@wenathlan/extension 1.1.49 → 1.1.51

package/extension/dist/background.js

@@ -2113,6 +2113,104 @@ var sessionmemory = class {
   async setcrashflag(value) {
     return this.adapter.set("crashed", value);
   }
+  /** Stores one composed workflow record version with its timestamp; re-composing the same version replaces it while older versions survive for the audit trail. */
+  async addworkflowrecord(record2) {
+    const records = await this.getworkflowrecordversions();
+    const remaining = records.filter((entry) => !(entry.id === record2.id && entry.version === record2.version));
+    await this.adapter.set("workflowrecords", [record2, ...remaining]);
+  }
+  /** Returns every stored workflow record version, newest first. */
+  async getworkflowrecordversions() {
+    return await this.adapter.get("workflowrecords") ?? [];
+  }
+  /** Returns the latest stored version of one workflow record. */
+  async getworkflowrecord(id) {
+    return (await this.getworkflowrecordversions()).find((entry) => entry.id === id);
+  }
+  /** Lists the saved workflow records, the latest version of each, newest first. */
+  async listworkflows() {
+    const seen = /* @__PURE__ */ new Set();
+    const latest = [];
+    for (const entry of await this.getworkflowrecordversions()) {
+      if (seen.has(entry.id)) continue;
+      seen.add(entry.id);
+      latest.push(entry);
+    }
+    return latest;
+  }
+  /** Stores one workflow run with its state transition; a run replace keeps the full runlog of the same id. */
+  async setworkflowrun(run) {
+    const runs = await this.listworkflowruns();
+    const remaining = runs.filter((entry) => entry.id !== run.id);
+    await this.adapter.set("workflowruns", [run, ...remaining]);
+  }
+  /** Returns every stored workflow run, newest first. */
+  async listworkflowruns() {
+    return await this.adapter.get("workflowruns") ?? [];
+  }
+  /** Returns one run with its full step outcome list so the panel shows the timeline after and during a run. */
+  async getrun(id) {
+    const run = (await this.listworkflowruns()).find((entry) => entry.id === id);
+    if (!run) return void 0;
+    return { run, log: await this.getrunlog(id) };
+  }
+  /** Records one runlog entry of a run; the runlog retention window is a user setting and an absent window keeps every entry. */
+  async addrunlogentry(runid, entry) {
+    const entries = await this.getrunlog(runid);
+    const combined = [...entries, entry];
+    const retention = (await this.getsettings())?.runlogretention;
+    await this.adapter.set(`runlog${runid}`, retention === void 0 ? combined : combined.slice(-retention));
+  }
+  /** Returns the runlog of one run, oldest first. */
+  async getrunlog(runid) {
+    return await this.adapter.get(`runlog${runid}`) ?? [];
+  }
+  /** Stores the variable values per scope of one run for inspection after the run. */
+  async setrunscopes(runid, scopes) {
+    return this.adapter.set(`runscopes${runid}`, scopes);
+  }
+  /** Returns the variable scopes of one run, oldest first. */
+  async getrunscopes(runid) {
+    return await this.adapter.get(`runscopes${runid}`) ?? [];
+  }
+  /** Records one provenance entry of a run: an expression result or a regex capture with its name, value and time. */
+  async addworkflowprovenance(runid, entry) {
+    const entries = await this.getworkflowprovenance(runid);
+    await this.adapter.set(`workflowprovenance${runid}`, [...entries, entry]);
+  }
+  /** Returns every provenance entry of one run, oldest first. */
+  async getworkflowprovenance(runid) {
+    return await this.adapter.get(`workflowprovenance${runid}`) ?? [];
+  }
+  /** Stores one shareable step template under its unique name. */
+  async addsteptemplate(template) {
+    const templates = (await this.getsteptemplates()).filter((entry) => entry.name !== template.name);
+    await this.adapter.set("steptemplates", [template, ...templates]);
+  }
+  /** Returns every stored step template, newest first. */
+  async getsteptemplates() {
+    return await this.adapter.get("steptemplates") ?? [];
+  }
+  /** Records one control flow decision of a run — a branch choice with its reason, the loop counters of an iteration trail, the retry attempts with their backoff durations, the timeout aborts with the exceeded budget, the join record with its strategy and conflicts or the catch handler execution — so the audit trail keeps every control flow turn. */
+  async addcontroldecision(runid, decision) {
+    const decisions = await this.listcontroldecisions(runid);
+    await this.adapter.set(`controldecisions${runid}`, [...decisions, { ...decision, runid }]);
+  }
+  /** Returns every stored control flow decision of one run, oldest first. */
+  async listcontroldecisions(runid) {
+    return await this.adapter.get(`controldecisions${runid}`) ?? [];
+  }
+  /** Returns the past branch decisions of one workflow across every stored run, oldest first, so review can compare branch paths over time. */
+  async getbranchhistory(workflowid) {
+    const runs = await this.listworkflowruns();
+    const ordered = [...runs].reverse().filter((run) => run.workflowid === workflowid);
+    const history2 = [];
+    for (const run of ordered) {
+      const decisions = await this.listcontroldecisions(run.id);
+      for (const decision of decisions) if (decision.kind === "branch" && decision.branch !== void 0) history2.push(decision.branch);
+    }
+    return history2;
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -3099,6 +3197,1194 @@ function teardowncdpsession(input) {
   };
 }
 
+// controlflow.ts
+var controlflowkinds = ["condition", "branch", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"];
+var defaultloopbound = 1e3;
+function iscontrolflowkind(kind) {
+  return controlflowkinds.includes(kind);
+}
+var cancellederror = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "cancellederror";
+  }
+};
+function controlname(value) {
+  return typeof value === "string" && /^[a-z][a-z0-9]*$/.test(value) ? value : void 0;
+}
+function controlstepslist(value) {
+  if (!Array.isArray(value) || value.length === 0) return void 0;
+  const steps = [];
+  for (const entry of value) {
+    const parsed = workflowstepof(entry);
+    if (!parsed) return void 0;
+    steps.push(parsed);
+  }
+  return steps;
+}
+function controlbound(value) {
+  if (value === void 0) return void 0;
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
+function conditionof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const expression = expressionof(candidate.expression);
+  if (!expression) return void 0;
+  if (expression.resultkind !== "boolean") return void 0;
+  return { expression };
+}
+function elseof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const name = controlname(candidate.name);
+  if (!name) return void 0;
+  if (candidate.when !== void 0) return void 0;
+  if (!Array.isArray(candidate.steps)) return void 0;
+  const steps = [];
+  for (const entry of candidate.steps) {
+    const parsed = workflowstepof(entry);
+    if (!parsed) return void 0;
+    steps.push(parsed);
+  }
+  return { name, steps };
+}
+function branchof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (!Array.isArray(candidate.paths) || candidate.paths.length === 0) return void 0;
+  const paths = [];
+  for (const entry of candidate.paths) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return void 0;
+    const path = entry;
+    const name = controlname(path.name);
+    if (!name) return void 0;
+    const when = path.when === void 0 ? void 0 : expressionof(path.when);
+    if (path.when !== void 0 && when === void 0) return void 0;
+    if (when !== void 0 && when.resultkind !== "boolean") return void 0;
+    const steps = controlstepslist(path.steps);
+    if (!steps) return void 0;
+    paths.push({ name, ...when !== void 0 ? { when } : {}, steps });
+  }
+  const names = paths.map((path) => path.name);
+  if (new Set(names).size !== names.length) return void 0;
+  const elsepath = elseof(candidate.else);
+  if (!elsepath) return void 0;
+  if (names.includes(elsepath.name)) return void 0;
+  return { paths, else: elsepath };
+}
+function loopof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const list = controlname(candidate.list);
+  const item = controlname(candidate.item);
+  const index = controlname(candidate.index);
+  if (!list || !item || !index) return void 0;
+  if (item === list || index === list || item === index) return void 0;
+  const bound = controlbound(candidate.bound);
+  if (candidate.bound !== void 0 && bound === void 0) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { list, item, index, ...bound !== void 0 ? { bound } : {}, steps };
+}
+function repeatuntilof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const until = expressionof(candidate.until);
+  if (!until || until.resultkind !== "boolean") return void 0;
+  const bound = controlbound(candidate.bound);
+  if (candidate.bound !== void 0 && bound === void 0) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { until, ...bound !== void 0 ? { bound } : {}, steps };
+}
+function whileof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const condition = expressionof(candidate.while);
+  if (!condition || condition.resultkind !== "boolean") return void 0;
+  const bound = controlbound(candidate.bound);
+  if (bound === void 0) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { while: condition, bound, steps };
+}
+function foreachof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.selector !== "string" || !candidate.selector.trim()) return void 0;
+  const item = controlname(candidate.item);
+  const index = controlname(candidate.index);
+  if (!item || !index || item === index) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { selector: candidate.selector, item, index, steps };
+}
+function parallelof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (!Array.isArray(candidate.branches) || candidate.branches.length === 0) return void 0;
+  const branches = [];
+  for (const entry of candidate.branches) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return void 0;
+    const branch = entry;
+    const id = controlname(branch.id);
+    if (!id) return void 0;
+    const steps = controlstepslist(branch.steps);
+    if (!steps) return void 0;
+    branches.push({ id, steps });
+  }
+  if (new Set(branches.map((branch) => branch.id)).size !== branches.length) return void 0;
+  const join = candidate.join && typeof candidate.join === "object" && !Array.isArray(candidate.join) ? candidate.join : void 0;
+  if (!join) return void 0;
+  if (join.strategy !== "first" && join.strategy !== "last" && join.strategy !== "fail") return void 0;
+  if (join.onfail !== "cancel" && join.onfail !== "continue") return void 0;
+  return { branches, join: { strategy: join.strategy, onfail: join.onfail } };
+}
+function tryof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  const catchcandidate = candidate.catch && typeof candidate.catch === "object" && !Array.isArray(candidate.catch) ? candidate.catch : void 0;
+  if (!catchcandidate) return void 0;
+  const catchsteps = controlstepslist(catchcandidate.steps);
+  if (!catchsteps) return void 0;
+  if (catchcandidate.rerun !== void 0 && typeof catchcandidate.rerun !== "boolean") return void 0;
+  const catchvalue = { steps: catchsteps, ...catchcandidate.rerun === true ? { rerun: true } : {} };
+  let retry;
+  if (candidate.retry !== void 0) {
+    const retrycandidate = candidate.retry && typeof candidate.retry === "object" && !Array.isArray(candidate.retry) ? candidate.retry : void 0;
+    if (!retrycandidate) return void 0;
+    if (typeof retrycandidate.attempts !== "number" || !Number.isInteger(retrycandidate.attempts) || retrycandidate.attempts < 1) return void 0;
+    const backoff = retrycandidate.backoff && typeof retrycandidate.backoff === "object" && !Array.isArray(retrycandidate.backoff) ? retrycandidate.backoff : void 0;
+    if (!backoff) return void 0;
+    if (backoff.shape !== "fixed" && backoff.shape !== "exponential") return void 0;
+    if (typeof backoff.base !== "number" || !Number.isFinite(backoff.base) || backoff.base < 0) return void 0;
+    if (typeof backoff.jitter !== "number" || !Number.isFinite(backoff.jitter) || backoff.jitter < 0) return void 0;
+    if (!Array.isArray(retrycandidate.retryable) || !retrycandidate.retryable.every((entry) => typeof entry === "string" && entry.trim())) return void 0;
+    retry = { attempts: retrycandidate.attempts, backoff: { shape: backoff.shape, base: backoff.base, jitter: backoff.jitter }, retryable: retrycandidate.retryable };
+  }
+  let timeout;
+  if (candidate.timeout !== void 0) {
+    const timeoutcandidate = candidate.timeout && typeof candidate.timeout === "object" && !Array.isArray(candidate.timeout) ? candidate.timeout : void 0;
+    if (!timeoutcandidate) return void 0;
+    const stepms = timeoutcandidate.stepms === void 0 ? void 0 : typeof timeoutcandidate.stepms === "number" && Number.isFinite(timeoutcandidate.stepms) && timeoutcandidate.stepms > 0 ? timeoutcandidate.stepms : void 0;
+    const runms = timeoutcandidate.runms === void 0 ? void 0 : typeof timeoutcandidate.runms === "number" && Number.isFinite(timeoutcandidate.runms) && timeoutcandidate.runms > 0 ? timeoutcandidate.runms : void 0;
+    if (stepms === void 0 && runms === void 0) return void 0;
+    if (timeoutcandidate.stepms !== void 0 && stepms === void 0) return void 0;
+    if (timeoutcandidate.runms !== void 0 && runms === void 0) return void 0;
+    timeout = { ...stepms !== void 0 ? { stepms } : {}, ...runms !== void 0 ? { runms } : {} };
+  }
+  return { steps, catch: catchvalue, ...retry !== void 0 ? { retry } : {}, ...timeout !== void 0 ? { timeout } : {} };
+}
+function controloptions(step) {
+  if (step.options === void 0) throw new Error(`The ${step.kind} step needs its reviewed control payload in options.`);
+  let parsed;
+  try {
+    parsed = JSON.parse(step.options);
+  } catch {
+    throw new Error(`The ${step.kind} control payload must be a JSON object.`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`The ${step.kind} control payload must be a JSON object.`);
+  return parsed;
+}
+function validatecontrolpayload(step) {
+  if (!iscontrolflowkind(step.kind)) return;
+  const payload = controloptions(step);
+  if (step.kind === "condition" && conditionof(payload.condition) === void 0) throw new Error("The condition step needs a reviewed boolean expression in its options.");
+  if (step.kind === "branch" && branchof(payload.branch) === void 0) throw new Error("The branch step needs reviewed unique paths with boolean match expressions and an else path in its options.");
+  if (step.kind === "loop" && loopof(payload.loop) === void 0) throw new Error("The loop step needs a reviewed list variable, distinct item and index variables, an optional positive safety bound and a non-empty body in its options.");
+  if (step.kind === "repeatuntil" && repeatuntilof(payload.repeatuntil) === void 0) throw new Error("The repeat until step needs a reviewed convergence expression, an optional positive safety bound and a non-empty body in its options.");
+  if (step.kind === "whileloop" && whileof(payload.while) === void 0) throw new Error("The while step needs a reviewed condition, a mandatory positive safety bound and a non-empty body in its options.");
+  if (step.kind === "foreach" && foreachof(payload.foreach) === void 0) throw new Error("The foreach step needs a reviewed non-empty selector, distinct item and index variables and a non-empty body in its options.");
+  if (step.kind === "parallel" && parallelof(payload.parallel) === void 0) throw new Error("The parallel step needs uniquely identified branches with bodies and a join policy of the first, last or fail strategy with cancel or continue on branch failure in its options.");
+  if (step.kind === "trycatch" && tryof(payload.try) === void 0) throw new Error("The try step needs a fragile body, a catch handler and optional retry and timeout policies in its options.");
+}
+function controlsteps(step) {
+  if (!iscontrolflowkind(step.kind)) return [];
+  let payload;
+  try {
+    payload = controloptions(step);
+  } catch {
+    return [];
+  }
+  const children = [];
+  const collect = (steps) => {
+    for (const child of steps) {
+      children.push(child);
+      collect(controlsteps(child));
+    }
+  };
+  if (step.kind === "condition") return children;
+  if (step.kind === "branch") {
+    const branch = branchof(payload.branch);
+    if (!branch) return children;
+    for (const path of branch.paths) collect(path.steps);
+    collect(branch.else.steps);
+    return children;
+  }
+  if (step.kind === "loop") {
+    const loop = loopof(payload.loop);
+    if (loop) collect(loop.steps);
+    return children;
+  }
+  if (step.kind === "repeatuntil") {
+    const repeat = repeatuntilof(payload.repeatuntil);
+    if (repeat) collect(repeat.steps);
+    return children;
+  }
+  if (step.kind === "whileloop") {
+    const condition = whileof(payload.while);
+    if (condition) collect(condition.steps);
+    return children;
+  }
+  if (step.kind === "foreach") {
+    const foreach = foreachof(payload.foreach);
+    if (foreach) collect(foreach.steps);
+    return children;
+  }
+  if (step.kind === "parallel") {
+    const parallel = parallelof(payload.parallel);
+    if (parallel) for (const branch of parallel.branches) collect(branch.steps);
+    return children;
+  }
+  const fragile = tryof(payload.try);
+  if (fragile) {
+    collect(fragile.steps);
+    collect(fragile.catch.steps);
+  }
+  return children;
+}
+function controlsummary(step) {
+  if (!iscontrolflowkind(step.kind)) return void 0;
+  let payload;
+  try {
+    payload = controloptions(step);
+  } catch {
+    return { kind: step.kind };
+  }
+  if (step.kind === "condition") {
+    const condition = conditionof(payload.condition);
+    return { kind: step.kind, ...condition ? { expression: `${condition.expression.operator} into ${condition.expression.result}` } : {} };
+  }
+  if (step.kind === "branch") {
+    const branch = branchof(payload.branch);
+    return { kind: step.kind, ...branch ? { paths: branch.paths.map((path) => path.name), elsepath: branch.else.name } : {} };
+  }
+  if (step.kind === "loop") {
+    const loop = loopof(payload.loop);
+    return { kind: step.kind, ...loop ? { list: loop.list, item: loop.item, index: loop.index, ...loop.bound !== void 0 ? { bound: loop.bound } : { bound: defaultloopbound } } : {} };
+  }
+  if (step.kind === "repeatuntil") {
+    const repeat = repeatuntilof(payload.repeatuntil);
+    return { kind: step.kind, ...repeat ? { bound: repeat.bound ?? defaultloopbound } : {} };
+  }
+  if (step.kind === "whileloop") {
+    const condition = whileof(payload.while);
+    return { kind: step.kind, ...condition ? { bound: condition.bound } : {} };
+  }
+  if (step.kind === "foreach") {
+    const foreach = foreachof(payload.foreach);
+    return { kind: step.kind, ...foreach ? { selector: foreach.selector, item: foreach.item, index: foreach.index } : {} };
+  }
+  if (step.kind === "parallel") {
+    const parallel = parallelof(payload.parallel);
+    return { kind: step.kind, ...parallel ? { branches: parallel.branches.map((branch) => branch.id), strategy: parallel.join.strategy, onfail: parallel.join.onfail } : {} };
+  }
