@wenathlan/extension 1.1.50 → 1.1.52

package/extension/dist/background.js

@@ -2191,6 +2191,97 @@ var sessionmemory = class {
   async getsteptemplates() {
     return await this.adapter.get("steptemplates") ?? [];
   }
+  /** Records one control flow decision of a run — a branch choice with its reason, the loop counters of an iteration trail, the retry attempts with their backoff durations, the timeout aborts with the exceeded budget, the join record with its strategy and conflicts or the catch handler execution — so the audit trail keeps every control flow turn. */
+  async addcontroldecision(runid, decision) {
+    const decisions = await this.listcontroldecisions(runid);
+    await this.adapter.set(`controldecisions${runid}`, [...decisions, { ...decision, runid }]);
+  }
+  /** Returns every stored control flow decision of one run, oldest first. */
+  async listcontroldecisions(runid) {
+    return await this.adapter.get(`controldecisions${runid}`) ?? [];
+  }
+  /** Returns the past branch decisions of one workflow across every stored run, oldest first, so review can compare branch paths over time. */
+  async getbranchhistory(workflowid) {
+    const runs = await this.listworkflowruns();
+    const ordered = [...runs].reverse().filter((run) => run.workflowid === workflowid);
+    const history2 = [];
+    for (const run of ordered) {
+      const decisions = await this.listcontroldecisions(run.id);
+      for (const decision of decisions) if (decision.kind === "branch" && decision.branch !== void 0) history2.push(decision.branch);
+    }
+    return history2;
+  }
+  /** Stores one armed trigger rule with its workflow reference; re-arming the same id replaces the rule while the fire history survives. */
+  async addtriggerule(rule) {
+    const rules = (await this.gettriggerules()).filter((entry) => entry.id !== rule.id);
+    await this.adapter.set("triggerules", [rule, ...rules]);
+  }
+  /** Returns every armed trigger rule, newest first. */
+  async gettriggerules() {
+    return await this.adapter.get("triggerules") ?? [];
+  }
+  /** Returns one armed trigger rule by its id. */
+  async gettriggerule(id) {
+    return (await this.gettriggerules()).find((rule) => rule.id === id);
+  }
+  /** Replaces one stored rule after an enable, disable, pause, resume, cooldown or fire bookkeeping change. */
+  async settriggerule(rule) {
+    const rules = await this.gettriggerules();
+    await this.adapter.set("triggerules", rules.map((entry) => entry.id === rule.id ? rule : entry));
+  }
+  /** Replaces every stored rule at once so the session pause and resume suspend and release the whole rule set atomically. */
+  async settriggerules(rules) {
+    return this.adapter.set("triggerules", rules);
+  }
+  /** Removes one armed rule when the user disarms it; the fire history survives for the audit trail. */
+  async removetriggerule(id) {
+    await this.adapter.set("triggerules", (await this.gettriggerules()).filter((rule) => rule.id !== id));
+  }
+  /** Lists every armed rule joined with the name of its composed workflow so the trigger list shows what each rule launches. */
+  async listtriggers() {
+    const rules = await this.gettriggerules();
+    const names = new Map((await this.listworkflows()).map((record2) => [record2.id, record2.name]));
+    return rules.map((rule) => ({ rule, ...names.has(rule.workflowid) ? { workflowname: names.get(rule.workflowid) } : {} }));
+  }
+  /** Records one trigger fire with the reviewed retention window; an absent window keeps every fire record while the rule counters always survive. */
+  async addtriggerfire(fire) {
+    const fires = await this.listtriggerfires();
+    const combined = [fire, ...fires];
+    const retention = (await this.getsettings())?.triggerretention;
+    await this.adapter.set("triggerfires", retention === void 0 ? combined : combined.slice(0, retention));
+  }
+  /** Returns every stored trigger fire record, newest first, optionally filtered to one rule. */
+  async listtriggerfires(ruleid) {
+    const fires = await this.adapter.get("triggerfires") ?? [];
+    return ruleid === void 0 ? fires : fires.filter((fire) => fire.ruleid === ruleid);
+  }
+  /** Stores the pending trigger queue: fires that arrived while the target run was busy or the session paused; the resume drains them through the same gates. */
+  async settriggerqueue(queue) {
+    return this.adapter.set("triggerqueue", queue);
+  }
+  /** Returns the pending trigger queue, oldest first. */
+  async gettriggerqueue() {
+    return await this.adapter.get("triggerqueue") ?? [];
+  }
+  /** Stores one verified webhook payload of a rule; the executor verifies the shared secret and the schema before anything persists. */
+  async addwebhookpayload(ruleid, payload, at) {
+    const stored = await this.adapter.get("webhookpayloads") ?? [];
+    await this.adapter.set("webhookpayloads", [{ ruleid, payload, at }, ...stored]);
+  }
+  /** Returns the stored webhook payloads of one rule, newest first; only secret verified deliveries ever reach this store. */
+  async listwebhookpayloads(ruleid) {
+    const stored = await this.adapter.get("webhookpayloads") ?? [];
+    return stored.filter((entry) => entry.ruleid === ruleid);
+  }
+  /** Stores one manual run preview with its step list so the panel renders it before confirmation. */
+  async addmanualrun(preview) {
+    const runs = (await this.listmanualruns()).filter((entry) => entry.id !== preview.id);
+    await this.adapter.set("manualruns", [preview, ...runs]);
+  }
+  /** Returns every stored manual run preview with its confirmation outcome, newest first. */
+  async listmanualruns() {
+    return await this.adapter.get("manualruns") ?? [];
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -3177,6 +3268,678 @@ function teardowncdpsession(input) {
   };
 }
 
+// controlflow.ts
+var controlflowkinds = ["condition", "branch", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"];
+var defaultloopbound = 1e3;
+function iscontrolflowkind(kind) {
+  return controlflowkinds.includes(kind);
+}
+var cancellederror = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "cancellederror";
+  }
+};
+function controlname(value) {
+  return typeof value === "string" && /^[a-z][a-z0-9]*$/.test(value) ? value : void 0;
+}
+function controlstepslist(value) {
+  if (!Array.isArray(value) || value.length === 0) return void 0;
+  const steps = [];
+  for (const entry of value) {
+    const parsed = workflowstepof(entry);
+    if (!parsed) return void 0;
+    steps.push(parsed);
+  }
+  return steps;
+}
+function controlbound(value) {
+  if (value === void 0) return void 0;
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
+function conditionof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const expression = expressionof(candidate.expression);
+  if (!expression) return void 0;
+  if (expression.resultkind !== "boolean") return void 0;
+  return { expression };
+}
+function elseof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const name = controlname(candidate.name);
+  if (!name) return void 0;
+  if (candidate.when !== void 0) return void 0;
+  if (!Array.isArray(candidate.steps)) return void 0;
+  const steps = [];
+  for (const entry of candidate.steps) {
+    const parsed = workflowstepof(entry);
+    if (!parsed) return void 0;
+    steps.push(parsed);
+  }
+  return { name, steps };
+}
+function branchof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (!Array.isArray(candidate.paths) || candidate.paths.length === 0) return void 0;
+  const paths = [];
+  for (const entry of candidate.paths) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return void 0;
+    const path = entry;
+    const name = controlname(path.name);
+    if (!name) return void 0;
+    const when = path.when === void 0 ? void 0 : expressionof(path.when);
+    if (path.when !== void 0 && when === void 0) return void 0;
+    if (when !== void 0 && when.resultkind !== "boolean") return void 0;
+    const steps = controlstepslist(path.steps);
+    if (!steps) return void 0;
+    paths.push({ name, ...when !== void 0 ? { when } : {}, steps });
+  }
+  const names = paths.map((path) => path.name);
+  if (new Set(names).size !== names.length) return void 0;
+  const elsepath = elseof(candidate.else);
+  if (!elsepath) return void 0;
+  if (names.includes(elsepath.name)) return void 0;
+  return { paths, else: elsepath };
+}
+function loopof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const list = controlname(candidate.list);
+  const item = controlname(candidate.item);
+  const index = controlname(candidate.index);
+  if (!list || !item || !index) return void 0;
+  if (item === list || index === list || item === index) return void 0;
+  const bound = controlbound(candidate.bound);
+  if (candidate.bound !== void 0 && bound === void 0) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { list, item, index, ...bound !== void 0 ? { bound } : {}, steps };
+}
+function repeatuntilof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const until = expressionof(candidate.until);
