@wenathlan/extension 1.1.50 → 1.1.51

package/extension/dist/background.js

@@ -2191,6 +2191,26 @@ var sessionmemory = class {
   async getsteptemplates() {
     return await this.adapter.get("steptemplates") ?? [];
   }
+  /** Records one control flow decision of a run — a branch choice with its reason, the loop counters of an iteration trail, the retry attempts with their backoff durations, the timeout aborts with the exceeded budget, the join record with its strategy and conflicts or the catch handler execution — so the audit trail keeps every control flow turn. */
+  async addcontroldecision(runid, decision) {
+    const decisions = await this.listcontroldecisions(runid);
+    await this.adapter.set(`controldecisions${runid}`, [...decisions, { ...decision, runid }]);
+  }
+  /** Returns every stored control flow decision of one run, oldest first. */
+  async listcontroldecisions(runid) {
+    return await this.adapter.get(`controldecisions${runid}`) ?? [];
+  }
+  /** Returns the past branch decisions of one workflow across every stored run, oldest first, so review can compare branch paths over time. */
+  async getbranchhistory(workflowid) {
+    const runs = await this.listworkflowruns();
+    const ordered = [...runs].reverse().filter((run) => run.workflowid === workflowid);
+    const history2 = [];
+    for (const run of ordered) {
+      const decisions = await this.listcontroldecisions(run.id);
+      for (const decision of decisions) if (decision.kind === "branch" && decision.branch !== void 0) history2.push(decision.branch);
+    }
+    return history2;
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -3177,6 +3197,678 @@ function teardowncdpsession(input) {
   };
 }
 
+// controlflow.ts
+var controlflowkinds = ["condition", "branch", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"];
+var defaultloopbound = 1e3;
+function iscontrolflowkind(kind) {
+  return controlflowkinds.includes(kind);
+}
+var cancellederror = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "cancellederror";
+  }
+};
+function controlname(value) {
+  return typeof value === "string" && /^[a-z][a-z0-9]*$/.test(value) ? value : void 0;
+}
+function controlstepslist(value) {
+  if (!Array.isArray(value) || value.length === 0) return void 0;
+  const steps = [];
+  for (const entry of value) {
+    const parsed = workflowstepof(entry);
+    if (!parsed) return void 0;
+    steps.push(parsed);
+  }
+  return steps;
+}
+function controlbound(value) {
+  if (value === void 0) return void 0;
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
+function conditionof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const expression = expressionof(candidate.expression);
+  if (!expression) return void 0;
+  if (expression.resultkind !== "boolean") return void 0;
+  return { expression };
+}
+function elseof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const name = controlname(candidate.name);
+  if (!name) return void 0;
+  if (candidate.when !== void 0) return void 0;
+  if (!Array.isArray(candidate.steps)) return void 0;
+  const steps = [];
+  for (const entry of candidate.steps) {
+    const parsed = workflowstepof(entry);
+    if (!parsed) return void 0;
+    steps.push(parsed);
+  }
+  return { name, steps };
+}
+function branchof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (!Array.isArray(candidate.paths) || candidate.paths.length === 0) return void 0;
+  const paths = [];
+  for (const entry of candidate.paths) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return void 0;
+    const path = entry;
+    const name = controlname(path.name);
+    if (!name) return void 0;
+    const when = path.when === void 0 ? void 0 : expressionof(path.when);
+    if (path.when !== void 0 && when === void 0) return void 0;
+    if (when !== void 0 && when.resultkind !== "boolean") return void 0;
+    const steps = controlstepslist(path.steps);
+    if (!steps) return void 0;
+    paths.push({ name, ...when !== void 0 ? { when } : {}, steps });
+  }
+  const names = paths.map((path) => path.name);
+  if (new Set(names).size !== names.length) return void 0;
+  const elsepath = elseof(candidate.else);
+  if (!elsepath) return void 0;
+  if (names.includes(elsepath.name)) return void 0;
+  return { paths, else: elsepath };
+}
+function loopof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const list = controlname(candidate.list);
+  const item = controlname(candidate.item);
+  const index = controlname(candidate.index);
+  if (!list || !item || !index) return void 0;
+  if (item === list || index === list || item === index) return void 0;
+  const bound = controlbound(candidate.bound);
+  if (candidate.bound !== void 0 && bound === void 0) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { list, item, index, ...bound !== void 0 ? { bound } : {}, steps };
+}
+function repeatuntilof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const until = expressionof(candidate.until);
+  if (!until || until.resultkind !== "boolean") return void 0;
+  const bound = controlbound(candidate.bound);
+  if (candidate.bound !== void 0 && bound === void 0) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { until, ...bound !== void 0 ? { bound } : {}, steps };
+}
+function whileof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const condition = expressionof(candidate.while);
+  if (!condition || condition.resultkind !== "boolean") return void 0;
+  const bound = controlbound(candidate.bound);
+  if (bound === void 0) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { while: condition, bound, steps };
+}
+function foreachof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.selector !== "string" || !candidate.selector.trim()) return void 0;
+  const item = controlname(candidate.item);
+  const index = controlname(candidate.index);
+  if (!item || !index || item === index) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { selector: candidate.selector, item, index, steps };
+}
+function parallelof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (!Array.isArray(candidate.branches) || candidate.branches.length === 0) return void 0;
+  const branches = [];
+  for (const entry of candidate.branches) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return void 0;
+    const branch = entry;
+    const id = controlname(branch.id);
+    if (!id) return void 0;
+    const steps = controlstepslist(branch.steps);
+    if (!steps) return void 0;
+    branches.push({ id, steps });
+  }
+  if (new Set(branches.map((branch) => branch.id)).size !== branches.length) return void 0;
+  const join = candidate.join && typeof candidate.join === "object" && !Array.isArray(candidate.join) ? candidate.join : void 0;
+  if (!join) return void 0;
+  if (join.strategy !== "first" && join.strategy !== "last" && join.strategy !== "fail") return void 0;
+  if (join.onfail !== "cancel" && join.onfail !== "continue") return void 0;
+  return { branches, join: { strategy: join.strategy, onfail: join.onfail } };
+}
+function tryof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  const catchcandidate = candidate.catch && typeof candidate.catch === "object" && !Array.isArray(candidate.catch) ? candidate.catch : void 0;
+  if (!catchcandidate) return void 0;
+  const catchsteps = controlstepslist(catchcandidate.steps);
+  if (!catchsteps) return void 0;
+  if (catchcandidate.rerun !== void 0 && typeof catchcandidate.rerun !== "boolean") return void 0;
+  const catchvalue = { steps: catchsteps, ...catchcandidate.rerun === true ? { rerun: true } : {} };
+  let retry;
+  if (candidate.retry !== void 0) {
+    const retrycandidate = candidate.retry && typeof candidate.retry === "object" && !Array.isArray(candidate.retry) ? candidate.retry : void 0;
+    if (!retrycandidate) return void 0;
+    if (typeof retrycandidate.attempts !== "number" || !Number.isInteger(retrycandidate.attempts) || retrycandidate.attempts < 1) return void 0;
+    const backoff = retrycandidate.backoff && typeof retrycandidate.backoff === "object" && !Array.isArray(retrycandidate.backoff) ? retrycandidate.backoff : void 0;
+    if (!backoff) return void 0;
+    if (backoff.shape !== "fixed" && backoff.shape !== "exponential") return void 0;
+    if (typeof backoff.base !== "number" || !Number.isFinite(backoff.base) || backoff.base < 0) return void 0;
+    if (typeof backoff.jitter !== "number" || !Number.isFinite(backoff.jitter) || backoff.jitter < 0) return void 0;
+    if (!Array.isArray(retrycandidate.retryable) || !retrycandidate.retryable.every((entry) => typeof entry === "string" && entry.trim())) return void 0;
+    retry = { attempts: retrycandidate.attempts, backoff: { shape: backoff.shape, base: backoff.base, jitter: backoff.jitter }, retryable: retrycandidate.retryable };
+  }
+  let timeout;
+  if (candidate.timeout !== void 0) {
+    const timeoutcandidate = candidate.timeout && typeof candidate.timeout === "object" && !Array.isArray(candidate.timeout) ? candidate.timeout : void 0;
+    if (!timeoutcandidate) return void 0;
+    const stepms = timeoutcandidate.stepms === void 0 ? void 0 : typeof timeoutcandidate.stepms === "number" && Number.isFinite(timeoutcandidate.stepms) && timeoutcandidate.stepms > 0 ? timeoutcandidate.stepms : void 0;
+    const runms = timeoutcandidate.runms === void 0 ? void 0 : typeof timeoutcandidate.runms === "number" && Number.isFinite(timeoutcandidate.runms) && timeoutcandidate.runms > 0 ? timeoutcandidate.runms : void 0;
+    if (stepms === void 0 && runms === void 0) return void 0;
+    if (timeoutcandidate.stepms !== void 0 && stepms === void 0) return void 0;
+    if (timeoutcandidate.runms !== void 0 && runms === void 0) return void 0;
+    timeout = { ...stepms !== void 0 ? { stepms } : {}, ...runms !== void 0 ? { runms } : {} };
+  }
+  return { steps, catch: catchvalue, ...retry !== void 0 ? { retry } : {}, ...timeout !== void 0 ? { timeout } : {} };
+}
+function controloptions(step) {
+  if (step.options === void 0) throw new Error(`The ${step.kind} step needs its reviewed control payload in options.`);
+  let parsed;
+  try {
+    parsed = JSON.parse(step.options);
+  } catch {
+    throw new Error(`The ${step.kind} control payload must be a JSON object.`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`The ${step.kind} control payload must be a JSON object.`);
+  return parsed;
+}
+function validatecontrolpayload(step) {