+  const fragile = tryof(payload.try);
+  return { kind: step.kind, ...fragile ? { ...fragile.retry !== void 0 ? { attempts: fragile.retry.attempts, backoff: `${fragile.retry.backoff.shape} base ${fragile.retry.backoff.base} jitter ${fragile.retry.backoff.jitter}` } : {}, ...fragile.catch.rerun === true ? { rerun: true } : {}, ...fragile.timeout?.stepms !== void 0 ? { stepms: fragile.timeout.stepms } : {}, ...fragile.timeout?.runms !== void 0 ? { runms: fragile.timeout.runms } : {} } : {} };
+}
+function evaluatecondition(condition, scopes) {
+  const value = expressioneval(condition.expression, scopes);
+  if (typeof value !== "boolean") throw new Error("The condition expression must resolve to a boolean.");
+  return value;
+}
+function choosebranch(input) {
+  let scopes = input.scopes;
+  if (input.pagestate !== void 0) {
+    const parent = scopes.length > 0 ? scopes[scopes.length - 1].name : void 0;
+    scopes = pushscope(scopes, `pagestate${input.stepid}`, parent);
+    if (input.pagestate.url !== void 0) scopes = setvariable(scopes, "pageurl", "string", input.pagestate.url, input.now);
+    if (input.pagestate.title !== void 0) scopes = setvariable(scopes, "pagetitle", "string", input.pagestate.title, input.now);
+    if (input.pagestate.ready !== void 0) scopes = setvariable(scopes, "pageready", "boolean", input.pagestate.ready, input.now);
+  }
+  for (const path of input.branch.paths) {
+    if (path.when === void 0) return { outcome: { stepid: input.stepid, path: path.name, reason: `The path ${path.name} matches unconditionally.`, at: input.now }, steps: path.steps };
+    const value = expressioneval(path.when, scopes);
+    if (typeof value !== "boolean") throw new Error(`The branch path ${path.name} needs a boolean expression.`);
+    if (value) return { outcome: { stepid: input.stepid, path: path.name, reason: `The condition of the path ${path.name} holds.`, at: input.now }, steps: path.steps };
+  }
+  return { outcome: { stepid: input.stepid, path: input.branch.else.name, reason: "No path condition held and the else path ran.", at: input.now }, steps: input.branch.else.steps };
+}
+async function runbody(input) {
+  let scopes = input.scopes;
+  const outputs = { ...input.outputs };
+  const log = [];
+  for (const child of input.steps) {
+    if (iscontrolflowkind(child.kind)) {
+      const result = await runcontrolstep({ step: child, scopes, outputs, execute: input.execute, now: input.now, ...input.path !== void 0 ? { path: `${input.path}.${child.id}` } : {} });
+      scopes = result.scopes;
+      log.push(...result.log);
+      outputs[child.id] = { stepid: child.id, ok: result.output.ok, summary: result.output.summary, ...result.output.details !== void 0 ? { details: result.output.details } : {}, at: input.now };
+      if (!result.output.ok) return { ok: false, scopes, log, outputs, failure: result.output };
+      continue;
+    }
+    const executed = await runstep({ step: child, scopes, outputs, execute: input.execute, now: input.now });
+    scopes = executed.scopes;
+    if (executed.childlog !== void 0) log.push(...executed.childlog);
+    log.push(executed.log);
+    outputs[child.id] = { stepid: child.id, ok: executed.output.ok, summary: executed.output.summary, ...executed.output.details !== void 0 ? { details: executed.output.details } : {}, at: input.now };
+    if (!executed.output.ok) return { ok: false, scopes, log, outputs, failure: executed.output };
+  }
+  return { ok: true, scopes, log, outputs };
+}
+function deepcopy(value) {
+  if (Array.isArray(value)) return value.map(deepcopy);
+  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, deepcopy(entry)]));
+  return value;
+}
+function iterationentry(step, iteration, total, ok, now) {
+  return { stepid: step.id, label: `${step.label} iteration ${iteration + 1}`, state: ok ? "done" : "failed", startedat: now, duration: 0, summary: `Iteration ${iteration + 1} of ${total}.`, details: { iteration, total } };
+}
+async function runloop(input) {
+  const list = resolvevariable(input.scopes, input.loop.list);
+  if (!list) throw new Error(`The loop references the undefined list variable ${input.loop.list}.`);
+  if (list.kind !== "list") throw new Error(`The loop variable ${input.loop.list} is not a list.`);
+  const items = list.value;
+  const bound = input.loop.bound ?? defaultloopbound;
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  if (items.length > bound) {
+    return { ok: false, scopes: input.scopes, log: [], summary: `The loop list holds ${items.length} items and exceeds the reviewed safety bound of ${bound} iterations; nothing ran.`, decision };
+  }
+  let scopes = input.scopes;
+  const log = [];
+  for (let index = 0; index < items.length; index += 1) {
+    scopes = setvariable(scopes, input.loop.item, "string", deepcopy(items[index]), input.now);
+    scopes = setvariable(scopes, input.loop.index, "number", index, input.now);
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.loop.steps, path: `${input.path ?? input.step.id}[${index}]` });
+    scopes = body.scopes;
+    const ok = body.ok;
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${index}]`, iteration: index, ok, at: input.now });
+    log.push(...body.log, iterationentry(input.step, index, items.length, ok, input.now));
+    if (!ok) return { ok: false, scopes, log, summary: `The loop failed at iteration ${index + 1} of ${items.length}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The loop ran ${items.length} iteration${items.length === 1 ? "" : "s"} over ${input.loop.list} inside the reviewed safety bound of ${bound}.`, decision };
+}
+async function runrepeatuntil(input) {
+  const bound = input.repeat.bound ?? defaultloopbound;
+  let scopes = input.scopes;
+  const log = [];
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  for (let iteration = 0; iteration < bound; iteration += 1) {
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.repeat.steps, path: `${input.path ?? input.step.id}[${iteration}]` });
+    scopes = body.scopes;
+    log.push(...body.log);
+    const converged = evaluatecondition({ expression: input.repeat.until }, scopes);
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${iteration}]`, iteration, ok: body.ok, at: input.now });
+    if (!body.ok) return { ok: false, scopes, log, summary: `The repeat until failed at iteration ${iteration + 1}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+    log.push(iterationentry(input.step, iteration, bound, true, input.now));
+    if (converged) return { ok: true, scopes, log, summary: `The repeat until converged after ${iteration + 1} iteration${iteration === 0 ? "" : "s"} inside the reviewed safety bound of ${bound}.`, decision };
+  }
+  return { ok: false, scopes, log, summary: `The repeat until never converged within the reviewed safety bound of ${bound} iterations.`, decision };
+}
+async function runwhile(input) {
+  let scopes = input.scopes;
+  const log = [];
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  for (let iteration = 0; iteration < input.condition.bound; iteration += 1) {
+    if (!evaluatecondition({ expression: input.condition.while }, scopes)) {
+      return { ok: true, scopes, log, summary: `The while loop ended after ${iteration} iteration${iteration === 1 ? "" : "s"} because its condition stopped holding inside the reviewed safety bound of ${input.condition.bound}.`, decision };
+    }
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.condition.steps, path: `${input.path ?? input.step.id}[${iteration}]` });
+    scopes = body.scopes;
+    log.push(...body.log);
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${iteration}]`, iteration, ok: body.ok, at: input.now });
+    if (!body.ok) return { ok: false, scopes, log, summary: `The while loop failed at iteration ${iteration + 1}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+    log.push(iterationentry(input.step, iteration, input.condition.bound, true, input.now));
+  }
+  if (evaluatecondition({ expression: input.condition.while }, scopes)) {
+    return { ok: false, scopes, log, summary: `The while loop hit its reviewed safety bound of ${input.condition.bound} iterations while its condition still held; the overflow is reported instead of looping forever.`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The while loop ended after ${input.condition.bound} iteration${input.condition.bound === 1 ? "" : "s"} inside the reviewed safety bound.`, decision };
+}
+async function runforeach(input) {
+  if (!input.resolveelements) throw new Error("The foreach step needs the element resolver of the executor seam.");
+  const elements = await input.resolveelements(input.foreach.selector);
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  if (elements.length === 0) return { ok: true, scopes: input.scopes, log: [], summary: `The selector ${input.foreach.selector} matched no element and the foreach ran zero iterations.`, decision };
+  let scopes = input.scopes;
+  const log = [];
+  for (let index = 0; index < elements.length; index += 1) {
+    scopes = setvariable(scopes, input.foreach.item, "element", deepcopy(elements[index]), input.now);
+    scopes = setvariable(scopes, input.foreach.index, "number", index, input.now);
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.foreach.steps, path: `${input.path ?? input.step.id}[${index}]` });
+    scopes = body.scopes;
+    const ok = body.ok;
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${index}]`, iteration: index, ok, at: input.now });
+    log.push(...body.log, iterationentry(input.step, index, elements.length, ok, input.now));
+    if (!ok) return { ok: false, scopes, log, summary: `The foreach failed at iteration ${index + 1} of ${elements.length}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The foreach ran ${elements.length} iteration${elements.length === 1 ? "" : "s"} over the elements of ${input.foreach.selector}.`, decision };
+}
+function joinbranches(input) {
+  const contributing = input.branches.filter((branch) => !branch.cancelled);
+  const byname = /* @__PURE__ */ new Map();
+  for (const branch of contributing) for (const variable of branch.variables) {
+    const entries = byname.get(variable.name) ?? [];
+    entries.push({ order: branch.order, value: variable });
+    byname.set(variable.name, entries);
+  }
+  const conflicts = [...byname.entries()].filter(([, entries]) => entries.length > 1).map(([name]) => name);
+  const record2 = { stepid: input.stepid, strategy: input.strategy, conflicts, merged: [], at: input.now };
+  if (conflicts.length > 0 && input.strategy === "fail") {
+    return { ok: false, conflicts, merged: [], record: record2, summary: `The join refused the conflicting writes of ${conflicts.join(", ")} under the fail strategy.` };
+  }
+  const merged = [];
+  for (const [name, entries] of byname) {
+    void name;
+    const winner = input.strategy === "first" ? entries.reduce((left, right) => left.order <= right.order ? left : right) : entries.reduce((left, right) => left.order >= right.order ? left : right);
+    merged.push({ ...winner.value, setat: input.now });
+  }
+  record2.merged = merged.map((variable) => variable.name);
+  return { ok: true, conflicts, merged, record: record2, summary: `The join merged ${merged.length} variable${merged.length === 1 ? "" : "s"} under the ${input.strategy} strategy${conflicts.length > 0 ? ` with the conflicts ${conflicts.join(", ")} resolved by the strategy` : " with no conflict"}.` };
+}
+async function runparallel(input) {
+  let finished = 0;
+  let firstfailure = Number.POSITIVE_INFINITY;
+  const log = [];
+  const launches = input.parallel.branches.map((branch, order) => (async () => {
+    const parent = input.scopes.length > 0 ? input.scopes[input.scopes.length - 1].name : void 0;
+    const isolated = pushscope(input.scopes, `branch${branch.id}`, parent);
+    const body = await runbody({ step: input.step, scopes: isolated, outputs: input.outputs, execute: input.execute, now: input.now, steps: branch.steps });
+    const finishedat = finished;
+    finished += 1;
+    if (!body.ok && finishedat < firstfailure) firstfailure = finishedat;
+    const scope = body.scopes[body.scopes.length - 1];
+    return { branch, order, finishedat, ok: body.ok, scopes: body.scopes, variables: scope.name === `branch${branch.id}` ? scope.variables : [], log: body.log, failure: body.failure };
+  })());
+  const settled = await Promise.all(launches);
+  for (const entry of settled) log.push(...entry.log);
+  const cancelmode = input.parallel.join.onfail === "cancel";
+  const outcomes = settled.map((entry) => ({ branchid: entry.branch.id, ok: entry.ok, summary: entry.ok ? `The branch ${entry.branch.id} completed.` : entry.failure?.summary ?? `The branch ${entry.branch.id} failed.`, ...cancelmode && firstfailure !== Number.POSITIVE_INFINITY && entry.finishedat > firstfailure ? { cancelled: true } : {} }));
+  const join = joinbranches({ stepid: input.step.id, branches: settled.map((entry, order) => ({ id: entry.branch.id, order, ok: entry.ok, cancelled: outcomes[order]?.cancelled === true, variables: entry.variables })), strategy: input.parallel.join.strategy, now: input.now });
+  const decision = { runid: "", stepid: input.step.id, kind: "join", at: input.now, join: join.record, branches: outcomes };
+  if (!join.ok) return { ok: false, scopes: input.scopes, log, summary: join.summary, decision };
+  let scopes = input.scopes;
+  for (const variable of join.merged) scopes = setvariable(scopes, variable.name, variable.kind, variable.value, input.now);
+  const failedbranches = settled.filter((entry, order) => !entry.ok && outcomes[order]?.cancelled !== true).map((entry) => entry.branch.id);
+  if (cancelmode && failedbranches.length > 0) {
+    return { ok: false, scopes, log, summary: `The parallel block failed on branch ${failedbranches.join(", ")} and the join policy cancelled the siblings still running; ${join.summary}`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The parallel block ran ${input.parallel.branches.length} concurrent branch${input.parallel.branches.length === 1 ? "" : "es"}; ${join.summary}`, decision };
+}
+function errorclassof(output) {
+  const errorclass = output.details?.errorclass;
+  return typeof errorclass === "string" && errorclass.trim() ? errorclass : "stepfailed";
+}
+function backoffdelay(policy, attempt, seed) {
+  const base = policy.backoff.shape === "exponential" ? policy.backoff.base * 2 ** (attempt - 1) : policy.backoff.base;
+  if (policy.backoff.jitter <= 0) return Math.max(0, base);
+  return Math.max(0, base - policy.backoff.jitter / 2 + seededrandom(seed + attempt) * policy.backoff.jitter);
+}
+function waitsome(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
+}
+async function applyretry(input) {
+  const seed = input.seed ?? 0;
+  let value = await input.run();
+  const attempts = [];
+  let attempt = 1;
+  while (!value.ok && attempt < input.policy.attempts) {
+    const errorclass = input.errorclass(value);
+    if (!input.policy.retryable.includes(errorclass)) break;
+    const delay = backoffdelay(input.policy, attempt, seed);
+    attempts.push({ stepid: input.stepid, attempt: attempt + 1, delay, errorclass, at: input.now });
+    if (delay > 0) await waitsome(delay);
+    attempt += 1;
+    value = await input.run();
+  }
+  return { value, attempts, exhausted: !value.ok && attempts.length > 0 && attempt >= input.policy.attempts };
+}
+async function applytimeout(input) {
+  let timer;
+  const guard = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("cancelled"), Math.max(0, input.budgetms));
+  });
+  const raced = await Promise.race([input.run().then((value) => ({ kind: "done", value })), guard.then((marker) => ({ kind: "cancelled", marker }))]);
+  if (timer !== void 0) clearTimeout(timer);
+  if (raced.kind === "done") return { aborted: false, value: raced.value };
+  return { aborted: true, output: { ok: false, summary: `The ${input.stepid} step exceeded its reviewed budget of ${input.budgetms} milliseconds and was cancelled.`, details: { errorclass: "timeout", budget: input.budgetms, cancelled: true } }, abort: { stepid: input.stepid, budget: input.budgetms, scope: "step", at: Date.now() } };
+}
+async function applyruntimeout(input) {
+  let timer;
+  const guard = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("cancelled"), Math.max(0, input.budgetms));
+  });
+  const raced = await Promise.race([input.run().then((value) => ({ kind: "done", value })), guard.then((marker) => ({ kind: "cancelled", marker }))]);
+  if (timer !== void 0) clearTimeout(timer);
+  if (raced.kind === "done") return { cancelled: false, value: raced.value };
+  return { cancelled: true, error: new cancellederror(`The run exceeded its reviewed budget of ${input.budgetms} milliseconds and was cancelled.`) };
+}
+async function runcatch(input) {
+  const body = await runbody({ step: { id: "catch", kind: "trycatch", label: "catch handler" }, scopes: input.scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.handler.steps });
+  return { ok: body.ok, scopes: body.scopes, log: body.log };
+}
+async function runtry(input) {
+  const timeouts = [];
+  const retries = [];
+  const runonce = async (child, scopes) => {
+    if (iscontrolflowkind(child.kind)) {
+      const result = await runcontrolstep({ step: child, scopes, outputs: input.outputs, execute: input.execute, now: input.now });
+      return { ok: result.output.ok, scopes: result.scopes, log: result.log, output: result.output };
+    }
+    const executed = await runstep({ step: child, scopes, outputs: input.outputs, execute: input.execute, now: input.now });
+    return { ok: executed.output.ok, scopes: executed.scopes, log: [...executed.childlog ?? [], executed.log], output: executed.output };
+  };
+  const runchild = async (child, scopes) => {
+    const attempt = async () => {
+      if (input.fragile.retry === void 0) return await runonce(child, scopes);
+      const retried = await applyretry({ stepid: child.id, policy: input.fragile.retry, run: () => runonce(child, scopes), errorclass: (value) => errorclassof(value.output), now: input.now, seed: seedof(child.id) });
+      retries.push(...retried.attempts);
+      return retried.value;
+    };
+    if (input.fragile.timeout?.stepms === void 0) return await attempt();
+    const guarded = await applytimeout({ stepid: child.id, budgetms: input.fragile.timeout.stepms, run: attempt });
+    if (!guarded.aborted) return guarded.value;
+    if (guarded.abort) timeouts.push(guarded.abort);
+    return { ok: false, scopes, log: [], output: guarded.output };
+  };
+  const runbodyof = async (scopes) => {
+    let current = scopes;
+    const log = [];
+    for (const child of input.fragile.steps) {
+      const executed = await runchild(child, current);
+      current = executed.scopes;
+      log.push(...executed.log);
+      if (!executed.ok) return { ok: false, scopes: current, log, failure: executed.output };
+    }
+    return { ok: true, scopes: current, log };
+  };
+  let body;
+  if (input.fragile.timeout?.runms !== void 0) {
+    const guarded = await applytimeout({ stepid: input.step.id, budgetms: input.fragile.timeout.runms, run: () => runbodyof(input.scopes) });
+    if (guarded.aborted) {
+      if (guarded.abort) timeouts.push({ ...guarded.abort, scope: "run" });