+  if (!until || until.resultkind !== "boolean") return void 0;
+  const bound = controlbound(candidate.bound);
+  if (candidate.bound !== void 0 && bound === void 0) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { until, ...bound !== void 0 ? { bound } : {}, steps };
+}
+function whileof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const condition = expressionof(candidate.while);
+  if (!condition || condition.resultkind !== "boolean") return void 0;
+  const bound = controlbound(candidate.bound);
+  if (bound === void 0) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { while: condition, bound, steps };
+}
+function foreachof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.selector !== "string" || !candidate.selector.trim()) return void 0;
+  const item = controlname(candidate.item);
+  const index = controlname(candidate.index);
+  if (!item || !index || item === index) return void 0;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  return { selector: candidate.selector, item, index, steps };
+}
+function parallelof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (!Array.isArray(candidate.branches) || candidate.branches.length === 0) return void 0;
+  const branches = [];
+  for (const entry of candidate.branches) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return void 0;
+    const branch = entry;
+    const id = controlname(branch.id);
+    if (!id) return void 0;
+    const steps = controlstepslist(branch.steps);
+    if (!steps) return void 0;
+    branches.push({ id, steps });
+  }
+  if (new Set(branches.map((branch) => branch.id)).size !== branches.length) return void 0;
+  const join = candidate.join && typeof candidate.join === "object" && !Array.isArray(candidate.join) ? candidate.join : void 0;
+  if (!join) return void 0;
+  if (join.strategy !== "first" && join.strategy !== "last" && join.strategy !== "fail") return void 0;
+  if (join.onfail !== "cancel" && join.onfail !== "continue") return void 0;
+  return { branches, join: { strategy: join.strategy, onfail: join.onfail } };
+}
+function tryof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const steps = controlstepslist(candidate.steps);
+  if (!steps) return void 0;
+  const catchcandidate = candidate.catch && typeof candidate.catch === "object" && !Array.isArray(candidate.catch) ? candidate.catch : void 0;
+  if (!catchcandidate) return void 0;
+  const catchsteps = controlstepslist(catchcandidate.steps);
+  if (!catchsteps) return void 0;
+  if (catchcandidate.rerun !== void 0 && typeof catchcandidate.rerun !== "boolean") return void 0;
+  const catchvalue = { steps: catchsteps, ...catchcandidate.rerun === true ? { rerun: true } : {} };
+  let retry;
+  if (candidate.retry !== void 0) {
+    const retrycandidate = candidate.retry && typeof candidate.retry === "object" && !Array.isArray(candidate.retry) ? candidate.retry : void 0;
+    if (!retrycandidate) return void 0;
+    if (typeof retrycandidate.attempts !== "number" || !Number.isInteger(retrycandidate.attempts) || retrycandidate.attempts < 1) return void 0;
+    const backoff = retrycandidate.backoff && typeof retrycandidate.backoff === "object" && !Array.isArray(retrycandidate.backoff) ? retrycandidate.backoff : void 0;
+    if (!backoff) return void 0;
+    if (backoff.shape !== "fixed" && backoff.shape !== "exponential") return void 0;
+    if (typeof backoff.base !== "number" || !Number.isFinite(backoff.base) || backoff.base < 0) return void 0;
+    if (typeof backoff.jitter !== "number" || !Number.isFinite(backoff.jitter) || backoff.jitter < 0) return void 0;
+    if (!Array.isArray(retrycandidate.retryable) || !retrycandidate.retryable.every((entry) => typeof entry === "string" && entry.trim())) return void 0;
+    retry = { attempts: retrycandidate.attempts, backoff: { shape: backoff.shape, base: backoff.base, jitter: backoff.jitter }, retryable: retrycandidate.retryable };
+  }
+  let timeout;
+  if (candidate.timeout !== void 0) {
+    const timeoutcandidate = candidate.timeout && typeof candidate.timeout === "object" && !Array.isArray(candidate.timeout) ? candidate.timeout : void 0;
+    if (!timeoutcandidate) return void 0;
+    const stepms = timeoutcandidate.stepms === void 0 ? void 0 : typeof timeoutcandidate.stepms === "number" && Number.isFinite(timeoutcandidate.stepms) && timeoutcandidate.stepms > 0 ? timeoutcandidate.stepms : void 0;
+    const runms = timeoutcandidate.runms === void 0 ? void 0 : typeof timeoutcandidate.runms === "number" && Number.isFinite(timeoutcandidate.runms) && timeoutcandidate.runms > 0 ? timeoutcandidate.runms : void 0;
+    if (stepms === void 0 && runms === void 0) return void 0;
+    if (timeoutcandidate.stepms !== void 0 && stepms === void 0) return void 0;
+    if (timeoutcandidate.runms !== void 0 && runms === void 0) return void 0;
+    timeout = { ...stepms !== void 0 ? { stepms } : {}, ...runms !== void 0 ? { runms } : {} };
+  }
+  return { steps, catch: catchvalue, ...retry !== void 0 ? { retry } : {}, ...timeout !== void 0 ? { timeout } : {} };
+}
+function controloptions(step) {
+  if (step.options === void 0) throw new Error(`The ${step.kind} step needs its reviewed control payload in options.`);
+  let parsed;
+  try {
+    parsed = JSON.parse(step.options);
+  } catch {
+    throw new Error(`The ${step.kind} control payload must be a JSON object.`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`The ${step.kind} control payload must be a JSON object.`);
+  return parsed;
+}
+function validatecontrolpayload(step) {
+  if (!iscontrolflowkind(step.kind)) return;
+  const payload = controloptions(step);
+  if (step.kind === "condition" && conditionof(payload.condition) === void 0) throw new Error("The condition step needs a reviewed boolean expression in its options.");
+  if (step.kind === "branch" && branchof(payload.branch) === void 0) throw new Error("The branch step needs reviewed unique paths with boolean match expressions and an else path in its options.");
+  if (step.kind === "loop" && loopof(payload.loop) === void 0) throw new Error("The loop step needs a reviewed list variable, distinct item and index variables, an optional positive safety bound and a non-empty body in its options.");
+  if (step.kind === "repeatuntil" && repeatuntilof(payload.repeatuntil) === void 0) throw new Error("The repeat until step needs a reviewed convergence expression, an optional positive safety bound and a non-empty body in its options.");
+  if (step.kind === "whileloop" && whileof(payload.while) === void 0) throw new Error("The while step needs a reviewed condition, a mandatory positive safety bound and a non-empty body in its options.");
+  if (step.kind === "foreach" && foreachof(payload.foreach) === void 0) throw new Error("The foreach step needs a reviewed non-empty selector, distinct item and index variables and a non-empty body in its options.");
+  if (step.kind === "parallel" && parallelof(payload.parallel) === void 0) throw new Error("The parallel step needs uniquely identified branches with bodies and a join policy of the first, last or fail strategy with cancel or continue on branch failure in its options.");
+  if (step.kind === "trycatch" && tryof(payload.try) === void 0) throw new Error("The try step needs a fragile body, a catch handler and optional retry and timeout policies in its options.");
+}
+function controlsteps(step) {
+  if (!iscontrolflowkind(step.kind)) return [];
+  let payload;
+  try {
+    payload = controloptions(step);
+  } catch {
+    return [];
+  }
+  const children = [];
+  const collect = (steps) => {
+    for (const child of steps) {
+      children.push(child);
+      collect(controlsteps(child));
+    }
+  };
+  if (step.kind === "condition") return children;
+  if (step.kind === "branch") {
+    const branch = branchof(payload.branch);
+    if (!branch) return children;
+    for (const path of branch.paths) collect(path.steps);
+    collect(branch.else.steps);
+    return children;
+  }
+  if (step.kind === "loop") {
+    const loop = loopof(payload.loop);
+    if (loop) collect(loop.steps);
+    return children;
+  }
+  if (step.kind === "repeatuntil") {
+    const repeat = repeatuntilof(payload.repeatuntil);
+    if (repeat) collect(repeat.steps);
+    return children;
+  }
+  if (step.kind === "whileloop") {
+    const condition = whileof(payload.while);
+    if (condition) collect(condition.steps);
+    return children;
+  }
+  if (step.kind === "foreach") {
+    const foreach = foreachof(payload.foreach);
+    if (foreach) collect(foreach.steps);
+    return children;
+  }
+  if (step.kind === "parallel") {
+    const parallel = parallelof(payload.parallel);
+    if (parallel) for (const branch of parallel.branches) collect(branch.steps);
+    return children;
+  }
+  const fragile = tryof(payload.try);
+  if (fragile) {
+    collect(fragile.steps);
+    collect(fragile.catch.steps);
+  }
+  return children;
+}
+function controlsummary(step) {