+  if (!iscontrolflowkind(step.kind)) return;
+  const payload = controloptions(step);
+  if (step.kind === "condition" && conditionof(payload.condition) === void 0) throw new Error("The condition step needs a reviewed boolean expression in its options.");
+  if (step.kind === "branch" && branchof(payload.branch) === void 0) throw new Error("The branch step needs reviewed unique paths with boolean match expressions and an else path in its options.");
+  if (step.kind === "loop" && loopof(payload.loop) === void 0) throw new Error("The loop step needs a reviewed list variable, distinct item and index variables, an optional positive safety bound and a non-empty body in its options.");
+  if (step.kind === "repeatuntil" && repeatuntilof(payload.repeatuntil) === void 0) throw new Error("The repeat until step needs a reviewed convergence expression, an optional positive safety bound and a non-empty body in its options.");
+  if (step.kind === "whileloop" && whileof(payload.while) === void 0) throw new Error("The while step needs a reviewed condition, a mandatory positive safety bound and a non-empty body in its options.");
+  if (step.kind === "foreach" && foreachof(payload.foreach) === void 0) throw new Error("The foreach step needs a reviewed non-empty selector, distinct item and index variables and a non-empty body in its options.");
+  if (step.kind === "parallel" && parallelof(payload.parallel) === void 0) throw new Error("The parallel step needs uniquely identified branches with bodies and a join policy of the first, last or fail strategy with cancel or continue on branch failure in its options.");
+  if (step.kind === "trycatch" && tryof(payload.try) === void 0) throw new Error("The try step needs a fragile body, a catch handler and optional retry and timeout policies in its options.");
+}
+function controlsteps(step) {
+  if (!iscontrolflowkind(step.kind)) return [];
+  let payload;
+  try {
+    payload = controloptions(step);
+  } catch {
+    return [];
+  }
+  const children = [];
+  const collect = (steps) => {
+    for (const child of steps) {
+      children.push(child);
+      collect(controlsteps(child));
+    }
+  };
+  if (step.kind === "condition") return children;
+  if (step.kind === "branch") {
+    const branch = branchof(payload.branch);
+    if (!branch) return children;
+    for (const path of branch.paths) collect(path.steps);
+    collect(branch.else.steps);
+    return children;
+  }
+  if (step.kind === "loop") {
+    const loop = loopof(payload.loop);
+    if (loop) collect(loop.steps);
+    return children;
+  }
+  if (step.kind === "repeatuntil") {
+    const repeat = repeatuntilof(payload.repeatuntil);
+    if (repeat) collect(repeat.steps);
+    return children;
+  }
+  if (step.kind === "whileloop") {
+    const condition = whileof(payload.while);
+    if (condition) collect(condition.steps);
+    return children;
+  }
+  if (step.kind === "foreach") {
+    const foreach = foreachof(payload.foreach);
+    if (foreach) collect(foreach.steps);
+    return children;
+  }
+  if (step.kind === "parallel") {
+    const parallel = parallelof(payload.parallel);
+    if (parallel) for (const branch of parallel.branches) collect(branch.steps);
+    return children;
+  }
+  const fragile = tryof(payload.try);
+  if (fragile) {
+    collect(fragile.steps);
+    collect(fragile.catch.steps);
+  }
+  return children;
+}
+function controlsummary(step) {
+  if (!iscontrolflowkind(step.kind)) return void 0;
+  let payload;
+  try {
+    payload = controloptions(step);
+  } catch {
+    return { kind: step.kind };
+  }
+  if (step.kind === "condition") {
+    const condition = conditionof(payload.condition);
+    return { kind: step.kind, ...condition ? { expression: `${condition.expression.operator} into ${condition.expression.result}` } : {} };
+  }
+  if (step.kind === "branch") {
+    const branch = branchof(payload.branch);
+    return { kind: step.kind, ...branch ? { paths: branch.paths.map((path) => path.name), elsepath: branch.else.name } : {} };
+  }
+  if (step.kind === "loop") {
+    const loop = loopof(payload.loop);
+    return { kind: step.kind, ...loop ? { list: loop.list, item: loop.item, index: loop.index, ...loop.bound !== void 0 ? { bound: loop.bound } : { bound: defaultloopbound } } : {} };
+  }
+  if (step.kind === "repeatuntil") {
+    const repeat = repeatuntilof(payload.repeatuntil);
+    return { kind: step.kind, ...repeat ? { bound: repeat.bound ?? defaultloopbound } : {} };
+  }
+  if (step.kind === "whileloop") {
+    const condition = whileof(payload.while);
+    return { kind: step.kind, ...condition ? { bound: condition.bound } : {} };
+  }
+  if (step.kind === "foreach") {
+    const foreach = foreachof(payload.foreach);
+    return { kind: step.kind, ...foreach ? { selector: foreach.selector, item: foreach.item, index: foreach.index } : {} };
+  }
+  if (step.kind === "parallel") {
+    const parallel = parallelof(payload.parallel);
+    return { kind: step.kind, ...parallel ? { branches: parallel.branches.map((branch) => branch.id), strategy: parallel.join.strategy, onfail: parallel.join.onfail } : {} };
+  }
+  const fragile = tryof(payload.try);
+  return { kind: step.kind, ...fragile ? { ...fragile.retry !== void 0 ? { attempts: fragile.retry.attempts, backoff: `${fragile.retry.backoff.shape} base ${fragile.retry.backoff.base} jitter ${fragile.retry.backoff.jitter}` } : {}, ...fragile.catch.rerun === true ? { rerun: true } : {}, ...fragile.timeout?.stepms !== void 0 ? { stepms: fragile.timeout.stepms } : {}, ...fragile.timeout?.runms !== void 0 ? { runms: fragile.timeout.runms } : {} } : {} };
+}
+function evaluatecondition(condition, scopes) {
+  const value = expressioneval(condition.expression, scopes);
+  if (typeof value !== "boolean") throw new Error("The condition expression must resolve to a boolean.");
+  return value;
+}
+function choosebranch(input) {
+  let scopes = input.scopes;
+  if (input.pagestate !== void 0) {
+    const parent = scopes.length > 0 ? scopes[scopes.length - 1].name : void 0;
+    scopes = pushscope(scopes, `pagestate${input.stepid}`, parent);
+    if (input.pagestate.url !== void 0) scopes = setvariable(scopes, "pageurl", "string", input.pagestate.url, input.now);
+    if (input.pagestate.title !== void 0) scopes = setvariable(scopes, "pagetitle", "string", input.pagestate.title, input.now);
+    if (input.pagestate.ready !== void 0) scopes = setvariable(scopes, "pageready", "boolean", input.pagestate.ready, input.now);
+  }
+  for (const path of input.branch.paths) {
+    if (path.when === void 0) return { outcome: { stepid: input.stepid, path: path.name, reason: `The path ${path.name} matches unconditionally.`, at: input.now }, steps: path.steps };
+    const value = expressioneval(path.when, scopes);
+    if (typeof value !== "boolean") throw new Error(`The branch path ${path.name} needs a boolean expression.`);
+    if (value) return { outcome: { stepid: input.stepid, path: path.name, reason: `The condition of the path ${path.name} holds.`, at: input.now }, steps: path.steps };
+  }
+  return { outcome: { stepid: input.stepid, path: input.branch.else.name, reason: "No path condition held and the else path ran.", at: input.now }, steps: input.branch.else.steps };
+}
+async function runbody(input) {
+  let scopes = input.scopes;
+  const outputs = { ...input.outputs };
+  const log = [];
+  for (const child of input.steps) {
+    if (iscontrolflowkind(child.kind)) {
+      const result = await runcontrolstep({ step: child, scopes, outputs, execute: input.execute, now: input.now, ...input.path !== void 0 ? { path: `${input.path}.${child.id}` } : {} });
+      scopes = result.scopes;
+      log.push(...result.log);
+      outputs[child.id] = { stepid: child.id, ok: result.output.ok, summary: result.output.summary, ...result.output.details !== void 0 ? { details: result.output.details } : {}, at: input.now };
+      if (!result.output.ok) return { ok: false, scopes, log, outputs, failure: result.output };
+      continue;
+    }
+    const executed = await runstep({ step: child, scopes, outputs, execute: input.execute, now: input.now });
+    scopes = executed.scopes;
+    if (executed.childlog !== void 0) log.push(...executed.childlog);
+    log.push(executed.log);
+    outputs[child.id] = { stepid: child.id, ok: executed.output.ok, summary: executed.output.summary, ...executed.output.details !== void 0 ? { details: executed.output.details } : {}, at: input.now };
+    if (!executed.output.ok) return { ok: false, scopes, log, outputs, failure: executed.output };
+  }
+  return { ok: true, scopes, log, outputs };
+}
+function deepcopy(value) {
+  if (Array.isArray(value)) return value.map(deepcopy);
+  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, deepcopy(entry)]));
+  return value;
+}
+function iterationentry(step, iteration, total, ok, now) {
+  return { stepid: step.id, label: `${step.label} iteration ${iteration + 1}`, state: ok ? "done" : "failed", startedat: now, duration: 0, summary: `Iteration ${iteration + 1} of ${total}.`, details: { iteration, total } };
+}
+async function runloop(input) {
+  const list = resolvevariable(input.scopes, input.loop.list);
+  if (!list) throw new Error(`The loop references the undefined list variable ${input.loop.list}.`);
+  if (list.kind !== "list") throw new Error(`The loop variable ${input.loop.list} is not a list.`);
+  const items = list.value;
+  const bound = input.loop.bound ?? defaultloopbound;
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  if (items.length > bound) {
+    return { ok: false, scopes: input.scopes, log: [], summary: `The loop list holds ${items.length} items and exceeds the reviewed safety bound of ${bound} iterations; nothing ran.`, decision };
+  }
+  let scopes = input.scopes;
+  const log = [];
+  for (let index = 0; index < items.length; index += 1) {
+    scopes = setvariable(scopes, input.loop.item, "string", deepcopy(items[index]), input.now);
+    scopes = setvariable(scopes, input.loop.index, "number", index, input.now);
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.loop.steps, path: `${input.path ?? input.step.id}[${index}]` });
+    scopes = body.scopes;
+    const ok = body.ok;
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${index}]`, iteration: index, ok, at: input.now });
+    log.push(...body.log, iterationentry(input.step, index, items.length, ok, input.now));
