewed action kind.` };
+    if (step.bindings) for (const binding of step.bindings) {
+      const source = byid.get(binding.stepid);
+      if (!source) return { allowed: false, reason: `The binding of ${binding.variable} references the unknown step ${binding.stepid}.` };
+      if (source.index >= index) return { allowed: false, reason: `The binding of ${binding.variable} must link an earlier step than ${step.id}.` };
+      defined.add(binding.variable);
+    }
+    if (step.expression) {
+      for (const operand of [step.expression.left, step.expression.right]) {
+        if (operand?.ref && !defined.has(operand.ref)) return { allowed: false, reason: `The expression of step ${step.id} references the undefined variable ${operand.ref}.` };
+      }
+      defined.add(step.expression.result);
+    }
+    if (step.extract) for (const group of step.extract.groups) defined.add(group);
+  }
+  return { allowed: true };
+}
+function pushscope(scopes, name, parent) {
+  return [...scopes, { name, variables: [], ...parent !== void 0 ? { parent } : {} }];
+}
+function popscope(scopes) {
+  if (scopes.length === 0) return scopes;
+  return scopes.slice(0, -1);
+}
+function resolvevariable(scopes, name) {
+  for (let index = scopes.length - 1; index >= 0; index -= 1) {
+    const scope = scopes[index];
+    const found = scope.variables.find((variable) => variable.name === name);
+    if (found) return found;
+    if (scope.parent === void 0) continue;
+    const parentindex = scopes.findIndex((candidate) => candidate.name === scope.parent);
+    if (parentindex >= 0 && parentindex < index) {
+      const inherited = resolvevariable([scopes[parentindex]], name);
+      if (inherited) return inherited;
+    }
+  }
+  return void 0;
+}
+function setvariable(scopes, name, kind, value, now) {
+  if (scopes.length === 0) scopes = [{ name: "root", variables: [] }];
+  const target = scopes[scopes.length - 1];
+  const variables = [...target.variables.filter((variable) => variable.name !== name), { name, kind, value, setat: now }];
+  return [...scopes.slice(0, -1), { ...target, variables }];
+}
+function coercevariable(value, kind) {
+  if (kind === "number") {
+    const parsed = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+    if (!Number.isFinite(parsed)) throw new Error("The bound value is not a finite number.");
+    return parsed;
+  }
+  if (kind === "boolean") {
+    if (typeof value === "boolean") return value;
+    if (value === "true") return true;
+    if (value === "false") return false;
+    throw new Error("The bound value is not a boolean.");
+  }
+  if (kind === "list") {
+    if (Array.isArray(value)) return value.map((item) => String(item));
+    if (typeof value === "string") return value.length === 0 ? [] : value.split(",");
+    throw new Error("The bound value is not a list.");
+  }
+  if (kind === "element") {
+    if (typeof value === "string" && value.trim()) return value;
+    throw new Error("The bound value is not an element reference.");
+  }
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  throw new Error("The bound value is not a string.");
+}
+function outcomedetail(outcome, path) {
+  if (!path) return outcome.summary;
+  let current = outcome.details ?? {};
+  for (const segment of path.split(".")) {
+    if (!current || typeof current !== "object" || Array.isArray(current)) return void 0;
+    current = current[segment];
+  }
+  return current;
+}
+function bindvariables(scopes, bindings, outputs, now) {
+  let current = scopes;
+  const produced = [];
+  for (const binding of bindings) {
+    const outcome = outputs[binding.stepid];
+    if (!outcome) continue;
+    const raw = outcomedetail(outcome, binding.path);
+    if (raw === void 0) throw new Error(`The binding of ${binding.variable} found no value at ${binding.path ?? "the summary"} of step ${binding.stepid}.`);
+    current = setvariable(current, binding.variable, binding.kind, coercevariable(raw, binding.kind), now);
+    produced.push(binding.variable);
+  }
+  return { scopes: current, produced };
+}
+function operandvalue(operand, scopes) {
+  if (operand.ref !== void 0) {
+    const resolved = resolvevariable(scopes, operand.ref);
+    if (!resolved) throw new Error(`The expression references the undefined variable ${operand.ref}.`);
+    return resolved.value;
+  }
+  if (operand.literal === void 0) throw new Error("The expression operand needs a variable reference or a literal.");
+  return operand.literal;
+}
+function expressioneval(expression, scopes) {
+  const left = operandvalue(expression.left, scopes);
+  const right = expression.right === void 0 ? void 0 : operandvalue(expression.right, scopes);
+  const operand = (value) => {
+    if (Array.isArray(value)) throw new Error("The expression operand is a list and needs the contains or length operator.");
+    if (value === void 0) throw new Error("The expression operand is missing.");
+    return value;
+  };
+  const numbervalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "number") return primitive;
+    if (typeof primitive === "string" && primitive.trim() !== "") {
+      const parsed = Number(primitive);
+      if (Number.isFinite(parsed)) return parsed;
+    }
+    throw new Error("The arithmetic operand is not a number.");
+  };
+  const booleanvalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "boolean") return primitive;
+    throw new Error("The logic operand is not a boolean.");
+  };
+  const stringvalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "string") return primitive;
+    if (typeof primitive === "number" || typeof primitive === "boolean") return String(primitive);
+    throw new Error("The text operand is not a string.");
+  };
+  switch (expression.operator) {
+    case "add":
+      return numbervalue(left) + numbervalue(right);
+    case "subtract":
+      return numbervalue(left) - numbervalue(right);
+    case "multiply":
+      return numbervalue(left) * numbervalue(right);
+    case "divide": {
+      const divisor = numbervalue(right);
+      if (divisor === 0) throw new Error("The expression divides by zero.");
+      return numbervalue(left) / divisor;
+    }
+    case "modulo": {
+      const divisor = numbervalue(right);
+      if (divisor === 0) throw new Error("The expression divides by zero.");
+      return numbervalue(left) % divisor;
+    }
+    case "equal":
+      return left === right;
+    case "notequal":
+      return left !== right;
+    case "less":
+      return numbervalue(left) < numbervalue(right);
+    case "greater":
+      return numbervalue(left) > numbervalue(right);
+    case "lessequal":
+      return numbervalue(left) <= numbervalue(right);
+    case "greaterequal":
+      return numbervalue(left) >= numbervalue(right);
+    case "and":
+      return booleanvalue(left) && booleanvalue(right);
+    case "or":
+      return booleanvalue(left) || booleanvalue(right);
+    case "not":
+      return !booleanvalue(left);
+    case "concat":
+      return `${stringvalue(left)}${stringvalue(right)}`;
+    case "contains": {
+      if (Array.isArray(left)) return left.includes(stringvalue(right));
+      return stringvalue(left).includes(stringvalue(right));
+    }
+    case "length": {
+      if (Array.isArray(left)) return left.length;
+      return stringvalue(left).length;
+    }
+    default:
+      throw new Error("The reviewed expression operator is unknown.");
+  }
+}
+function regexextract(rule, text2, now) {
+  const pattern = new RegExp(rule.pattern, rule.flags);
+  const match = pattern.exec(text2);
+  if (!match) return { matched: false, variables: [] };
+  const variables = [];
+  for (const group of rule.groups) {
+    const value = match.groups?.[group];
+    variables.push({ name: group, kind: "string", value: typeof value === "string" ? value : "", setat: now });
+  }
+  return { matched: true, variables };
+}
+function waitelementplan(wait) {
+  if (wait.timeout <= 0 || wait.poll <= 0) return { probes: 1, lastwait: 0 };
+  const probes = Math.floor(wait.timeout / wait.poll) + 1;
+  return { probes, lastwait: wait.timeout % wait.poll };
+}
+function delayjitter(delay, seed) {
+  if (delay.jitter <= 0) return Math.max(0, delay.base);
+  const sample = seededrandom(seed);
+  return Math.max(0, delay.base - delay.jitter / 2 + sample * delay.jitter);
+}
+function seededrandom(seed) {
+  let state = seed >>> 0;
+  state ^= state >>> 16;
+  state = Math.imul(state, 2246822507);
+  state ^= state >>> 13;
+  state = Math.imul(state, 3266489909);
+  state ^= state >>> 16;
+  state = state >>> 0 || 1;
+  state ^= state << 13;
+  state >>>= 0;
+  state ^= state >> 17;
+  state ^= state << 5;
+  state >>>= 0;
+  return state / 4294967296;
+}
+function newworkflowrun(input) {
+  return { id: input.id ?? crypto.randomUUID(), workflowid: input.workflowid, state: "pending", cursor: 0, startedat: input.now, ...input.dryrun === true ? { dryrun: true } : {} };
+}
+function pauserun(run, now) {
+  if (run.state !== "running") throw new Error("Only a running workflow can pause.");
+  return { ...run, state: "paused", pausedat: now };
+}
+function cancelrun(run, reason, now) {
+  if (run.state === "done" || run.state === "cancelled") return run;
+  return { ...run, state: "cancelled", cancelreason: reason, endedat: now };
+}
+function interpolate(text2, scopes) {
+  const consumed = [];
+  const resolved = text2.replace(/\$\{([a-z][a-z0-9]*)\}/g, (_whole, name) => {
+    const variable = resolvevariable(scopes, name);