+  if (!iscontrolflowkind(step.kind)) return void 0;
+  let payload;
+  try {
+    payload = controloptions(step);
+  } catch {
+    return { kind: step.kind };
+  }
+  if (step.kind === "condition") {
+    const condition = conditionof(payload.condition);
+    return { kind: step.kind, ...condition ? { expression: `${condition.expression.operator} into ${condition.expression.result}` } : {} };
+  }
+  if (step.kind === "branch") {
+    const branch = branchof(payload.branch);
+    return { kind: step.kind, ...branch ? { paths: branch.paths.map((path) => path.name), elsepath: branch.else.name } : {} };
+  }
+  if (step.kind === "loop") {
+    const loop = loopof(payload.loop);
+    return { kind: step.kind, ...loop ? { list: loop.list, item: loop.item, index: loop.index, ...loop.bound !== void 0 ? { bound: loop.bound } : { bound: defaultloopbound } } : {} };
+  }
+  if (step.kind === "repeatuntil") {
+    const repeat = repeatuntilof(payload.repeatuntil);
+    return { kind: step.kind, ...repeat ? { bound: repeat.bound ?? defaultloopbound } : {} };
+  }
+  if (step.kind === "whileloop") {
+    const condition = whileof(payload.while);
+    return { kind: step.kind, ...condition ? { bound: condition.bound } : {} };
+  }
+  if (step.kind === "foreach") {
+    const foreach = foreachof(payload.foreach);
+    return { kind: step.kind, ...foreach ? { selector: foreach.selector, item: foreach.item, index: foreach.index } : {} };
+  }
+  if (step.kind === "parallel") {
+    const parallel = parallelof(payload.parallel);
+    return { kind: step.kind, ...parallel ? { branches: parallel.branches.map((branch) => branch.id), strategy: parallel.join.strategy, onfail: parallel.join.onfail } : {} };
+  }
+  const fragile = tryof(payload.try);
+  return { kind: step.kind, ...fragile ? { ...fragile.retry !== void 0 ? { attempts: fragile.retry.attempts, backoff: `${fragile.retry.backoff.shape} base ${fragile.retry.backoff.base} jitter ${fragile.retry.backoff.jitter}` } : {}, ...fragile.catch.rerun === true ? { rerun: true } : {}, ...fragile.timeout?.stepms !== void 0 ? { stepms: fragile.timeout.stepms } : {}, ...fragile.timeout?.runms !== void 0 ? { runms: fragile.timeout.runms } : {} } : {} };
+}
+function evaluatecondition(condition, scopes) {
+  const value = expressioneval(condition.expression, scopes);
+  if (typeof value !== "boolean") throw new Error("The condition expression must resolve to a boolean.");
+  return value;
+}
+function choosebranch(input) {
+  let scopes = input.scopes;
+  if (input.pagestate !== void 0) {
+    const parent = scopes.length > 0 ? scopes[scopes.length - 1].name : void 0;
+    scopes = pushscope(scopes, `pagestate${input.stepid}`, parent);
+    if (input.pagestate.url !== void 0) scopes = setvariable(scopes, "pageurl", "string", input.pagestate.url, input.now);
+    if (input.pagestate.title !== void 0) scopes = setvariable(scopes, "pagetitle", "string", input.pagestate.title, input.now);
+    if (input.pagestate.ready !== void 0) scopes = setvariable(scopes, "pageready", "boolean", input.pagestate.ready, input.now);
+  }
+  for (const path of input.branch.paths) {
+    if (path.when === void 0) return { outcome: { stepid: input.stepid, path: path.name, reason: `The path ${path.name} matches unconditionally.`, at: input.now }, steps: path.steps };
+    const value = expressioneval(path.when, scopes);
+    if (typeof value !== "boolean") throw new Error(`The branch path ${path.name} needs a boolean expression.`);
+    if (value) return { outcome: { stepid: input.stepid, path: path.name, reason: `The condition of the path ${path.name} holds.`, at: input.now }, steps: path.steps };
+  }
+  return { outcome: { stepid: input.stepid, path: input.branch.else.name, reason: "No path condition held and the else path ran.", at: input.now }, steps: input.branch.else.steps };
+}
+async function runbody(input) {
+  let scopes = input.scopes;
+  const outputs = { ...input.outputs };
+  const log = [];
+  for (const child of input.steps) {
+    if (iscontrolflowkind(child.kind)) {
+      const result = await runcontrolstep({ step: child, scopes, outputs, execute: input.execute, now: input.now, ...input.path !== void 0 ? { path: `${input.path}.${child.id}` } : {} });
+      scopes = result.scopes;
+      log.push(...result.log);
+      outputs[child.id] = { stepid: child.id, ok: result.output.ok, summary: result.output.summary, ...result.output.details !== void 0 ? { details: result.output.details } : {}, at: input.now };
+      if (!result.output.ok) return { ok: false, scopes, log, outputs, failure: result.output };
+      continue;
+    }
+    const executed = await runstep({ step: child, scopes, outputs, execute: input.execute, now: input.now });
+    scopes = executed.scopes;
+    if (executed.childlog !== void 0) log.push(...executed.childlog);
+    log.push(executed.log);
+    outputs[child.id] = { stepid: child.id, ok: executed.output.ok, summary: executed.output.summary, ...executed.output.details !== void 0 ? { details: executed.output.details } : {}, at: input.now };
+    if (!executed.output.ok) return { ok: false, scopes, log, outputs, failure: executed.output };
+  }
+  return { ok: true, scopes, log, outputs };
+}
+function deepcopy(value) {
+  if (Array.isArray(value)) return value.map(deepcopy);
+  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, deepcopy(entry)]));
+  return value;
+}
+function iterationentry(step, iteration, total, ok, now) {
+  return { stepid: step.id, label: `${step.label} iteration ${iteration + 1}`, state: ok ? "done" : "failed", startedat: now, duration: 0, summary: `Iteration ${iteration + 1} of ${total}.`, details: { iteration, total } };
+}
+async function runloop(input) {
+  const list = resolvevariable(input.scopes, input.loop.list);
+  if (!list) throw new Error(`The loop references the undefined list variable ${input.loop.list}.`);
+  if (list.kind !== "list") throw new Error(`The loop variable ${input.loop.list} is not a list.`);
+  const items = list.value;
+  const bound = input.loop.bound ?? defaultloopbound;
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  if (items.length > bound) {
+    return { ok: false, scopes: input.scopes, log: [], summary: `The loop list holds ${items.length} items and exceeds the reviewed safety bound of ${bound} iterations; nothing ran.`, decision };
+  }
+  let scopes = input.scopes;
+  const log = [];
+  for (let index = 0; index < items.length; index += 1) {
+    scopes = setvariable(scopes, input.loop.item, "string", deepcopy(items[index]), input.now);
+    scopes = setvariable(scopes, input.loop.index, "number", index, input.now);
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.loop.steps, path: `${input.path ?? input.step.id}[${index}]` });
+    scopes = body.scopes;
+    const ok = body.ok;
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${index}]`, iteration: index, ok, at: input.now });
+    log.push(...body.log, iterationentry(input.step, index, items.length, ok, input.now));
+    if (!ok) return { ok: false, scopes, log, summary: `The loop failed at iteration ${index + 1} of ${items.length}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The loop ran ${items.length} iteration${items.length === 1 ? "" : "s"} over ${input.loop.list} inside the reviewed safety bound of ${bound}.`, decision };
+}
+async function runrepeatuntil(input) {
+  const bound = input.repeat.bound ?? defaultloopbound;
+  let scopes = input.scopes;
+  const log = [];
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  for (let iteration = 0; iteration < bound; iteration += 1) {
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.repeat.steps, path: `${input.path ?? input.step.id}[${iteration}]` });
+    scopes = body.scopes;
+    log.push(...body.log);
+    const converged = evaluatecondition({ expression: input.repeat.until }, scopes);
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${iteration}]`, iteration, ok: body.ok, at: input.now });
+    if (!body.ok) return { ok: false, scopes, log, summary: `The repeat until failed at iteration ${iteration + 1}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+    log.push(iterationentry(input.step, iteration, bound, true, input.now));
+    if (converged) return { ok: true, scopes, log, summary: `The repeat until converged after ${iteration + 1} iteration${iteration === 0 ? "" : "s"} inside the reviewed safety bound of ${bound}.`, decision };
+  }
+  return { ok: false, scopes, log, summary: `The repeat until never converged within the reviewed safety bound of ${bound} iterations.`, decision };
+}
+async function runwhile(input) {
+  let scopes = input.scopes;
+  const log = [];
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  for (let iteration = 0; iteration < input.condition.bound; iteration += 1) {
+    if (!evaluatecondition({ expression: input.condition.while }, scopes)) {
+      return { ok: true, scopes, log, summary: `The while loop ended after ${iteration} iteration${iteration === 1 ? "" : "s"} because its condition stopped holding inside the reviewed safety bound of ${input.condition.bound}.`, decision };