+    if (!ok) return { ok: false, scopes, log, summary: `The loop failed at iteration ${index + 1} of ${items.length}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The loop ran ${items.length} iteration${items.length === 1 ? "" : "s"} over ${input.loop.list} inside the reviewed safety bound of ${bound}.`, decision };
+}
+async function runrepeatuntil(input) {
+  const bound = input.repeat.bound ?? defaultloopbound;
+  let scopes = input.scopes;
+  const log = [];
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  for (let iteration = 0; iteration < bound; iteration += 1) {
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.repeat.steps, path: `${input.path ?? input.step.id}[${iteration}]` });
+    scopes = body.scopes;
+    log.push(...body.log);
+    const converged = evaluatecondition({ expression: input.repeat.until }, scopes);
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${iteration}]`, iteration, ok: body.ok, at: input.now });
+    if (!body.ok) return { ok: false, scopes, log, summary: `The repeat until failed at iteration ${iteration + 1}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+    log.push(iterationentry(input.step, iteration, bound, true, input.now));
+    if (converged) return { ok: true, scopes, log, summary: `The repeat until converged after ${iteration + 1} iteration${iteration === 0 ? "" : "s"} inside the reviewed safety bound of ${bound}.`, decision };
+  }
+  return { ok: false, scopes, log, summary: `The repeat until never converged within the reviewed safety bound of ${bound} iterations.`, decision };
+}
+async function runwhile(input) {
+  let scopes = input.scopes;
+  const log = [];
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  for (let iteration = 0; iteration < input.condition.bound; iteration += 1) {
+    if (!evaluatecondition({ expression: input.condition.while }, scopes)) {
+      return { ok: true, scopes, log, summary: `The while loop ended after ${iteration} iteration${iteration === 1 ? "" : "s"} because its condition stopped holding inside the reviewed safety bound of ${input.condition.bound}.`, decision };
+    }
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.condition.steps, path: `${input.path ?? input.step.id}[${iteration}]` });
+    scopes = body.scopes;
+    log.push(...body.log);
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${iteration}]`, iteration, ok: body.ok, at: input.now });
+    if (!body.ok) return { ok: false, scopes, log, summary: `The while loop failed at iteration ${iteration + 1}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+    log.push(iterationentry(input.step, iteration, input.condition.bound, true, input.now));
+  }
+  if (evaluatecondition({ expression: input.condition.while }, scopes)) {
+    return { ok: false, scopes, log, summary: `The while loop hit its reviewed safety bound of ${input.condition.bound} iterations while its condition still held; the overflow is reported instead of looping forever.`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The while loop ended after ${input.condition.bound} iteration${input.condition.bound === 1 ? "" : "s"} inside the reviewed safety bound.`, decision };
+}
+async function runforeach(input) {
+  if (!input.resolveelements) throw new Error("The foreach step needs the element resolver of the executor seam.");
+  const elements = await input.resolveelements(input.foreach.selector);
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  if (elements.length === 0) return { ok: true, scopes: input.scopes, log: [], summary: `The selector ${input.foreach.selector} matched no element and the foreach ran zero iterations.`, decision };
+  let scopes = input.scopes;
+  const log = [];
+  for (let index = 0; index < elements.length; index += 1) {
+    scopes = setvariable(scopes, input.foreach.item, "element", deepcopy(elements[index]), input.now);
+    scopes = setvariable(scopes, input.foreach.index, "number", index, input.now);
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.foreach.steps, path: `${input.path ?? input.step.id}[${index}]` });
+    scopes = body.scopes;
+    const ok = body.ok;
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${index}]`, iteration: index, ok, at: input.now });
+    log.push(...body.log, iterationentry(input.step, index, elements.length, ok, input.now));
+    if (!ok) return { ok: false, scopes, log, summary: `The foreach failed at iteration ${index + 1} of ${elements.length}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The foreach ran ${elements.length} iteration${elements.length === 1 ? "" : "s"} over the elements of ${input.foreach.selector}.`, decision };
+}
+function joinbranches(input) {
+  const contributing = input.branches.filter((branch) => !branch.cancelled);
+  const byname = /* @__PURE__ */ new Map();
+  for (const branch of contributing) for (const variable of branch.variables) {
+    const entries = byname.get(variable.name) ?? [];
+    entries.push({ order: branch.order, value: variable });
+    byname.set(variable.name, entries);
+  }
+  const conflicts = [...byname.entries()].filter(([, entries]) => entries.length > 1).map(([name]) => name);
+  const record2 = { stepid: input.stepid, strategy: input.strategy, conflicts, merged: [], at: input.now };
+  if (conflicts.length > 0 && input.strategy === "fail") {
+    return { ok: false, conflicts, merged: [], record: record2, summary: `The join refused the conflicting writes of ${conflicts.join(", ")} under the fail strategy.` };
+  }
+  const merged = [];
+  for (const [name, entries] of byname) {
+    void name;
+    const winner = input.strategy === "first" ? entries.reduce((left, right) => left.order <= right.order ? left : right) : entries.reduce((left, right) => left.order >= right.order ? left : right);
+    merged.push({ ...winner.value, setat: input.now });
+  }
+  record2.merged = merged.map((variable) => variable.name);
+  return { ok: true, conflicts, merged, record: record2, summary: `The join merged ${merged.length} variable${merged.length === 1 ? "" : "s"} under the ${input.strategy} strategy${conflicts.length > 0 ? ` with the conflicts ${conflicts.join(", ")} resolved by the strategy` : " with no conflict"}.` };
+}
+async function runparallel(input) {
+  let finished = 0;
+  let firstfailure = Number.POSITIVE_INFINITY;
+  const log = [];
+  const launches = input.parallel.branches.map((branch, order) => (async () => {
+    const parent = input.scopes.length > 0 ? input.scopes[input.scopes.length - 1].name : void 0;
+    const isolated = pushscope(input.scopes, `branch${branch.id}`, parent);
+    const body = await runbody({ step: input.step, scopes: isolated, outputs: input.outputs, execute: input.execute, now: input.now, steps: branch.steps });
+    const finishedat = finished;
+    finished += 1;
+    if (!body.ok && finishedat < firstfailure) firstfailure = finishedat;
+    const scope = body.scopes[body.scopes.length - 1];
+    return { branch, order, finishedat, ok: body.ok, scopes: body.scopes, variables: scope.name === `branch${branch.id}` ? scope.variables : [], log: body.log, failure: body.failure };
+  })());
+  const settled = await Promise.all(launches);
+  for (const entry of settled) log.push(...entry.log);
+  const cancelmode = input.parallel.join.onfail === "cancel";
+  const outcomes = settled.map((entry) => ({ branchid: entry.branch.id, ok: entry.ok, summary: entry.ok ? `The branch ${entry.branch.id} completed.` : entry.failure?.summary ?? `The branch ${entry.branch.id} failed.`, ...cancelmode && firstfailure !== Number.POSITIVE_INFINITY && entry.finishedat > firstfailure ? { cancelled: true } : {} }));
+  const join = joinbranches({ stepid: input.step.id, branches: settled.map((entry, order) => ({ id: entry.branch.id, order, ok: entry.ok, cancelled: outcomes[order]?.cancelled === true, variables: entry.variables })), strategy: input.parallel.join.strategy, now: input.now });
+  const decision = { runid: "", stepid: input.step.id, kind: "join", at: input.now, join: join.record, branches: outcomes };
+  if (!join.ok) return { ok: false, scopes: input.scopes, log, summary: join.summary, decision };
+  let scopes = input.scopes;
+  for (const variable of join.merged) scopes = setvariable(scopes, variable.name, variable.kind, variable.value, input.now);
+  const failedbranches = settled.filter((entry, order) => !entry.ok && outcomes[order]?.cancelled !== true).map((entry) => entry.branch.id);
+  if (cancelmode && failedbranches.length > 0) {
+    return { ok: false, scopes, log, summary: `The parallel block failed on branch ${failedbranches.join(", ")} and the join policy cancelled the siblings still running; ${join.summary}`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The parallel block ran ${input.parallel.branches.length} concurrent branch${input.parallel.branches.length === 1 ? "" : "es"}; ${join.summary}`, decision };
+}
+function errorclassof(output) {
+  const errorclass = output.details?.errorclass;
+  return typeof errorclass === "string" && errorclass.trim() ? errorclass : "stepfailed";
+}
+function backoffdelay(policy, attempt, seed) {
+  const base = policy.backoff.shape === "exponential" ? policy.backoff.base * 2 ** (attempt - 1) : policy.backoff.base;
+  if (policy.backoff.jitter <= 0) return Math.max(0, base);
+  return Math.max(0, base - policy.backoff.jitter / 2 + seededrandom(seed + attempt) * policy.backoff.jitter);
+}
+function waitsome(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
+}
+async function applyretry(input) {
+  const seed = input.seed ?? 0;
+  let value = await input.run();
+  const attempts = [];
+  let attempt = 1;
+  while (!value.ok && attempt < input.policy.attempts) {
+    const errorclass = input.errorclass(value);
+    if (!input.policy.retryable.includes(errorclass)) break;
+    const delay = backoffdelay(input.policy, attempt, seed);
+    attempts.push({ stepid: input.stepid, attempt: attempt + 1, delay, errorclass, at: input.now });
+    if (delay > 0) await waitsome(delay);
+    attempt += 1;
+    value = await input.run();
+  }
+  return { value, attempts, exhausted: !value.ok && attempts.length > 0 && attempt >= input.policy.attempts };
+}
+async function applytimeout(input) {
+  let timer;
+  const guard = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("cancelled"), Math.max(0, input.budgetms));
+  });