+    if (!variable) throw new Error(`The step references the undefined variable ${name}.`);
+    consumed.push(name);
+    return Array.isArray(variable.value) ? variable.value.join(",") : String(variable.value);
+  });
+  return { text: resolved, consumed };
+}
+function runlogof(step, state, startedat, duration, summary, extra) {
+  return { stepid: step.id, label: step.label, state, startedat, duration, summary, ...extra.block !== void 0 ? { block: extra.block } : {}, ...extra.consumed !== void 0 && extra.consumed.length > 0 ? { consumed: extra.consumed } : {}, ...extra.produced !== void 0 && extra.produced.length > 0 ? { produced: extra.produced } : {}, ...extra.checkpoint === true ? { checkpoint: true } : {}, ...extra.details !== void 0 ? { details: extra.details } : {} };
+}
+async function runstep(input) {
+  const startedat = input.now;
+  let scopes = input.scopes;
+  const consumed = [];
+  if (input.step.bindings) {
+    const bound = bindvariables(scopes, input.step.bindings.filter((binding) => input.outputs[binding.stepid] !== void 0), input.outputs, input.now);
+    scopes = bound.scopes;
+  }
+  let produced = [];
+  try {
+    if (input.step.expression) {
+      const value2 = expressioneval(input.step.expression, scopes);
+      scopes = setvariable(scopes, input.step.expression.result, input.step.expression.resultkind, coercevariable(value2, input.step.expression.resultkind), input.now);
+      produced = [...produced, input.step.expression.result];
+    }
+    let stepvalue = input.step.value;
+    if (input.step.extract) {
+      const text2 = stepvalue ?? "";
+      const interpolated = interpolate(text2, scopes);
+      consumed.push(...interpolated.consumed);
+      const extraction = regexextract(input.step.extract, interpolated.text, input.now);
+      if (extraction.matched) {
+        for (const variable of extraction.variables) scopes = setvariable(scopes, variable.name, "string", variable.value, input.now);
+        produced = [...produced, ...extraction.variables.map((variable) => variable.name)];
+      }
+      stepvalue = interpolated.text;
+    }
+    const target = input.step.target !== void 0 ? interpolate(input.step.target, scopes) : void 0;
+    if (target) consumed.push(...target.consumed);
+    const value = stepvalue !== void 0 ? interpolate(stepvalue, scopes) : void 0;
+    if (value) consumed.push(...value.consumed);
+    const options = input.step.options !== void 0 ? interpolate(input.step.options, scopes) : void 0;
+    if (options) consumed.push(...options.consumed);
+    const dispatchable = { ...input.step, ...target !== void 0 ? { target: target.text } : {}, ...value !== void 0 ? { value: value.text } : {}, ...options !== void 0 ? { options: options.text } : {} };
+    const output = await input.execute(dispatchable, { scopes, ...input.block !== void 0 ? { block: input.block } : {} });
+    if (input.step.bindings) {
+      const bound = bindvariables(scopes, input.step.bindings, { ...input.outputs, [input.step.id]: { stepid: input.step.id, ok: output.ok, summary: output.summary, ...output.details !== void 0 ? { details: output.details } : {}, at: input.now } }, input.now);
+      scopes = bound.scopes;
+      produced = [.../* @__PURE__ */ new Set([...produced, ...bound.produced])];
+    }
+    const duration = Date.now() - startedat;
+    return { scopes, log: runlogof(input.step, output.ok ? "done" : "failed", startedat, duration, output.summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {}, ...produced.length > 0 ? { produced } : {}, ...output.details !== void 0 ? { details: output.details } : {}, ...output.ok ? { checkpoint: true } : {} }), output };
+  } catch (error) {
+    const duration = Date.now() - startedat;
+    const summary = error instanceof Error ? error.message : String(error);
+    return { scopes, log: runlogof(input.step, "failed", startedat, duration, summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {} }), output: { ok: false, summary } };
+  }
+}
+async function runworkflow(input) {
+  if (input.gates && !input.gates.sessionactive) throw new Error("The workflow refuses to run outside an approved session.");
+  if (input.gates && !input.gates.planapproved) throw new Error("The workflow refuses to run without the approved plan review.");
+  if (input.gates) for (const origin of input.record.origins) {
+    if (!input.gates.origingranted(origin)) throw new Error(`The workflow origin ${origin} falls outside the session grants.`);
+  }
+  if (input.run.state === "done" || input.run.state === "failed" || input.run.state === "cancelled") throw new Error(`The workflow run is already ${input.run.state}.`);
+  const { pausedat, ...resumed } = input.run;
+  void pausedat;
+  let run = input.run.state === "paused" ? { ...resumed, state: "running" } : { ...input.run, state: "running" };
+  let scopes = input.scopes ?? [{ name: "root", variables: [] }];
+  const log = [...input.log ?? []];
+  const outputs = { ...input.outputs ?? {} };
+  let activeblock;
+  for (let index = run.cursor; index < input.record.steps.length; index += 1) {
+    const step = input.record.steps[index];
+    if (step.block !== void 0 && step.block !== activeblock) {
+      scopes = pushscope(scopes, step.block, scopes[scopes.length - 1].name);
+      activeblock = step.block;
+    } else if (step.block === void 0 && activeblock !== void 0) {
+      while (scopes.length > 1) scopes = popscope(scopes);
+      activeblock = void 0;
+    }
+    const executed = await runstep({ step, scopes, outputs, execute: input.execute, now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
+    scopes = executed.scopes;
+    log.push(executed.log);
+    outputs[step.id] = { stepid: step.id, ok: executed.output.ok, summary: executed.output.summary, ...executed.output.details !== void 0 ? { details: executed.output.details } : {}, at: Date.now() };
+    if (!executed.output.ok) {
+      run = { ...run, state: "failed", endedat: Date.now(), failreason: executed.output.summary };
+      return { run, scopes, log, outputs };
+    }
+    run = { ...run, cursor: index + 1 };
+    if (input.oncheckpoint) await input.oncheckpoint({ run, scopes, log });
+  }
+  run = { ...run, state: "done", endedat: Date.now() };
+  return { run, scopes, log, outputs };
+}
+function dryrunworkflow(input) {
+  const run = { ...input.run, state: "running", ...input.run.dryrun === true ? { dryrun: true } : { dryrun: true } };
+  let scopes = input.scopes ?? [{ name: "root", variables: [] }];
+  const log = [...input.log ?? []];
+  for (let index = run.cursor; index < input.record.steps.length; index += 1) {
+    const step = input.record.steps[index];
+    const summary = input.projection(step);
+    const entry = summary === void 0 ? runlogof(step, "refused", input.now, 0, `The ${step.kind} step has no read only projection and the dry run refuses it.`, { ...step.block !== void 0 ? { block: step.block } : {} }) : runlogof(step, "done", input.now, 0, summary, { ...step.block !== void 0 ? { block: step.block } : {} });
+    log.push(entry);
+    scopes = setvariable(scopes, `${step.id}outcome`, "boolean", entry.state === "done", input.now);
+  }
+  return { run: { ...run, state: "done", cursor: input.record.steps.length, endedat: input.now }, scopes, log };
+}
+
 // netauth.ts
 function oauthflowof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -3332,9 +3915,9 @@ function consolediff(input) {
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
@@ -3355,6 +3938,7 @@ var cdpactions = /* @__PURE__ */ new Set(["attachcdp", "detachcdp", "cdpcmd", "w
 var profileractions = /* @__PURE__ */ new Set(["measureflow", "heapshot", "trackmemory", "profilecpu", "watchshifts", "traceload", "annotatetrace", "replaytrace", "capturesourcemaps"]);
 var emulationactions = /* @__PURE__ */ new Set(["emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "blackboxscripts"]);
 var sessionactions = /* @__PURE__ */ new Set(["persiststate", "capturesession", "restoresession", "namedsessions", "diffsessions", "searchsessions", "exportsessions", "importsessions"]);
+var workflowactions = /* @__PURE__ */ new Set(["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
 var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
@@ -3373,6 +3957,9 @@ function hostpattern(origin) {
 function issessionkind(kind) {
   return sessionactions.has(kind);
 }
+function isworkflowkind(kind) {
+  return workflowactions.has(kind);
+}
 function isdebugkind(kind) {
   return debugactions.has(kind);
 }
@@ -4909,6 +5496,162 @@ function sessionfolderunique(name, folders) {
 function snapshotretentionwindow(settings) {
   return settings?.sessionretention;
 }
+function validateworkflowgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "composeworkflow") {
+    const payload = options.workflow;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { allowed: false, reason: "The workflow composition needs the reviewed workflow payload with its name, version, origins, steps and blocks." };
+    const candidate = payload;
+    if (typeof candidate.name !== "string" || !candidate.name.trim()) return { allowed: false, reason: "The workflow composition needs a reviewed non-empty name." };
+    if (typeof candidate.version !== "number" || !Number.isInteger(candidate.version) || candidate.version < 1) return { allowed: false, reason: "The workflow version must be a positive integer." };