+    }
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.condition.steps, path: `${input.path ?? input.step.id}[${iteration}]` });
+    scopes = body.scopes;
+    log.push(...body.log);
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${iteration}]`, iteration, ok: body.ok, at: input.now });
+    if (!body.ok) return { ok: false, scopes, log, summary: `The while loop failed at iteration ${iteration + 1}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+    log.push(iterationentry(input.step, iteration, input.condition.bound, true, input.now));
+  }
+  if (evaluatecondition({ expression: input.condition.while }, scopes)) {
+    return { ok: false, scopes, log, summary: `The while loop hit its reviewed safety bound of ${input.condition.bound} iterations while its condition still held; the overflow is reported instead of looping forever.`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The while loop ended after ${input.condition.bound} iteration${input.condition.bound === 1 ? "" : "s"} inside the reviewed safety bound.`, decision };
+}
+async function runforeach(input) {
+  if (!input.resolveelements) throw new Error("The foreach step needs the element resolver of the executor seam.");
+  const elements = await input.resolveelements(input.foreach.selector);
+  const loops = [];
+  const decision = { runid: "", stepid: input.step.id, kind: "loop", at: input.now, loops };
+  if (elements.length === 0) return { ok: true, scopes: input.scopes, log: [], summary: `The selector ${input.foreach.selector} matched no element and the foreach ran zero iterations.`, decision };
+  let scopes = input.scopes;
+  const log = [];
+  for (let index = 0; index < elements.length; index += 1) {
+    scopes = setvariable(scopes, input.foreach.item, "element", deepcopy(elements[index]), input.now);
+    scopes = setvariable(scopes, input.foreach.index, "number", index, input.now);
+    const body = await runbody({ step: input.step, scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.foreach.steps, path: `${input.path ?? input.step.id}[${index}]` });
+    scopes = body.scopes;
+    const ok = body.ok;
+    loops.push({ stepid: input.step.id, path: `${input.path ?? input.step.id}[${index}]`, iteration: index, ok, at: input.now });
+    log.push(...body.log, iterationentry(input.step, index, elements.length, ok, input.now));
+    if (!ok) return { ok: false, scopes, log, summary: `The foreach failed at iteration ${index + 1} of ${elements.length}: ${body.failure?.summary ?? "the body step failed."}`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The foreach ran ${elements.length} iteration${elements.length === 1 ? "" : "s"} over the elements of ${input.foreach.selector}.`, decision };
+}
+function joinbranches(input) {
+  const contributing = input.branches.filter((branch) => !branch.cancelled);
+  const byname = /* @__PURE__ */ new Map();
+  for (const branch of contributing) for (const variable of branch.variables) {
+    const entries = byname.get(variable.name) ?? [];
+    entries.push({ order: branch.order, value: variable });
+    byname.set(variable.name, entries);
+  }
+  const conflicts = [...byname.entries()].filter(([, entries]) => entries.length > 1).map(([name]) => name);
+  const record2 = { stepid: input.stepid, strategy: input.strategy, conflicts, merged: [], at: input.now };
+  if (conflicts.length > 0 && input.strategy === "fail") {
+    return { ok: false, conflicts, merged: [], record: record2, summary: `The join refused the conflicting writes of ${conflicts.join(", ")} under the fail strategy.` };
+  }
+  const merged = [];
+  for (const [name, entries] of byname) {
+    void name;
+    const winner = input.strategy === "first" ? entries.reduce((left, right) => left.order <= right.order ? left : right) : entries.reduce((left, right) => left.order >= right.order ? left : right);
+    merged.push({ ...winner.value, setat: input.now });
+  }
+  record2.merged = merged.map((variable) => variable.name);
+  return { ok: true, conflicts, merged, record: record2, summary: `The join merged ${merged.length} variable${merged.length === 1 ? "" : "s"} under the ${input.strategy} strategy${conflicts.length > 0 ? ` with the conflicts ${conflicts.join(", ")} resolved by the strategy` : " with no conflict"}.` };
+}
+async function runparallel(input) {
+  let finished = 0;
+  let firstfailure = Number.POSITIVE_INFINITY;
+  const log = [];
+  const launches = input.parallel.branches.map((branch, order) => (async () => {
+    const parent = input.scopes.length > 0 ? input.scopes[input.scopes.length - 1].name : void 0;
+    const isolated = pushscope(input.scopes, `branch${branch.id}`, parent);
+    const body = await runbody({ step: input.step, scopes: isolated, outputs: input.outputs, execute: input.execute, now: input.now, steps: branch.steps });
+    const finishedat = finished;
+    finished += 1;
+    if (!body.ok && finishedat < firstfailure) firstfailure = finishedat;
+    const scope = body.scopes[body.scopes.length - 1];
+    return { branch, order, finishedat, ok: body.ok, scopes: body.scopes, variables: scope.name === `branch${branch.id}` ? scope.variables : [], log: body.log, failure: body.failure };
+  })());
+  const settled = await Promise.all(launches);
+  for (const entry of settled) log.push(...entry.log);
+  const cancelmode = input.parallel.join.onfail === "cancel";
+  const outcomes = settled.map((entry) => ({ branchid: entry.branch.id, ok: entry.ok, summary: entry.ok ? `The branch ${entry.branch.id} completed.` : entry.failure?.summary ?? `The branch ${entry.branch.id} failed.`, ...cancelmode && firstfailure !== Number.POSITIVE_INFINITY && entry.finishedat > firstfailure ? { cancelled: true } : {} }));
+  const join = joinbranches({ stepid: input.step.id, branches: settled.map((entry, order) => ({ id: entry.branch.id, order, ok: entry.ok, cancelled: outcomes[order]?.cancelled === true, variables: entry.variables })), strategy: input.parallel.join.strategy, now: input.now });
+  const decision = { runid: "", stepid: input.step.id, kind: "join", at: input.now, join: join.record, branches: outcomes };
+  if (!join.ok) return { ok: false, scopes: input.scopes, log, summary: join.summary, decision };
+  let scopes = input.scopes;
+  for (const variable of join.merged) scopes = setvariable(scopes, variable.name, variable.kind, variable.value, input.now);
+  const failedbranches = settled.filter((entry, order) => !entry.ok && outcomes[order]?.cancelled !== true).map((entry) => entry.branch.id);
+  if (cancelmode && failedbranches.length > 0) {
+    return { ok: false, scopes, log, summary: `The parallel block failed on branch ${failedbranches.join(", ")} and the join policy cancelled the siblings still running; ${join.summary}`, decision };
+  }
+  return { ok: true, scopes, log, summary: `The parallel block ran ${input.parallel.branches.length} concurrent branch${input.parallel.branches.length === 1 ? "" : "es"}; ${join.summary}`, decision };
+}
+function errorclassof(output) {
+  const errorclass = output.details?.errorclass;
+  return typeof errorclass === "string" && errorclass.trim() ? errorclass : "stepfailed";
+}
+function backoffdelay(policy, attempt, seed) {
+  const base = policy.backoff.shape === "exponential" ? policy.backoff.base * 2 ** (attempt - 1) : policy.backoff.base;
+  if (policy.backoff.jitter <= 0) return Math.max(0, base);
+  return Math.max(0, base - policy.backoff.jitter / 2 + seededrandom(seed + attempt) * policy.backoff.jitter);
+}
+function waitsome(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
+}
+async function applyretry(input) {
+  const seed = input.seed ?? 0;
+  let value = await input.run();
+  const attempts = [];
+  let attempt = 1;
+  while (!value.ok && attempt < input.policy.attempts) {
+    const errorclass = input.errorclass(value);
+    if (!input.policy.retryable.includes(errorclass)) break;
+    const delay = backoffdelay(input.policy, attempt, seed);
+    attempts.push({ stepid: input.stepid, attempt: attempt + 1, delay, errorclass, at: input.now });
+    if (delay > 0) await waitsome(delay);
+    attempt += 1;
+    value = await input.run();
+  }
+  return { value, attempts, exhausted: !value.ok && attempts.length > 0 && attempt >= input.policy.attempts };
+}
+async function applytimeout(input) {
+  let timer;
+  const guard = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("cancelled"), Math.max(0, input.budgetms));
+  });
+  const raced = await Promise.race([input.run().then((value) => ({ kind: "done", value })), guard.then((marker) => ({ kind: "cancelled", marker }))]);
+  if (timer !== void 0) clearTimeout(timer);
+  if (raced.kind === "done") return { aborted: false, value: raced.value };
+  return { aborted: true, output: { ok: false, summary: `The ${input.stepid} step exceeded its reviewed budget of ${input.budgetms} milliseconds and was cancelled.`, details: { errorclass: "timeout", budget: input.budgetms, cancelled: true } }, abort: { stepid: input.stepid, budget: input.budgetms, scope: "step", at: Date.now() } };