+  const raced = await Promise.race([input.run().then((value) => ({ kind: "done", value })), guard.then((marker) => ({ kind: "cancelled", marker }))]);
+  if (timer !== void 0) clearTimeout(timer);
+  if (raced.kind === "done") return { aborted: false, value: raced.value };
+  return { aborted: true, output: { ok: false, summary: `The ${input.stepid} step exceeded its reviewed budget of ${input.budgetms} milliseconds and was cancelled.`, details: { errorclass: "timeout", budget: input.budgetms, cancelled: true } }, abort: { stepid: input.stepid, budget: input.budgetms, scope: "step", at: Date.now() } };
+}
+async function applyruntimeout(input) {
+  let timer;
+  const guard = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("cancelled"), Math.max(0, input.budgetms));
+  });
+  const raced = await Promise.race([input.run().then((value) => ({ kind: "done", value })), guard.then((marker) => ({ kind: "cancelled", marker }))]);
+  if (timer !== void 0) clearTimeout(timer);
+  if (raced.kind === "done") return { cancelled: false, value: raced.value };
+  return { cancelled: true, error: new cancellederror(`The run exceeded its reviewed budget of ${input.budgetms} milliseconds and was cancelled.`) };
+}
+async function runcatch(input) {
+  const body = await runbody({ step: { id: "catch", kind: "trycatch", label: "catch handler" }, scopes: input.scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.handler.steps });
+  return { ok: body.ok, scopes: body.scopes, log: body.log };
+}
+async function runtry(input) {
+  const timeouts = [];
+  const retries = [];
+  const runonce = async (child, scopes) => {
+    if (iscontrolflowkind(child.kind)) {
+      const result = await runcontrolstep({ step: child, scopes, outputs: input.outputs, execute: input.execute, now: input.now });
+      return { ok: result.output.ok, scopes: result.scopes, log: result.log, output: result.output };
+    }
+    const executed = await runstep({ step: child, scopes, outputs: input.outputs, execute: input.execute, now: input.now });
+    return { ok: executed.output.ok, scopes: executed.scopes, log: [...executed.childlog ?? [], executed.log], output: executed.output };
+  };
+  const runchild = async (child, scopes) => {
+    const attempt = async () => {
+      if (input.fragile.retry === void 0) return await runonce(child, scopes);
+      const retried = await applyretry({ stepid: child.id, policy: input.fragile.retry, run: () => runonce(child, scopes), errorclass: (value) => errorclassof(value.output), now: input.now, seed: seedof(child.id) });
+      retries.push(...retried.attempts);
+      return retried.value;
+    };
+    if (input.fragile.timeout?.stepms === void 0) return await attempt();
+    const guarded = await applytimeout({ stepid: child.id, budgetms: input.fragile.timeout.stepms, run: attempt });
+    if (!guarded.aborted) return guarded.value;
+    if (guarded.abort) timeouts.push(guarded.abort);
+    return { ok: false, scopes, log: [], output: guarded.output };
+  };
+  const runbodyof = async (scopes) => {
+    let current = scopes;
+    const log = [];
+    for (const child of input.fragile.steps) {
+      const executed = await runchild(child, current);
+      current = executed.scopes;
+      log.push(...executed.log);
+      if (!executed.ok) return { ok: false, scopes: current, log, failure: executed.output };
+    }
+    return { ok: true, scopes: current, log };
+  };
+  let body;
+  if (input.fragile.timeout?.runms !== void 0) {
+    const guarded = await applytimeout({ stepid: input.step.id, budgetms: input.fragile.timeout.runms, run: () => runbodyof(input.scopes) });
+    if (guarded.aborted) {
+      if (guarded.abort) timeouts.push({ ...guarded.abort, scope: "run" });
+      body = { ok: false, scopes: input.scopes, log: [], failure: guarded.output ?? { ok: false, summary: "The try block exceeded its reviewed run budget and was cancelled.", details: { errorclass: "timeout", cancelled: true } } };
+    } else {
+      body = guarded.value;
+    }
+  } else {
+    body = await runbodyof(input.scopes);
+  }
+  if (body.ok) {
+    const summary = `The try block completed its ${input.fragile.steps.length} step${input.fragile.steps.length === 1 ? "" : "s"}${retries.length > 0 ? ` after ${retries.length} retry attempt${retries.length === 1 ? "" : "s"}` : ""}.`;
+    if (retries.length === 0 && timeouts.length === 0) return { ok: true, scopes: body.scopes, log: body.log, summary };
+    return { ok: true, scopes: body.scopes, log: body.log, summary, decision: { runid: "", stepid: input.step.id, kind: "retry", at: input.now, ...retries.length > 0 ? { retries } : {}, ...timeouts.length > 0 ? { timeouts } : {} } };
+  }
+  const handler = await runcatch({ handler: input.fragile.catch, scopes: body.scopes, outputs: input.outputs, execute: input.execute, now: input.now });
+  const errorclass = errorclassof(body.failure ?? { ok: false, summary: "" });
+  const decision = { runid: "", stepid: input.step.id, kind: "catch", at: input.now, ...retries.length > 0 ? { retries } : {}, ...timeouts.length > 0 ? { timeouts } : {}, catch: { errorclass, message: body.failure?.summary ?? "The fragile body step failed.", rerun: input.fragile.catch.rerun === true } };
+  if (!handler.ok) return { ok: false, scopes: handler.scopes, log: [...body.log, ...handler.log], summary: `The catch handler of the try block failed after the ${errorclass} failure.`, decision };
+  if (input.fragile.catch.rerun === true) {
+    const rerun = await runbodyof(handler.scopes);
+    if (rerun.ok) return { ok: true, scopes: rerun.scopes, log: [...body.log, ...handler.log, ...rerun.log], summary: `The catch handler ran after the ${errorclass} failure and the rerun of the try body succeeded.`, decision };
+    return { ok: false, scopes: rerun.scopes, log: [...body.log, ...handler.log, ...rerun.log], summary: `The catch handler ran and the rerun of the try body failed again with ${errorclassof(rerun.failure ?? { ok: false, summary: "" })}.`, decision };
+  }
+  return { ok: true, scopes: handler.scopes, log: [...body.log, ...handler.log], summary: `The catch handler ran ${input.fragile.catch.steps.length} step${input.fragile.catch.steps.length === 1 ? "" : "s"} after the ${errorclass} failure.`, decision };
+}
+function seedof(text2) {
+  let hash = 2166136261;
+  for (let index = 0; index < text2.length; index += 1) {
+    hash ^= text2.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash >>> 0;
+}
+async function runcontrolstep(input) {
+  const payload = controloptions(input.step);
+  const base = { step: input.step, scopes: input.scopes, outputs: input.outputs, execute: input.execute, now: input.now, ...input.path !== void 0 ? { path: input.path } : {} };
+  let result;
+  switch (input.step.kind) {
+    case "condition": {
+      const condition = conditionof(payload.condition);
+      if (!condition) throw new Error("The condition step needs a reviewed boolean expression in its options.");
+      const value = evaluatecondition(condition, input.scopes);
+      const scopes = setvariable(input.scopes, condition.expression.result, condition.expression.resultkind, value, input.now);
+      const summary = `The condition ${condition.expression.result} ${value ? "holds" : "does not hold"} over the extracted values.`;
+      return { scopes, log: [], output: { ok: true, summary, details: { condition: { result: condition.expression.result, value } } } };
+    }
+    case "branch": {
+      const branch = branchof(payload.branch);
+      if (!branch) throw new Error("The branch step needs reviewed unique paths with boolean match expressions and an else path in its options.");
+      const chosen = choosebranch({ stepid: input.step.id, branch, scopes: input.scopes, ...input.pagestate !== void 0 ? { pagestate: input.pagestate } : {}, now: input.now });
+      const body = await runbody({ ...base, steps: chosen.steps });
+      result = body.ok ? { ok: true, scopes: body.scopes, log: body.log, summary: `The branch chose the path ${chosen.outcome.path}: ${chosen.outcome.reason}`, decision: { runid: input.runid ?? "", stepid: input.step.id, kind: "branch", at: input.now, branch: chosen.outcome } } : { ok: false, scopes: body.scopes, log: body.log, summary: `The branch chose the path ${chosen.outcome.path} and its body failed: ${body.failure?.summary ?? "the body step failed."}`, decision: { runid: input.runid ?? "", stepid: input.step.id, kind: "branch", at: input.now, branch: chosen.outcome } };
+      break;
+    }
+    case "loop": {
+      const loop = loopof(payload.loop);
+      if (!loop) throw new Error("The loop step needs a reviewed list variable, distinct item and index variables, an optional positive safety bound and a non-empty body in its options.");
+      result = await runloop({ ...base, loop });
+      break;
+    }
+    case "repeatuntil": {
+      const repeat = repeatuntilof(payload.repeatuntil);
+      if (!repeat) throw new Error("The repeat until step needs a reviewed convergence expression, an optional positive safety bound and a non-empty body in its options.");
+      result = await runrepeatuntil({ ...base, repeat });
+      break;
+    }
+    case "whileloop": {
+      const condition = whileof(payload.while);
+      if (!condition) throw new Error("The while step needs a reviewed condition, a mandatory positive safety bound and a non-empty body in its options.");
+      result = await runwhile({ ...base, condition });
+      break;
+    }
+    case "foreach": {
+      const foreach = foreachof(payload.foreach);
+      if (!foreach) throw new Error("The foreach step needs a reviewed non-empty selector, distinct item and index variables and a non-empty body in its options.");
+      result = await runforeach({ ...base, foreach, ...input.resolveelements !== void 0 ? { resolveelements: input.resolveelements } : {} });
+      break;
+    }
+    case "parallel": {
+      const parallel = parallelof(payload.parallel);
+      if (!parallel) throw new Error("The parallel step needs uniquely identified branches with bodies and a join policy of the first, last or fail strategy with cancel or continue on branch failure in its options.");
+      result = await runparallel({ ...base, parallel });
+      break;
+    }
+    case "trycatch": {
+      const fragile = tryof(payload.try);
+      if (!fragile) throw new Error("The try step needs a fragile body, a catch handler and optional retry and timeout policies in its options.");