+    if (!Array.isArray(candidate.origins) || candidate.origins.length === 0 || !candidate.origins.every((origin) => typeof origin === "string" && origin.startsWith("https://"))) return { allowed: false, reason: "The workflow needs at least one granted HTTPS origin so every step stays inside the grants." };
+    if (!Array.isArray(candidate.steps) || candidate.steps.length === 0 || !candidate.steps.every((entry) => workflowstepof(entry) !== void 0 || entry && typeof entry === "object" && typeof entry.block === "string")) return { allowed: false, reason: "The workflow needs a non-empty reviewed step list of the workflow step grammar or block invocations." };
+    const blocks = Array.isArray(candidate.blocks) ? candidate.blocks.flatMap((block) => {
+      const parsed = workflowblockof(block);
+      return parsed !== void 0 ? [parsed] : [];
+    }) : [];
+    if (Array.isArray(candidate.blocks) && blocks.length !== candidate.blocks.length) return { allowed: false, reason: "The reviewed block list must carry unique lowercase names, labels and valid child steps." };
+    try {
+      const record2 = composeworkflow({ name: candidate.name, version: candidate.version, origins: candidate.origins, steps: candidate.steps.map((entry) => "block" in entry ? { block: entry.block, label: typeof entry.label === "string" ? entry.label : entry.block } : workflowstepof(entry)), blocks, now: 0, kindallowed: (candidatekind) => {
+        try {
+          actionrisk(candidatekind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, riskof: (candidatekind) => actionrisk(candidatekind) });
+      const inputs = Array.isArray(candidate.inputs) ? candidate.inputs.flatMap((name) => typeof name === "string" ? [name] : []) : void 0;
+      const checked = validateworkflow(record2, { kindallowed: (workflowkind) => {
+        try {
+          actionrisk(workflowkind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, ...inputs !== void 0 ? { inputs } : {} });
+      if (!checked.allowed) return checked;
+    } catch (error) {
+      return { allowed: false, reason: error instanceof Error ? error.message : "The workflow payload failed its composition validation." };
+    }
+    return { allowed: true };
+  }
+  if (kind === "savetemplate") {
+    const payload = options.template && typeof options.template === "object" && !Array.isArray(options.template) ? options.template : {};
+    const template = steptemplateof({ id: "templatereview", origin: "https://example.com", sharedat: 0, ...payload });
+    if (!template) return { allowed: false, reason: "The step template needs a reviewed name and a valid workflow step it shares across workflows." };
+    return { allowed: true };
+  }
+  if (kind === "runworkflow") {
+    if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "The workflow run needs the reviewed id of the composed workflow." };
+    if (options.reviewed !== true) return { allowed: false, reason: "Every real workflow run needs the explicit run review with its expanded step list shown before the first step executes." };
+    if (options.variables !== void 0 && (!options.variables || typeof options.variables !== "object" || Array.isArray(options.variables) || !Object.values(options.variables).every((value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean"))) return { allowed: false, reason: "The reviewed run variables must be an object of string, number or boolean values." };
+    return { allowed: true };
+  }
+  if (kind === "dryrun") {
+    if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "The dry run needs the reviewed id of the composed workflow." };
+    return { allowed: true };
+  }
+  if (kind === "delay") {
+    const delay = options.delay;
+    if (!delay || typeof delay !== "object" || Array.isArray(delay)) return { allowed: false, reason: "The delay needs a reviewed base and jitter window in options." };
+    const reviewed = delay;
+    if (typeof reviewed.base !== "number" || !Number.isFinite(reviewed.base) || reviewed.base < 0) return { allowed: false, reason: "The reviewed delay base must be zero or a positive number of milliseconds." };
+    if (typeof reviewed.jitter !== "number" || !Number.isFinite(reviewed.jitter) || reviewed.jitter < 0) return { allowed: false, reason: "The reviewed delay jitter window must be zero or a positive number of milliseconds with no code ceiling." };
+    return { allowed: true };
+  }
+  if (kind === "waitelement") {
+    const wait = options.wait;
+    if (!wait || typeof wait !== "object" || Array.isArray(wait)) return { allowed: false, reason: "The element wait needs a reviewed selector, timeout and poll interval in options." };
+    const reviewed = wait;
+    if (typeof reviewed.selector !== "string" || !reviewed.selector.trim()) return { allowed: false, reason: "The element wait needs a reviewed non-empty selector." };
+    if (typeof reviewed.timeout !== "number" || !Number.isFinite(reviewed.timeout) || reviewed.timeout < 0) return { allowed: false, reason: "The reviewed element wait timeout must be zero or a positive number of milliseconds with no code ceiling." };
+    if (typeof reviewed.poll !== "number" || !Number.isFinite(reviewed.poll) || reviewed.poll < 0) return { allowed: false, reason: "The reviewed element wait poll interval must be zero or a positive number of milliseconds with no code ceiling." };
+    return { allowed: true };
+  }
+  if (kind === "compute") {
+    const expression = expressionof(options.expression);
+    if (!expression) return { allowed: false, reason: `The expression step needs a reviewed expression with operands, an operator of the reviewed set (${expressionoperators.join(", ")}) and a result variable of a reviewed kind.` };
+    const operatorcheck = validatexpressionoperators(expression);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return { allowed: true };
+  }
+  if (kind === "extractvars") {
+    const rule = regexruleof(options.rule);
+    if (!rule) return { allowed: false, reason: "The variable extraction needs a reviewed regex rule with its pattern, flags and named capture groups." };
+    const shapecheck = validateregexrule(rule.pattern);
+    if (!shapecheck.allowed) return shapecheck;
+    if (typeof options.text !== "string") return { allowed: false, reason: "The variable extraction needs the reviewed text the regex rule applies to." };
+    return { allowed: true };
+  }
+  return { allowed: true };
+}
+function validateregexrule(pattern) {
+  try {
+    new RegExp(pattern);
+  } catch {
+    return { allowed: false, reason: "The reviewed regex pattern does not compile." };
+  }
+  const nestedquantifier = /\((?:[^()\\]|\\.)*[+*}]\)[+*{]/.test(pattern) || /\(\)[+*{]/.test(pattern);
+  if (nestedquantifier) return { allowed: false, reason: "The reviewed regex pattern nests an unbounded quantifier inside a quantified group and is refused because adversarial text could explode the backtracking." };
+  const unboundedrepeat = /\{\d+,\}/.test(pattern);
+  if (unboundedrepeat && /\([^)]*\{\d+,\}[^)]*\)[+*{]/.test(pattern)) return { allowed: false, reason: "The reviewed regex pattern repeats an unbounded group and is refused because adversarial text could explode the backtracking." };
+  return { allowed: true };
+}
+function validatexpressionoperators(expression) {
+  const numeric = /* @__PURE__ */ new Set(["add", "subtract", "multiply", "divide", "modulo"]);
+  const logic = /* @__PURE__ */ new Set(["and", "or", "not"]);
+  const comparison = /* @__PURE__ */ new Set(["less", "greater", "lessequal", "greaterequal"]);
+  const text2 = /* @__PURE__ */ new Set(["concat", "contains"]);
+  const operator = expression.operator;
+  if (numeric.has(operator)) {
+    for (const operand of [expression.left, expression.right]) {
+      if (operand === void 0) continue;
+      if (operand.literal !== void 0 && typeof operand.literal === "boolean") return { allowed: false, reason: `The ${operator} operator needs numeric operands; boolean literals are refused.` };
+    }
+    if (expression.resultkind !== "number" && expression.resultkind !== "string") return { allowed: false, reason: `The ${operator} operator needs a number result kind.` };
+  }
+  if (logic.has(operator)) {
+    for (const operand of [expression.left, expression.right]) {
+      if (operand === void 0) continue;
+      if (operand.literal !== void 0 && typeof operand.literal !== "boolean") return { allowed: false, reason: `The ${operator} operator needs boolean operands; non boolean literals are refused.` };
+    }
+    if (expression.resultkind !== "boolean") return { allowed: false, reason: `The ${operator} operator needs a boolean result kind.` };
+    if (operator === "not" && expression.right !== void 0) return { allowed: false, reason: "The not operator takes one operand only." };
+  }
+  if (comparison.has(operator) && expression.resultkind !== "boolean") return { allowed: false, reason: `The ${operator} operator needs a boolean result kind.` };
+  if (text2.has(operator) && expression.resultkind !== "boolean" && expression.resultkind !== "string") return { allowed: false, reason: `The ${operator} operator needs a string or boolean result kind.` };
+  if (operator === "contains" && expression.resultkind !== "boolean") return { allowed: false, reason: "The contains operator needs a boolean result kind." };
+  if (operator === "length") {
+    if (expression.right !== void 0) return { allowed: false, reason: "The length operator takes one operand only." };
+    if (expression.resultkind !== "number") return { allowed: false, reason: "The length operator needs a number result kind." };