+}
+async function applyruntimeout(input) {
+  let timer;
+  const guard = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("cancelled"), Math.max(0, input.budgetms));
+  });
+  const raced = await Promise.race([input.run().then((value) => ({ kind: "done", value })), guard.then((marker) => ({ kind: "cancelled", marker }))]);
+  if (timer !== void 0) clearTimeout(timer);
+  if (raced.kind === "done") return { cancelled: false, value: raced.value };
+  return { cancelled: true, error: new cancellederror(`The run exceeded its reviewed budget of ${input.budgetms} milliseconds and was cancelled.`) };
+}
+async function runcatch(input) {
+  const body = await runbody({ step: { id: "catch", kind: "trycatch", label: "catch handler" }, scopes: input.scopes, outputs: input.outputs, execute: input.execute, now: input.now, steps: input.handler.steps });
+  return { ok: body.ok, scopes: body.scopes, log: body.log };
+}
+async function runtry(input) {
+  const timeouts = [];
+  const retries = [];
+  const runonce = async (child, scopes) => {
+    if (iscontrolflowkind(child.kind)) {
+      const result = await runcontrolstep({ step: child, scopes, outputs: input.outputs, execute: input.execute, now: input.now });
+      return { ok: result.output.ok, scopes: result.scopes, log: result.log, output: result.output };
+    }
+    const executed = await runstep({ step: child, scopes, outputs: input.outputs, execute: input.execute, now: input.now });
+    return { ok: executed.output.ok, scopes: executed.scopes, log: [...executed.childlog ?? [], executed.log], output: executed.output };
+  };
+  const runchild = async (child, scopes) => {
+    const attempt = async () => {
+      if (input.fragile.retry === void 0) return await runonce(child, scopes);
+      const retried = await applyretry({ stepid: child.id, policy: input.fragile.retry, run: () => runonce(child, scopes), errorclass: (value) => errorclassof(value.output), now: input.now, seed: seedof(child.id) });
+      retries.push(...retried.attempts);
+      return retried.value;
+    };
+    if (input.fragile.timeout?.stepms === void 0) return await attempt();
+    const guarded = await applytimeout({ stepid: child.id, budgetms: input.fragile.timeout.stepms, run: attempt });
+    if (!guarded.aborted) return guarded.value;
+    if (guarded.abort) timeouts.push(guarded.abort);
+    return { ok: false, scopes, log: [], output: guarded.output };
+  };
+  const runbodyof = async (scopes) => {
+    let current = scopes;
+    const log = [];
+    for (const child of input.fragile.steps) {
+      const executed = await runchild(child, current);
+      current = executed.scopes;
+      log.push(...executed.log);
+      if (!executed.ok) return { ok: false, scopes: current, log, failure: executed.output };
+    }
+    return { ok: true, scopes: current, log };
+  };
+  let body;
+  if (input.fragile.timeout?.runms !== void 0) {
+    const guarded = await applytimeout({ stepid: input.step.id, budgetms: input.fragile.timeout.runms, run: () => runbodyof(input.scopes) });
+    if (guarded.aborted) {
+      if (guarded.abort) timeouts.push({ ...guarded.abort, scope: "run" });
+      body = { ok: false, scopes: input.scopes, log: [], failure: guarded.output ?? { ok: false, summary: "The try block exceeded its reviewed run budget and was cancelled.", details: { errorclass: "timeout", cancelled: true } } };
+    } else {
+      body = guarded.value;
+    }
+  } else {
+    body = await runbodyof(input.scopes);
+  }
+  if (body.ok) {
+    const summary = `The try block completed its ${input.fragile.steps.length} step${input.fragile.steps.length === 1 ? "" : "s"}${retries.length > 0 ? ` after ${retries.length} retry attempt${retries.length === 1 ? "" : "s"}` : ""}.`;
+    if (retries.length === 0 && timeouts.length === 0) return { ok: true, scopes: body.scopes, log: body.log, summary };
+    return { ok: true, scopes: body.scopes, log: body.log, summary, decision: { runid: "", stepid: input.step.id, kind: "retry", at: input.now, ...retries.length > 0 ? { retries } : {}, ...timeouts.length > 0 ? { timeouts } : {} } };
+  }
+  const handler = await runcatch({ handler: input.fragile.catch, scopes: body.scopes, outputs: input.outputs, execute: input.execute, now: input.now });
+  const errorclass = errorclassof(body.failure ?? { ok: false, summary: "" });
+  const decision = { runid: "", stepid: input.step.id, kind: "catch", at: input.now, ...retries.length > 0 ? { retries } : {}, ...timeouts.length > 0 ? { timeouts } : {}, catch: { errorclass, message: body.failure?.summary ?? "The fragile body step failed.", rerun: input.fragile.catch.rerun === true } };
+  if (!handler.ok) return { ok: false, scopes: handler.scopes, log: [...body.log, ...handler.log], summary: `The catch handler of the try block failed after the ${errorclass} failure.`, decision };
+  if (input.fragile.catch.rerun === true) {
+    const rerun = await runbodyof(handler.scopes);
+    if (rerun.ok) return { ok: true, scopes: rerun.scopes, log: [...body.log, ...handler.log, ...rerun.log], summary: `The catch handler ran after the ${errorclass} failure and the rerun of the try body succeeded.`, decision };
+    return { ok: false, scopes: rerun.scopes, log: [...body.log, ...handler.log, ...rerun.log], summary: `The catch handler ran and the rerun of the try body failed again with ${errorclassof(rerun.failure ?? { ok: false, summary: "" })}.`, decision };
+  }
+  return { ok: true, scopes: handler.scopes, log: [...body.log, ...handler.log], summary: `The catch handler ran ${input.fragile.catch.steps.length} step${input.fragile.catch.steps.length === 1 ? "" : "s"} after the ${errorclass} failure.`, decision };
+}
+function seedof(text2) {
+  let hash = 2166136261;
+  for (let index = 0; index < text2.length; index += 1) {
+    hash ^= text2.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash >>> 0;
+}
+async function runcontrolstep(input) {
+  const payload = controloptions(input.step);
+  const base = { step: input.step, scopes: input.scopes, outputs: input.outputs, execute: input.execute, now: input.now, ...input.path !== void 0 ? { path: input.path } : {} };
+  let result;
+  switch (input.step.kind) {
+    case "condition": {
+      const condition = conditionof(payload.condition);
+      if (!condition) throw new Error("The condition step needs a reviewed boolean expression in its options.");
+      const value = evaluatecondition(condition, input.scopes);
+      const scopes = setvariable(input.scopes, condition.expression.result, condition.expression.resultkind, value, input.now);
+      const summary = `The condition ${condition.expression.result} ${value ? "holds" : "does not hold"} over the extracted values.`;
+      return { scopes, log: [], output: { ok: true, summary, details: { condition: { result: condition.expression.result, value } } } };
+    }
+    case "branch": {
+      const branch = branchof(payload.branch);
+      if (!branch) throw new Error("The branch step needs reviewed unique paths with boolean match expressions and an else path in its options.");
+      const chosen = choosebranch({ stepid: input.step.id, branch, scopes: input.scopes, ...input.pagestate !== void 0 ? { pagestate: input.pagestate } : {}, now: input.now });
+      const body = await runbody({ ...base, steps: chosen.steps });
+      result = body.ok ? { ok: true, scopes: body.scopes, log: body.log, summary: `The branch chose the path ${chosen.outcome.path}: ${chosen.outcome.reason}`, decision: { runid: input.runid ?? "", stepid: input.step.id, kind: "branch", at: input.now, branch: chosen.outcome } } : { ok: false, scopes: body.scopes, log: body.log, summary: `The branch chose the path ${chosen.outcome.path} and its body failed: ${body.failure?.summary ?? "the body step failed."}`, decision: { runid: input.runid ?? "", stepid: input.step.id, kind: "branch", at: input.now, branch: chosen.outcome } };
+      break;
+    }
+    case "loop": {
+      const loop = loopof(payload.loop);
+      if (!loop) throw new Error("The loop step needs a reviewed list variable, distinct item and index variables, an optional positive safety bound and a non-empty body in its options.");
+      result = await runloop({ ...base, loop });
+      break;
+    }
+    case "repeatuntil": {
+      const repeat = repeatuntilof(payload.repeatuntil);
+      if (!repeat) throw new Error("The repeat until step needs a reviewed convergence expression, an optional positive safety bound and a non-empty body in its options.");
+      result = await runrepeatuntil({ ...base, repeat });
+      break;
+    }
+    case "whileloop": {
+      const condition = whileof(payload.while);
+      if (!condition) throw new Error("The while step needs a reviewed condition, a mandatory positive safety bound and a non-empty body in its options.");
+      result = await runwhile({ ...base, condition });
+      break;
+    }
+    case "foreach": {