+      body = { ok: false, scopes: input.scopes, log: [], failure: guarded.output ?? { ok: false, summary: "The try block exceeded its reviewed run budget and was cancelled.", details: { errorclass: "timeout", cancelled: true } } };
+    } else {
+      body = guarded.value;
+    }
+  } else {
+    body = await runbodyof(input.scopes);
+  }
+  if (body.ok) {
+    const summary = `The try block completed its ${input.fragile.steps.length} step${input.fragile.steps.length === 1 ? "" : "s"}${retries.length > 0 ? ` after ${retries.length} retry attempt${retries.length === 1 ? "" : "s"}` : ""}.`;
+    if (retries.length === 0 && timeouts.length === 0) return { ok: true, scopes: body.scopes, log: body.log, summary };
+    return { ok: true, scopes: body.scopes, log: body.log, summary, decision: { runid: "", stepid: input.step.id, kind: "retry", at: input.now, ...retries.length > 0 ? { retries } : {}, ...timeouts.length > 0 ? { timeouts } : {} } };
+  }
+  const handler = await runcatch({ handler: input.fragile.catch, scopes: body.scopes, outputs: input.outputs, execute: input.execute, now: input.now });
+  const errorclass = errorclassof(body.failure ?? { ok: false, summary: "" });
+  const decision = { runid: "", stepid: input.step.id, kind: "catch", at: input.now, ...retries.length > 0 ? { retries } : {}, ...timeouts.length > 0 ? { timeouts } : {}, catch: { errorclass, message: body.failure?.summary ?? "The fragile body step failed.", rerun: input.fragile.catch.rerun === true } };
+  if (!handler.ok) return { ok: false, scopes: handler.scopes, log: [...body.log, ...handler.log], summary: `The catch handler of the try block failed after the ${errorclass} failure.`, decision };
+  if (input.fragile.catch.rerun === true) {
+    const rerun = await runbodyof(handler.scopes);
+    if (rerun.ok) return { ok: true, scopes: rerun.scopes, log: [...body.log, ...handler.log, ...rerun.log], summary: `The catch handler ran after the ${errorclass} failure and the rerun of the try body succeeded.`, decision };
+    return { ok: false, scopes: rerun.scopes, log: [...body.log, ...handler.log, ...rerun.log], summary: `The catch handler ran and the rerun of the try body failed again with ${errorclassof(rerun.failure ?? { ok: false, summary: "" })}.`, decision };
+  }
+  return { ok: true, scopes: handler.scopes, log: [...body.log, ...handler.log], summary: `The catch handler ran ${input.fragile.catch.steps.length} step${input.fragile.catch.steps.length === 1 ? "" : "s"} after the ${errorclass} failure.`, decision };
+}
+function seedof(text2) {
+  let hash = 2166136261;
+  for (let index = 0; index < text2.length; index += 1) {
+    hash ^= text2.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash >>> 0;
+}
+async function runcontrolstep(input) {
+  const payload = controloptions(input.step);
+  const base = { step: input.step, scopes: input.scopes, outputs: input.outputs, execute: input.execute, now: input.now, ...input.path !== void 0 ? { path: input.path } : {} };
+  let result;
+  switch (input.step.kind) {
+    case "condition": {
+      const condition = conditionof(payload.condition);
+      if (!condition) throw new Error("The condition step needs a reviewed boolean expression in its options.");
+      const value = evaluatecondition(condition, input.scopes);
+      const scopes = setvariable(input.scopes, condition.expression.result, condition.expression.resultkind, value, input.now);
+      const summary = `The condition ${condition.expression.result} ${value ? "holds" : "does not hold"} over the extracted values.`;
+      return { scopes, log: [], output: { ok: true, summary, details: { condition: { result: condition.expression.result, value } } } };
+    }
+    case "branch": {
+      const branch = branchof(payload.branch);
+      if (!branch) throw new Error("The branch step needs reviewed unique paths with boolean match expressions and an else path in its options.");
+      const chosen = choosebranch({ stepid: input.step.id, branch, scopes: input.scopes, ...input.pagestate !== void 0 ? { pagestate: input.pagestate } : {}, now: input.now });
+      const body = await runbody({ ...base, steps: chosen.steps });
+      result = body.ok ? { ok: true, scopes: body.scopes, log: body.log, summary: `The branch chose the path ${chosen.outcome.path}: ${chosen.outcome.reason}`, decision: { runid: input.runid ?? "", stepid: input.step.id, kind: "branch", at: input.now, branch: chosen.outcome } } : { ok: false, scopes: body.scopes, log: body.log, summary: `The branch chose the path ${chosen.outcome.path} and its body failed: ${body.failure?.summary ?? "the body step failed."}`, decision: { runid: input.runid ?? "", stepid: input.step.id, kind: "branch", at: input.now, branch: chosen.outcome } };
+      break;
+    }
+    case "loop": {
+      const loop = loopof(payload.loop);
+      if (!loop) throw new Error("The loop step needs a reviewed list variable, distinct item and index variables, an optional positive safety bound and a non-empty body in its options.");
+      result = await runloop({ ...base, loop });
+      break;
+    }
+    case "repeatuntil": {
+      const repeat = repeatuntilof(payload.repeatuntil);
+      if (!repeat) throw new Error("The repeat until step needs a reviewed convergence expression, an optional positive safety bound and a non-empty body in its options.");
+      result = await runrepeatuntil({ ...base, repeat });
+      break;
+    }
+    case "whileloop": {
+      const condition = whileof(payload.while);
+      if (!condition) throw new Error("The while step needs a reviewed condition, a mandatory positive safety bound and a non-empty body in its options.");
+      result = await runwhile({ ...base, condition });
+      break;
+    }
+    case "foreach": {
+      const foreach = foreachof(payload.foreach);
+      if (!foreach) throw new Error("The foreach step needs a reviewed non-empty selector, distinct item and index variables and a non-empty body in its options.");
+      result = await runforeach({ ...base, foreach, ...input.resolveelements !== void 0 ? { resolveelements: input.resolveelements } : {} });
+      break;
+    }
+    case "parallel": {
+      const parallel = parallelof(payload.parallel);
+      if (!parallel) throw new Error("The parallel step needs uniquely identified branches with bodies and a join policy of the first, last or fail strategy with cancel or continue on branch failure in its options.");
+      result = await runparallel({ ...base, parallel });
+      break;
+    }
+    case "trycatch": {
+      const fragile = tryof(payload.try);
+      if (!fragile) throw new Error("The try step needs a fragile body, a catch handler and optional retry and timeout policies in its options.");
+      result = await runtry({ ...base, fragile });
+      break;
+    }
+    default:
+      throw new Error(`The ${input.step.kind} step is not a control flow kind.`);
+  }
+  if (result.decision !== void 0 && input.runid !== void 0) result.decision.runid = input.runid;
+  return { scopes: result.scopes, log: result.log, output: { ok: result.ok, summary: result.summary, ...result.decision !== void 0 ? { details: { control: result.decision } } : {} } };
+}
+
+// workflow.ts
+var workflowkinds = ["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"];
+function workflowstepof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return void 0;
+  if (typeof candidate.kind !== "string" || !/^[a-z]+$/.test(candidate.kind)) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  if (candidate.target !== void 0 && (typeof candidate.target !== "string" || !candidate.target)) return void 0;
+  if (candidate.value !== void 0 && typeof candidate.value !== "string") return void 0;
+  if (candidate.options !== void 0 && typeof candidate.options !== "string") return void 0;
+  const bindings = Array.isArray(candidate.bindings) ? candidate.bindings.flatMap((binding) => bindingof(binding) !== void 0 ? [bindingof(binding)] : []) : void 0;
+  if (candidate.bindings !== void 0 && bindings === void 0) return void 0;
+  if (Array.isArray(candidate.bindings) && bindings !== void 0 && bindings.length !== candidate.bindings.length) return void 0;
+  const expression = candidate.expression === void 0 ? void 0 : expressionof(candidate.expression);
+  if (candidate.expression !== void 0 && expression === void 0) return void 0;
+  const extract = candidate.extract === void 0 ? void 0 : regexruleof(candidate.extract);
+  if (candidate.extract !== void 0 && extract === void 0) return void 0;
+  return { id: candidate.id, kind: candidate.kind, label: candidate.label, ...candidate.target !== void 0 ? { target: candidate.target } : {}, ...candidate.value !== void 0 ? { value: candidate.value } : {}, ...candidate.options !== void 0 ? { options: candidate.options } : {}, ...bindings !== void 0 && bindings.length > 0 ? { bindings } : {}, ...expression !== void 0 ? { expression } : {}, ...extract !== void 0 ? { extract } : {} };
+}
+function blockinvocationof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.block !== "string" || !candidate.block.trim()) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  return { block: candidate.block, label: candidate.label };
+}
+function workflowblockof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.name !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.name)) return void 0;
+  if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
+  if (!Array.isArray(candidate.steps)) return void 0;
+  const steps = [];
+  for (const entry of candidate.steps) {
+    const step = workflowstepof(entry);
+    if (step) {
+      steps.push(step);
+      continue;
+    }
+    const invocation = blockinvocationof(entry);
+    if (invocation) {
+      steps.push(invocation);
+      continue;
+    }
+    return void 0;
+  }
+  return { name: candidate.name, label: candidate.label, steps };
+}
+function steptemplateof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.id !== "string" || !candidate.id.trim()) return void 0;
+  if (typeof candidate.name !== "string" || !candidate.name.trim()) return void 0;
+  if (typeof candidate.origin !== "string" || !candidate.origin.trim()) return void 0;
+  const step = workflowstepof(candidate.step);
+  if (!step) return void 0;
+  if (typeof candidate.sharedat !== "number" || !Number.isFinite(candidate.sharedat)) return void 0;
+  return { id: candidate.id, name: candidate.name, origin: candidate.origin, step, sharedat: candidate.sharedat };
+}
+function bindingof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.variable !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.variable)) return void 0;
+  if (!variablekinds.includes(candidate.kind)) return void 0;
+  if (typeof candidate.stepid !== "string" || !candidate.stepid.trim()) return void 0;
+  if (candidate.path !== void 0 && (typeof candidate.path !== "string" || !candidate.path.trim())) return void 0;
+  return { variable: candidate.variable, kind: candidate.kind, stepid: candidate.stepid, ...candidate.path !== void 0 ? { path: candidate.path } : {} };
+}
+var variablekinds = ["string", "number", "boolean", "list", "element"];
+var expressionoperators = ["add", "subtract", "multiply", "divide", "modulo", "equal", "notequal", "less", "greater", "lessequal", "greaterequal", "and", "or", "not", "concat", "contains", "length"];
+function expressionof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const left = operandof(candidate.left);
+  if (!left) return void 0;
+  const right = candidate.right === void 0 ? void 0 : operandof(candidate.right);
+  if (candidate.right !== void 0 && right === void 0) return void 0;
+  if (typeof candidate.operator !== "string" || !expressionoperators.includes(candidate.operator)) return void 0;
+  if (typeof candidate.result !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.result)) return void 0;
+  if (!variablekinds.includes(candidate.resultkind)) return void 0;
+  return { left, ...right !== void 0 ? { right } : {}, operator: candidate.operator, result: candidate.result, resultkind: candidate.resultkind };
+}
+function operandof(value) {
+  if (value === void 0) return void 0;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return { literal: value };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.ref === "string" && /^[a-z][a-z0-9]*$/.test(candidate.ref)) return { ref: candidate.ref };
+  if (typeof candidate.literal === "string" || typeof candidate.literal === "number" || typeof candidate.literal === "boolean") return { literal: candidate.literal };
+  return void 0;
+}
+function regexruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.pattern !== "string" || !candidate.pattern.trim()) return void 0;
+  if (typeof candidate.flags !== "string" || !/^[dgimsuvy]*$/.test(candidate.flags)) return void 0;
+  const groups = Array.isArray(candidate.groups) ? candidate.groups.flatMap((group) => typeof group === "string" && /^[a-z][a-z0-9]*$/.test(group) ? [group] : []) : [];
+  if (candidate.groups !== void 0 && groups.length !== candidate.groups.length) return void 0;
+  return { pattern: candidate.pattern, flags: candidate.flags, groups };
+}
+function expandblocks(steps, blocks) {
+  const byname = new Map(blocks.map((block) => [block.name, block]));
+  const expanded = [];
+  const visit = (entries, path, inside) => {
+    for (const entry of entries) {
+      if ("kind" in entry && "label" in entry && !("block" in entry)) {
+        expanded.push(inside === void 0 ? entry : { ...entry, block: inside });
+        continue;
+      }
+      const invocation = blockinvocationof(entry);
+      if (!invocation) throw new Error("The step list entry is neither a reviewed step nor a block invocation.");
+      if (path.includes(invocation.block)) throw new Error(`The block ${invocation.block} recurs inside itself and cannot expand.`);
+      const block = byname.get(invocation.block);
+      if (!block) throw new Error(`The block ${invocation.block} is not defined in the workflow.`);
+      visit(block.steps, [...path, invocation.block], invocation.block);
+    }
+  };
+  visit(steps, [], void 0);
+  if (expanded.length === 0) throw new Error("A workflow needs at least one executable step after block expansion.");
+  return expanded;
+}
+function composeworkflow(input) {
+  if (typeof input.name !== "string" || !input.name.trim()) throw new Error("The workflow name must be a non-empty string.");
+  if (typeof input.version !== "number" || !Number.isInteger(input.version) || input.version < 1) throw new Error("The workflow version must be a positive integer.");
+  if (!Array.isArray(input.origins) || input.origins.length === 0) throw new Error("A workflow needs at least one granted HTTPS origin.");
+  const origins = input.origins.map((origin) => {
+    try {
+      return new URL(origin).origin;
+    } catch {
+      throw new Error(`The workflow origin ${origin} is not a valid url.`);
+    }
+  });
+  if (origins.some((origin) => !origin.startsWith("https://"))) throw new Error("Workflow origins must use HTTPS.");
+  const blocks = input.blocks ?? [];
+  if (blocks.some((block, index) => blocks.findIndex((other) => other.name === block.name) !== index)) throw new Error("Workflow block names must stay unique.");
+  for (const entry of input.steps) {
+    if ("kind" in entry && "label" in entry && !("block" in entry)) {
+      if (input.kindallowed && !input.kindallowed(entry.kind)) throw new Error(`The workflow step kind ${entry.kind} is not a reviewed action kind.`);
+    }
+  }
+  for (const block of blocks) for (const entry of block.steps) {
+    if ("kind" in entry && "label" in entry && !("block" in entry) && input.kindallowed && !input.kindallowed(entry.kind)) throw new Error(`The workflow step kind ${entry.kind} inside block ${block.name} is not a reviewed action kind.`);
+  }
+  const steps = expandblocks(input.steps, blocks);
+  for (const step of steps) {
+    if (input.kindallowed && !input.kindallowed(step.kind)) throw new Error(`The workflow step kind ${step.kind} is not a reviewed action kind.`);
+    if (iscontrolflowkind(step.kind)) {
+      validatecontrolpayload(step);
+      for (const child of controlsteps(step)) {
+        if (input.kindallowed && !input.kindallowed(child.kind)) throw new Error(`The workflow step kind ${child.kind} inside the control payload of ${step.id} is not a reviewed action kind.`);
+      }
+    }
+    if (step.bindings) for (const binding of step.bindings) {
+      if (!steps.some((other) => other.id === binding.stepid)) throw new Error(`The binding of ${binding.variable} references the unknown step ${binding.stepid}.`);
+    }
+  }
+  const riskof = input.riskof ?? (() => "sensitive");
+  const gradedkinds = steps.flatMap((step) => [step.kind, ...controlsteps(step).map((child) => child.kind)]);
+  const risk = gradedkinds.some((kind) => riskof(kind) === "sensitive") ? "sensitive" : gradedkinds.some((kind) => riskof(kind) === "interaction") ? "interaction" : "read";
+  const record2 = { id: input.id ?? crypto.randomUUID(), name: input.name, version: input.version, origins: [...new Set(origins)], steps, blocks, risk, createdat: input.now };
+  return deepfreeze(record2);
+}
+function deepfreeze(record2) {
+  for (const step of record2.steps) Object.freeze(step);
+  for (const block of record2.blocks) for (const entry of block.steps) if ("kind" in entry && "label" in entry && !("block" in entry)) Object.freeze(entry);
+  Object.freeze(record2.blocks);
+  Object.freeze(record2.steps);
+  return Object.freeze(record2);
+}
+function validateworkflow(record2, options) {
+  if (record2.steps.length === 0) return { allowed: false, reason: "A workflow needs at least one reviewed step." };
+  const defined = new Set(options?.inputs ?? []);
+  const byid = new Map(record2.steps.map((step, index) => [step.id, { step, index }]));
+  for (let index = 0; index < record2.steps.length; index += 1) {
+    const step = record2.steps[index];
+    if (options?.kindallowed && !options.kindallowed(step.kind)) return { allowed: false, reason: `The workflow step kind ${step.kind} is not a reviewed action kind.` };
+    if (step.bindings) for (const binding of step.bindings) {
+      const source = byid.get(binding.stepid);
+      if (!source) return { allowed: false, reason: `The binding of ${binding.variable} references the unknown step ${binding.stepid}.` };
+      if (source.index >= index) return { allowed: false, reason: `The binding of ${binding.variable} must link an earlier step than ${step.id}.` };
+      defined.add(binding.variable);
+    }
+    if (step.expression) {
+      for (const operand of [step.expression.left, step.expression.right]) {
+        if (operand?.ref && !defined.has(operand.ref)) return { allowed: false, reason: `The expression of step ${step.id} references the undefined variable ${operand.ref}.` };
+      }
+      defined.add(step.expression.result);
+    }
+    if (step.extract) for (const group of step.extract.groups) defined.add(group);
+  }
+  return { allowed: true };
+}
+function pushscope(scopes, name, parent) {
+  return [...scopes, { name, variables: [], ...parent !== void 0 ? { parent } : {} }];
+}
+function popscope(scopes) {
+  if (scopes.length === 0) return scopes;
+  return scopes.slice(0, -1);
+}
+function resolvevariable(scopes, name) {
+  for (let index = scopes.length - 1; index >= 0; index -= 1) {
+    const scope = scopes[index];
+    const found = scope.variables.find((variable) => variable.name === name);