+  }
+  if ((operator === "equal" || operator === "notequal") && !(/* @__PURE__ */ new Set(["boolean", "string", "number"])).has(expression.resultkind)) return { allowed: false, reason: "The equality operator needs a primitive result kind." };
+  return { allowed: true };
+}
+function workflowgate(input) {
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now: input.now, action: "run the workflow step" });
+  if (!gate.allowed) return gate;
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Workflow steps need the approved plan review before they run." };
+  if (input.step.kind === "runworkflow") {
+    let runoptions = {};
+    try {
+      runoptions = parseoptions(input.step);
+    } catch {
+      runoptions = {};
+    }
+    if (runoptions.reviewed !== true) return { allowed: false, reason: "Every real workflow run needs the explicit run review with its expanded step list shown before the first step executes." };
+  }
+  return { allowed: true };
+}
+function dryrunprojection(step) {
+  const risk = resolvedrisk({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.target !== void 0 ? { target: step.target } : {}, ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  if (risk !== "read") return void 0;
+  if (step.kind === "delay") return `The delay step would sleep its reviewed base inside the jitter window.`;
+  if (step.kind === "waitelement") return `The element wait step would poll ${step.target ?? "the reviewed selector"} until appearance or the reviewed timeout.`;
+  if (step.kind === "compute") return `The compute step would evaluate its reviewed expression into the result variable.`;
+  if (step.kind === "extractvars") return `The variable extraction step would apply its reviewed regex rule and store the named captures.`;
+  return `The ${step.kind} step would run read only and mutate nothing.`;
+}
 function validatecdpgrammar(step, options) {
   const kind = step.kind;
   if (kind === "attachcdp") {
@@ -5478,6 +6221,10 @@ function validatestep(step, origin) {
     const sessioncheck = validatesessiongrammar(step, options);
     if (!sessioncheck.allowed) return sessioncheck;
   }
+  if (isworkflowkind(step.kind)) {
+    const workflowcheck = validateworkflowgrammar(step, options);
+    if (!workflowcheck.allowed) return workflowcheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -5668,6 +6415,10 @@ function canexecute(input) {
       }
     }
   }
+  if (isworkflowkind(input.step.kind)) {
+    const workflowgatecheck = workflowgate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
+    if (!workflowgatecheck.allowed) return workflowgatecheck;
+  }
   if (iscontrolkind(input.step.kind)) {
     const controlgate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "control the network" });
     if (!controlgate.allowed) return controlgate;
@@ -5924,9 +6675,15 @@ function recordsession(progress, planid, stepid, entry, now) {
   const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { session: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function recordworkflow(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const counts = `${entry.executed !== void 0 ? `${entry.executed} executed step${entry.executed === 1 ? "" : "s"}, ` : ""}${entry.refused !== void 0 ? `${entry.refused} refused step${entry.refused === 1 ? "" : "s"}, ` : ""}${entry.total !== void 0 ? `${entry.total} total step${entry.total === 1 ? "" : "s"}, ` : ""}`.replace(/, $/, "");
+  const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { workflow: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.49";
+var packageversion = "1.1.50";
 
 // types.ts
 var protocolversion = packageversion;
@@ -6142,6 +6899,29 @@ function parseproposal(value, origin, grants) {
       }
       if (step.kind === "importsessions" && importsessionfile(sessionoptions.file) === void 0) throw new Error("Session import files of unknown format versions are refused.");
     }
+    if (isworkflowkind(step.kind)) {
+      let workflowoptions = {};
+      try {
+        workflowoptions = parseoptions(step);
+      } catch {
+        workflowoptions = {};
+      }
+      if (step.kind === "composeworkflow") {
+        const payload = workflowoptions.workflow && typeof workflowoptions.workflow === "object" && !Array.isArray(workflowoptions.workflow) ? workflowoptions.workflow : void 0;
+        const origins = payload && Array.isArray(payload.origins) ? payload.origins.filter((originvalue) => typeof originvalue === "string") : [];
+        for (const workfloworigin of origins) {
+          const granted = covered.some((pattern) => {
+            try {
+              return new URL(workfloworigin).origin === new URL(pattern).origin;
+            } catch {
+              return false;
+            }
+          });
+          if (!granted) throw new Error(`The workflow origin ${workfloworigin} stays outside the grants.`);
+        }
+      }
+      if (step.kind === "runworkflow" && workflowoptions.reviewed !== true) throw new Error("Workflow runs without the explicit run review of the expanded step list are refused.");
+    }
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
     const target = outboundtarget(step);
@@ -6201,6 +6981,11 @@ function parseproposal(value, origin, grants) {
   };
   return { version: protocolversion, plan };
 }
+function workflowoutcome(input) {
+  const selected = input.stepid !== void 0 ? input.entries.filter((entry) => entry.stepid === input.stepid) : input.entries;
+  const steps = selected.map((entry) => ({ stepid: entry.stepid, label: entry.label, state: entry.state, duration: entry.duration, summary: entry.summary, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.produced !== void 0 ? { produced: entry.produced } : {}, ...entry.consumed !== void 0 ? { consumed: entry.consumed } : {}, ...entry.checkpoint === true ? { checkpoint: true } : {} }));
+  return { version: protocolversion, runid: input.run.id, workflowid: input.run.workflowid, state: input.run.state, ...input.run.dryrun === true ? { dryrun: true } : {}, steps };
+}
 function stepof(kind, candidate, index) {
   return { id: typeof candidate.id === "string" ? candidate.id : `candidate${index + 1}`, kind, summary: typeof candidate.summary === "string" ? candidate.summary : "", risk: "read", ...typeof candidate.options === "string" ? { options: candidate.options } : {} };
 }
@@ -6216,7 +7001,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed } } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -6350,6 +7135,9 @@ function emulationreport(input) {
 function sessionreport(input) {
   return { version: protocolversion, records: input.records, events: input.events, folders: input.folders, diffs: input.diffs, ...input.auto !== void 0 ? { auto: input.auto } : {}, ...input.crashed === true ? { crashed: true } : {} };
 }
+function workflowreport(input) {
+  return { version: protocolversion, workflows: input.workflows, runs: input.runs, templates: input.templates, log: input.log ?? [], scopes: input.scopes ?? [], provenance: input.provenance ?? [] };
+}
 
 // capture.ts
 var capturekinds = ["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"];
@@ -7866,15 +8654,15 @@ function remainingpages(sessionvalue, planned) {
 function provenancefor(artifact, url, stepid, at) {
   return { artifact: artifact.id, name: artifact.name, url, stepid, rowstart: artifact.rowcount > 0 ? 1 : 0, rowend: artifact.rowcount, checksum: artifact.checksum, at };
 }
-function interpolate(text2, row) {
+function interpolate2(text2, row) {
   return text2.replace(/\{\{([^}]+)\}\}/g, (_, key) => row[key.trim()] ?? "");
 }
 function loopstep(step, row) {
   return {
     ...step,
-    ...step.target !== void 0 ? { target: interpolate(step.target, row) } : {},
-    ...step.value !== void 0 ? { value: interpolate(step.value, row) } : {},
-    ...step.options !== void 0 ? { options: interpolate(step.options, row) } : {}
+    ...step.target !== void 0 ? { target: interpolate2(step.target, row) } : {},
+    ...step.value !== void 0 ? { value: interpolate2(step.value, row) } : {},
+    ...step.options !== void 0 ? { options: interpolate2(step.options, row) } : {}
   };
 }
 function loopvariables(row) {
@@ -8078,7 +8866,7 @@ function stepoptions2(step) {
 }
 async function refreshcapabilities() {
   const report = await readcapabilities();
-  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds], sessions: [...sessionkinds] };
+  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds], sessions: [...sessionkinds], workflow: [...workflowkinds] };
   await memory.setcapabilities(withmedia);
   return withmedia;
 }
@@ -12193,7 +12981,8 @@ async function refreshbadge() {
   const locationprompts = (await memory.getlocationconsents()).filter((consent) => consent.approved === void 0).length;
   const emulatedlayers = [...activeemulation.values()].reduce((total2, state) => total2 + activelayers(state).length, 0);
   const tasktabs2 = new Set(badges.map((badge) => badge.tabid)).size;
-  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts + consoleprompts + debuggerprompts + locationprompts + emulatedlayers + observedrequests + livechannels + activerulescount;
+  const runningworkflows = (await memory.listworkflowruns()).filter((run) => run.state === "running").length + activeworkflowruns.size;
+  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts + consoleprompts + debuggerprompts + locationprompts + emulatedlayers + observedrequests + livechannels + activerulescount + runningworkflows;