+      const foreach = foreachof(payload.foreach);
+      if (!foreach) throw new Error("The foreach step needs a reviewed non-empty selector, distinct item and index variables and a non-empty body in its options.");
+      result = await runforeach({ ...base, foreach, ...input.resolveelements !== void 0 ? { resolveelements: input.resolveelements } : {} });
+      break;
+    }
+    case "parallel": {
+      const parallel = parallelof(payload.parallel);
+      if (!parallel) throw new Error("The parallel step needs uniquely identified branches with bodies and a join policy of the first, last or fail strategy with cancel or continue on branch failure in its options.");
+      result = await runparallel({ ...base, parallel });
+      break;
+    }
+    case "trycatch": {
+      const fragile = tryof(payload.try);
+      if (!fragile) throw new Error("The try step needs a fragile body, a catch handler and optional retry and timeout policies in its options.");
+      result = await runtry({ ...base, fragile });
+      break;
+    }
+    default:
+      throw new Error(`The ${input.step.kind} step is not a control flow kind.`);
+  }
+  if (result.decision !== void 0 && input.runid !== void 0) result.decision.runid = input.runid;
+  return { scopes: result.scopes, log: result.log, output: { ok: result.ok, summary: result.summary, ...result.decision !== void 0 ? { details: { control: result.decision } } : {} } };
+}
+
 // workflow.ts
 var workflowkinds = ["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"];
 function workflowstepof(value) {
@@ -3324,12 +4087,19 @@ function composeworkflow(input) {
   const steps = expandblocks(input.steps, blocks);
   for (const step of steps) {
     if (input.kindallowed && !input.kindallowed(step.kind)) throw new Error(`The workflow step kind ${step.kind} is not a reviewed action kind.`);
+    if (iscontrolflowkind(step.kind)) {
+      validatecontrolpayload(step);
+      for (const child of controlsteps(step)) {
+        if (input.kindallowed && !input.kindallowed(child.kind)) throw new Error(`The workflow step kind ${child.kind} inside the control payload of ${step.id} is not a reviewed action kind.`);
+      }
+    }
     if (step.bindings) for (const binding of step.bindings) {
       if (!steps.some((other) => other.id === binding.stepid)) throw new Error(`The binding of ${binding.variable} references the unknown step ${binding.stepid}.`);
     }
   }
   const riskof = input.riskof ?? (() => "sensitive");
-  const risk = steps.some((step) => riskof(step.kind) === "sensitive") ? "sensitive" : steps.some((step) => riskof(step.kind) === "interaction") ? "interaction" : "read";
+  const gradedkinds = steps.flatMap((step) => [step.kind, ...controlsteps(step).map((child) => child.kind)]);
+  const risk = gradedkinds.some((kind) => riskof(kind) === "sensitive") ? "sensitive" : gradedkinds.some((kind) => riskof(kind) === "interaction") ? "interaction" : "read";
   const record2 = { id: input.id ?? crypto.randomUUID(), name: input.name, version: input.version, origins: [...new Set(origins)], steps, blocks, risk, createdat: input.now };
   return deepfreeze(record2);
 }
@@ -3610,21 +4380,24 @@ async function runstep(input) {
       }
       stepvalue = interpolated.text;
     }
-    const target = input.step.target !== void 0 ? interpolate(input.step.target, scopes) : void 0;
+    const controlled = iscontrolflowkind(input.step.kind);
+    const target = !controlled && input.step.target !== void 0 ? interpolate(input.step.target, scopes) : void 0;
     if (target) consumed.push(...target.consumed);
-    const value = stepvalue !== void 0 ? interpolate(stepvalue, scopes) : void 0;
+    const value = !controlled && stepvalue !== void 0 ? interpolate(stepvalue, scopes) : void 0;
     if (value) consumed.push(...value.consumed);
-    const options = input.step.options !== void 0 ? interpolate(input.step.options, scopes) : void 0;
+    const options = !controlled && input.step.options !== void 0 ? interpolate(input.step.options, scopes) : void 0;
     if (options) consumed.push(...options.consumed);
     const dispatchable = { ...input.step, ...target !== void 0 ? { target: target.text } : {}, ...value !== void 0 ? { value: value.text } : {}, ...options !== void 0 ? { options: options.text } : {} };
-    const output = await input.execute(dispatchable, { scopes, ...input.block !== void 0 ? { block: input.block } : {} });
+    const output = await input.execute(dispatchable, { scopes, outputs: input.outputs, ...input.block !== void 0 ? { block: input.block } : {} });
+    if (output.scopes !== void 0) scopes = output.scopes;
+    const childlog = output.log;
     if (input.step.bindings) {
       const bound = bindvariables(scopes, input.step.bindings, { ...input.outputs, [input.step.id]: { stepid: input.step.id, ok: output.ok, summary: output.summary, ...output.details !== void 0 ? { details: output.details } : {}, at: input.now } }, input.now);
       scopes = bound.scopes;
       produced = [.../* @__PURE__ */ new Set([...produced, ...bound.produced])];
     }
     const duration = Date.now() - startedat;
-    return { scopes, log: runlogof(input.step, output.ok ? "done" : "failed", startedat, duration, output.summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {}, ...produced.length > 0 ? { produced } : {}, ...output.details !== void 0 ? { details: output.details } : {}, ...output.ok ? { checkpoint: true } : {} }), output };
+    return { scopes, log: runlogof(input.step, output.ok ? "done" : "failed", startedat, duration, output.summary, { ...input.block !== void 0 ? { block: input.block } : {}, ...consumed.length > 0 ? { consumed } : {}, ...produced.length > 0 ? { produced } : {}, ...output.details !== void 0 ? { details: output.details } : {}, ...output.ok ? { checkpoint: true } : {} }), ...childlog !== void 0 ? { childlog } : {}, output };
   } catch (error) {
     const duration = Date.now() - startedat;
     const summary = error instanceof Error ? error.message : String(error);
@@ -3656,6 +4429,7 @@ async function runworkflow(input) {
     }
     const executed = await runstep({ step, scopes, outputs, execute: input.execute, now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
     scopes = executed.scopes;
+    if (executed.childlog !== void 0) log.push(...executed.childlog);
     log.push(executed.log);
     outputs[step.id] = { stepid: step.id, ok: executed.output.ok, summary: executed.output.summary, ...executed.output.details !== void 0 ? { details: executed.output.details } : {}, at: Date.now() };
     if (!executed.output.ok) {
@@ -3682,6 +4456,394 @@ function dryrunworkflow(input) {
   return { run: { ...run, state: "done", cursor: input.record.steps.length, endedat: input.now }, scopes, log };
 }
 
+// trigger.ts
+var triggerkinds = ["visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"];
+var triggerfamilies = ["visit", "url", "menu", "key", "button", "cron", "interval", "urllist", "webhook", "event"];
+var triggereventcatalog = ["mutate", "focus", "banner", "console", "error", "navigate"];
+var defaulttriggercooldown = 1e4;
+function triggerfamilyof(kind) {
+  const index = triggerkinds.indexOf(kind);
+  return index >= 0 ? triggerfamilies[index] : void 0;
+}
+function triggerlabel(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function positivewindow(value) {
+  if (value === void 0) return void 0;
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
+}
+function jitterwindow(value) {
+  if (value === void 0) return void 0;
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+function httpsorigin(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  try {
+    const parsed = new URL(value.trim());
+    if (parsed.protocol !== "https:") return void 0;
+    return parsed.origin;
+  } catch {
+    return void 0;
+  }
+}
+function webhookfieldof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.name !== "string" || !/^[a-z][a-z0-9]*$/i.test(candidate.name)) return void 0;
+  if (candidate.kind !== "string" && candidate.kind !== "number" && candidate.kind !== "boolean") return void 0;
+  if (candidate.required !== void 0 && typeof candidate.required !== "boolean") return void 0;
+  return { name: candidate.name, kind: candidate.kind, ...candidate.required === true ? { required: true } : {} };
+}
+function triggerpayloadof(family, value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (family === "visit") {
+    if (!Array.isArray(candidate.origins) || candidate.origins.length === 0) return void 0;
+    const origins = candidate.origins.map((origin) => httpsorigin(origin));
+    if (origins.some((origin) => origin === void 0)) return void 0;
+    return { origins: [...new Set(origins)] };
+  }
+  if (family === "url") {
+    if (typeof candidate.pattern !== "string" || !candidate.pattern.trim()) return void 0;
+    if (httpsorigin(candidate.pattern) === void 0) return void 0;
+    return { pattern: candidate.pattern.trim() };
+  }
+  if (family === "menu") {
+    const title = triggerlabel(candidate.title);
+    if (!title) return void 0;