+      result = await runtry({ ...base, fragile });
+      break;
+    }
+    default:
+      throw new Error(`The ${input.step.kind} step is not a control flow kind.`);
+  }
+  if (result.decision !== void 0 && input.runid !== void 0) result.decision.runid = input.runid;
+  return { scopes: result.scopes, log: result.log, output: { ok: result.ok, summary: result.summary, ...result.decision !== void 0 ? { details: { control: result.decision } } : {} } };
+}
+
 // workflow.ts
 var workflowkinds = ["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"];
 function workflowstepof(value) {
@@ -3324,12 +4016,19 @@ function composeworkflow(input) {
   const steps = expandblocks(input.steps, blocks);
   for (const step of steps) {
     if (input.kindallowed && !input.kindallowed(step.kind)) throw new Error(`The workflow step kind ${step.kind} is not a reviewed action kind.`);
+    if (iscontrolflowkind(step.kind)) {
+      validatecontrolpayload(step);
+      for (const child of controlsteps(step)) {
+        if (input.kindallowed && !input.kindallowed(child.kind)) throw new Error(`The workflow step kind ${child.kind} inside the control payload of ${step.id} is not a reviewed action kind.`);
+      }
+    }
     if (step.bindings) for (const binding of step.bindings) {
       if (!steps.some((other) => other.id === binding.stepid)) throw new Error(`The binding of ${binding.variable} references the unknown step ${binding.stepid}.`);
     }
   }
   const riskof = input.riskof ?? (() => "sensitive");
-  const risk = steps.some((step) => riskof(step.kind) === "sensitive") ? "sensitive" : steps.some((step) => riskof(step.kind) === "interaction") ? "interaction" : "read";
+  const gradedkinds = steps.flatMap((step) => [step.kind, ...controlsteps(step).map((child) => child.kind)]);
+  const risk = gradedkinds.some((kind) => riskof(kind) === "sensitive") ? "sensitive" : gradedkinds.some((kind) => riskof(kind) === "interaction") ? "interaction" : "read";
   const record2 = { id: input.id ?? crypto.randomUUID(), name: input.name, version: input.version, origins: [...new Set(origins)], steps, blocks, risk, createdat: input.now };
   return deepfreeze(record2);
 }
@@ -3610,21 +4309,24 @@ async function runstep(input) {
       }
       stepvalue = interpolated.text;
     }
-    const target = input.step.target !== void 0 ? interpolate(input.step.target, scopes) : void 0;
+    const controlled = iscontrolflowkind(input.step.kind);
+    const target = !controlled && input.step.target !== void 0 ? interpolate(input.step.target, scopes) : void 0;
     if (target) consumed.push(...target.consumed);
-    const value = stepvalue !== void 0 ? interpolate(stepvalue, scopes) : void 0;
+    const value = !controlled && stepvalue !== void 0 ? interpolate(stepvalue, scopes) : void 0;
     if (value) consumed.push(...value.consumed);
-    const options = input.step.options !== void 0 ? interpolate(input.step.options, scopes) : void 0;
+    const options = !controlled && input.step.options !== void 0 ? interpolate(input.step.options, scopes) : void 0;
     if (options) consumed.push(...options.consumed);
     const dispatchable = { ...input.step, ...target !== void 0 ? { target: target.text } : {}, ...value !== void 0 ? { value: value.text } : {}, ...options !== void 0 ? { options: options.text } : {} };
-    const output = await input.execute(dispatchable, { scopes, ...input.block !== void 0 ? { block: input.block } : {} });
+    const output = await input.execute(dispatchable, { scopes, outputs: input.outputs, ...input.block !== void 0 ? { block: input.block } : {} });
+    if (output.scopes !== void 0) scopes = output.scopes;
+    const childlog = output.log;
     if (input.step.bindings) {
       const bound = bindvariables(scopes, input.step.bindings, { ...input.outputs, [input.step.id]: { stepid: input.step.id, ok: output.ok, summary: output.summary, ...output.details !== void 0 ? { details: output.details } : {}, at: input.now } }, input.now);
       scopes = bound.scopes;
       produced = [.../* @__PURE__ */ new Set([...produced, ...bound.produced])];
     }
     const duration = Date.now() - startedat;
-    return { scopes, log: runlogof(input.step, output.ok ? "done" : "failed", startedat, duration, output.summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {}, ...produced.length > 0 ? { produced } : {}, ...output.details !== void 0 ? { details: output.details } : {}, ...output.ok ? { checkpoint: true } : {} }), output };
+    return { scopes, log: runlogof(input.step, output.ok ? "done" : "failed", startedat, duration, output.summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {}, ...produced.length > 0 ? { produced } : {}, ...output.details !== void 0 ? { details: output.details } : {}, ...output.ok ? { checkpoint: true } : {} }), ...childlog !== void 0 ? { childlog } : {}, output };
   } catch (error) {
     const duration = Date.now() - startedat;
     const summary = error instanceof Error ? error.message : String(error);
@@ -3656,6 +4358,7 @@ async function runworkflow(input) {
     }
     const executed = await runstep({ step, scopes, outputs, execute: input.execute, now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
     scopes = executed.scopes;
+    if (executed.childlog !== void 0) log.push(...executed.childlog);
     log.push(executed.log);
     outputs[step.id] = { stepid: step.id, ok: executed.output.ok, summary: executed.output.summary, ...executed.output.details !== void 0 ? { details: executed.output.details } : {}, at: Date.now() };
     if (!executed.output.ok) {
@@ -3916,8 +4619,8 @@ function consolediff(input) {
 
 // policy.ts
 var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow"]);
-var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
+var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars", "condition", "branch"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
@@ -3938,7 +4641,7 @@ var cdpactions = /* @__PURE__ */ new Set(["attachcdp", "detachcdp", "cdpcmd", "w
 var profileractions = /* @__PURE__ */ new Set(["measureflow", "heapshot", "trackmemory", "profilecpu", "watchshifts", "traceload", "annotatetrace", "replaytrace", "capturesourcemaps"]);
 var emulationactions = /* @__PURE__ */ new Set(["emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "blackboxscripts"]);
 var sessionactions = /* @__PURE__ */ new Set(["persiststate", "capturesession", "restoresession", "namedsessions", "diffsessions", "searchsessions", "exportsessions", "importsessions"]);
-var workflowactions = /* @__PURE__ */ new Set(["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
+var workflowactions = /* @__PURE__ */ new Set(["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars", "condition", "branch", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
 var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
@@ -5583,6 +6286,68 @@ function validateworkflowgrammar(step, options) {
     if (typeof options.text !== "string") return { allowed: false, reason: "The variable extraction needs the reviewed text the regex rule applies to." };
     return { allowed: true };
   }
+  if (kind === "condition") {
+    const condition = conditionof(options.condition);
+    if (!condition) return { allowed: false, reason: "The condition step needs a reviewed boolean expression in its options." };
+    const operatorcheck = validatexpressionoperators(condition.expression);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return { allowed: true };
+  }
+  if (kind === "branch") {
+    const branch = branchof(options.branch);
+    if (!branch) return { allowed: false, reason: "The branch step needs reviewed unique paths with boolean match expressions and an else path in its options so every branch terminates." };
+    for (const path of [...branch.paths, branch.else]) {
+      if (path.when === void 0) continue;
+      const operatorcheck = validatexpressionoperators(path.when);
+      if (!operatorcheck.allowed) return operatorcheck;
+    }
+    return controlchildkinds(step);
+  }
+  if (kind === "loop") {
+    const loop = loopof(options.loop);
+    if (!loop) return { allowed: false, reason: "The loop step needs a reviewed list variable, distinct item and index variables, an optional positive safety bound and a non-empty body in its options; an absent bound keeps the documented default." };
+    return controlchildkinds(step);
+  }
+  if (kind === "repeatuntil") {
+    const repeat = repeatuntilof(options.repeatuntil);
+    if (!repeat) return { allowed: false, reason: "The repeat until step needs a reviewed convergence expression, an optional positive safety bound and a non-empty body in its options." };
+    const operatorcheck = validatexpressionoperators(repeat.until);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return controlchildkinds(step);
+  }
+  if (kind === "whileloop") {
+    const condition = whileof(options.while);
+    if (!condition) return { allowed: false, reason: "The while step needs a reviewed condition, a mandatory positive safety bound and a non-empty body in its options; a while loop without a safety bound is refused." };
+    const operatorcheck = validatexpressionoperators(condition.while);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return controlchildkinds(step);
+  }
+  if (kind === "foreach") {
+    const foreach = foreachof(options.foreach);
+    if (!foreach) return { allowed: false, reason: "The foreach step needs a reviewed non-empty selector, distinct item and index variables and a non-empty body in its options." };
+    return controlchildkinds(step);
+  }
+  if (kind === "parallel") {
+    const parallel = parallelof(options.parallel);
+    if (!parallel) return { allowed: false, reason: "The parallel step needs uniquely identified branches with bodies and a join policy of the first, last or fail strategy with cancel or continue on branch failure in its options." };
+    return controlchildkinds(step);
+  }
+  if (kind === "trycatch") {
+    const fragile = tryof(options.try);
+    if (!fragile) return { allowed: false, reason: "The try step needs a fragile body, a catch handler and optional retry and timeout policies in its options: attempts stay user configured with no code ceiling, backoff is fixed or exponential and budgets are positive." };
+    return controlchildkinds(step);
+  }
+  return { allowed: true };
+}
+function controlchildkinds(step) {