   await chrome.action.setBadgeText({ text: total > 0 ? String(total) : "" }).catch(() => {
   });
 }
@@ -12477,6 +13266,252 @@ async function executesessionstep(step, session, plan, tabid2, origin) {
   }
   throw new Error(`The ${step.kind} step has no session memory executor.`);
 }
+var activeworkflowruns = /* @__PURE__ */ new Map();
+function runscopes(variables) {
+  const root = { name: "root", variables: [] };
+  if (!variables || typeof variables !== "object" || Array.isArray(variables)) return [root];
+  for (const [name, value] of Object.entries(variables)) {
+    if (typeof value === "number") root.variables.push({ name, kind: "number", value, setat: Date.now() });
+    else if (typeof value === "boolean") root.variables.push({ name, kind: "boolean", value, setat: Date.now() });
+    else if (typeof value === "string") root.variables.push({ name, kind: "string", value, setat: Date.now() });
+  }
+  return [root];
+}
+async function dispatchworkflowstep(step, context) {
+  const settings = await memory.getsettings();
+  const verdicts = await memory.getsafeties();
+  const action = {
+    id: step.id,
+    kind: step.kind,
+    summary: step.label,
+    risk: actionrisk(step.kind),
+    ...step.target !== void 0 ? { target: step.target } : {},
+    ...step.value !== void 0 ? { value: step.value } : {},
+    ...step.options !== void 0 ? { options: step.options } : {}
+  };
+  const gate = canexecute({ session: context.session, plan: context.plan, step: action, tabid: context.tabid, origin: context.origin, ...verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
+  if (!gate.allowed) return { ok: false, summary: `The workflow step ${step.label} was refused: ${gate.reason}` };
+  if (step.kind === "delay") return await executedelaystep(step);
+  if (step.kind === "waitelement") return await executewaitelement(step, context.tabid);
+  if (step.kind === "compute") return await executecomputestep(step, context.session);
+  if (step.kind === "extractvars") return await executeextractvarsstep(step, context.session);
+  const output = await executeaction(action, context.session, context.plan, context.tabid, context.origin, settings, verdicts.length > 0 ? verdicts : void 0, "run");
+  return { ok: Boolean(output.ok), summary: output.summary, ...output.details !== void 0 ? { details: output.details } : {} };
+}
+async function executedelaystep(step) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.options !== void 0 ? { options: step.options } : {} });
+  const delay = delayof(options.delay);
+  const sampled = delayjitter(delay, hashseed(`${step.id}:${Date.now()}`));
+  const transport = await sleepreviewed(sampled, step.id);
+  return { ok: true, summary: `Slept ${Math.round(sampled)} milliseconds inside the reviewed window of base ${delay.base} and jitter ${delay.jitter}${transport === "alarm" ? " through the alarms api" : ""}.`, details: { sampled: Math.round(sampled), base: delay.base, jitter: delay.jitter, transport } };
+}
+function delayof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("The delay needs a reviewed base and jitter window.");
+  const candidate = value;
+  if (typeof candidate.base !== "number" || !Number.isFinite(candidate.base) || candidate.base < 0) throw new Error("The reviewed delay base must be zero or a positive number of milliseconds.");
+  if (typeof candidate.jitter !== "number" || !Number.isFinite(candidate.jitter) || candidate.jitter < 0) throw new Error("The reviewed delay jitter window must be zero or a positive number of milliseconds.");
+  return { base: candidate.base, jitter: candidate.jitter };
+}
+function hashseed(text2) {
+  let hash = 2166136261;
+  for (let index = 0; index < text2.length; index += 1) {
+    hash ^= text2.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash >>> 0;
+}
+async function sleepreviewed(sampled, stepid) {
+  const alarmname = `devthinkdelay${stepid}`;
+  if (sampled > 3e4 && typeof chrome.alarms?.create === "function" && typeof chrome.alarms.onAlarm?.addListener === "function") {
+    try {
+      await new Promise((resolve) => {
+        const fallback = setTimeout(() => {
+          chrome.alarms.onAlarm.removeListener(listener);
+          resolve();
+        }, sampled + 5e3);
+        const listener = (alarm) => {
+          if (alarm.name !== alarmname) return;
+          clearTimeout(fallback);
+          chrome.alarms.onAlarm.removeListener(listener);
+          resolve();
+        };
+        chrome.alarms.onAlarm.addListener(listener);
+        void chrome.alarms.create(alarmname, { when: Date.now() + sampled });
+      });
+      return "alarm";
+    } catch {
+    }
+  }
+  await waitsome(sampled);
+  return "timer";
+}
+async function executewaitelement(step, tabid2) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.target !== void 0 ? { target: step.target } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  const wait = waitof(options.wait, step.target);
+  const startedat = Date.now();
+  const starttab = await chrome.tabs.get(tabid2).catch(() => void 0);
+  const starturl = starttab?.url ?? "";
+  const plan = waitelementplan(wait);
+  const singlepass = plan.probes === 1;
+  const deadline = startedat + wait.timeout;
+  for (let pass = 0; pass < plan.probes; pass += 1) {
+    const tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+    if (!tab || starturl !== "" && (tab.url ?? "") !== starturl) return { ok: false, summary: `The tab navigated away and the element wait for ${wait.selector} aborted cleanly after ${Date.now() - startedat} milliseconds.` };
+    const probe = await bridgecall(tabid2, "elementrect", wait.selector).catch(() => void 0);
+    if (probe?.ok) return { ok: true, summary: `Selector ${wait.selector} appeared after ${Date.now() - startedat} milliseconds of polling every ${wait.poll} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat, poll: wait.poll } };
+    if (singlepass || Date.now() >= deadline) break;
+    await waitsome(pass + 1 < plan.probes ? wait.poll : plan.lastwait);
+  }
+  return { ok: false, summary: `Selector ${wait.selector} did not appear within the reviewed timeout of ${wait.timeout} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat } };
+}
+function waitof(value, target) {
+  const candidate = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const selector = typeof candidate.selector === "string" && candidate.selector.trim() ? candidate.selector : target;
+  if (!selector || !selector.trim()) throw new Error("The element wait needs a reviewed non-empty selector.");
+  const timeout = typeof candidate.timeout === "number" && Number.isFinite(candidate.timeout) && candidate.timeout >= 0 ? candidate.timeout : -1;
+  const poll = typeof candidate.poll === "number" && Number.isFinite(candidate.poll) && candidate.poll >= 0 ? candidate.poll : -1;
+  if (timeout < 0 || poll < 0) throw new Error("The element wait needs a reviewed timeout and poll interval of zero or more milliseconds.");
+  return { selector, timeout, poll };
+}
+async function executecomputestep(step, session) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.options !== void 0 ? { options: step.options } : {} });
+  const expression = options.expression;
+  if (!expression || typeof expression !== "object") throw new Error("The compute step needs a reviewed expression.");
+  const scopes = runscopes(options.variables);
+  const value = expressioneval(expression, scopes);
+  await audit("workflow", `Evaluated the reviewed expression into ${expression.result} with the value ${typeof value === "string" ? `"${value}"` : String(value)}.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Computed ${expression.result} = ${typeof value === "string" ? `"${value}"` : String(value)} through the ${expression.operator} operator.`, details: { result: expression.result, kind: expression.resultkind, value } };
+}
+async function executeextractvarsstep(step, session) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  const rule = options.rule;
+  if (!rule || typeof rule !== "object" || typeof rule.pattern !== "string") throw new Error("The variable extraction needs a reviewed regex rule.");
+  const text2 = typeof options.text === "string" ? options.text : step.value ?? "";
+  const extraction = regexextract(rule, text2, Date.now());
+  if (!extraction.matched) {
+    await audit("workflow", `The reviewed regex rule of the ${step.id} step matched nothing; no variable was stored.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+    return { ok: true, summary: "The reviewed regex rule matched nothing; no variable was stored.", details: { matched: false, groups: rule.groups } };
+  }
+  await audit("workflow", `The reviewed regex rule captured ${extraction.variables.map((variable) => variable.name).join(", ")} as variables.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Captured ${extraction.variables.length} variable${extraction.variables.length === 1 ? "" : "s"} from the reviewed text.`, details: { matched: true, variables: extraction.variables } };
+}
+async function executeworkflowstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  if (step.kind === "composeworkflow") {
+    const payload = options.workflow;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("The workflow composition needs the reviewed workflow payload.");
+    const candidate = payload;
+    const record2 = composeworkflow({
+      ...typeof candidate.id === "string" && candidate.id.trim() ? { id: candidate.id } : {},