+    return { title };
+  }
+  if (family === "key") {
+    if (typeof candidate.command !== "string" || !/^[a-z][a-z0-9-]*$/.test(candidate.command)) return void 0;
+    if (candidate.key !== void 0 && (typeof candidate.key !== "string" || !candidate.key.trim())) return void 0;
+    return { command: candidate.command, ...candidate.key !== void 0 ? { key: candidate.key } : {} };
+  }
+  if (family === "button") return {};
+  if (family === "cron") {
+    if (typeof candidate.cron !== "string" || !candidate.cron.trim()) return void 0;
+    if (cronparse(candidate.cron) === void 0) return void 0;
+    if (candidate.timezone !== void 0 && (typeof candidate.timezone !== "string" || !timezonevalid(candidate.timezone))) return void 0;
+    return { cron: candidate.cron.trim(), ...candidate.timezone !== void 0 ? { timezone: candidate.timezone } : {} };
+  }
+  if (family === "interval") {
+    const period = positivewindow(candidate.period);
+    if (period === void 0) return void 0;
+    const jitter = jitterwindow(candidate.jitter);
+    if (candidate.jitter !== void 0 && jitter === void 0) return void 0;
+    return { period, ...jitter !== void 0 ? { jitter } : {} };
+  }
+  if (family === "urllist") {
+    if (!Array.isArray(candidate.urls) || candidate.urls.length === 0) return void 0;
+    const urls = candidate.urls.map((url) => httpsorigin(url) === void 0 ? void 0 : url.trim());
+    if (urls.some((url) => url === void 0)) return void 0;
+    return { urls };
+  }
+  if (family === "webhook") {
+    if (typeof candidate.secret !== "string" || !webhooksecretok(candidate.secret)) return void 0;
+    if (!Array.isArray(candidate.schema) || candidate.schema.length === 0) return void 0;
+    const schema = candidate.schema.map((field) => webhookfieldof(field));
+    if (schema.some((field) => field === void 0)) return void 0;
+    const names = schema.map((field) => field.name);
+    if (new Set(names).size !== names.length) return void 0;
+    return { secret: candidate.secret, schema };
+  }
+  const events = candidate.events;
+  if (!Array.isArray(events) || events.length === 0) return void 0;
+  if (!events.every((name) => typeof name === "string" && triggereventcatalog.includes(name))) return void 0;
+  return { events: [...new Set(events)] };
+}
+function webhooksecretok(secret) {
+  if (secret.length < 24) return false;
+  if (/^(.)\1+$/.test(secret)) return false;
+  return /[a-z]/i.test(secret) && /\d/.test(secret);
+}
+function timezonevalid(timezone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: timezone });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function armrule(input) {
+  if (typeof input.workflowid !== "string" || !input.workflowid.trim()) return void 0;
+  const payload = triggerpayloadof(input.family, input.payload);
+  if (!payload) return void 0;
+  if (input.cooldown !== void 0 && (typeof input.cooldown !== "number" || !Number.isFinite(input.cooldown) || input.cooldown <= 0)) return void 0;
+  const cooldown = input.cooldown ?? (input.family === "webhook" || input.family === "event" ? defaulttriggercooldown : 0);
+  const label = input.label ?? `The ${input.family} rule of ${input.workflowid}`;
+  return { id: input.id ?? crypto.randomUUID(), kind: input.family, workflowid: input.workflowid, label, ...payload, cooldown, state: { enabled: true, cooldown }, stats: { fires: 0, launches: 0, suppressions: 0 }, createdat: input.now };
+}
+function updaterule(rule, patch) {
+  return { ...rule, ...patch.state !== void 0 ? { state: { ...rule.state, ...patch.state } } : {}, ...patch.stats !== void 0 ? { stats: { ...rule.stats, ...patch.stats } } : {} };
+}
+function matchurl(pattern, url) {
+  let parsedpattern;
+  let parsedurl;
+  try {
+    parsedpattern = new URL(pattern);
+    parsedurl = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsedpattern.protocol !== parsedurl.protocol) return false;
+  if (parsedpattern.hostname !== parsedurl.hostname) return false;
+  if (parsedpattern.port !== "" && parsedpattern.port !== parsedurl.port) return false;
+  return globmatch(`${parsedpattern.pathname}${parsedpattern.search}`, `${parsedurl.pathname}${parsedurl.search}`);
+}
+function globmatch(pattern, text2) {
+  const escaped = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const expression = new RegExp(["^", pattern.split("**").map((segment) => segment.split("*").map(escaped).join("[^/]*")).join(".*"), "$"].join(""));
+  return expression.test(text2);
+}
+function visitmatch(origins, url) {
+  let origin = "";
+  try {
+    origin = new URL(url).origin;
+  } catch {
+    return false;
+  }
+  return origins.includes(origin);
+}
+function cronparse(expression) {
+  const fields = expression.trim().split(/\s+/);
+  if (fields.length !== 5) return void 0;
+  const minutes = cronfield(fields[0] ?? "", 0, 59);
+  const hours = cronfield(fields[1] ?? "", 0, 23);
+  const daysofmonth = cronfield(fields[2] ?? "", 1, 31);
+  const months = cronfield(fields[3] ?? "", 1, 12, monthnames);
+  const daysofweek = cronfield(fields[4] ?? "", 0, 7, weekdaynames, true);
+  if (!minutes || !hours || !daysofmonth || !months || !daysofweek) return void 0;
+  return { minutes, hours, daysofmonth, months, daysofweek: [...new Set(daysofweek.map((day) => day % 7))].sort((left, right) => left - right) };
+}
+var weekdaynames = { sun: 0, mon: 1, tue: 2, wed: 3, thu: 4, fri: 5, sat: 6 };
+var monthnames = { jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6, jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12 };
+function cronfield(field, min, max, names, sundayseven = false) {
+  const values = /* @__PURE__ */ new Set();
+  for (const part of field.split(",")) {
+    if (!part) return void 0;
+    const [range, stepstring] = part.split("/");
+    const step = stepstring === void 0 ? 1 : Number(stepstring);
+    if (!Number.isInteger(step) || step < 1) return void 0;
+    let low = min;
+    let high = max;
+    if (range !== void 0 && range !== "*") {
+      const bounds = range.split("-");
+      if (bounds.length > 2) return void 0;
+      const lowvalue = cronvalue(bounds[0] ?? "", min, max, names);
+      if (lowvalue === void 0) return void 0;
+      low = lowvalue;
+      high = lowvalue;
+      if (bounds.length === 2) {
+        const highvalue = cronvalue(bounds[1] ?? "", min, max, names);
+        if (highvalue === void 0 || highvalue < lowvalue) return void 0;
+        high = highvalue;
+      }
+    }
+    for (let value = low; value <= high; value += step) values.add(value);
+  }
+  const list = [...values];
+  if (list.some((value) => value < min || value > max)) return void 0;
+  if (sundayseven && values.has(7)) {
+    values.delete(7);
+    values.add(0);
+  }
+  return [...values].sort((left, right) => left - right);
+}
+function cronvalue(value, min, max, names) {
+  const candidate = names?.[value.toLowerCase()];
+  if (candidate !== void 0) return candidate;
+  if (!/^\d+$/.test(value)) return void 0;
+  const parsed = Number(value);
+  if (parsed < min || parsed > max) return void 0;
+  return parsed;
+}
+function calendarparts(at, timezone) {
+  if (timezone === void 0) {
+    const date = new Date(at);
+    return { minute: date.getUTCMinutes(), hour: date.getUTCHours(), day: date.getUTCDate(), month: date.getUTCMonth() + 1, weekday: date.getUTCDay() };
+  }
+  const parts = new Intl.DateTimeFormat("en-US", { timeZone: timezone, hourCycle: "h23", minute: "numeric", hour: "numeric", day: "numeric", month: "short", weekday: "short" }).formatToParts(new Date(at));
+  const pick = (type) => parts.find((part) => part.type === type)?.value ?? "";
+  const weekday = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"].indexOf(pick("weekday"));
+  const month = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"].indexOf(pick("month")) + 1;
+  return { minute: Number(pick("minute")), hour: Number(pick("hour")), day: Number(pick("day")), month, weekday };
+}
+function crondaymatch(schedule, parts) {
+  if (!schedule.months.includes(parts.month)) return false;
+  const domfull = schedule.daysofmonth.length === 31;
+  const dowfull = schedule.daysofweek.length === 7;
+  const dommatch = schedule.daysofmonth.includes(parts.day);
+  const dowmatch = schedule.daysofweek.includes(parts.weekday);
+  if (!domfull && !dowfull) return dommatch || dowmatch;
+  if (!domfull) return dommatch;
+  if (!dowfull) return dowmatch;
+  return true;
+}
+function cronnext(expression, from, timezone) {
+  const schedule = cronparse(expression);
+  if (!schedule) return void 0;
+  const minute = 6e4;
+  const hour = 60 * minute;
+  const day = 24 * hour;
+  let candidate = Math.floor(from / minute) * minute + minute;
+  const horizon = from + 4 * 366 * day;
+  while (candidate <= horizon) {
+    const parts = calendarparts(candidate, timezone);
+    if (!crondaymatch(schedule, parts)) {
+      candidate += day - parts.hour * hour - parts.minute * minute;
+      continue;
+    }
+    if (!schedule.hours.includes(parts.hour)) {
+      const later = schedule.hours.find((value) => value > parts.hour);