+  const children = controlsteps({ id: step.id, kind: step.kind, label: step.summary, ...step.options !== void 0 ? { options: step.options } : {} });
+  for (const child of children) {
+    try {
+      actionrisk(child.kind);
+    } catch {
+      return { allowed: false, reason: `The ${child.kind} step inside the control payload of the ${step.kind} step is not a reviewed action kind.` };
+    }
+  }
   return { allowed: true };
 }
 function validateregexrule(pattern) {
@@ -5644,6 +6409,20 @@ function workflowgate(input) {
   return { allowed: true };
 }
 function dryrunprojection(step) {
+  if (iscontrolflowkind(step.kind)) {
+    for (const child of controlsteps(step)) {
+      const childrisk = resolvedrisk({ id: child.id, kind: child.kind, summary: child.label, risk: "read", ...child.target !== void 0 ? { target: child.target } : {}, ...child.value !== void 0 ? { value: child.value } : {}, ...child.options !== void 0 ? { options: child.options } : {} });
+      if (childrisk !== "read") return void 0;
+    }
+    if (step.kind === "condition") return "The condition step would evaluate its reviewed expression over the extracted values with no page side effect.";
+    if (step.kind === "branch") return "The branch step would choose one reviewed path by page state and only the chosen path would run.";
+    if (step.kind === "loop") return "The loop step would iterate its reviewed list binding the item and index variables per iteration inside the safety bound.";
+    if (step.kind === "repeatuntil") return "The repeat until step would rerun its body until the convergence expression holds inside the safety bound.";
+    if (step.kind === "whileloop") return "The while step would loop while its condition holds inside the reviewed safety bound.";
+    if (step.kind === "foreach") return "The foreach step would iterate the elements of its reviewed selector binding the item and index variables per iteration.";
+    if (step.kind === "parallel") return "The parallel step would run its branches concurrently and join their outcomes under the reviewed strategy.";
+    return "The try step would run its fragile body and only the catch handler on failure.";
+  }
   const risk = resolvedrisk({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.target !== void 0 ? { target: step.target } : {}, ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
   if (risk !== "read") return void 0;
   if (step.kind === "delay") return `The delay step would sleep its reviewed base inside the jitter window.`;
@@ -6422,30 +7201,30 @@ function canexecute(input) {
   if (iscontrolkind(input.step.kind)) {
     const controlgate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "control the network" });
     if (!controlgate.allowed) return controlgate;
-    let controloptions = {};
+    let controloptions2 = {};
     try {
-      controloptions = parseoptions(input.step);
+      controloptions2 = parseoptions(input.step);
     } catch {
-      controloptions = {};
+      controloptions2 = {};
     }
     if (input.step.kind === "blockrequest") {
       const blockgatecheck = blockgate(input.session, input.step, now);
       if (!blockgatecheck.allowed) return blockgatecheck;
-      const rule = blockruleof(controloptions.block);
+      const rule = blockruleof(controloptions2.block);
       if (rule) {
         const blockorigin = origincheck(input.session, rule.urlpattern);
         if (!blockorigin.allowed) return blockorigin;
       }
     }
     if (input.step.kind === "mockresponse" || input.step.kind === "rewriteheaders") {
-      const patterns = input.step.kind === "mockresponse" ? [mockspecof(controloptions.mock)?.urlpattern ?? ""] : Array.isArray(controloptions.rules) ? controloptions.rules.map((item) => item && typeof item === "object" && !Array.isArray(item) ? String(item.urlpattern ?? "") : "") : [];
+      const patterns = input.step.kind === "mockresponse" ? [mockspecof(controloptions2.mock)?.urlpattern ?? ""] : Array.isArray(controloptions2.rules) ? controloptions2.rules.map((item) => item && typeof item === "object" && !Array.isArray(item) ? String(item.urlpattern ?? "") : "") : [];
       for (const pattern of patterns) {
         const patterngate = origincheck(input.session, pattern);
         if (!patterngate.allowed) return patterngate;
       }
     }
     if (input.step.kind === "setcookies" || input.step.kind === "readcookies" || input.step.kind === "clearcookies") {
-      const domain = typeof controloptions.domain === "string" && controloptions.domain.trim() ? controloptions.domain : Array.isArray(controloptions.cookies) ? String(controloptions.cookies[0]?.domain ?? "") : "";
+      const domain = typeof controloptions2.domain === "string" && controloptions2.domain.trim() ? controloptions2.domain : Array.isArray(controloptions2.cookies) ? String(controloptions2.cookies[0]?.domain ?? "") : "";
       if (!domain) return { allowed: false, reason: "A reviewed cookie domain is required before cookie control runs." };
       const cookiegatecheck = cookiegate(input.session, domain, now);
       if (!cookiegatecheck.allowed) return cookiegatecheck;
@@ -6677,13 +7456,13 @@ function recordsession(progress, planid, stepid, entry, now) {
 }
 function recordworkflow(progress, planid, stepid, entry, now) {
   const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
-  const counts = `${entry.executed !== void 0 ? `${entry.executed} executed step${entry.executed === 1 ? "" : "s"}, ` : ""}${entry.refused !== void 0 ? `${entry.refused} refused step${entry.refused === 1 ? "" : "s"}, ` : ""}${entry.total !== void 0 ? `${entry.total} total step${entry.total === 1 ? "" : "s"}, ` : ""}`.replace(/, $/, "");
+  const counts = `${entry.executed !== void 0 ? `${entry.executed} executed step${entry.executed === 1 ? "" : "s"}, ` : ""}${entry.refused !== void 0 ? `${entry.refused} refused step${entry.refused === 1 ? "" : "s"}, ` : ""}${entry.total !== void 0 ? `${entry.total} total step${entry.total === 1 ? "" : "s"}, ` : ""}${entry.iterations !== void 0 ? `${entry.iterations} iteration${entry.iterations === 1 ? "" : "s"}, ` : ""}${entry.denominator !== void 0 ? `denominator ${entry.denominator}, ` : ""}`.replace(/, $/, "");
   const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { workflow: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
 
 // version.ts
-var packageversion = "1.1.50";
+var packageversion = "1.1.51";
 
 // types.ts
 var protocolversion = packageversion;
@@ -6983,7 +7762,7 @@ function parseproposal(value, origin, grants) {
 }
 function workflowoutcome(input) {
   const selected = input.stepid !== void 0 ? input.entries.filter((entry) => entry.stepid === input.stepid) : input.entries;
-  const steps = selected.map((entry) => ({ stepid: entry.stepid, label: entry.label, state: entry.state, duration: entry.duration, summary: entry.summary, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.produced !== void 0 ? { produced: entry.produced } : {}, ...entry.consumed !== void 0 ? { consumed: entry.consumed } : {}, ...entry.checkpoint === true ? { checkpoint: true } : {} }));
+  const steps = selected.map((entry) => ({ stepid: entry.stepid, label: entry.label, state: entry.state, duration: entry.duration, summary: entry.summary, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.produced !== void 0 ? { produced: entry.produced } : {}, ...entry.consumed !== void 0 ? { consumed: entry.consumed } : {}, ...entry.checkpoint === true ? { checkpoint: true } : {}, ...entry.details !== void 0 && entry.details.control !== void 0 ? { control: entry.details.control } : {} }));
   return { version: protocolversion, runid: input.run.id, workflowid: input.run.workflowid, state: input.run.state, ...input.run.dryrun === true ? { dryrun: true } : {}, steps };
 }
 function stepof(kind, candidate, index) {
@@ -7001,7 +7780,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed } } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed, ...input.workflow.timeout !== void 0 ? { timeout: input.workflow.timeout } : {}, ...input.workflow.retry !== void 0 ? { retry: input.workflow.retry } : {} } } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -7136,7 +7915,7 @@ function sessionreport(input) {
   return { version: protocolversion, records: input.records, events: input.events, folders: input.folders, diffs: input.diffs, ...input.auto !== void 0 ? { auto: input.auto } : {}, ...input.crashed === true ? { crashed: true } : {} };
 }
 function workflowreport(input) {
-  return { version: protocolversion, workflows: input.workflows, runs: input.runs, templates: input.templates, log: input.log ?? [], scopes: input.scopes ?? [], provenance: input.provenance ?? [] };
+  return { version: protocolversion, workflows: input.workflows, runs: input.runs, templates: input.templates, log: input.log ?? [], scopes: input.scopes ?? [], provenance: input.provenance ?? [], control: input.control ?? [] };
 }
 
 // capture.ts
@@ -8866,7 +9645,7 @@ function stepoptions2(step) {
 }
 async function refreshcapabilities() {
   const report = await readcapabilities();
-  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds], sessions: [...sessionkinds], workflow: [...workflowkinds] };
+  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds], sessions: [...sessionkinds], workflow: [...workflowkinds, ...controlflowkinds] };
   await memory.setcapabilities(withmedia);
   return withmedia;
 }
@@ -11566,7 +12345,7 @@ async function executehttpstep(step, session, plan, tabid2, origin) {
 var activesockets = /* @__PURE__ */ new Map();
 var channelbuses = /* @__PURE__ */ new Map();
 var netpoll = 100;
-function waitsome(milliseconds) {
+function waitsome2(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
 }
 async function queueinboundmessage(channelid, payload) {
@@ -11654,7 +12433,7 @@ async function runsubscription(subscription, controller) {
     }
     if (controller.signal.aborted) break;
     if (subscription.lifetime !== void 0 && Date.now() - startedat >= subscription.lifetime) break;
-    await waitsome(netpoll * 10);
+    await waitsome2(netpoll * 10);
   }
   const closed = { ...current, state: "closed", closedat: Date.now() };
   await memory.setsubscription(closed);
@@ -11748,7 +12527,7 @@ async function executesocketstep(step, session, plan, tabid2, origin) {
       const queued = await memory.getmessages(channelid);