+      name: String(candidate.name ?? ""),
+      version: Number(candidate.version ?? 0),
+      origins: Array.isArray(candidate.origins) ? candidate.origins.filter((entry) => typeof entry === "string") : [],
+      steps: (Array.isArray(candidate.steps) ? candidate.steps : []).flatMap((entry) => {
+        const parsed = workflowstepofentry(entry);
+        return parsed !== void 0 ? [parsed] : [];
+      }),
+      blocks: (Array.isArray(candidate.blocks) ? candidate.blocks : []).flatMap((block) => {
+        const parsed = workflowblockof(block);
+        return parsed !== void 0 ? [parsed] : [];
+      }),
+      now: Date.now(),
+      kindallowed: (kind) => {
+        try {
+          actionrisk(kind);
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      riskof: (kind) => actionrisk(kind)
+    });
+    await memory.addworkflowrecord(record2);
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "compose", detail: `Composed the workflow ${record2.name} version ${record2.version}`, total: record2.steps.length }, Date.now()));
+    await audit("workflow", `Composed the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"} graded ${record2.risk} for review; blocks expanded so no step stayed hidden.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    return { ok: true, summary: `Composed the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} expanded steps graded ${record2.risk}.`, details: { workflow: { recordid: record2.id, steps: record2.steps.length, risk: record2.risk } } };
+  }
+  if (step.kind === "savetemplate") {
+    const template = steptemplateof({ ...options.template ?? {}, id: randomid(), origin, sharedat: Date.now() });
+    if (!template) throw new Error("The step template needs a reviewed name and a valid workflow step.");
+    await memory.addsteptemplate(template);
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "template", detail: `Shared the step template ${template.name}` }, Date.now()));
+    await audit("workflow", `Shared the step template ${template.name} of the ${template.step.kind} kind for reuse across workflows.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    return { ok: true, summary: `Shared the step template ${template.name}.`, details: { workflow: { recordid: template.name, steps: 1 } } };
+  }
+  if (step.kind === "runworkflow") return await executeworkflowrun(step, session, plan, tabid2, origin, false);
+  if (step.kind === "dryrun") return await executeworkflowrun(step, session, plan, tabid2, origin, true);
+  if (step.kind === "delay") return await executedelaystep({ id: step.id, kind: "delay", label: step.summary });
+  if (step.kind === "waitelement") return await executewaitelement({ id: step.id, kind: "waitelement", label: step.summary, ...step.target !== void 0 ? { target: step.target } : {}, ...step.options !== void 0 ? { options: step.options } : {} }, tabid2);
+  if (step.kind === "compute") return await executecomputestep({ id: step.id, kind: "compute", label: step.summary, ...step.options !== void 0 ? { options: step.options } : {} }, session);
+  if (step.kind === "extractvars") return await executeextractvarsstep({ id: step.id, kind: "extractvars", label: step.summary, ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} }, session);
+  throw new Error(`The ${step.kind} step has no workflow executor.`);
+}
+function workflowstepofentry(value) {
+  const parsed = workflowstepof(value);
+  if (parsed) return parsed;
+  return blockinvocationof(value);
+}
+async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
+  const options = stepoptions2(step);
+  const workflowid = typeof options.workflowid === "string" ? options.workflowid : "";
+  const record2 = await memory.getworkflowrecord(workflowid);
+  if (!record2) throw new Error(`No composed workflow matches ${workflowid || "the reviewed id"}.`);
+  for (const workfloworigin of record2.origins) {
+    if (!origingranted(session, workfloworigin)) throw new Error(`The workflow origin ${workfloworigin} falls outside the session grants.`);
+  }
+  const run = newworkflowrun({ workflowid: record2.id, dryrun: dry, now: Date.now() });
+  await memory.setworkflowrun(run);
+  await memory.setrunscopes(run.id, runscopes(options.variables));
+  if (dry) {
+    const evaluated = dryrunworkflow({ record: record2, run, now: Date.now(), projection: dryrunprojection });
+    for (const entry of evaluated.log) await memory.addrunlogentry(run.id, entry);
+    await memory.setworkflowrun(evaluated.run);
+    const refused = evaluated.log.filter((entry) => entry.state === "refused").length;
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "dryrun", detail: `Dry ran the workflow ${record2.name}`, runid: run.id, executed: evaluated.log.length - refused, refused, total: record2.steps.length }, Date.now()));
+    await audit("workflow", `The dry run of the workflow ${record2.name} evaluated ${evaluated.log.length} step${evaluated.log.length === 1 ? "" : "s"} read only; ${refused} step${refused === 1 ? "" : "s"} refused for lacking a read only projection and nothing was mutated.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    return { ok: true, summary: `The dry run evaluated ${evaluated.log.length} steps read only; ${refused} refused for lacking a read only projection.`, details: { runid: run.id, state: evaluated.run.state, dryrun: true, executed: evaluated.log.length - refused, refused, total: record2.steps.length } };
+  }
+  const guards = { cancelled: false };
+  activeworkflowruns.set(run.id, guards);
+  await audit("workflow", `Started the run ${run.id} of the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} reviewed steps; every step passes the session, plan review and origin gates.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+  const context = { session, plan, tabid: tabid2, origin };
+  const execute = async (workflowstep) => {
+    if (guards.cancelled) return { ok: false, summary: `The run was cancelled before the ${workflowstep.label} step dispatched.` };
+    return await dispatchworkflowstep(workflowstep, context);
+  };
+  let result;
+  try {
+    result = await runworkflow({
+      record: record2,
+      run,
+      scopes: runscopes(options.variables),
+      execute,
+      now: Date.now(),
+      gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) },
+      oncheckpoint: async (state) => {
+        await memory.setworkflowrun(state.run);
+        const last = state.log[state.log.length - 1];
+        if (last) await memory.addrunlogentry(state.run.id, last);
+        await memory.setrunscopes(state.run.id, state.scopes);
+        for (const scope of state.scopes) for (const variable of scope.variables) await memory.addworkflowprovenance(state.run.id, { runid: state.run.id, kind: "binding", name: variable.name, value: variable.value, at: variable.setat });
+        await refreshbadge();
+      }
+    });
+  } finally {
+    activeworkflowruns.delete(run.id);
+  }
+  await memory.setworkflowrun(result.run);
+  for (const entry of result.log) {
+    const stored = await memory.getrunlog(run.id);
+    if (!stored.some((candidate) => candidate.stepid === entry.stepid && candidate.startedat === entry.startedat)) await memory.addrunlogentry(run.id, entry);
+  }
+  await memory.setrunscopes(run.id, result.scopes);
+  const executed = result.run.cursor;
+  await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "run", detail: `Ran the workflow ${record2.name}`, runid: run.id, executed, total: record2.steps.length }, Date.now()));
+  await audit("workflow", `The run ${run.id} of the workflow ${record2.name} ended ${result.run.state} after ${executed} of ${record2.steps.length} steps${result.run.failreason !== void 0 ? ` with the failure ${result.run.failreason}` : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+  await refreshbadge();
+  return { ok: result.run.state === "done", summary: `The workflow run ended ${result.run.state} after ${executed} of ${record2.steps.length} steps.`, details: { runid: run.id, state: result.run.state, executed, total: record2.steps.length, ...result.run.failreason !== void 0 ? { failreason: result.run.failreason } : {} } };
+}
 async function executestep(stepid) {
   const session = await memory.getsession();
   const plan = await memory.getplan();
@@ -12485,7 +13520,10 @@ async function executestep(stepid) {
   if (!step) throw new Error("Reviewed step was not found.");
   const settings = await memory.getsettings();
   const verdicts = await memory.getsafeties();
-  const gate = canexecute({ session, plan, step, tabid: tab.id, origin, ...verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
+  return executeaction(step, session, plan, tab.id, origin, settings, verdicts.length > 0 ? verdicts : void 0, "plan");
+}
+async function executeaction(step, session, plan, tabid2, origin, settings, verdicts, mode) {
+  const gate = canexecute({ session, plan, step, tabid: tabid2, origin, ...verdicts !== void 0 && verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
   if (!gate.allowed) throw new Error(gate.reason);
   const capability = requiredcapability(step.kind);
   if (capability) {
@@ -12499,79 +13537,82 @@ async function executestep(stepid) {
       await enforcewindowreview(step, session, plan);
     }
     if (istabscommandkind(step.kind)) {
-      output = await executetabscommand(step, session, plan, tab.id);
+      output = await executetabscommand(step, session, plan, tabid2);