+    if (found) return found;
+    if (scope.parent === void 0) continue;
+    const parentindex = scopes.findIndex((candidate) => candidate.name === scope.parent);
+    if (parentindex >= 0 && parentindex < index) {
+      const inherited = resolvevariable([scopes[parentindex]], name);
+      if (inherited) return inherited;
+    }
+  }
+  return void 0;
+}
+function setvariable(scopes, name, kind, value, now) {
+  if (scopes.length === 0) scopes = [{ name: "root", variables: [] }];
+  const target = scopes[scopes.length - 1];
+  const variables = [...target.variables.filter((variable) => variable.name !== name), { name, kind, value, setat: now }];
+  return [...scopes.slice(0, -1), { ...target, variables }];
+}
+function coercevariable(value, kind) {
+  if (kind === "number") {
+    const parsed = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+    if (!Number.isFinite(parsed)) throw new Error("The bound value is not a finite number.");
+    return parsed;
+  }
+  if (kind === "boolean") {
+    if (typeof value === "boolean") return value;
+    if (value === "true") return true;
+    if (value === "false") return false;
+    throw new Error("The bound value is not a boolean.");
+  }
+  if (kind === "list") {
+    if (Array.isArray(value)) return value.map((item) => String(item));
+    if (typeof value === "string") return value.length === 0 ? [] : value.split(",");
+    throw new Error("The bound value is not a list.");
+  }
+  if (kind === "element") {
+    if (typeof value === "string" && value.trim()) return value;
+    throw new Error("The bound value is not an element reference.");
+  }
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  throw new Error("The bound value is not a string.");
+}
+function outcomedetail(outcome, path) {
+  if (!path) return outcome.summary;
+  let current = outcome.details ?? {};
+  for (const segment of path.split(".")) {
+    if (!current || typeof current !== "object" || Array.isArray(current)) return void 0;
+    current = current[segment];
+  }
+  return current;
+}
+function bindvariables(scopes, bindings, outputs, now) {
+  let current = scopes;
+  const produced = [];
+  for (const binding of bindings) {
+    const outcome = outputs[binding.stepid];
+    if (!outcome) continue;
+    const raw = outcomedetail(outcome, binding.path);
+    if (raw === void 0) throw new Error(`The binding of ${binding.variable} found no value at ${binding.path ?? "the summary"} of step ${binding.stepid}.`);
+    current = setvariable(current, binding.variable, binding.kind, coercevariable(raw, binding.kind), now);
+    produced.push(binding.variable);
+  }
+  return { scopes: current, produced };
+}
+function operandvalue(operand, scopes) {
+  if (operand.ref !== void 0) {
+    const resolved = resolvevariable(scopes, operand.ref);
+    if (!resolved) throw new Error(`The expression references the undefined variable ${operand.ref}.`);
+    return resolved.value;
+  }
+  if (operand.literal === void 0) throw new Error("The expression operand needs a variable reference or a literal.");
+  return operand.literal;
+}
+function expressioneval(expression, scopes) {
+  const left = operandvalue(expression.left, scopes);
+  const right = expression.right === void 0 ? void 0 : operandvalue(expression.right, scopes);
+  const operand = (value) => {
+    if (Array.isArray(value)) throw new Error("The expression operand is a list and needs the contains or length operator.");
+    if (value === void 0) throw new Error("The expression operand is missing.");
+    return value;
+  };
+  const numbervalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "number") return primitive;
+    if (typeof primitive === "string" && primitive.trim() !== "") {
+      const parsed = Number(primitive);
+      if (Number.isFinite(parsed)) return parsed;
+    }
+    throw new Error("The arithmetic operand is not a number.");
+  };
+  const booleanvalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "boolean") return primitive;
+    throw new Error("The logic operand is not a boolean.");
+  };
+  const stringvalue = (value) => {
+    const primitive = operand(value);
+    if (typeof primitive === "string") return primitive;
+    if (typeof primitive === "number" || typeof primitive === "boolean") return String(primitive);
+    throw new Error("The text operand is not a string.");
+  };
+  switch (expression.operator) {
+    case "add":
+      return numbervalue(left) + numbervalue(right);
+    case "subtract":
+      return numbervalue(left) - numbervalue(right);
+    case "multiply":
+      return numbervalue(left) * numbervalue(right);
+    case "divide": {
+      const divisor = numbervalue(right);
+      if (divisor === 0) throw new Error("The expression divides by zero.");
+      return numbervalue(left) / divisor;
+    }
+    case "modulo": {
+      const divisor = numbervalue(right);
+      if (divisor === 0) throw new Error("The expression divides by zero.");
+      return numbervalue(left) % divisor;
+    }
+    case "equal":
+      return left === right;
+    case "notequal":
+      return left !== right;
+    case "less":
+      return numbervalue(left) < numbervalue(right);
+    case "greater":
+      return numbervalue(left) > numbervalue(right);
+    case "lessequal":
+      return numbervalue(left) <= numbervalue(right);
+    case "greaterequal":
+      return numbervalue(left) >= numbervalue(right);
+    case "and":
+      return booleanvalue(left) && booleanvalue(right);
+    case "or":
+      return booleanvalue(left) || booleanvalue(right);
+    case "not":
+      return !booleanvalue(left);
+    case "concat":
+      return `${stringvalue(left)}${stringvalue(right)}`;
+    case "contains": {
+      if (Array.isArray(left)) return left.includes(stringvalue(right));
+      return stringvalue(left).includes(stringvalue(right));
+    }
+    case "length": {
+      if (Array.isArray(left)) return left.length;
+      return stringvalue(left).length;
+    }
+    default:
+      throw new Error("The reviewed expression operator is unknown.");
+  }
+}
+function regexextract(rule, text2, now) {
+  const pattern = new RegExp(rule.pattern, rule.flags);
+  const match = pattern.exec(text2);
+  if (!match) return { matched: false, variables: [] };
+  const variables = [];
+  for (const group of rule.groups) {
+    const value = match.groups?.[group];
+    variables.push({ name: group, kind: "string", value: typeof value === "string" ? value : "", setat: now });
+  }
+  return { matched: true, variables };
+}
+function waitelementplan(wait) {
+  if (wait.timeout <= 0 || wait.poll <= 0) return { probes: 1, lastwait: 0 };
+  const probes = Math.floor(wait.timeout / wait.poll) + 1;
+  return { probes, lastwait: wait.timeout % wait.poll };
+}
+function delayjitter(delay, seed) {
+  if (delay.jitter <= 0) return Math.max(0, delay.base);
+  const sample = seededrandom(seed);
+  return Math.max(0, delay.base - delay.jitter / 2 + sample * delay.jitter);
+}
+function seededrandom(seed) {
+  let state = seed >>> 0;
+  state ^= state >>> 16;
+  state = Math.imul(state, 2246822507);
+  state ^= state >>> 13;
+  state = Math.imul(state, 3266489909);
+  state ^= state >>> 16;
+  state = state >>> 0 || 1;
+  state ^= state << 13;
+  state >>>= 0;
+  state ^= state >> 17;
+  state ^= state << 5;
+  state >>>= 0;
+  return state / 4294967296;
+}
+function newworkflowrun(input) {
+  return { id: input.id ?? crypto.randomUUID(), workflowid: input.workflowid, state: "pending", cursor: 0, startedat: input.now, ...input.dryrun === true ? { dryrun: true } : {} };
+}
+function pauserun(run, now) {
+  if (run.state !== "running") throw new Error("Only a running workflow can pause.");
+  return { ...run, state: "paused", pausedat: now };
+}
+function cancelrun(run, reason, now) {
+  if (run.state === "done" || run.state === "cancelled") return run;
+  return { ...run, state: "cancelled", cancelreason: reason, endedat: now };
+}
+function interpolate(text2, scopes) {
+  const consumed = [];
+  const resolved = text2.replace(/\$\{([a-z][a-z0-9]*)\}/g, (_whole, name) => {
+    const variable = resolvevariable(scopes, name);
+    if (!variable) throw new Error(`The step references the undefined variable ${name}.`);
+    consumed.push(name);
+    return Array.isArray(variable.value) ? variable.value.join(",") : String(variable.value);
+  });
+  return { text: resolved, consumed };
+}
+function runlogof(step, state, startedat, duration, summary, extra) {
+  return { stepid: step.id, label: step.label, state, startedat, duration, summary, ...extra.block !== void 0 ? { block: extra.block } : {}, ...extra.consumed !== void 0 && extra.consumed.length > 0 ? { consumed: extra.consumed } : {}, ...extra.produced !== void 0 && extra.produced.length > 0 ? { produced: extra.produced } : {}, ...extra.checkpoint === true ? { checkpoint: true } : {}, ...extra.details !== void 0 ? { details: extra.details } : {} };
+}
+async function runstep(input) {
+  const startedat = input.now;
+  let scopes = input.scopes;
+  const consumed = [];
+  if (input.step.bindings) {
+    const bound = bindvariables(scopes, input.step.bindings.filter((binding) => input.outputs[binding.stepid] !== void 0), input.outputs, input.now);
+    scopes = bound.scopes;
+  }
+  let produced = [];
+  try {
+    if (input.step.expression) {
+      const value2 = expressioneval(input.step.expression, scopes);
+      scopes = setvariable(scopes, input.step.expression.result, input.step.expression.resultkind, coercevariable(value2, input.step.expression.resultkind), input.now);
+      produced = [...produced, input.step.expression.result];
+    }
+    let stepvalue = input.step.value;
+    if (input.step.extract) {
+      const text2 = stepvalue ?? "";
+      const interpolated = interpolate(text2, scopes);
+      consumed.push(...interpolated.consumed);
+      const extraction = regexextract(input.step.extract, interpolated.text, input.now);
+      if (extraction.matched) {
+        for (const variable of extraction.variables) scopes = setvariable(scopes, variable.name, "string", variable.value, input.now);
+        produced = [...produced, ...extraction.variables.map((variable) => variable.name)];
+      }
+      stepvalue = interpolated.text;
+    }
+    const controlled = iscontrolflowkind(input.step.kind);
+    const target = !controlled && input.step.target !== void 0 ? interpolate(input.step.target, scopes) : void 0;
+    if (target) consumed.push(...target.consumed);
+    const value = !controlled && stepvalue !== void 0 ? interpolate(stepvalue, scopes) : void 0;
+    if (value) consumed.push(...value.consumed);
+    const options = !controlled && input.step.options !== void 0 ? interpolate(input.step.options, scopes) : void 0;
+    if (options) consumed.push(...options.consumed);
+    const dispatchable = { ...input.step, ...target !== void 0 ? { target: target.text } : {}, ...value !== void 0 ? { value: value.text } : {}, ...options !== void 0 ? { options: options.text } : {} };
+    const output = await input.execute(dispatchable, { scopes, outputs: input.outputs, ...input.block !== void 0 ? { block: input.block } : {} });
+    if (output.scopes !== void 0) scopes = output.scopes;
+    const childlog = output.log;
+    if (input.step.bindings) {
+      const bound = bindvariables(scopes, input.step.bindings, { ...input.outputs, [input.step.id]: { stepid: input.step.id, ok: output.ok, summary: output.summary, ...output.details !== void 0 ? { details: output.details } : {}, at: input.now } }, input.now);
+      scopes = bound.scopes;
+      produced = [.../* @__PURE__ */ new Set([...produced, ...bound.produced])];
+    }
+    const duration = Date.now() - startedat;
+    return { scopes, log: runlogof(input.step, output.ok ? "done" : "failed", startedat, duration, output.summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {}, ...produced.length > 0 ? { produced } : {}, ...output.details !== void 0 ? { details: output.details } : {}, ...output.ok ? { checkpoint: true } : {} }), ...childlog !== void 0 ? { childlog } : {}, output };
+  } catch (error) {
+    const duration = Date.now() - startedat;
+    const summary = error instanceof Error ? error.message : String(error);
+    return { scopes, log: runlogof(input.step, "failed", startedat, duration, summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {} }), output: { ok: false, summary } };
+  }
+}
+async function runworkflow(input) {
+  if (input.gates && !input.gates.sessionactive) throw new Error("The workflow refuses to run outside an approved session.");
+  if (input.gates && !input.gates.planapproved) throw new Error("The workflow refuses to run without the approved plan review.");
+  if (input.gates) for (const origin of input.record.origins) {
+    if (!input.gates.origingranted(origin)) throw new Error(`The workflow origin ${origin} falls outside the session grants.`);
+  }
+  if (input.run.state === "done" || input.run.state === "failed" || input.run.state === "cancelled") throw new Error(`The workflow run is already ${input.run.state}.`);
+  const { pausedat, ...resumed } = input.run;
+  void pausedat;
+  let run = input.run.state === "paused" ? { ...resumed, state: "running" } : { ...input.run, state: "running" };
+  let scopes = input.scopes ?? [{ name: "root", variables: [] }];
+  const log = [...input.log ?? []];
+  const outputs = { ...input.outputs ?? {} };
+  let activeblock;
+  for (let index = run.cursor; index < input.record.steps.length; index += 1) {
+    const step = input.record.steps[index];
+    if (step.block !== void 0 && step.block !== activeblock) {
+      scopes = pushscope(scopes, step.block, scopes[scopes.length - 1].name);
+      activeblock = step.block;
+    } else if (step.block === void 0 && activeblock !== void 0) {
+      while (scopes.length > 1) scopes = popscope(scopes);
+      activeblock = void 0;
+    }
+    const executed = await runstep({ step, scopes, outputs, execute: input.execute, now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
+    scopes = executed.scopes;
+    if (executed.childlog !== void 0) log.push(...executed.childlog);
+    log.push(executed.log);
+    outputs[step.id] = { stepid: step.id, ok: executed.output.ok, summary: executed.output.summary, ...executed.output.details !== void 0 ? { details: executed.output.details } : {}, at: Date.now() };
+    if (!executed.output.ok) {
+      run = { ...run, state: "failed", endedat: Date.now(), failreason: executed.output.summary };
+      return { run, scopes, log, outputs };
+    }
+    run = { ...run, cursor: index + 1 };
+    if (input.oncheckpoint) await input.oncheckpoint({ run, scopes, log });
+  }
+  run = { ...run, state: "done", endedat: Date.now() };
+  return { run, scopes, log, outputs };
+}
+function dryrunworkflow(input) {
+  const run = { ...input.run, state: "running", ...input.run.dryrun === true ? { dryrun: true } : { dryrun: true } };
+  let scopes = input.scopes ?? [{ name: "root", variables: [] }];
+  const log = [...input.log ?? []];
+  for (let index = run.cursor; index < input.record.steps.length; index += 1) {
+    const step = input.record.steps[index];
+    const summary = input.projection(step);
+    const entry = summary === void 0 ? runlogof(step, "refused", input.now, 0, `The ${step.kind} step has no read only projection and the dry run refuses it.`, { ...step.block !== void 0 ? { block: step.block } : {} }) : runlogof(step, "done", input.now, 0, summary, { ...step.block !== void 0 ? { block: step.block } : {} });
+    log.push(entry);
+    scopes = setvariable(scopes, `${step.id}outcome`, "boolean", entry.state === "done", input.now);
+  }
+  return { run: { ...run, state: "done", cursor: input.record.steps.length, endedat: input.now }, scopes, log };
+}
+
 // netauth.ts
 function oauthflowof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -3332,9 +4618,9 @@ function consolediff(input) {
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions"]);
-var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow"]);
+var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars", "condition", "branch"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
@@ -3355,6 +4641,7 @@ var cdpactions = /* @__PURE__ */ new Set(["attachcdp", "detachcdp", "cdpcmd", "w
 var profileractions = /* @__PURE__ */ new Set(["measureflow", "heapshot", "trackmemory", "profilecpu", "watchshifts", "traceload", "annotatetrace", "replaytrace", "capturesourcemaps"]);
 var emulationactions = /* @__PURE__ */ new Set(["emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "blackboxscripts"]);
 var sessionactions = /* @__PURE__ */ new Set(["persiststate", "capturesession", "restoresession", "namedsessions", "diffsessions", "searchsessions", "exportsessions", "importsessions"]);
+var workflowactions = /* @__PURE__ */ new Set(["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars", "condition", "branch", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
 var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
@@ -3373,6 +4660,9 @@ function hostpattern(origin) {
 function issessionkind(kind) {
   return sessionactions.has(kind);
 }
+function isworkflowkind(kind) {
+  return workflowactions.has(kind);
+}
 function isdebugkind(kind) {
   return debugactions.has(kind);
 }
@@ -4909,6 +6199,238 @@ function sessionfolderunique(name, folders) {
 function snapshotretentionwindow(settings) {
   return settings?.sessionretention;
 }
+function validateworkflowgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "composeworkflow") {
+    const payload = options.workflow;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { allowed: false, reason: "The workflow composition needs the reviewed workflow payload with its name, version, origins, steps and blocks." };
+    const candidate = payload;
+    if (typeof candidate.name !== "string" || !candidate.name.trim()) return { allowed: false, reason: "The workflow composition needs a reviewed non-empty name." };
+    if (typeof candidate.version !== "number" || !Number.isInteger(candidate.version) || candidate.version < 1) return { allowed: false, reason: "The workflow version must be a positive integer." };
+    if (!Array.isArray(candidate.origins) || candidate.origins.length === 0 || !candidate.origins.every((origin) => typeof origin === "string" && origin.startsWith("https://"))) return { allowed: false, reason: "The workflow needs at least one granted HTTPS origin so every step stays inside the grants." };
+    if (!Array.isArray(candidate.steps) || candidate.steps.length === 0 || !candidate.steps.every((entry) => workflowstepof(entry) !== void 0 || entry && typeof entry === "object" && typeof entry.block === "string")) return { allowed: false, reason: "The workflow needs a non-empty reviewed step list of the workflow step grammar or block invocations." };
+    const blocks = Array.isArray(candidate.blocks) ? candidate.blocks.flatMap((block) => {
+      const parsed = workflowblockof(block);
+      return parsed !== void 0 ? [parsed] : [];
+    }) : [];
+    if (Array.isArray(candidate.blocks) && blocks.length !== candidate.blocks.length) return { allowed: false, reason: "The reviewed block list must carry unique lowercase names, labels and valid child steps." };
+    try {