       matched = queued.filter((envelope) => matchmessage(filter, envelope)).slice(0, filter.limit ?? (matched.length || void 0));
       if (matched.length >= (filter.limit ?? 1) || Date.now() >= deadline) break;
-      await waitsome(netpoll);
+      await waitsome2(netpoll);
     }
     await memory.drainmessages(matched.map((envelope) => ({ channelid: envelope.channelid, sequence: envelope.sequence })));
     await audit("socket", `The message wait on channel ${channelid} matched ${matched.length} envelope${matched.length === 1 ? "" : "s"} of the reviewed filter within the ${budget} millisecond budget; payload values stay out of the audit trail.`, extra);
@@ -11809,7 +12588,7 @@ async function executesocketstep(step, session, plan, tabid2, origin) {
           break;
         }
         stopcursor = decision.cursor;
-        await waitsome(decision.next?.wait ?? cursor.interval);
+        await waitsome2(decision.next?.wait ?? cursor.interval);
         next = { url: decision.next?.url ?? next.url, ...decision.next?.body !== void 0 ? { body: decision.next.body } : {} };
       }
     } finally {
@@ -11831,7 +12610,7 @@ async function executenetwatchstep(step, session, plan, tabid2, origin) {
     const limit = typeof options.limit === "number" && Number.isInteger(options.limit) && options.limit >= 1 ? options.limit : void 0;
     const before = await bridgecall(tabid2, "resourcerecords");
     const known = new Set(resourcefacts(before ?? []).map((fact) => `${fact.url}@${fact.start}`));
-    if (window2 > 0) await waitsome(window2);
+    if (window2 > 0) await waitsome2(window2);
     const after = await bridgecall(tabid2, "resourcerecords");
     const fresh = resourcefacts(after ?? []).filter((fact) => !known.has(`${fact.url}@${fact.start}`));
     const chosen = limit !== void 0 ? fresh.slice(0, limit) : fresh;
@@ -13342,7 +14121,7 @@ async function sleepreviewed(sampled, stepid) {
     } catch {
     }
   }
-  await waitsome(sampled);
+  await waitsome2(sampled);
   return "timer";
 }
 async function executewaitelement(step, tabid2) {
@@ -13360,7 +14139,7 @@ async function executewaitelement(step, tabid2) {
     const probe = await bridgecall(tabid2, "elementrect", wait.selector).catch(() => void 0);
     if (probe?.ok) return { ok: true, summary: `Selector ${wait.selector} appeared after ${Date.now() - startedat} milliseconds of polling every ${wait.poll} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat, poll: wait.poll } };
     if (singlepass || Date.now() >= deadline) break;
-    await waitsome(pass + 1 < plan.probes ? wait.poll : plan.lastwait);
+    await waitsome2(pass + 1 < plan.probes ? wait.poll : plan.lastwait);
   }
   return { ok: false, summary: `Selector ${wait.selector} did not appear within the reviewed timeout of ${wait.timeout} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat } };
 }
@@ -13475,13 +14254,26 @@ async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
   activeworkflowruns.set(run.id, guards);
   await audit("workflow", `Started the run ${run.id} of the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} reviewed steps; every step passes the session, plan review and origin gates.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
   const context = { session, plan, tabid: tabid2, origin };
-  const execute = async (workflowstep) => {
+  const executesteprouted = async (workflowstep, stepcontext) => {
     if (guards.cancelled) return { ok: false, summary: `The run was cancelled before the ${workflowstep.label} step dispatched.` };
-    return await dispatchworkflowstep(workflowstep, context);
+    if (!iscontrolflowkind(workflowstep.kind)) return await dispatchworkflowstep(workflowstep, context);
+    const controlled = await runcontrolstep({
+      step: workflowstep,
+      scopes: stepcontext.scopes,
+      outputs: stepcontext.outputs ?? {},
+      execute: async (dispatched, inner) => await executesteprouted(dispatched, inner),
+      now: Date.now(),
+      runid: run.id,
+      pagestate: await pagestateof(tabid2),
+      resolveelements: async (selector) => await resolveelements(tabid2, selector)
+    });
+    return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
   };
+  const execute = async (workflowstep, stepcontext) => await executesteprouted(workflowstep, stepcontext);
   let result;
+  const runbudget = options.timeout && typeof options.timeout === "object" && !Array.isArray(options.timeout) && typeof options.timeout.runms === "number" && Number.isFinite(options.timeout.runms) && options.timeout.runms > 0 ? options.timeout.runms : void 0;
   try {
-    result = await runworkflow({
+    const launch = () => runworkflow({
       record: record2,
       run,
       scopes: runscopes(options.variables),
@@ -13497,6 +14289,18 @@ async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
         await refreshbadge();
       }
     });
+    if (runbudget === void 0) {
+      result = await launch();
+    } else {
+      const raced = await applyruntimeout({ budgetms: runbudget, run: launch });
+      if (raced.cancelled) {
+        guards.cancelled = true;
+        const aborted = await storetimeoutabort(run, step, raced.error.message, runbudget);
+        result = { run: aborted.run, scopes: [], log: aborted.log, outputs: {} };
+      } else {
+        result = raced.value;
+      }
+    }
   } finally {
     activeworkflowruns.delete(run.id);
   }
@@ -13506,12 +14310,59 @@ async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
     if (!stored.some((candidate) => candidate.stepid === entry.stepid && candidate.startedat === entry.startedat)) await memory.addrunlogentry(run.id, entry);
   }
   await memory.setrunscopes(run.id, result.scopes);
+  const decisions = [];
+  for (const entry of result.log) {
+    const control = entry.details?.control;
+    if (control && typeof control === "object" && !Array.isArray(control)) {
+      const decision = control;
+      decisions.push(decision);
+      await memory.addcontroldecision(run.id, decision);
+    }
+  }
+  for (const decision of decisions) await auditcontroldecision(run.id, decision, session.id, plan.id);
+  const loopbounds = record2.steps.flatMap((controlstep) => {
+    const summary = controlsummary(controlstep);
+    return summary !== void 0 && summary.bound !== void 0 && (controlstep.kind === "loop" || controlstep.kind === "repeatuntil" || controlstep.kind === "whileloop") ? [summary.bound] : [];
+  });
+  if (loopbounds.length > 0) {
+    const iterations = decisions.filter((decision) => decision.kind === "loop").reduce((total, decision) => total + (decision.loops?.length ?? 0), 0);
+    const denominator = loopbounds.reduce((total, bound) => total + bound, 0);
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "control", detail: `The control flow steps of the workflow ${record2.name} ran their loops toward the reviewed bounds`, runid: run.id, iterations, denominator }, Date.now()));
+  }
   const executed = result.run.cursor;
   await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "run", detail: `Ran the workflow ${record2.name}`, runid: run.id, executed, total: record2.steps.length }, Date.now()));
   await audit("workflow", `The run ${run.id} of the workflow ${record2.name} ended ${result.run.state} after ${executed} of ${record2.steps.length} steps${result.run.failreason !== void 0 ? ` with the failure ${result.run.failreason}` : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
   await refreshbadge();
   return { ok: result.run.state === "done", summary: `The workflow run ended ${result.run.state} after ${executed} of ${record2.steps.length} steps.`, details: { runid: run.id, state: result.run.state, executed, total: record2.steps.length, ...result.run.failreason !== void 0 ? { failreason: result.run.failreason } : {} } };
 }
+async function pagestateof(tabid2) {
+  const tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+  if (!tab) return {};
+  return { ...tab.url !== void 0 ? { url: tab.url } : {}, ...tab.title !== void 0 ? { title: tab.title } : {}, ...tab.status !== void 0 ? { ready: tab.status === "complete" } : {} };
+}
+async function resolveelements(tabid2, selector) {
+  const resolved = await bridgecall(tabid2, "queryelements", selector).catch(() => void 0);
+  if (!resolved?.ok) return [];
+  return resolved.selectors ?? [];
+}
+async function storetimeoutabort(run, step, message, budget) {
+  const at = Date.now();
+  const aborted = { ...run, state: "failed", endedat: at, failreason: message };
+  const entry = { stepid: step.id, label: `Run budget of ${step.id}`, state: "failed", startedat: at, duration: 0, summary: message, details: { errorclass: "timeout", budget, cancelled: true, control: { runid: run.id, stepid: step.id, kind: "timeout", at, timeouts: [{ stepid: step.id, budget, scope: "run", at }] } } };
+  const decision = entry.details?.control;
+  await memory.addcontroldecision(run.id, decision);
+  await memory.addrunlogentry(run.id, entry);
+  await audit("workflow", `The run ${run.id} exceeded its reviewed budget of ${budget} milliseconds and was cancelled with the cancelled error class.`, { planid: step.id });
+  return { run: aborted, log: [entry] };
+}
+async function auditcontroldecision(runid, decision, sessionid, planid) {
+  if (decision.kind === "branch" && decision.branch !== void 0) await audit("workflow", `The branch step ${decision.stepid} of the run ${runid} chose the path ${decision.branch.path}: ${decision.branch.reason}`, { sessionid, planid });
+  else if (decision.kind === "loop" && decision.loops !== void 0) await audit("workflow", `The loop step ${decision.stepid} of the run ${runid} recorded ${decision.loops.length} iteration counter${decision.loops.length === 1 ? "" : "s"} with the paths ${decision.loops.map((counter) => counter.path).join(", ")}.`, { sessionid, planid });
+  else if (decision.kind === "join" && decision.join !== void 0) await audit("workflow", `The join of the parallel step ${decision.stepid} of the run ${runid} merged ${decision.join.merged.length} variable${decision.join.merged.length === 1 ? "" : "s"} under the ${decision.join.strategy} strategy${decision.join.conflicts.length > 0 ? ` with the conflicts ${decision.join.conflicts.join(", ")}` : " with no conflict"}.`, { sessionid, planid });
+  else if (decision.kind === "catch" && decision.catch !== void 0) await audit("workflow", `The catch handler of the try step ${decision.stepid} of the run ${runid} ran after the ${decision.catch.errorclass} failure${decision.catch.rerun ? " and reran the fragile body" : ""}.`, { sessionid, planid });