     } else if (isdatasetkind(step.kind)) {
-      output = await executedatastep(step, session, plan, tab.id, origin);
+      output = await executedatastep(step, session, plan, tabid2, origin);
     } else if (isfileskind(step.kind)) {
-      output = await executefilesstep(step, session, plan, tab.id, origin);
+      output = await executefilesstep(step, session, plan, tabid2, origin);
     } else if (isformkind(step.kind)) {
-      output = await executeformstep(step, session, plan, tab.id, origin);
+      output = await executeformstep(step, session, plan, tabid2, origin);
     } else if (isbrowserkind(step.kind)) {
-      output = await runbrowseraction(step, tab.id, tab.windowId ?? chrome.windows.WINDOW_ID_CURRENT);
+      output = await runbrowseraction(step, tabid2, chrome.windows.WINDOW_ID_CURRENT);
     } else if (step.kind === "keyhold") {
-      output = await executekeyhold(step, session, plan, tab.id, origin);
+      output = await executekeyhold(step, session, plan, tabid2, origin);
     } else if (step.kind === "keyrelease") {
-      output = await executekeyrelease(step, session, plan, tab.id, origin);
+      output = await executekeyrelease(step, session, plan, tabid2, origin);
     } else if (step.kind === "dismissdialog") {
-      output = await executedismissdialog(step, session, plan, tab.id, origin);
+      output = await executedismissdialog(step, session, plan, tabid2, origin);
     } else if (step.kind === "retryaction") {
-      output = await executeretryaction(step, session, plan, tab.id, origin);
+      output = await executeretryaction(step, session, plan, tabid2, origin);
     } else if (step.kind === "mapclicks") {
-      output = await executemapclicks(step, plan, tab.id, origin);
+      output = await executemapclicks(step, plan, tabid2, origin);
     } else if (step.kind === "enterframe") {
-      output = await executeenterframe(step, plan, tab.id, origin);
+      output = await executeenterframe(step, plan, tabid2, origin);
     } else if (watchstepkinds.has(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Watch kinds refuse to run outside an approved session plan.");
-      const watched = await executewatchstep(step, session, plan, tab.id, origin);
+      const watched = await executewatchstep(step, session, plan, tabid2, origin);
       output = watched.output;
       watchwindow = { startedat: watched.watch.startedat, lifetime: watched.watch.lifetime };
     } else if (step.kind === "diffsnapshots") {
-      output = await executediffsnapshots(step, session, plan, tab.id, origin);
+      output = await executediffsnapshots(step, session, plan, tabid2, origin);
     } else if (navigationstepkinds.has(step.kind)) {
-      output = await executenavigationkind(step, session, plan, tab.id, origin);
+      output = await executenavigationkind(step, session, plan, tabid2, origin);
     } else if (iscapturekind(step.kind)) {
-      output = await executecapturestep(step, session, plan, tab.id, origin);
+      output = await executecapturestep(step, session, plan, tabid2, origin);
     } else if (ismediakind(step.kind)) {
-      output = await executemediastep(step, session, plan, tab.id, origin);
+      output = await executemediastep(step, session, plan, tabid2, origin);
     } else if (ishttpkind(step.kind)) {
-      output = await executehttpstep(step, session, plan, tab.id, origin);
+      output = await executehttpstep(step, session, plan, tabid2, origin);
     } else if (issocketkind(step.kind)) {
-      output = await executesocketstep(step, session, plan, tab.id, origin);
+      output = await executesocketstep(step, session, plan, tabid2, origin);
     } else if (isnetwatchkind(step.kind)) {
-      output = await executenetwatchstep(step, session, plan, tab.id, origin);
+      output = await executenetwatchstep(step, session, plan, tabid2, origin);
     } else if (iscontrolkind(step.kind)) {
-      output = await executenetcontrolstep(step, session, plan, tab.id, origin);
+      output = await executenetcontrolstep(step, session, plan, tabid2, origin);
     } else if (isdebugkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Debugging kinds refuse to run outside an approved session plan.");
-      output = await executetimelinestep(step, session, plan, tab.id, origin);
+      output = await executetimelinestep(step, session, plan, tabid2, origin);
     } else if (iscdpkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Devtools protocol kinds refuse to run outside an approved session plan.");
-      output = await executecdpstep(step, session, plan, tab.id, origin);
+      output = await executecdpstep(step, session, plan, tabid2, origin);
     } else if (isprofilekind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Profiling kinds refuse to run outside an approved session plan.");
-      output = await executeprofilestep(step, session, plan, tab.id, origin);
+      output = await executeprofilestep(step, session, plan, tabid2, origin);
     } else if (isemulationkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Emulation kinds refuse to run outside an approved session plan.");
-      output = await executeemulationstep(step, session, plan, tab.id, origin);
+      output = await executeemulationstep(step, session, plan, tabid2, origin);
     } else if (issessionkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Session memory kinds refuse to run outside an approved session plan.");
-      output = await executesessionstep(step, session, plan, tab.id, origin);
+      output = await executesessionstep(step, session, plan, tabid2, origin);
+    } else if (isworkflowkind(step.kind)) {
+      if (!session || !plan || plan.state !== "approved") throw new Error("Workflow kinds refuse to run outside an approved session plan.");
+      output = await executeworkflowstep(step, session, plan, tabid2, origin);
     } else {
       if (step.target && freshcheckkinds.has(step.kind)) {
-        const fresh = await snapshot(tab.id);
+        const fresh = await snapshot(tabid2);
         if (!fresh.interactive.some((item) => item.selector === step.target)) throw new Error("The page changed and the target must be reviewed again.");
       }
-      output = await dispatchpagestep(step, tab.id, origin, plan);
+      output = await dispatchpagestep(step, tabid2, origin, plan);
     }
     return output;
   };
   const runplan = plan;
   const capturepolicystate = await runcapturepolicy();
   if (capturepolicystate === "beforeafter" && session && step.risk !== "read" && beforeafterwrapallowed(step.kind)) {
-    const before = await grabstateshot(step, session, runplan, tab.id, "before");
+    const before = await grabstateshot(step, session, runplan, tabid2, "before");
     output = await dispatchreviewedstep();
     if (output?.ok) {
-      const after = await grabstateshot(step, session, runplan, tab.id, "after");
+      const after = await grabstateshot(step, session, runplan, tabid2, "after");
       const domversion = await memory.getobservationversion();
       const paired = capturestates({ policy: "beforeafter", before, after, actionkind: step.kind, ...step.target ? { target: step.target } : {}, ...domversion !== void 0 ? { domsnapshotid: String(domversion) } : {}, at: Date.now(), id: randomid() });
       if (paired.pair) {
@@ -12583,7 +13624,7 @@ async function executestep(stepid) {
   } else {
     output = await dispatchreviewedstep();
   }
-  if (["navigate", "back", "forward"].includes(step.kind)) await recordnavigation(step, session, tab.id);
+  if (["navigate", "back", "forward"].includes(step.kind)) await recordnavigation(step, session, tabid2);
   await recordevidence(step, output, session, plan, origin);
   if (output?.ok && plan && typeof output.details?.tabid === "number") {
     await memory.setprogress(assigntasktab(await memory.getprogress(), plan.id, output.details.tabid, Date.now()));
@@ -12591,20 +13632,20 @@ async function executestep(stepid) {
   const summary = output?.summary ?? "The page action returned no result.";
   const resolved = output?.details?.resolvedtarget;
   if (resolved) {
-    await memory.addresolution({ stepid, mode: resolved.mode, selector: resolved.selector, label: resolved.label, at: Date.now() });
+    await memory.addresolution({ stepid: step.id, mode: resolved.mode, selector: resolved.selector, label: resolved.label, at: Date.now() });
   }
-  const outcome = { stepid, ok: Boolean(output?.ok), summary, ...output?.details ? { details: output.details } : {}, at: Date.now() };
+  const outcome = { stepid: step.id, ok: Boolean(output?.ok), summary, ...output?.details ? { details: output.details } : {}, at: Date.now() };
   const auditkind = stepauditkind(step, Boolean(output?.ok));
-  await audit(auditkind, summary, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid });
+  await audit(auditkind, summary, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid: step.id });
   await memory.addoutcome(outcome);
-  if (output?.ok && plan) {
+  if (output?.ok && plan && mode === "plan") {
     const base = await memory.getprogress();
-    const completed = watchwindow ? recordwatchcompletion(base, plan.id, stepid, watchwindow.startedat, watchwindow.lifetime, Date.now()) : recordstep(base, plan.id, stepid, Date.now());
+    const completed = watchwindow ? recordwatchcompletion(base, plan.id, step.id, watchwindow.startedat, watchwindow.lifetime, Date.now()) : recordstep(base, plan.id, step.id, Date.now());
     const tracked = recordoutcome(completed, plan.id, outcome, Date.now());