+      const record2 = composeworkflow({ name: candidate.name, version: candidate.version, origins: candidate.origins, steps: candidate.steps.map((entry) => "block" in entry ? { block: entry.block, label: typeof entry.label === "string" ? entry.label : entry.block } : workflowstepof(entry)), blocks, now: 0, kindallowed: (candidatekind) => {
+        try {
+          actionrisk(candidatekind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, riskof: (candidatekind) => actionrisk(candidatekind) });
+      const inputs = Array.isArray(candidate.inputs) ? candidate.inputs.flatMap((name) => typeof name === "string" ? [name] : []) : void 0;
+      const checked = validateworkflow(record2, { kindallowed: (workflowkind) => {
+        try {
+          actionrisk(workflowkind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, ...inputs !== void 0 ? { inputs } : {} });
+      if (!checked.allowed) return checked;
+    } catch (error) {
+      return { allowed: false, reason: error instanceof Error ? error.message : "The workflow payload failed its composition validation." };
+    }
+    return { allowed: true };
+  }
+  if (kind === "savetemplate") {
+    const payload = options.template && typeof options.template === "object" && !Array.isArray(options.template) ? options.template : {};
+    const template = steptemplateof({ id: "templatereview", origin: "https://example.com", sharedat: 0, ...payload });
+    if (!template) return { allowed: false, reason: "The step template needs a reviewed name and a valid workflow step it shares across workflows." };
+    return { allowed: true };
+  }
+  if (kind === "runworkflow") {
+    if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "The workflow run needs the reviewed id of the composed workflow." };
+    if (options.reviewed !== true) return { allowed: false, reason: "Every real workflow run needs the explicit run review with its expanded step list shown before the first step executes." };
+    if (options.variables !== void 0 && (!options.variables || typeof options.variables !== "object" || Array.isArray(options.variables) || !Object.values(options.variables).every((value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean"))) return { allowed: false, reason: "The reviewed run variables must be an object of string, number or boolean values." };
+    return { allowed: true };
+  }
+  if (kind === "dryrun") {
+    if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "The dry run needs the reviewed id of the composed workflow." };
+    return { allowed: true };
+  }
+  if (kind === "delay") {
+    const delay = options.delay;
+    if (!delay || typeof delay !== "object" || Array.isArray(delay)) return { allowed: false, reason: "The delay needs a reviewed base and jitter window in options." };
+    const reviewed = delay;
+    if (typeof reviewed.base !== "number" || !Number.isFinite(reviewed.base) || reviewed.base < 0) return { allowed: false, reason: "The reviewed delay base must be zero or a positive number of milliseconds." };
+    if (typeof reviewed.jitter !== "number" || !Number.isFinite(reviewed.jitter) || reviewed.jitter < 0) return { allowed: false, reason: "The reviewed delay jitter window must be zero or a positive number of milliseconds with no code ceiling." };
+    return { allowed: true };
+  }
+  if (kind === "waitelement") {
+    const wait = options.wait;
+    if (!wait || typeof wait !== "object" || Array.isArray(wait)) return { allowed: false, reason: "The element wait needs a reviewed selector, timeout and poll interval in options." };
+    const reviewed = wait;
+    if (typeof reviewed.selector !== "string" || !reviewed.selector.trim()) return { allowed: false, reason: "The element wait needs a reviewed non-empty selector." };
+    if (typeof reviewed.timeout !== "number" || !Number.isFinite(reviewed.timeout) || reviewed.timeout < 0) return { allowed: false, reason: "The reviewed element wait timeout must be zero or a positive number of milliseconds with no code ceiling." };
+    if (typeof reviewed.poll !== "number" || !Number.isFinite(reviewed.poll) || reviewed.poll < 0) return { allowed: false, reason: "The reviewed element wait poll interval must be zero or a positive number of milliseconds with no code ceiling." };
+    return { allowed: true };
+  }
+  if (kind === "compute") {
+    const expression = expressionof(options.expression);
+    if (!expression) return { allowed: false, reason: `The expression step needs a reviewed expression with operands, an operator of the reviewed set (${expressionoperators.join(", ")}) and a result variable of a reviewed kind.` };
+    const operatorcheck = validatexpressionoperators(expression);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return { allowed: true };
+  }
+  if (kind === "extractvars") {
+    const rule = regexruleof(options.rule);
+    if (!rule) return { allowed: false, reason: "The variable extraction needs a reviewed regex rule with its pattern, flags and named capture groups." };
+    const shapecheck = validateregexrule(rule.pattern);
+    if (!shapecheck.allowed) return shapecheck;
+    if (typeof options.text !== "string") return { allowed: false, reason: "The variable extraction needs the reviewed text the regex rule applies to." };
+    return { allowed: true };
+  }
+  if (kind === "condition") {
+    const condition = conditionof(options.condition);
+    if (!condition) return { allowed: false, reason: "The condition step needs a reviewed boolean expression in its options." };
+    const operatorcheck = validatexpressionoperators(condition.expression);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return { allowed: true };
+  }
+  if (kind === "branch") {
+    const branch = branchof(options.branch);
+    if (!branch) return { allowed: false, reason: "The branch step needs reviewed unique paths with boolean match expressions and an else path in its options so every branch terminates." };
+    for (const path of [...branch.paths, branch.else]) {
+      if (path.when === void 0) continue;
+      const operatorcheck = validatexpressionoperators(path.when);
+      if (!operatorcheck.allowed) return operatorcheck;
+    }
+    return controlchildkinds(step);
+  }
+  if (kind === "loop") {
+    const loop = loopof(options.loop);
+    if (!loop) return { allowed: false, reason: "The loop step needs a reviewed list variable, distinct item and index variables, an optional positive safety bound and a non-empty body in its options; an absent bound keeps the documented default." };
+    return controlchildkinds(step);
+  }
+  if (kind === "repeatuntil") {
+    const repeat = repeatuntilof(options.repeatuntil);
+    if (!repeat) return { allowed: false, reason: "The repeat until step needs a reviewed convergence expression, an optional positive safety bound and a non-empty body in its options." };
+    const operatorcheck = validatexpressionoperators(repeat.until);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return controlchildkinds(step);
+  }
+  if (kind === "whileloop") {
+    const condition = whileof(options.while);
+    if (!condition) return { allowed: false, reason: "The while step needs a reviewed condition, a mandatory positive safety bound and a non-empty body in its options; a while loop without a safety bound is refused." };
+    const operatorcheck = validatexpressionoperators(condition.while);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return controlchildkinds(step);
+  }
+  if (kind === "foreach") {
+    const foreach = foreachof(options.foreach);
+    if (!foreach) return { allowed: false, reason: "The foreach step needs a reviewed non-empty selector, distinct item and index variables and a non-empty body in its options." };
+    return controlchildkinds(step);
+  }
+  if (kind === "parallel") {
+    const parallel = parallelof(options.parallel);
+    if (!parallel) return { allowed: false, reason: "The parallel step needs uniquely identified branches with bodies and a join policy of the first, last or fail strategy with cancel or continue on branch failure in its options." };
+    return controlchildkinds(step);
+  }
+  if (kind === "trycatch") {
+    const fragile = tryof(options.try);
+    if (!fragile) return { allowed: false, reason: "The try step needs a fragile body, a catch handler and optional retry and timeout policies in its options: attempts stay user configured with no code ceiling, backoff is fixed or exponential and budgets are positive." };
+    return controlchildkinds(step);
+  }
+  return { allowed: true };
+}
+function controlchildkinds(step) {
+  const children = controlsteps({ id: step.id, kind: step.kind, label: step.summary, ...step.options !== void 0 ? { options: step.options } : {} });
+  for (const child of children) {
+    try {
+      actionrisk(child.kind);
+    } catch {
+      return { allowed: false, reason: `The ${child.kind} step inside the control payload of the ${step.kind} step is not a reviewed action kind.` };
+    }
+  }
+  return { allowed: true };
+}
+function validateregexrule(pattern) {
+  try {
+    new RegExp(pattern);
+  } catch {
+    return { allowed: false, reason: "The reviewed regex pattern does not compile." };
+  }
+  const nestedquantifier = /\((?:[^()\\]|\\.)*[+*}]\)[+*{]/.test(pattern) || /\(\)[+*{]/.test(pattern);
+  if (nestedquantifier) return { allowed: false, reason: "The reviewed regex pattern nests an unbounded quantifier inside a quantified group and is refused because adversarial text could explode the backtracking." };
+  const unboundedrepeat = /\{\d+,\}/.test(pattern);
+  if (unboundedrepeat && /\([^)]*\{\d+,\}[^)]*\)[+*{]/.test(pattern)) return { allowed: false, reason: "The reviewed regex pattern repeats an unbounded group and is refused because adversarial text could explode the backtracking." };
+  return { allowed: true };
+}
+function validatexpressionoperators(expression) {
+  const numeric = /* @__PURE__ */ new Set(["add", "subtract", "multiply", "divide", "modulo"]);
+  const logic = /* @__PURE__ */ new Set(["and", "or", "not"]);
+  const comparison = /* @__PURE__ */ new Set(["less", "greater", "lessequal", "greaterequal"]);
+  const text2 = /* @__PURE__ */ new Set(["concat", "contains"]);
+  const operator = expression.operator;
+  if (numeric.has(operator)) {
+    for (const operand of [expression.left, expression.right]) {
+      if (operand === void 0) continue;
+      if (operand.literal !== void 0 && typeof operand.literal === "boolean") return { allowed: false, reason: `The ${operator} operator needs numeric operands; boolean literals are refused.` };
+    }
+    if (expression.resultkind !== "number" && expression.resultkind !== "string") return { allowed: false, reason: `The ${operator} operator needs a number result kind.` };
+  }
+  if (logic.has(operator)) {
+    for (const operand of [expression.left, expression.right]) {
+      if (operand === void 0) continue;
+      if (operand.literal !== void 0 && typeof operand.literal !== "boolean") return { allowed: false, reason: `The ${operator} operator needs boolean operands; non boolean literals are refused.` };
+    }
+    if (expression.resultkind !== "boolean") return { allowed: false, reason: `The ${operator} operator needs a boolean result kind.` };
+    if (operator === "not" && expression.right !== void 0) return { allowed: false, reason: "The not operator takes one operand only." };
+  }
+  if (comparison.has(operator) && expression.resultkind !== "boolean") return { allowed: false, reason: `The ${operator} operator needs a boolean result kind.` };
+  if (text2.has(operator) && expression.resultkind !== "boolean" && expression.resultkind !== "string") return { allowed: false, reason: `The ${operator} operator needs a string or boolean result kind.` };
+  if (operator === "contains" && expression.resultkind !== "boolean") return { allowed: false, reason: "The contains operator needs a boolean result kind." };
+  if (operator === "length") {
+    if (expression.right !== void 0) return { allowed: false, reason: "The length operator takes one operand only." };
+    if (expression.resultkind !== "number") return { allowed: false, reason: "The length operator needs a number result kind." };
+  }
+  if ((operator === "equal" || operator === "notequal") && !(/* @__PURE__ */ new Set(["boolean", "string", "number"])).has(expression.resultkind)) return { allowed: false, reason: "The equality operator needs a primitive result kind." };
+  return { allowed: true };
+}
+function workflowgate(input) {
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now: input.now, action: "run the workflow step" });
+  if (!gate.allowed) return gate;
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Workflow steps need the approved plan review before they run." };
+  if (input.step.kind === "runworkflow") {
+    let runoptions = {};
+    try {
+      runoptions = parseoptions(input.step);
+    } catch {
+      runoptions = {};
+    }
+    if (runoptions.reviewed !== true) return { allowed: false, reason: "Every real workflow run needs the explicit run review with its expanded step list shown before the first step executes." };
+  }
+  return { allowed: true };
+}
+function dryrunprojection(step) {
+  if (iscontrolflowkind(step.kind)) {
+    for (const child of controlsteps(step)) {
+      const childrisk = resolvedrisk({ id: child.id, kind: child.kind, summary: child.label, risk: "read", ...child.target !== void 0 ? { target: child.target } : {}, ...child.value !== void 0 ? { value: child.value } : {}, ...child.options !== void 0 ? { options: child.options } : {} });
+      if (childrisk !== "read") return void 0;
+    }
+    if (step.kind === "condition") return "The condition step would evaluate its reviewed expression over the extracted values with no page side effect.";
+    if (step.kind === "branch") return "The branch step would choose one reviewed path by page state and only the chosen path would run.";
+    if (step.kind === "loop") return "The loop step would iterate its reviewed list binding the item and index variables per iteration inside the safety bound.";
+    if (step.kind === "repeatuntil") return "The repeat until step would rerun its body until the convergence expression holds inside the safety bound.";
+    if (step.kind === "whileloop") return "The while step would loop while its condition holds inside the reviewed safety bound.";
+    if (step.kind === "foreach") return "The foreach step would iterate the elements of its reviewed selector binding the item and index variables per iteration.";
+    if (step.kind === "parallel") return "The parallel step would run its branches concurrently and join their outcomes under the reviewed strategy.";
+    return "The try step would run its fragile body and only the catch handler on failure.";
+  }
+  const risk = resolvedrisk({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.target !== void 0 ? { target: step.target } : {}, ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  if (risk !== "read") return void 0;
+  if (step.kind === "delay") return `The delay step would sleep its reviewed base inside the jitter window.`;
+  if (step.kind === "waitelement") return `The element wait step would poll ${step.target ?? "the reviewed selector"} until appearance or the reviewed timeout.`;
+  if (step.kind === "compute") return `The compute step would evaluate its reviewed expression into the result variable.`;
+  if (step.kind === "extractvars") return `The variable extraction step would apply its reviewed regex rule and store the named captures.`;
+  return `The ${step.kind} step would run read only and mutate nothing.`;
+}
 function validatecdpgrammar(step, options) {
   const kind = step.kind;
   if (kind === "attachcdp") {
@@ -5478,6 +7000,10 @@ function validatestep(step, origin) {
     const sessioncheck = validatesessiongrammar(step, options);
     if (!sessioncheck.allowed) return sessioncheck;
   }
+  if (isworkflowkind(step.kind)) {
+    const workflowcheck = validateworkflowgrammar(step, options);
+    if (!workflowcheck.allowed) return workflowcheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -5668,33 +7194,37 @@ function canexecute(input) {
       }
     }
   }
+  if (isworkflowkind(input.step.kind)) {
+    const workflowgatecheck = workflowgate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
+    if (!workflowgatecheck.allowed) return workflowgatecheck;
+  }
   if (iscontrolkind(input.step.kind)) {
     const controlgate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "control the network" });
     if (!controlgate.allowed) return controlgate;
-    let controloptions = {};
+    let controloptions2 = {};
     try {
-      controloptions = parseoptions(input.step);
+      controloptions2 = parseoptions(input.step);
     } catch {
-      controloptions = {};
+      controloptions2 = {};
     }
     if (input.step.kind === "blockrequest") {
       const blockgatecheck = blockgate(input.session, input.step, now);
       if (!blockgatecheck.allowed) return blockgatecheck;
-      const rule = blockruleof(controloptions.block);
+      const rule = blockruleof(controloptions2.block);
       if (rule) {
         const blockorigin = origincheck(input.session, rule.urlpattern);
         if (!blockorigin.allowed) return blockorigin;
       }
     }
     if (input.step.kind === "mockresponse" || input.step.kind === "rewriteheaders") {
-      const patterns = input.step.kind === "mockresponse" ? [mockspecof(controloptions.mock)?.urlpattern ?? ""] : Array.isArray(controloptions.rules) ? controloptions.rules.map((item) => item && typeof item === "object" && !Array.isArray(item) ? String(item.urlpattern ?? "") : "") : [];
+      const patterns = input.step.kind === "mockresponse" ? [mockspecof(controloptions2.mock)?.urlpattern ?? ""] : Array.isArray(controloptions2.rules) ? controloptions2.rules.map((item) => item && typeof item === "object" && !Array.isArray(item) ? String(item.urlpattern ?? "") : "") : [];
       for (const pattern of patterns) {
         const patterngate = origincheck(input.session, pattern);
         if (!patterngate.allowed) return patterngate;
       }
     }
     if (input.step.kind === "setcookies" || input.step.kind === "readcookies" || input.step.kind === "clearcookies") {
-      const domain = typeof controloptions.domain === "string" && controloptions.domain.trim() ? controloptions.domain : Array.isArray(controloptions.cookies) ? String(controloptions.cookies[0]?.domain ?? "") : "";
+      const domain = typeof controloptions2.domain === "string" && controloptions2.domain.trim() ? controloptions2.domain : Array.isArray(controloptions2.cookies) ? String(controloptions2.cookies[0]?.domain ?? "") : "";
       if (!domain) return { allowed: false, reason: "A reviewed cookie domain is required before cookie control runs." };
       const cookiegatecheck = cookiegate(input.session, domain, now);
       if (!cookiegatecheck.allowed) return cookiegatecheck;
@@ -5924,9 +7454,15 @@ function recordsession(progress, planid, stepid, entry, now) {
   const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { session: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function recordworkflow(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const counts = `${entry.executed !== void 0 ? `${entry.executed} executed step${entry.executed === 1 ? "" : "s"}, ` : ""}${entry.refused !== void 0 ? `${entry.refused} refused step${entry.refused === 1 ? "" : "s"}, ` : ""}${entry.total !== void 0 ? `${entry.total} total step${entry.total === 1 ? "" : "s"}, ` : ""}${entry.iterations !== void 0 ? `${entry.iterations} iteration${entry.iterations === 1 ? "" : "s"}, ` : ""}${entry.denominator !== void 0 ? `denominator ${entry.denominator}, ` : ""}`.replace(/, $/, "");