+  else if (decision.kind === "retry" && decision.retries !== void 0) await audit("workflow", `The retry policy of the try step ${decision.stepid} of the run ${runid} ran ${decision.retries.length} retry attempt${decision.retries.length === 1 ? "" : "s"} with the backoff durations ${decision.retries.map((attempt) => `${attempt.delay} ms`).join(", ")}.`, { sessionid, planid });
+  else if (decision.kind === "timeout" && decision.timeouts !== void 0) await audit("workflow", `The timeout policy of the try step ${decision.stepid} of the run ${runid} aborted ${decision.timeouts.length} step${decision.timeouts.length === 1 ? "" : "s"} that exceeded their reviewed budgets.`, { sessionid, planid });
+}
 async function executestep(stepid) {
   const session = await memory.getsession();
   const plan = await memory.getplan();
@@ -13845,7 +14696,7 @@ async function handlerequest(message, sender) {
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id), control: await memory.listcontroldecisions(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -15016,7 +15867,49 @@ async function handlerequest(message, sender) {
       const inputreview = message;
       const record2 = await memory.getworkflowrecord(inputreview.workflowid?.trim() ?? "");
       if (!record2) throw new Error(`No composed workflow matches ${inputreview.workflowid ?? ""}.`);
-      return { record: record2, steps: record2.steps.map((entry) => ({ id: entry.id, kind: entry.kind, label: entry.label, ...entry.target !== void 0 ? { target: entry.target } : {}, ...entry.value !== void 0 ? { value: entry.value } : {}, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.bindings !== void 0 ? { bindings: entry.bindings } : {}, ...entry.expression !== void 0 ? { expression: entry.expression } : {}, ...entry.extract !== void 0 ? { extract: entry.extract } : {} })), blocks: record2.blocks, risk: record2.risk, origins: record2.origins };
+      return { record: record2, steps: record2.steps.map((entry) => ({ id: entry.id, kind: entry.kind, label: entry.label, ...entry.target !== void 0 ? { target: entry.target } : {}, ...entry.value !== void 0 ? { value: entry.value } : {}, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.bindings !== void 0 ? { bindings: entry.bindings } : {}, ...entry.expression !== void 0 ? { expression: entry.expression } : {}, ...entry.extract !== void 0 ? { extract: entry.extract } : {}, ...controlsummary(entry) !== void 0 ? { control: controlsummary(entry) } : {} })), blocks: record2.blocks, risk: record2.risk, origins: record2.origins };
+    }
+    case "setloopbound": {
+      const inputbound = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Editing a loop safety bound needs an active browser session behind the consent gates.");
+      const record2 = await memory.getworkflowrecord(inputbound.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputbound.workflowid ?? ""}.`);
+      if (typeof inputbound.bound !== "number" || !Number.isInteger(inputbound.bound) || inputbound.bound < 1) throw new Error("The loop safety bound must be a positive integer with no code ceiling.");
+      const target = record2.steps.find((entry) => entry.id === (inputbound.stepid ?? ""));
+      if (!target || target.kind !== "loop" && target.kind !== "repeatuntil") throw new Error(`No loop or repeat until step of the workflow matches ${inputbound.stepid ?? ""}.`);
+      let payload;
+      try {
+        payload = JSON.parse(target.options ?? "{}");
+      } catch {
+        payload = {};
+      }
+      const key = target.kind === "loop" ? "loop" : "repeatuntil";
+      const body = payload[key] && typeof payload[key] === "object" && !Array.isArray(payload[key]) ? payload[key] : {};
+      body.bound = inputbound.bound;
+      payload[key] = body;
+      const restep = { ...target, options: JSON.stringify(payload) };
+      const recomposed = composeworkflow({
+        id: record2.id,
+        name: record2.name,
+        version: record2.version + 1,
+        origins: [...record2.origins],
+        steps: record2.steps.map((entry) => entry.id === target.id ? restep : entry),
+        blocks: [...record2.blocks],
+        now: Date.now(),
+        kindallowed: (kind) => {
+          try {
+            actionrisk(kind);
+            return true;
+          } catch {
+            return false;
+          }
+        },
+        riskof: (kind) => actionrisk(kind)
+      });
+      await memory.addworkflowrecord(recomposed);
+      await audit("workflow", `The user edited the loop safety bound of the step ${target.id} of the workflow ${record2.name} to ${inputbound.bound} iterations; version ${recomposed.version} was recomposed and the older version survives for the audit trail.`, { sessionid: session.id });
+      return { workflowid: recomposed.id, stepid: target.id, bound: inputbound.bound, version: recomposed.version };
     }
     case "approveworkflowrun": {
       const inputapprove = message;
@@ -15039,8 +15932,24 @@ async function handlerequest(message, sender) {
       const step = record2.steps.find((entry) => entry.id === (inputsingle.stepid ?? ""));
       if (!step) throw new Error(`No step of the workflow matches ${inputsingle.stepid ?? ""}.`);
       const { tab, origin } = await activecontext();
-      const executed = await runstep({ step, scopes: await memory.getrunscopes(stored.run.id), outputs: {}, execute: async (dispatched) => dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin }), now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
+      const executestepsingle = async (dispatched, stepcontext) => {
+        if (iscontrolflowkind(dispatched.kind)) {
+          const controlled = await runcontrolstep({ step: dispatched, scopes: stepcontext.scopes, outputs: stepcontext.outputs ?? {}, execute: executestepsingle, now: Date.now(), runid: stored.run.id, pagestate: await pagestateof(tab.id), resolveelements: async (selector) => await resolveelements(tab.id, selector) });
+          return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
+        }
+        return await dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin });
+      };
+      const executed = await runstep({ step, scopes: await memory.getrunscopes(stored.run.id), outputs: {}, execute: executestepsingle, now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
       await memory.addrunlogentry(stored.run.id, executed.log);
+      if (executed.childlog !== void 0) for (const entry of executed.childlog) await memory.addrunlogentry(stored.run.id, entry);
+      for (const entry of [executed.log, ...executed.childlog ?? []]) {
+        const control = entry.details?.control;
+        if (control && typeof control === "object" && !Array.isArray(control)) {
+          const decision = control;
+          await memory.addcontroldecision(stored.run.id, decision);
+          await auditcontroldecision(stored.run.id, decision, session.id, plan.id);
+        }
+      }
       await memory.setrunscopes(stored.run.id, executed.scopes);
       const stepindex = record2.steps.findIndex((entry) => entry.id === step.id);
       const isthenext = stepindex === stored.run.cursor && executed.output.ok;
@@ -15073,15 +15982,32 @@ async function handlerequest(message, sender) {
       const scopes = await memory.getrunscopes(stored.run.id);
       const log = await memory.getrunlog(stored.run.id);
       const { tab, origin } = await activecontext();
-      const resumed = await runworkflow({ record: record2, run: stored.run, scopes, log, execute: async (dispatched) => dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin }), now: Date.now(), gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) }, oncheckpoint: async (state) => {
+      let storedentries = log.length;
+      const executeresume = async (dispatched, stepcontext) => {
+        if (iscontrolflowkind(dispatched.kind)) {
+          const controlled = await runcontrolstep({ step: dispatched, scopes: stepcontext.scopes, outputs: stepcontext.outputs ?? {}, execute: executeresume, now: Date.now(), runid: stored.run.id, pagestate: await pagestateof(tab.id), resolveelements: async (selector) => await resolveelements(tab.id, selector) });
+          return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
+        }
+        return await dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin });
+      };
+      const resumed = await runworkflow({ record: record2, run: stored.run, scopes, log, execute: executeresume, now: Date.now(), gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) }, oncheckpoint: async (state) => {
         await memory.setworkflowrun(state.run);
-        const last = state.log[state.log.length - 1];
-        if (last) await memory.addrunlogentry(state.run.id, last);
+        for (const entry of state.log.slice(storedentries)) await memory.addrunlogentry(state.run.id, entry);
+        storedentries = state.log.length;
         await memory.setrunscopes(state.run.id, state.scopes);
       } });
+      for (const entry of resumed.log.slice(storedentries)) await memory.addrunlogentry(stored.run.id, entry);
+      for (const entry of resumed.log.slice(log.length)) {
+        const control = entry.details?.control;
+        if (control && typeof control === "object" && !Array.isArray(control)) {
+          const decision = control;
+          await memory.addcontroldecision(stored.run.id, decision);
+          await auditcontroldecision(stored.run.id, decision, session.id, plan.id);
+        }
+      }
       await memory.setworkflowrun(resumed.run);
       await memory.setrunscopes(stored.run.id, resumed.scopes);
-      await audit("workflow", `Resumed the workflow run ${stored.run.id} from the checkpoint at step cursor ${stored.run.cursor}; the run ended ${resumed.run.state} at cursor ${resumed.run.cursor}.`, { sessionid: session.id, planid: plan.id });
+      await audit("workflow", `Resumed the workflow run ${stored.run.id} from the checkpoint at step cursor ${stored.run.cursor}; the run ended ${resumed.run.state} at cursor ${resumed.run.cursor} with ${resumed.log.length - log.length} new runlog entries.`, { sessionid: session.id, planid: plan.id });
       await refreshbadge();
       return { runid: resumed.run.id, state: resumed.run.state, cursor: resumed.run.cursor };
     }