     await memory.setprogress(tracked);
     await memory.settaskstate(taskstateof({ runid: plan.id, stepcursor: tracked.completedsteps.length, outputs: tracked.outcomes ?? [], checkpointat: Date.now() }));
     const tracker = activememorytrackers.get(plan.id);
-    if (tracker) await sampleheapforstep(tracker, stepid, tab.id, origin, plan).catch(() => {
+    if (tracker) await sampleheapforstep(tracker, step.id, tabid2, origin, plan).catch(() => {
     });
     await updatetaskbadges(plan, tracked);
     await refreshbadge();
@@ -12799,11 +13840,12 @@ async function handlerequest(message, sender) {
       const autosnapshot = await memory.getautosnapshot();
       const crashed = await memory.getcrashflag();
       const sessionrecords = await memory.applysessionexpiry(snapshotretentionwindow(runsettings), Date.now());
+      const newestworkflowrun = (await memory.listworkflowruns())[0];
       const taskstate = plan ? await memory.gettaskstate(plan.id) : void 0;
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -13970,6 +15012,97 @@ async function handlerequest(message, sender) {
       await audit("session", "The user cleared the reviewed auto snapshot interval; on demand captures stay the only source of session records.");
       return { cleared: true };
     }
+    case "workflowreview": {
+      const inputreview = message;
+      const record2 = await memory.getworkflowrecord(inputreview.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputreview.workflowid ?? ""}.`);
+      return { record: record2, steps: record2.steps.map((entry) => ({ id: entry.id, kind: entry.kind, label: entry.label, ...entry.target !== void 0 ? { target: entry.target } : {}, ...entry.value !== void 0 ? { value: entry.value } : {}, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.bindings !== void 0 ? { bindings: entry.bindings } : {}, ...entry.expression !== void 0 ? { expression: entry.expression } : {}, ...entry.extract !== void 0 ? { extract: entry.extract } : {} })), blocks: record2.blocks, risk: record2.risk, origins: record2.origins };
+    }
+    case "approveworkflowrun": {
+      const inputapprove = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Workflow runs need an active browser session behind the consent gates.");
+      const record2 = await memory.getworkflowrecord(inputapprove.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputapprove.workflowid ?? ""}.`);
+      await audit("workflow", `The user approved the run review of the workflow ${record2.name} version ${record2.version} with its ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"} shown; the run still passes every consent gate per step.`, { sessionid: session.id });
+      return { approved: true, steps: record2.steps.length, risk: record2.risk };
+    }
+    case "executeworkflowstep": {
+      const inputsingle = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || !plan || plan.state !== "approved") throw new Error("Single step execution needs an approved session plan.");
+      const stored = await memory.getrun(inputsingle.runid?.trim() ?? "");
+      if (!stored) throw new Error(`No workflow run matches ${inputsingle.runid ?? ""}.`);
+      const record2 = await memory.getworkflowrecord(stored.run.workflowid);
+      if (!record2) throw new Error("The workflow of the run is no longer composed in the library.");
+      const step = record2.steps.find((entry) => entry.id === (inputsingle.stepid ?? ""));
+      if (!step) throw new Error(`No step of the workflow matches ${inputsingle.stepid ?? ""}.`);
+      const { tab, origin } = await activecontext();
+      const executed = await runstep({ step, scopes: await memory.getrunscopes(stored.run.id), outputs: {}, execute: async (dispatched) => dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin }), now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
+      await memory.addrunlogentry(stored.run.id, executed.log);
+      await memory.setrunscopes(stored.run.id, executed.scopes);
+      const stepindex = record2.steps.findIndex((entry) => entry.id === step.id);
+      const isthenext = stepindex === stored.run.cursor && executed.output.ok;
+      if (isthenext) await memory.setworkflowrun({ ...stored.run, cursor: stored.run.cursor + 1 });
+      await audit("workflow", `Executed the single step ${step.label} of the run ${stored.run.id} outside the run loop${isthenext ? " and advanced its checkpoint" : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+      return workflowoutcome({ run: { ...stored.run, ...isthenext ? { cursor: stored.run.cursor + 1 } : {} }, entries: await memory.getrunlog(stored.run.id), stepid: step.id });
+    }
+    case "pauseworkflowrun": {
+      const inputpause = message;
+      const stored = (await memory.listworkflowruns()).find((entry) => entry.id === (inputpause.runid ?? ""));
+      if (!stored) throw new Error(`No workflow run matches ${inputpause.runid ?? ""}.`);
+      const guards = activeworkflowruns.get(stored.id);
+      if (guards) guards.cancelled = true;
+      const paused = pauserun(stored, Date.now());
+      await memory.setworkflowrun(paused);
+      await audit("workflow", `Paused the workflow run ${paused.id} at the checkpoint of step cursor ${paused.cursor}; the resume continues exactly there.`, {});
+      await refreshbadge();
+      return { runid: paused.id, state: paused.state, cursor: paused.cursor };
+    }
+    case "resumeworkflowrun": {
+      const inputresume = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || !plan || plan.state !== "approved") throw new Error("The run resume needs an approved session plan.");
+      const stored = await memory.getrun(inputresume.runid?.trim() ?? "");
+      if (!stored) throw new Error(`No workflow run matches ${inputresume.runid ?? ""}.`);
+      if (stored.run.state !== "paused" && stored.run.state !== "running") throw new Error(`The workflow run is already ${stored.run.state}.`);
+      const record2 = await memory.getworkflowrecord(stored.run.workflowid);
+      if (!record2) throw new Error("The workflow of the run is no longer composed in the library.");
+      const scopes = await memory.getrunscopes(stored.run.id);
+      const log = await memory.getrunlog(stored.run.id);
+      const { tab, origin } = await activecontext();
+      const resumed = await runworkflow({ record: record2, run: stored.run, scopes, log, execute: async (dispatched) => dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin }), now: Date.now(), gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) }, oncheckpoint: async (state) => {
+        await memory.setworkflowrun(state.run);
+        const last = state.log[state.log.length - 1];
+        if (last) await memory.addrunlogentry(state.run.id, last);
+        await memory.setrunscopes(state.run.id, state.scopes);
+      } });
+      await memory.setworkflowrun(resumed.run);
+      await memory.setrunscopes(stored.run.id, resumed.scopes);
+      await audit("workflow", `Resumed the workflow run ${stored.run.id} from the checkpoint at step cursor ${stored.run.cursor}; the run ended ${resumed.run.state} at cursor ${resumed.run.cursor}.`, { sessionid: session.id, planid: plan.id });
+      await refreshbadge();
+      return { runid: resumed.run.id, state: resumed.run.state, cursor: resumed.run.cursor };
+    }
+    case "cancelworkflowrun": {
+      const inputcancel = message;
+      const stored = (await memory.listworkflowruns()).find((entry) => entry.id === (inputcancel.runid ?? ""));
+      if (!stored) throw new Error(`No workflow run matches ${inputcancel.runid ?? ""}.`);
+      const guards = activeworkflowruns.get(stored.id);
+      if (guards) guards.cancelled = true;
+      const cancelled = cancelrun(stored, typeof inputcancel.reason === "string" && inputcancel.reason.trim() ? inputcancel.reason.trim() : "user cancel", Date.now());
+      await memory.setworkflowrun(cancelled);
+      await audit("workflow", `Cancelled the workflow run ${cancelled.id} with the reason ${cancelled.cancelreason ?? "user cancel"} at step cursor ${cancelled.cursor}.`, {});
+      await refreshbadge();
+      return { runid: cancelled.id, state: cancelled.state, cancelreason: cancelled.cancelreason };
+    }
+    case "workflowoutcome": {
+      const inputoutcome = message;
+      const stored = await memory.getrun(inputoutcome.runid?.trim() ?? "");
+      if (!stored) throw new Error(`No workflow run matches ${inputoutcome.runid ?? ""}.`);
+      return workflowoutcome({ run: stored.run, entries: stored.log, ...inputoutcome.stepid !== void 0 && inputoutcome.stepid !== "" ? { stepid: inputoutcome.stepid } : {} });
+    }
     default:
       throw new Error("Unknown Devthink request.");
   }
@@ -13994,7 +15127,15 @@ async function detectcrash() {
 }
 chrome.runtime.onStartup.addListener(() => {
   void detectcrash();
+  void pauseinterruptedworkflowruns();
 });
+async function pauseinterruptedworkflowruns() {
+  for (const run of await memory.listworkflowruns()) {
+    if (run.state !== "running") continue;
+    await memory.setworkflowrun({ ...run, state: "paused", pausedat: Date.now() });
+    await audit("workflow", `The service worker restart paused the workflow run ${run.id} at its last checkpoint of step cursor ${run.cursor}; the resume continues exactly there.`, {});
+  }
+}
 async function maybeautosnapshot() {
   const state = await memory.getautosnapshot();
   if (!state || !Number.isFinite(state.interval.period)) return;