+  const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { workflow: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.49";
+var packageversion = "1.1.51";
 
 // types.ts
 var protocolversion = packageversion;
@@ -6142,6 +7678,29 @@ function parseproposal(value, origin, grants) {
       }
       if (step.kind === "importsessions" && importsessionfile(sessionoptions.file) === void 0) throw new Error("Session import files of unknown format versions are refused.");
     }
+    if (isworkflowkind(step.kind)) {
+      let workflowoptions = {};
+      try {
+        workflowoptions = parseoptions(step);
+      } catch {
+        workflowoptions = {};
+      }
+      if (step.kind === "composeworkflow") {
+        const payload = workflowoptions.workflow && typeof workflowoptions.workflow === "object" && !Array.isArray(workflowoptions.workflow) ? workflowoptions.workflow : void 0;
+        const origins = payload && Array.isArray(payload.origins) ? payload.origins.filter((originvalue) => typeof originvalue === "string") : [];
+        for (const workfloworigin of origins) {
+          const granted = covered.some((pattern) => {
+            try {
+              return new URL(workfloworigin).origin === new URL(pattern).origin;
+            } catch {
+              return false;
+            }
+          });
+          if (!granted) throw new Error(`The workflow origin ${workfloworigin} stays outside the grants.`);
+        }
+      }
+      if (step.kind === "runworkflow" && workflowoptions.reviewed !== true) throw new Error("Workflow runs without the explicit run review of the expanded step list are refused.");
+    }
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
     const target = outboundtarget(step);
@@ -6201,6 +7760,11 @@ function parseproposal(value, origin, grants) {
   };
   return { version: protocolversion, plan };
 }
+function workflowoutcome(input) {
+  const selected = input.stepid !== void 0 ? input.entries.filter((entry) => entry.stepid === input.stepid) : input.entries;
+  const steps = selected.map((entry) => ({ stepid: entry.stepid, label: entry.label, state: entry.state, duration: entry.duration, summary: entry.summary, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.produced !== void 0 ? { produced: entry.produced } : {}, ...entry.consumed !== void 0 ? { consumed: entry.consumed } : {}, ...entry.checkpoint === true ? { checkpoint: true } : {}, ...entry.details !== void 0 && entry.details.control !== void 0 ? { control: entry.details.control } : {} }));
+  return { version: protocolversion, runid: input.run.id, workflowid: input.run.workflowid, state: input.run.state, ...input.run.dryrun === true ? { dryrun: true } : {}, steps };
+}
 function stepof(kind, candidate, index) {
   return { id: typeof candidate.id === "string" ? candidate.id : `candidate${index + 1}`, kind, summary: typeof candidate.summary === "string" ? candidate.summary : "", risk: "read", ...typeof candidate.options === "string" ? { options: candidate.options } : {} };
 }
@@ -6216,7 +7780,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed, ...input.workflow.timeout !== void 0 ? { timeout: input.workflow.timeout } : {}, ...input.workflow.retry !== void 0 ? { retry: input.workflow.retry } : {} } } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -6350,6 +7914,9 @@ function emulationreport(input) {
 function sessionreport(input) {
   return { version: protocolversion, records: input.records, events: input.events, folders: input.folders, diffs: input.diffs, ...input.auto !== void 0 ? { auto: input.auto } : {}, ...input.crashed === true ? { crashed: true } : {} };
 }
+function workflowreport(input) {
+  return { version: protocolversion, workflows: input.workflows, runs: input.runs, templates: input.templates, log: input.log ?? [], scopes: input.scopes ?? [], provenance: input.provenance ?? [], control: input.control ?? [] };
+}
 
 // capture.ts
 var capturekinds = ["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"];
@@ -7866,15 +9433,15 @@ function remainingpages(sessionvalue, planned) {
 function provenancefor(artifact, url, stepid, at) {
   return { artifact: artifact.id, name: artifact.name, url, stepid, rowstart: artifact.rowcount > 0 ? 1 : 0, rowend: artifact.rowcount, checksum: artifact.checksum, at };
 }
-function interpolate(text2, row) {
+function interpolate2(text2, row) {
   return text2.replace(/\{\{([^}]+)\}\}/g, (_, key) => row[key.trim()] ?? "");
 }
 function loopstep(step, row) {
   return {
     ...step,
-    ...step.target !== void 0 ? { target: interpolate(step.target, row) } : {},
-    ...step.value !== void 0 ? { value: interpolate(step.value, row) } : {},
-    ...step.options !== void 0 ? { options: interpolate(step.options, row) } : {}
+    ...step.target !== void 0 ? { target: interpolate2(step.target, row) } : {},
+    ...step.value !== void 0 ? { value: interpolate2(step.value, row) } : {},
+    ...step.options !== void 0 ? { options: interpolate2(step.options, row) } : {}
   };
 }
 function loopvariables(row) {
@@ -8078,7 +9645,7 @@ function stepoptions2(step) {
 }
 async function refreshcapabilities() {
   const report = await readcapabilities();
-  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds], sessions: [...sessionkinds] };
+  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds], sessions: [...sessionkinds], workflow: [...workflowkinds, ...controlflowkinds] };
   await memory.setcapabilities(withmedia);
   return withmedia;
 }
@@ -10778,7 +12345,7 @@ async function executehttpstep(step, session, plan, tabid2, origin) {
 var activesockets = /* @__PURE__ */ new Map();
 var channelbuses = /* @__PURE__ */ new Map();
 var netpoll = 100;
-function waitsome(milliseconds) {
+function waitsome2(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
 }
 async function queueinboundmessage(channelid, payload) {
@@ -10866,7 +12433,7 @@ async function runsubscription(subscription, controller) {
     }
     if (controller.signal.aborted) break;
     if (subscription.lifetime !== void 0 && Date.now() - startedat >= subscription.lifetime) break;
-    await waitsome(netpoll * 10);
+    await waitsome2(netpoll * 10);
   }
   const closed = { ...current, state: "closed", closedat: Date.now() };
   await memory.setsubscription(closed);
@@ -10960,7 +12527,7 @@ async function executesocketstep(step, session, plan, tabid2, origin) {
       const queued = await memory.getmessages(channelid);
       matched = queued.filter((envelope) => matchmessage(filter, envelope)).slice(0, filter.limit ?? (matched.length || void 0));
       if (matched.length >= (filter.limit ?? 1) || Date.now() >= deadline) break;
-      await waitsome(netpoll);
+      await waitsome2(netpoll);
     }
     await memory.drainmessages(matched.map((envelope) => ({ channelid: envelope.channelid, sequence: envelope.sequence })));
     await audit("socket", `The message wait on channel ${channelid} matched ${matched.length} envelope${matched.length === 1 ? "" : "s"} of the reviewed filter within the ${budget} millisecond budget; payload values stay out of the audit trail.`, extra);
@@ -11021,7 +12588,7 @@ async function executesocketstep(step, session, plan, tabid2, origin) {
           break;
         }
         stopcursor = decision.cursor;
-        await waitsome(decision.next?.wait ?? cursor.interval);
+        await waitsome2(decision.next?.wait ?? cursor.interval);
         next = { url: decision.next?.url ?? next.url, ...decision.next?.body !== void 0 ? { body: decision.next.body } : {} };
       }
     } finally {
@@ -11043,7 +12610,7 @@ async function executenetwatchstep(step, session, plan, tabid2, origin) {
     const limit = typeof options.limit === "number" && Number.isInteger(options.limit) && options.limit >= 1 ? options.limit : void 0;
     const before = await bridgecall(tabid2, "resourcerecords");
     const known = new Set(resourcefacts(before ?? []).map((fact) => `${fact.url}@${fact.start}`));
-    if (window2 > 0) await waitsome(window2);
+    if (window2 > 0) await waitsome2(window2);
     const after = await bridgecall(tabid2, "resourcerecords");
     const fresh = resourcefacts(after ?? []).filter((fact) => !known.has(`${fact.url}@${fact.start}`));
     const chosen = limit !== void 0 ? fresh.slice(0, limit) : fresh;
@@ -12193,7 +13760,8 @@ async function refreshbadge() {
   const locationprompts = (await memory.getlocationconsents()).filter((consent) => consent.approved === void 0).length;
   const emulatedlayers = [...activeemulation.values()].reduce((total2, state) => total2 + activelayers(state).length, 0);
   const tasktabs2 = new Set(badges.map((badge) => badge.tabid)).size;
-  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts + consoleprompts + debuggerprompts + locationprompts + emulatedlayers + observedrequests + livechannels + activerulescount;
+  const runningworkflows = (await memory.listworkflowruns()).filter((run) => run.state === "running").length + activeworkflowruns.size;
+  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts + consoleprompts + debuggerprompts + locationprompts + emulatedlayers + observedrequests + livechannels + activerulescount + runningworkflows;
   await chrome.action.setBadgeText({ text: total > 0 ? String(total) : "" }).catch(() => {
   });
 }
@@ -12477,6 +14045,324 @@ async function executesessionstep(step, session, plan, tabid2, origin) {
   }
   throw new Error(`The ${step.kind} step has no session memory executor.`);
 }
+var activeworkflowruns = /* @__PURE__ */ new Map();
+function runscopes(variables) {
+  const root = { name: "root", variables: [] };
+  if (!variables || typeof variables !== "object" || Array.isArray(variables)) return [root];
+  for (const [name, value] of Object.entries(variables)) {
+    if (typeof value === "number") root.variables.push({ name, kind: "number", value, setat: Date.now() });
+    else if (typeof value === "boolean") root.variables.push({ name, kind: "boolean", value, setat: Date.now() });
+    else if (typeof value === "string") root.variables.push({ name, kind: "string", value, setat: Date.now() });
+  }
+  return [root];
+}
+async function dispatchworkflowstep(step, context) {
+  const settings = await memory.getsettings();
+  const verdicts = await memory.getsafeties();
+  const action = {
+    id: step.id,
+    kind: step.kind,
+    summary: step.label,
+    risk: actionrisk(step.kind),
+    ...step.target !== void 0 ? { target: step.target } : {},
+    ...step.value !== void 0 ? { value: step.value } : {},
+    ...step.options !== void 0 ? { options: step.options } : {}
+  };
+  const gate = canexecute({ session: context.session, plan: context.plan, step: action, tabid: context.tabid, origin: context.origin, ...verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
+  if (!gate.allowed) return { ok: false, summary: `The workflow step ${step.label} was refused: ${gate.reason}` };
+  if (step.kind === "delay") return await executedelaystep(step);
+  if (step.kind === "waitelement") return await executewaitelement(step, context.tabid);
+  if (step.kind === "compute") return await executecomputestep(step, context.session);
+  if (step.kind === "extractvars") return await executeextractvarsstep(step, context.session);
+  const output = await executeaction(action, context.session, context.plan, context.tabid, context.origin, settings, verdicts.length > 0 ? verdicts : void 0, "run");
+  return { ok: Boolean(output.ok), summary: output.summary, ...output.details !== void 0 ? { details: output.details } : {} };
+}
+async function executedelaystep(step) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.options !== void 0 ? { options: step.options } : {} });
+  const delay = delayof(options.delay);
+  const sampled = delayjitter(delay, hashseed(`${step.id}:${Date.now()}`));
+  const transport = await sleepreviewed(sampled, step.id);
+  return { ok: true, summary: `Slept ${Math.round(sampled)} milliseconds inside the reviewed window of base ${delay.base} and jitter ${delay.jitter}${transport === "alarm" ? " through the alarms api" : ""}.`, details: { sampled: Math.round(sampled), base: delay.base, jitter: delay.jitter, transport } };
+}
+function delayof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("The delay needs a reviewed base and jitter window.");
+  const candidate = value;
+  if (typeof candidate.base !== "number" || !Number.isFinite(candidate.base) || candidate.base < 0) throw new Error("The reviewed delay base must be zero or a positive number of milliseconds.");
+  if (typeof candidate.jitter !== "number" || !Number.isFinite(candidate.jitter) || candidate.jitter < 0) throw new Error("The reviewed delay jitter window must be zero or a positive number of milliseconds.");
+  return { base: candidate.base, jitter: candidate.jitter };
+}
+function hashseed(text2) {
+  let hash = 2166136261;
+  for (let index = 0; index < text2.length; index += 1) {
+    hash ^= text2.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash >>> 0;
+}
+async function sleepreviewed(sampled, stepid) {
+  const alarmname = `devthinkdelay${stepid}`;
+  if (sampled > 3e4 && typeof chrome.alarms?.create === "function" && typeof chrome.alarms.onAlarm?.addListener === "function") {
+    try {
+      await new Promise((resolve) => {
+        const fallback = setTimeout(() => {
+          chrome.alarms.onAlarm.removeListener(listener);
+          resolve();
+        }, sampled + 5e3);
+        const listener = (alarm) => {
+          if (alarm.name !== alarmname) return;
+          clearTimeout(fallback);
+          chrome.alarms.onAlarm.removeListener(listener);
+          resolve();
+        };
+        chrome.alarms.onAlarm.addListener(listener);
+        void chrome.alarms.create(alarmname, { when: Date.now() + sampled });
+      });
+      return "alarm";
+    } catch {
+    }
+  }
+  await waitsome2(sampled);
+  return "timer";
+}
+async function executewaitelement(step, tabid2) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.target !== void 0 ? { target: step.target } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  const wait = waitof(options.wait, step.target);
+  const startedat = Date.now();
+  const starttab = await chrome.tabs.get(tabid2).catch(() => void 0);
+  const starturl = starttab?.url ?? "";
+  const plan = waitelementplan(wait);
+  const singlepass = plan.probes === 1;
+  const deadline = startedat + wait.timeout;
+  for (let pass = 0; pass < plan.probes; pass += 1) {
+    const tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+    if (!tab || starturl !== "" && (tab.url ?? "") !== starturl) return { ok: false, summary: `The tab navigated away and the element wait for ${wait.selector} aborted cleanly after ${Date.now() - startedat} milliseconds.` };
+    const probe = await bridgecall(tabid2, "elementrect", wait.selector).catch(() => void 0);
+    if (probe?.ok) return { ok: true, summary: `Selector ${wait.selector} appeared after ${Date.now() - startedat} milliseconds of polling every ${wait.poll} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat, poll: wait.poll } };
+    if (singlepass || Date.now() >= deadline) break;
+    await waitsome2(pass + 1 < plan.probes ? wait.poll : plan.lastwait);
+  }
+  return { ok: false, summary: `Selector ${wait.selector} did not appear within the reviewed timeout of ${wait.timeout} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat } };
+}
+function waitof(value, target) {
+  const candidate = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const selector = typeof candidate.selector === "string" && candidate.selector.trim() ? candidate.selector : target;
+  if (!selector || !selector.trim()) throw new Error("The element wait needs a reviewed non-empty selector.");
+  const timeout = typeof candidate.timeout === "number" && Number.isFinite(candidate.timeout) && candidate.timeout >= 0 ? candidate.timeout : -1;
+  const poll = typeof candidate.poll === "number" && Number.isFinite(candidate.poll) && candidate.poll >= 0 ? candidate.poll : -1;
+  if (timeout < 0 || poll < 0) throw new Error("The element wait needs a reviewed timeout and poll interval of zero or more milliseconds.");
+  return { selector, timeout, poll };
+}
+async function executecomputestep(step, session) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.options !== void 0 ? { options: step.options } : {} });
+  const expression = options.expression;
+  if (!expression || typeof expression !== "object") throw new Error("The compute step needs a reviewed expression.");
+  const scopes = runscopes(options.variables);
+  const value = expressioneval(expression, scopes);
+  await audit("workflow", `Evaluated the reviewed expression into ${expression.result} with the value ${typeof value === "string" ? `"${value}"` : String(value)}.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Computed ${expression.result} = ${typeof value === "string" ? `"${value}"` : String(value)} through the ${expression.operator} operator.`, details: { result: expression.result, kind: expression.resultkind, value } };
+}
+async function executeextractvarsstep(step, session) {
+  const options = stepoptions2({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
+  const rule = options.rule;
+  if (!rule || typeof rule !== "object" || typeof rule.pattern !== "string") throw new Error("The variable extraction needs a reviewed regex rule.");
+  const text2 = typeof options.text === "string" ? options.text : step.value ?? "";
+  const extraction = regexextract(rule, text2, Date.now());
+  if (!extraction.matched) {
+    await audit("workflow", `The reviewed regex rule of the ${step.id} step matched nothing; no variable was stored.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+    return { ok: true, summary: "The reviewed regex rule matched nothing; no variable was stored.", details: { matched: false, groups: rule.groups } };
+  }
+  await audit("workflow", `The reviewed regex rule captured ${extraction.variables.map((variable) => variable.name).join(", ")} as variables.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Captured ${extraction.variables.length} variable${extraction.variables.length === 1 ? "" : "s"} from the reviewed text.`, details: { matched: true, variables: extraction.variables } };
+}
+async function executeworkflowstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  if (step.kind === "composeworkflow") {
+    const payload = options.workflow;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("The workflow composition needs the reviewed workflow payload.");
+    const candidate = payload;
+    const record2 = composeworkflow({
+      ...typeof candidate.id === "string" && candidate.id.trim() ? { id: candidate.id } : {},
+      name: String(candidate.name ?? ""),
+      version: Number(candidate.version ?? 0),
+      origins: Array.isArray(candidate.origins) ? candidate.origins.filter((entry) => typeof entry === "string") : [],
+      steps: (Array.isArray(candidate.steps) ? candidate.steps : []).flatMap((entry) => {
+        const parsed = workflowstepofentry(entry);
+        return parsed !== void 0 ? [parsed] : [];
+      }),
+      blocks: (Array.isArray(candidate.blocks) ? candidate.blocks : []).flatMap((block) => {
+        const parsed = workflowblockof(block);
+        return parsed !== void 0 ? [parsed] : [];
+      }),
+      now: Date.now(),
+      kindallowed: (kind) => {
+        try {
+          actionrisk(kind);
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      riskof: (kind) => actionrisk(kind)
+    });
+    await memory.addworkflowrecord(record2);
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "compose", detail: `Composed the workflow ${record2.name} version ${record2.version}`, total: record2.steps.length }, Date.now()));
+    await audit("workflow", `Composed the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"} graded ${record2.risk} for review; blocks expanded so no step stayed hidden.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    return { ok: true, summary: `Composed the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} expanded steps graded ${record2.risk}.`, details: { workflow: { recordid: record2.id, steps: record2.steps.length, risk: record2.risk } } };
+  }
+  if (step.kind === "savetemplate") {
+    const template = steptemplateof({ ...options.template ?? {}, id: randomid(), origin, sharedat: Date.now() });
+    if (!template) throw new Error("The step template needs a reviewed name and a valid workflow step.");
+    await memory.addsteptemplate(template);
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "template", detail: `Shared the step template ${template.name}` }, Date.now()));
+    await audit("workflow", `Shared the step template ${template.name} of the ${template.step.kind} kind for reuse across workflows.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    return { ok: true, summary: `Shared the step template ${template.name}.`, details: { workflow: { recordid: template.name, steps: 1 } } };
+  }
+  if (step.kind === "runworkflow") return await executeworkflowrun(step, session, plan, tabid2, origin, false);
+  if (step.kind === "dryrun") return await executeworkflowrun(step, session, plan, tabid2, origin, true);
+  if (step.kind === "delay") return await executedelaystep({ id: step.id, kind: "delay", label: step.summary });
+  if (step.kind === "waitelement") return await executewaitelement({ id: step.id, kind: "waitelement", label: step.summary, ...step.target !== void 0 ? { target: step.target } : {}, ...step.options !== void 0 ? { options: step.options } : {} }, tabid2);
+  if (step.kind === "compute") return await executecomputestep({ id: step.id, kind: "compute", label: step.summary, ...step.options !== void 0 ? { options: step.options } : {} }, session);
+  if (step.kind === "extractvars") return await executeextractvarsstep({ id: step.id, kind: "extractvars", label: step.summary, ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} }, session);
+  throw new Error(`The ${step.kind} step has no workflow executor.`);
+}
+function workflowstepofentry(value) {
+  const parsed = workflowstepof(value);
+  if (parsed) return parsed;
+  return blockinvocationof(value);
+}
+async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
+  const options = stepoptions2(step);
+  const workflowid = typeof options.workflowid === "string" ? options.workflowid : "";
+  const record2 = await memory.getworkflowrecord(workflowid);
+  if (!record2) throw new Error(`No composed workflow matches ${workflowid || "the reviewed id"}.`);
+  for (const workfloworigin of record2.origins) {
+    if (!origingranted(session, workfloworigin)) throw new Error(`The workflow origin ${workfloworigin} falls outside the session grants.`);
+  }
+  const run = newworkflowrun({ workflowid: record2.id, dryrun: dry, now: Date.now() });
+  await memory.setworkflowrun(run);
+  await memory.setrunscopes(run.id, runscopes(options.variables));
+  if (dry) {
+    const evaluated = dryrunworkflow({ record: record2, run, now: Date.now(), projection: dryrunprojection });
+    for (const entry of evaluated.log) await memory.addrunlogentry(run.id, entry);
+    await memory.setworkflowrun(evaluated.run);
+    const refused = evaluated.log.filter((entry) => entry.state === "refused").length;
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "dryrun", detail: `Dry ran the workflow ${record2.name}`, runid: run.id, executed: evaluated.log.length - refused, refused, total: record2.steps.length }, Date.now()));
+    await audit("workflow", `The dry run of the workflow ${record2.name} evaluated ${evaluated.log.length} step${evaluated.log.length === 1 ? "" : "s"} read only; ${refused} step${refused === 1 ? "" : "s"} refused for lacking a read only projection and nothing was mutated.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    return { ok: true, summary: `The dry run evaluated ${evaluated.log.length} steps read only; ${refused} refused for lacking a read only projection.`, details: { runid: run.id, state: evaluated.run.state, dryrun: true, executed: evaluated.log.length - refused, refused, total: record2.steps.length } };
+  }
+  const guards = { cancelled: false };
+  activeworkflowruns.set(run.id, guards);
+  await audit("workflow", `Started the run ${run.id} of the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} reviewed steps; every step passes the session, plan review and origin gates.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+  const context = { session, plan, tabid: tabid2, origin };
+  const executesteprouted = async (workflowstep, stepcontext) => {
+    if (guards.cancelled) return { ok: false, summary: `The run was cancelled before the ${workflowstep.label} step dispatched.` };
+    if (!iscontrolflowkind(workflowstep.kind)) return await dispatchworkflowstep(workflowstep, context);
+    const controlled = await runcontrolstep({
+      step: workflowstep,
+      scopes: stepcontext.scopes,
+      outputs: stepcontext.outputs ?? {},
+      execute: async (dispatched, inner) => await executesteprouted(dispatched, inner),
+      now: Date.now(),
+      runid: run.id,
+      pagestate: await pagestateof(tabid2),
+      resolveelements: async (selector) => await resolveelements(tabid2, selector)
+    });
+    return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
+  };
+  const execute = async (workflowstep, stepcontext) => await executesteprouted(workflowstep, stepcontext);
+  let result;
+  const runbudget = options.timeout && typeof options.timeout === "object" && !Array.isArray(options.timeout) && typeof options.timeout.runms === "number" && Number.isFinite(options.timeout.runms) && options.timeout.runms > 0 ? options.timeout.runms : void 0;
+  try {
+    const launch = () => runworkflow({
+      record: record2,
+      run,
+      scopes: runscopes(options.variables),
+      execute,
+      now: Date.now(),
+      gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) },
+      oncheckpoint: async (state) => {
+        await memory.setworkflowrun(state.run);
+        const last = state.log[state.log.length - 1];
+        if (last) await memory.addrunlogentry(state.run.id, last);
+        await memory.setrunscopes(state.run.id, state.scopes);
+        for (const scope of state.scopes) for (const variable of scope.variables) await memory.addworkflowprovenance(state.run.id, { runid: state.run.id, kind: "binding", name: variable.name, value: variable.value, at: variable.setat });
+        await refreshbadge();
+      }
+    });
+    if (runbudget === void 0) {
+      result = await launch();
+    } else {
+      const raced = await applyruntimeout({ budgetms: runbudget, run: launch });
+      if (raced.cancelled) {
+        guards.cancelled = true;
+        const aborted = await storetimeoutabort(run, step, raced.error.message, runbudget);
+        result = { run: aborted.run, scopes: [], log: aborted.log, outputs: {} };
+      } else {
+        result = raced.value;
+      }
+    }
+  } finally {
+    activeworkflowruns.delete(run.id);
+  }
+  await memory.setworkflowrun(result.run);
+  for (const entry of result.log) {
+    const stored = await memory.getrunlog(run.id);
+    if (!stored.some((candidate) => candidate.stepid === entry.stepid && candidate.startedat === entry.startedat)) await memory.addrunlogentry(run.id, entry);
+  }
+  await memory.setrunscopes(run.id, result.scopes);
+  const decisions = [];
+  for (const entry of result.log) {
+    const control = entry.details?.control;
+    if (control && typeof control === "object" && !Array.isArray(control)) {
+      const decision = control;
+      decisions.push(decision);
+      await memory.addcontroldecision(run.id, decision);
+    }
+  }
+  for (const decision of decisions) await auditcontroldecision(run.id, decision, session.id, plan.id);
+  const loopbounds = record2.steps.flatMap((controlstep) => {
+    const summary = controlsummary(controlstep);
+    return summary !== void 0 && summary.bound !== void 0 && (controlstep.kind === "loop" || controlstep.kind === "repeatuntil" || controlstep.kind === "whileloop") ? [summary.bound] : [];
+  });
+  if (loopbounds.length > 0) {
+    const iterations = decisions.filter((decision) => decision.kind === "loop").reduce((total, decision) => total + (decision.loops?.length ?? 0), 0);
+    const denominator = loopbounds.reduce((total, bound) => total + bound, 0);
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "control", detail: `The control flow steps of the workflow ${record2.name} ran their loops toward the reviewed bounds`, runid: run.id, iterations, denominator }, Date.now()));
+  }
+  const executed = result.run.cursor;
+  await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "run", detail: `Ran the workflow ${record2.name}`, runid: run.id, executed, total: record2.steps.length }, Date.now()));
+  await audit("workflow", `The run ${run.id} of the workflow ${record2.name} ended ${result.run.state} after ${executed} of ${record2.steps.length} steps${result.run.failreason !== void 0 ? ` with the failure ${result.run.failreason}` : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+  await refreshbadge();
+  return { ok: result.run.state === "done", summary: `The workflow run ended ${result.run.state} after ${executed} of ${record2.steps.length} steps.`, details: { runid: run.id, state: result.run.state, executed, total: record2.steps.length, ...result.run.failreason !== void 0 ? { failreason: result.run.failreason } : {} } };
+}
+async function pagestateof(tabid2) {
+  const tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+  if (!tab) return {};
+  return { ...tab.url !== void 0 ? { url: tab.url } : {}, ...tab.title !== void 0 ? { title: tab.title } : {}, ...tab.status !== void 0 ? { ready: tab.status === "complete" } : {} };
+}
+async function resolveelements(tabid2, selector) {
+  const resolved = await bridgecall(tabid2, "queryelements", selector).catch(() => void 0);
+  if (!resolved?.ok) return [];
+  return resolved.selectors ?? [];
+}
+async function storetimeoutabort(run, step, message, budget) {
+  const at = Date.now();
+  const aborted = { ...run, state: "failed", endedat: at, failreason: message };
+  const entry = { stepid: step.id, label: `Run budget of ${step.id}`, state: "failed", startedat: at, duration: 0, summary: message, details: { errorclass: "timeout", budget, cancelled: true, control: { runid: run.id, stepid: step.id, kind: "timeout", at, timeouts: [{ stepid: step.id, budget, scope: "run", at }] } } };
+  const decision = entry.details?.control;
+  await memory.addcontroldecision(run.id, decision);
+  await memory.addrunlogentry(run.id, entry);
+  await audit("workflow", `The run ${run.id} exceeded its reviewed budget of ${budget} milliseconds and was cancelled with the cancelled error class.`, { planid: step.id });
+  return { run: aborted, log: [entry] };
+}
+async function auditcontroldecision(runid, decision, sessionid, planid) {
+  if (decision.kind === "branch" && decision.branch !== void 0) await audit("workflow", `The branch step ${decision.stepid} of the run ${runid} chose the path ${decision.branch.path}: ${decision.branch.reason}`, { sessionid, planid });
+  else if (decision.kind === "loop" && decision.loops !== void 0) await audit("workflow", `The loop step ${decision.stepid} of the run ${runid} recorded ${decision.loops.length} iteration counter${decision.loops.length === 1 ? "" : "s"} with the paths ${decision.loops.map((counter) => counter.path).join(", ")}.`, { sessionid, planid });
+  else if (decision.kind === "join" && decision.join !== void 0) await audit("workflow", `The join of the parallel step ${decision.stepid} of the run ${runid} merged ${decision.join.merged.length} variable${decision.join.merged.length === 1 ? "" : "s"} under the ${decision.join.strategy} strategy${decision.join.conflicts.length > 0 ? ` with the conflicts ${decision.join.conflicts.join(", ")}` : " with no conflict"}.`, { sessionid, planid });
+  else if (decision.kind === "catch" && decision.catch !== void 0) await audit("workflow", `The catch handler of the try step ${decision.stepid} of the run ${runid} ran after the ${decision.catch.errorclass} failure${decision.catch.rerun ? " and reran the fragile body" : ""}.`, { sessionid, planid });
+  else if (decision.kind === "retry" && decision.retries !== void 0) await audit("workflow", `The retry policy of the try step ${decision.stepid} of the run ${runid} ran ${decision.retries.length} retry attempt${decision.retries.length === 1 ? "" : "s"} with the backoff durations ${decision.retries.map((attempt) => `${attempt.delay} ms`).join(", ")}.`, { sessionid, planid });
+  else if (decision.kind === "timeout" && decision.timeouts !== void 0) await audit("workflow", `The timeout policy of the try step ${decision.stepid} of the run ${runid} aborted ${decision.timeouts.length} step${decision.timeouts.length === 1 ? "" : "s"} that exceeded their reviewed budgets.`, { sessionid, planid });
+}
 async function executestep(stepid) {
   const session = await memory.getsession();
   const plan = await memory.getplan();
@@ -12485,7 +14371,10 @@ async function executestep(stepid) {
   if (!step) throw new Error("Reviewed step was not found.");
   const settings = await memory.getsettings();
   const verdicts = await memory.getsafeties();
-  const gate = canexecute({ session, plan, step, tabid: tab.id, origin, ...verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
+  return executeaction(step, session, plan, tab.id, origin, settings, verdicts.length > 0 ? verdicts : void 0, "plan");
+}
+async function executeaction(step, session, plan, tabid2, origin, settings, verdicts, mode) {
+  const gate = canexecute({ session, plan, step, tabid: tabid2, origin, ...verdicts !== void 0 && verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
   if (!gate.allowed) throw new Error(gate.reason);
   const capability = requiredcapability(step.kind);
   if (capability) {
@@ -12499,79 +14388,82 @@ async function executestep(stepid) {
       await enforcewindowreview(step, session, plan);
     }
     if (istabscommandkind(step.kind)) {
-      output = await executetabscommand(step, session, plan, tab.id);
+      output = await executetabscommand(step, session, plan, tabid2);
     } else if (isdatasetkind(step.kind)) {
-      output = await executedatastep(step, session, plan, tab.id, origin);
+      output = await executedatastep(step, session, plan, tabid2, origin);
     } else if (isfileskind(step.kind)) {
-      output = await executefilesstep(step, session, plan, tab.id, origin);
+      output = await executefilesstep(step, session, plan, tabid2, origin);
     } else if (isformkind(step.kind)) {
-      output = await executeformstep(step, session, plan, tab.id, origin);
+      output = await executeformstep(step, session, plan, tabid2, origin);
     } else if (isbrowserkind(step.kind)) {
-      output = await runbrowseraction(step, tab.id, tab.windowId ?? chrome.windows.WINDOW_ID_CURRENT);
+      output = await runbrowseraction(step, tabid2, chrome.windows.WINDOW_ID_CURRENT);
     } else if (step.kind === "keyhold") {
-      output = await executekeyhold(step, session, plan, tab.id, origin);
+      output = await executekeyhold(step, session, plan, tabid2, origin);
     } else if (step.kind === "keyrelease") {
-      output = await executekeyrelease(step, session, plan, tab.id, origin);
+      output = await executekeyrelease(step, session, plan, tabid2, origin);
     } else if (step.kind === "dismissdialog") {
-      output = await executedismissdialog(step, session, plan, tab.id, origin);
+      output = await executedismissdialog(step, session, plan, tabid2, origin);
     } else if (step.kind === "retryaction") {
-      output = await executeretryaction(step, session, plan, tab.id, origin);
+      output = await executeretryaction(step, session, plan, tabid2, origin);
     } else if (step.kind === "mapclicks") {
-      output = await executemapclicks(step, plan, tab.id, origin);
+      output = await executemapclicks(step, plan, tabid2, origin);
     } else if (step.kind === "enterframe") {
-      output = await executeenterframe(step, plan, tab.id, origin);
+      output = await executeenterframe(step, plan, tabid2, origin);
     } else if (watchstepkinds.has(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Watch kinds refuse to run outside an approved session plan.");
-      const watched = await executewatchstep(step, session, plan, tab.id, origin);
+      const watched = await executewatchstep(step, session, plan, tabid2, origin);
       output = watched.output;
       watchwindow = { startedat: watched.watch.startedat, lifetime: watched.watch.lifetime };
     } else if (step.kind === "diffsnapshots") {
-      output = await executediffsnapshots(step, session, plan, tab.id, origin);
+      output = await executediffsnapshots(step, session, plan, tabid2, origin);
     } else if (navigationstepkinds.has(step.kind)) {
-      output = await executenavigationkind(step, session, plan, tab.id, origin);
+      output = await executenavigationkind(step, session, plan, tabid2, origin);
     } else if (iscapturekind(step.kind)) {
-      output = await executecapturestep(step, session, plan, tab.id, origin);
+      output = await executecapturestep(step, session, plan, tabid2, origin);
     } else if (ismediakind(step.kind)) {
-      output = await executemediastep(step, session, plan, tab.id, origin);
+      output = await executemediastep(step, session, plan, tabid2, origin);
     } else if (ishttpkind(step.kind)) {
-      output = await executehttpstep(step, session, plan, tab.id, origin);
+      output = await executehttpstep(step, session, plan, tabid2, origin);
     } else if (issocketkind(step.kind)) {
-      output = await executesocketstep(step, session, plan, tab.id, origin);
+      output = await executesocketstep(step, session, plan, tabid2, origin);
     } else if (isnetwatchkind(step.kind)) {
-      output = await executenetwatchstep(step, session, plan, tab.id, origin);
+      output = await executenetwatchstep(step, session, plan, tabid2, origin);
     } else if (iscontrolkind(step.kind)) {
-      output = await executenetcontrolstep(step, session, plan, tab.id, origin);
+      output = await executenetcontrolstep(step, session, plan, tabid2, origin);
     } else if (isdebugkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Debugging kinds refuse to run outside an approved session plan.");
-      output = await executetimelinestep(step, session, plan, tab.id, origin);
+      output = await executetimelinestep(step, session, plan, tabid2, origin);
     } else if (iscdpkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Devtools protocol kinds refuse to run outside an approved session plan.");
-      output = await executecdpstep(step, session, plan, tab.id, origin);
+      output = await executecdpstep(step, session, plan, tabid2, origin);
     } else if (isprofilekind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Profiling kinds refuse to run outside an approved session plan.");
-      output = await executeprofilestep(step, session, plan, tab.id, origin);
+      output = await executeprofilestep(step, session, plan, tabid2, origin);
     } else if (isemulationkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Emulation kinds refuse to run outside an approved session plan.");
-      output = await executeemulationstep(step, session, plan, tab.id, origin);
+      output = await executeemulationstep(step, session, plan, tabid2, origin);
     } else if (issessionkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Session memory kinds refuse to run outside an approved session plan.");
-      output = await executesessionstep(step, session, plan, tab.id, origin);
+      output = await executesessionstep(step, session, plan, tabid2, origin);
+    } else if (isworkflowkind(step.kind)) {
+      if (!session || !plan || plan.state !== "approved") throw new Error("Workflow kinds refuse to run outside an approved session plan.");
+      output = await executeworkflowstep(step, session, plan, tabid2, origin);
     } else {
       if (step.target && freshcheckkinds.has(step.kind)) {
-        const fresh = await snapshot(tab.id);
+        const fresh = await snapshot(tabid2);
         if (!fresh.interactive.some((item) => item.selector === step.target)) throw new Error("The page changed and the target must be reviewed again.");
       }
-      output = await dispatchpagestep(step, tab.id, origin, plan);
+      output = await dispatchpagestep(step, tabid2, origin, plan);
     }
     return output;
   };
   const runplan = plan;
   const capturepolicystate = await runcapturepolicy();
   if (capturepolicystate === "beforeafter" && session && step.risk !== "read" && beforeafterwrapallowed(step.kind)) {
-    const before = await grabstateshot(step, session, runplan, tab.id, "before");
+    const before = await grabstateshot(step, session, runplan, tabid2, "before");
     output = await dispatchreviewedstep();
     if (output?.ok) {
-      const after = await grabstateshot(step, session, runplan, tab.id, "after");
+      const after = await grabstateshot(step, session, runplan, tabid2, "after");
       const domversion = await memory.getobservationversion();
       const paired = capturestates({ policy: "beforeafter", before, after, actionkind: step.kind, ...step.target ? { target: step.target } : {}, ...domversion !== void 0 ? { domsnapshotid: String(domversion) } : {}, at: Date.now(), id: randomid() });
       if (paired.pair) {
@@ -12583,7 +14475,7 @@ async function executestep(stepid) {
   } else {
     output = await dispatchreviewedstep();
   }
-  if (["navigate", "back", "forward"].includes(step.kind)) await recordnavigation(step, session, tab.id);
+  if (["navigate", "back", "forward"].includes(step.kind)) await recordnavigation(step, session, tabid2);
   await recordevidence(step, output, session, plan, origin);
   if (output?.ok && plan && typeof output.details?.tabid === "number") {
     await memory.setprogress(assigntasktab(await memory.getprogress(), plan.id, output.details.tabid, Date.now()));
@@ -12591,20 +14483,20 @@ async function executestep(stepid) {
   const summary = output?.summary ?? "The page action returned no result.";
   const resolved = output?.details?.resolvedtarget;
   if (resolved) {
-    await memory.addresolution({ stepid, mode: resolved.mode, selector: resolved.selector, label: resolved.label, at: Date.now() });
+    await memory.addresolution({ stepid: step.id, mode: resolved.mode, selector: resolved.selector, label: resolved.label, at: Date.now() });
   }
-  const outcome = { stepid, ok: Boolean(output?.ok), summary, ...output?.details ? { details: output.details } : {}, at: Date.now() };
+  const outcome = { stepid: step.id, ok: Boolean(output?.ok), summary, ...output?.details ? { details: output.details } : {}, at: Date.now() };
   const auditkind = stepauditkind(step, Boolean(output?.ok));
-  await audit(auditkind, summary, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid });
+  await audit(auditkind, summary, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid: step.id });
   await memory.addoutcome(outcome);
-  if (output?.ok && plan) {
+  if (output?.ok && plan && mode === "plan") {
     const base = await memory.getprogress();
-    const completed = watchwindow ? recordwatchcompletion(base, plan.id, stepid, watchwindow.startedat, watchwindow.lifetime, Date.now()) : recordstep(base, plan.id, stepid, Date.now());
+    const completed = watchwindow ? recordwatchcompletion(base, plan.id, step.id, watchwindow.startedat, watchwindow.lifetime, Date.now()) : recordstep(base, plan.id, step.id, Date.now());
     const tracked = recordoutcome(completed, plan.id, outcome, Date.now());
     await memory.setprogress(tracked);
     await memory.settaskstate(taskstateof({ runid: plan.id, stepcursor: tracked.completedsteps.length, outputs: tracked.outcomes ?? [], checkpointat: Date.now() }));
     const tracker = activememorytrackers.get(plan.id);
-    if (tracker) await sampleheapforstep(tracker, stepid, tab.id, origin, plan).catch(() => {
+    if (tracker) await sampleheapforstep(tracker, step.id, tabid2, origin, plan).catch(() => {
     });
     await updatetaskbadges(plan, tracked);
     await refreshbadge();
@@ -12799,11 +14691,12 @@ async function handlerequest(message, sender) {
       const autosnapshot = await memory.getautosnapshot();
       const crashed = await memory.getcrashflag();
       const sessionrecords = await memory.applysessionexpiry(snapshotretentionwindow(runsettings), Date.now());
+      const newestworkflowrun = (await memory.listworkflowruns())[0];
       const taskstate = plan ? await memory.gettaskstate(plan.id) : void 0;
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id), control: await memory.listcontroldecisions(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -13970,6 +15863,172 @@ async function handlerequest(message, sender) {
       await audit("session", "The user cleared the reviewed auto snapshot interval; on demand captures stay the only source of session records.");
       return { cleared: true };
     }
+    case "workflowreview": {
+      const inputreview = message;
+      const record2 = await memory.getworkflowrecord(inputreview.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputreview.workflowid ?? ""}.`);
+      return { record: record2, steps: record2.steps.map((entry) => ({ id: entry.id, kind: entry.kind, label: entry.label, ...entry.target !== void 0 ? { target: entry.target } : {}, ...entry.value !== void 0 ? { value: entry.value } : {}, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.bindings !== void 0 ? { bindings: entry.bindings } : {}, ...entry.expression !== void 0 ? { expression: entry.expression } : {}, ...entry.extract !== void 0 ? { extract: entry.extract } : {}, ...controlsummary(entry) !== void 0 ? { control: controlsummary(entry) } : {} })), blocks: record2.blocks, risk: record2.risk, origins: record2.origins };
+    }
+    case "setloopbound": {
+      const inputbound = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Editing a loop safety bound needs an active browser session behind the consent gates.");
+      const record2 = await memory.getworkflowrecord(inputbound.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputbound.workflowid ?? ""}.`);
+      if (typeof inputbound.bound !== "number" || !Number.isInteger(inputbound.bound) || inputbound.bound < 1) throw new Error("The loop safety bound must be a positive integer with no code ceiling.");
+      const target = record2.steps.find((entry) => entry.id === (inputbound.stepid ?? ""));
+      if (!target || target.kind !== "loop" && target.kind !== "repeatuntil") throw new Error(`No loop or repeat until step of the workflow matches ${inputbound.stepid ?? ""}.`);
+      let payload;
+      try {
+        payload = JSON.parse(target.options ?? "{}");
+      } catch {
+        payload = {};
+      }
+      const key = target.kind === "loop" ? "loop" : "repeatuntil";
+      const body = payload[key] && typeof payload[key] === "object" && !Array.isArray(payload[key]) ? payload[key] : {};
+      body.bound = inputbound.bound;
+      payload[key] = body;
+      const restep = { ...target, options: JSON.stringify(payload) };
+      const recomposed = composeworkflow({
+        id: record2.id,
+        name: record2.name,
+        version: record2.version + 1,
+        origins: [...record2.origins],
+        steps: record2.steps.map((entry) => entry.id === target.id ? restep : entry),
+        blocks: [...record2.blocks],
+        now: Date.now(),
+        kindallowed: (kind) => {
+          try {
+            actionrisk(kind);
+            return true;
+          } catch {
+            return false;
+          }
+        },
+        riskof: (kind) => actionrisk(kind)
+      });
+      await memory.addworkflowrecord(recomposed);
+      await audit("workflow", `The user edited the loop safety bound of the step ${target.id} of the workflow ${record2.name} to ${inputbound.bound} iterations; version ${recomposed.version} was recomposed and the older version survives for the audit trail.`, { sessionid: session.id });
+      return { workflowid: recomposed.id, stepid: target.id, bound: inputbound.bound, version: recomposed.version };
+    }
+    case "approveworkflowrun": {
+      const inputapprove = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Workflow runs need an active browser session behind the consent gates.");
+      const record2 = await memory.getworkflowrecord(inputapprove.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputapprove.workflowid ?? ""}.`);
+      await audit("workflow", `The user approved the run review of the workflow ${record2.name} version ${record2.version} with its ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"} shown; the run still passes every consent gate per step.`, { sessionid: session.id });
+      return { approved: true, steps: record2.steps.length, risk: record2.risk };
+    }
+    case "executeworkflowstep": {
+      const inputsingle = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || !plan || plan.state !== "approved") throw new Error("Single step execution needs an approved session plan.");
+      const stored = await memory.getrun(inputsingle.runid?.trim() ?? "");
+      if (!stored) throw new Error(`No workflow run matches ${inputsingle.runid ?? ""}.`);
+      const record2 = await memory.getworkflowrecord(stored.run.workflowid);
+      if (!record2) throw new Error("The workflow of the run is no longer composed in the library.");
+      const step = record2.steps.find((entry) => entry.id === (inputsingle.stepid ?? ""));
+      if (!step) throw new Error(`No step of the workflow matches ${inputsingle.stepid ?? ""}.`);
+      const { tab, origin } = await activecontext();
+      const executestepsingle = async (dispatched, stepcontext) => {
+        if (iscontrolflowkind(dispatched.kind)) {
+          const controlled = await runcontrolstep({ step: dispatched, scopes: stepcontext.scopes, outputs: stepcontext.outputs ?? {}, execute: executestepsingle, now: Date.now(), runid: stored.run.id, pagestate: await pagestateof(tab.id), resolveelements: async (selector) => await resolveelements(tab.id, selector) });
+          return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
+        }
+        return await dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin });
+      };
+      const executed = await runstep({ step, scopes: await memory.getrunscopes(stored.run.id), outputs: {}, execute: executestepsingle, now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
+      await memory.addrunlogentry(stored.run.id, executed.log);
+      if (executed.childlog !== void 0) for (const entry of executed.childlog) await memory.addrunlogentry(stored.run.id, entry);
+      for (const entry of [executed.log, ...executed.childlog ?? []]) {
+        const control = entry.details?.control;
+        if (control && typeof control === "object" && !Array.isArray(control)) {
+          const decision = control;
+          await memory.addcontroldecision(stored.run.id, decision);
+          await auditcontroldecision(stored.run.id, decision, session.id, plan.id);
+        }
+      }
+      await memory.setrunscopes(stored.run.id, executed.scopes);
+      const stepindex = record2.steps.findIndex((entry) => entry.id === step.id);
+      const isthenext = stepindex === stored.run.cursor && executed.output.ok;
+      if (isthenext) await memory.setworkflowrun({ ...stored.run, cursor: stored.run.cursor + 1 });
+      await audit("workflow", `Executed the single step ${step.label} of the run ${stored.run.id} outside the run loop${isthenext ? " and advanced its checkpoint" : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+      return workflowoutcome({ run: { ...stored.run, ...isthenext ? { cursor: stored.run.cursor + 1 } : {} }, entries: await memory.getrunlog(stored.run.id), stepid: step.id });
+    }
+    case "pauseworkflowrun": {
+      const inputpause = message;
+      const stored = (await memory.listworkflowruns()).find((entry) => entry.id === (inputpause.runid ?? ""));
+      if (!stored) throw new Error(`No workflow run matches ${inputpause.runid ?? ""}.`);
+      const guards = activeworkflowruns.get(stored.id);
+      if (guards) guards.cancelled = true;
+      const paused = pauserun(stored, Date.now());
+      await memory.setworkflowrun(paused);
+      await audit("workflow", `Paused the workflow run ${paused.id} at the checkpoint of step cursor ${paused.cursor}; the resume continues exactly there.`, {});
+      await refreshbadge();
+      return { runid: paused.id, state: paused.state, cursor: paused.cursor };
+    }
+    case "resumeworkflowrun": {
+      const inputresume = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || !plan || plan.state !== "approved") throw new Error("The run resume needs an approved session plan.");
+      const stored = await memory.getrun(inputresume.runid?.trim() ?? "");
+      if (!stored) throw new Error(`No workflow run matches ${inputresume.runid ?? ""}.`);
+      if (stored.run.state !== "paused" && stored.run.state !== "running") throw new Error(`The workflow run is already ${stored.run.state}.`);
+      const record2 = await memory.getworkflowrecord(stored.run.workflowid);
+      if (!record2) throw new Error("The workflow of the run is no longer composed in the library.");
+      const scopes = await memory.getrunscopes(stored.run.id);
+      const log = await memory.getrunlog(stored.run.id);
+      const { tab, origin } = await activecontext();
+      let storedentries = log.length;
+      const executeresume = async (dispatched, stepcontext) => {
+        if (iscontrolflowkind(dispatched.kind)) {
+          const controlled = await runcontrolstep({ step: dispatched, scopes: stepcontext.scopes, outputs: stepcontext.outputs ?? {}, execute: executeresume, now: Date.now(), runid: stored.run.id, pagestate: await pagestateof(tab.id), resolveelements: async (selector) => await resolveelements(tab.id, selector) });
+          return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
+        }
+        return await dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin });
+      };
+      const resumed = await runworkflow({ record: record2, run: stored.run, scopes, log, execute: executeresume, now: Date.now(), gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) }, oncheckpoint: async (state) => {
+        await memory.setworkflowrun(state.run);
+        for (const entry of state.log.slice(storedentries)) await memory.addrunlogentry(state.run.id, entry);
+        storedentries = state.log.length;
+        await memory.setrunscopes(state.run.id, state.scopes);
+      } });
+      for (const entry of resumed.log.slice(storedentries)) await memory.addrunlogentry(stored.run.id, entry);
+      for (const entry of resumed.log.slice(log.length)) {
+        const control = entry.details?.control;
+        if (control && typeof control === "object" && !Array.isArray(control)) {
+          const decision = control;
+          await memory.addcontroldecision(stored.run.id, decision);
+          await auditcontroldecision(stored.run.id, decision, session.id, plan.id);
+        }
+      }
+      await memory.setworkflowrun(resumed.run);
+      await memory.setrunscopes(stored.run.id, resumed.scopes);
+      await audit("workflow", `Resumed the workflow run ${stored.run.id} from the checkpoint at step cursor ${stored.run.cursor}; the run ended ${resumed.run.state} at cursor ${resumed.run.cursor} with ${resumed.log.length - log.length} new runlog entries.`, { sessionid: session.id, planid: plan.id });
+      await refreshbadge();
+      return { runid: resumed.run.id, state: resumed.run.state, cursor: resumed.run.cursor };
+    }
+    case "cancelworkflowrun": {
+      const inputcancel = message;
+      const stored = (await memory.listworkflowruns()).find((entry) => entry.id === (inputcancel.runid ?? ""));
+      if (!stored) throw new Error(`No workflow run matches ${inputcancel.runid ?? ""}.`);
+      const guards = activeworkflowruns.get(stored.id);
+      if (guards) guards.cancelled = true;
+      const cancelled = cancelrun(stored, typeof inputcancel.reason === "string" && inputcancel.reason.trim() ? inputcancel.reason.trim() : "user cancel", Date.now());
+      await memory.setworkflowrun(cancelled);
+      await audit("workflow", `Cancelled the workflow run ${cancelled.id} with the reason ${cancelled.cancelreason ?? "user cancel"} at step cursor ${cancelled.cursor}.`, {});
+      await refreshbadge();
+      return { runid: cancelled.id, state: cancelled.state, cancelreason: cancelled.cancelreason };
+    }
+    case "workflowoutcome": {
+      const inputoutcome = message;
+      const stored = await memory.getrun(inputoutcome.runid?.trim() ?? "");
+      if (!stored) throw new Error(`No workflow run matches ${inputoutcome.runid ?? ""}.`);
+      return workflowoutcome({ run: stored.run, entries: stored.log, ...inputoutcome.stepid !== void 0 && inputoutcome.stepid !== "" ? { stepid: inputoutcome.stepid } : {} });
+    }
     default:
       throw new Error("Unknown Devthink request.");
   }
@@ -13994,7 +16053,15 @@ async function detectcrash() {
 }
 chrome.runtime.onStartup.addListener(() => {
   void detectcrash();
+  void pauseinterruptedworkflowruns();
 });
+async function pauseinterruptedworkflowruns() {
+  for (const run of await memory.listworkflowruns()) {
+    if (run.state !== "running") continue;
+    await memory.setworkflowrun({ ...run, state: "paused", pausedat: Date.now() });
+    await audit("workflow", `The service worker restart paused the workflow run ${run.id} at its last checkpoint of step cursor ${run.cursor}; the resume continues exactly there.`, {});
+  }
+}
 async function maybeautosnapshot() {
   const state = await memory.getautosnapshot();
   if (!state || !Number.isFinite(state.interval.period)) return;