+      candidate += later === void 0 ? day - parts.hour * hour - parts.minute * minute : (later - parts.hour) * hour - parts.minute * minute;
+      continue;
+    }
+    if (!schedule.minutes.includes(parts.minute)) {
+      const later = schedule.minutes.find((value) => value > parts.minute);
+      candidate += later === void 0 ? (60 - parts.minute) * minute : (later - parts.minute) * minute;
+      continue;
+    }
+    return candidate;
+  }
+  return void 0;
+}
+function schedulecron(rule, from) {
+  return cronnext(rule.cron, from, rule.timezone);
+}
+function scheduleinterval(rule, lastfire, armedat, seed) {
+  const base = (lastfire ?? armedat) + rule.period;
+  const jitter = rule.jitter ?? 0;
+  if (jitter <= 0) return base;
+  return Math.max(0, Math.round(base - jitter / 2 + seededrandom(seed) * jitter));
+}
+function listdue(rules, now) {
+  return rules.flatMap((rule) => {
+    if (rule.state.nextfireat === void 0 || rule.state.nextfireat > now) return [];
+    if (!rule.state.enabled || rule.state.pausedat !== void 0) return [];
+    return [{ rule, overdueby: now - rule.state.nextfireat }];
+  });
+}
+function applycooldown(rule, now) {
+  const lastfireat = rule.state.lastfireat;
+  if (lastfireat === void 0 || rule.state.cooldown <= 0) return { suppressed: false, remaining: 0 };
+  const remaining = lastfireat + rule.state.cooldown - now;
+  return { suppressed: remaining > 0, remaining: Math.max(0, remaining) };
+}
+function evaluatetrigger(input) {
+  const rule = input.rule;
+  if (!rule.state.enabled) return { fired: false, suppressed: "disabled" };
+  if (rule.state.pausedat !== void 0) return { fired: false, suppressed: "paused" };
+  if (!input.workflowreviewed) return { fired: false, suppressed: "unreviewed" };
+  if (input.runactive) return { fired: false, suppressed: "dedupe" };
+  const cooldown = applycooldown(rule, input.now);
+  if (cooldown.suppressed) return { fired: false, suppressed: "cooldown", remaining: cooldown.remaining };
+  const fire = { id: crypto.randomUUID(), ruleid: rule.id, at: input.now, cause: input.cause, ...input.url !== void 0 ? { url: input.url } : {}, ...input.title !== void 0 ? { title: input.title } : {}, ...input.payload !== void 0 ? { payload: input.payload } : {} };
+  return { fired: true, fire };
+}
+function queuefire(queue, fire) {
+  if (queue.some((pending) => pending.ruleid === fire.ruleid)) return { queue, queued: false, deduped: true };
+  return { queue: [...queue, fire], queued: true, deduped: false };
+}
+async function drainqueue(queue, launch) {
+  let remaining = [...queue];
+  let launched = 0;
+  while (remaining.length > 0) {
+    const fire = remaining[0];
+    try {
+      await launch(fire);
+    } catch {
+      return { launched, remaining };
+    }
+    remaining = remaining.slice(1);
+    launched += 1;
+  }
+  return { launched, remaining };
+}
+function verifywebhook(input) {
+  if (typeof input.rule.secret !== "string" || !input.rule.secret) return { verified: false, reason: "The webhook rule carries no reviewed secret." };
+  if (!secrectsmatch(input.secret, input.rule.secret)) return { verified: false, reason: "The webhook secret does not match the reviewed secret of the rule." };
+  const payload = input.payload;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { verified: false, reason: "The webhook payload must be a JSON object." };
+  const candidate = payload;
+  for (const field of input.rule.schema ?? []) {
+    const value = candidate[field.name];
+    if (value === void 0) {
+      if (field.required === true) return { verified: false, reason: `The required webhook field ${field.name} is missing.` };
+      continue;
+    }
+    if (typeof value !== field.kind) return { verified: false, reason: `The webhook field ${field.name} is not a ${field.kind}.` };
+  }
+  return { verified: true };
+}
+function secrectsmatch(left, right) {
+  if (left.length !== right.length) return false;
+  let same = true;
+  for (let index = 0; index < left.length; index += 1) if (left.charCodeAt(index) !== right.charCodeAt(index)) same = false;
+  return same;
+}
+function eventrulematches(rule, event) {
+  return (rule.events ?? []).includes(event);
+}
+function observeevents(rules, event) {
+  if (!triggereventcatalog.includes(event)) return [];
+  return rules.filter((rule) => rule.kind === "event" && rule.state.enabled && rule.state.pausedat === void 0 && eventrulematches(rule, event));
+}
+function pauseall(rules, now) {
+  return rules.map((rule) => rule.state.enabled && rule.state.pausedat === void 0 ? updaterule(rule, { state: { pausedat: now } }) : rule);
+}
+function resumeall(rules) {
+  return rules.map((rule) => {
+    if (rule.state.pausedat === void 0) return rule;
+    const state = { ...rule.state };
+    delete state.pausedat;
+    return { ...rule, state };
+  });
+}
+function manualpreview(record2, now) {
+  return { id: crypto.randomUUID(), workflowid: record2.id, preview: record2.steps.map((step) => ({ stepid: step.id, kind: step.kind, label: step.label, ...step.block !== void 0 ? { block: step.block } : {}, ...controlsummary(step) !== void 0 ? { control: controlsummary(step) } : {} })), at: now };
+}
+function confirmmanualrun(preview, confirmed, now) {
+  return { ...preview, confirmed, decidedat: now };
+}
+function triggersummary(rule) {
+  return {
+    kind: rule.kind,
+    workflowid: rule.workflowid,
+    label: rule.label,
+    ...rule.origins !== void 0 ? { origins: rule.origins } : {},
+    ...rule.pattern !== void 0 ? { pattern: rule.pattern } : {},
+    ...rule.title !== void 0 ? { title: rule.title } : {},
+    ...rule.command !== void 0 ? { command: rule.command } : {},
+    ...rule.key !== void 0 ? { key: rule.key } : {},
+    ...rule.cron !== void 0 ? { cron: rule.cron, ...rule.timezone !== void 0 ? { timezone: rule.timezone } : {} } : {},
+    ...rule.period !== void 0 ? { period: rule.period, ...rule.jitter !== void 0 ? { jitter: rule.jitter } : {} } : {},
+    ...rule.urls !== void 0 ? { urls: rule.urls } : {},
+    ...rule.events !== void 0 ? { events: rule.events } : {},
+    ...rule.schema !== void 0 ? { fields: rule.schema.length } : {},
+    cooldown: rule.state.cooldown,
+    enabled: rule.state.enabled,
+    ...rule.state.nextfireat !== void 0 ? { nextfireat: rule.state.nextfireat } : {}
+  };
+}
+function ruleorigins(rule) {
+  const origins = /* @__PURE__ */ new Set();
+  for (const origin of rule.origins ?? []) origins.add(origin);
+  if (rule.pattern !== void 0) {
+    const origin = httpsorigin(rule.pattern);
+    if (origin !== void 0) origins.add(origin);
+  }
+  for (const url of rule.urls ?? []) {
+    const origin = httpsorigin(url);
+    if (origin !== void 0) origins.add(origin);
+  }
+  return [...origins];
+}
+function ruleoriginsgranted(rule, workfloworigins) {
+  const granted = new Set(workfloworigins);
+  return ruleorigins(rule).every((origin) => granted.has(origin));
+}
+
 // netauth.ts
 function oauthflowof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -3915,9 +5077,9 @@ function consolediff(input) {
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow"]);
-var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow", "visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"]);
+var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars", "condition", "branch"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
@@ -3938,7 +5100,8 @@ var cdpactions = /* @__PURE__ */ new Set(["attachcdp", "detachcdp", "cdpcmd", "w
 var profileractions = /* @__PURE__ */ new Set(["measureflow", "heapshot", "trackmemory", "profilecpu", "watchshifts", "traceload", "annotatetrace", "replaytrace", "capturesourcemaps"]);
 var emulationactions = /* @__PURE__ */ new Set(["emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "blackboxscripts"]);
 var sessionactions = /* @__PURE__ */ new Set(["persiststate", "capturesession", "restoresession", "namedsessions", "diffsessions", "searchsessions", "exportsessions", "importsessions"]);
-var workflowactions = /* @__PURE__ */ new Set(["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"]);
+var workflowactions = /* @__PURE__ */ new Set(["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars", "condition", "branch", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
+var triggeractions = /* @__PURE__ */ new Set(["visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"]);
 var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
@@ -3960,6 +5123,9 @@ function issessionkind(kind) {
 function isworkflowkind(kind) {
   return workflowactions.has(kind);
 }
+function istriggeraction(kind) {
+  return triggeractions.has(kind);
+}
 function isdebugkind(kind) {
   return debugactions.has(kind);
 }
@@ -5583,6 +6749,68 @@ function validateworkflowgrammar(step, options) {
     if (typeof options.text !== "string") return { allowed: false, reason: "The variable extraction needs the reviewed text the regex rule applies to." };
     return { allowed: true };
   }
+  if (kind === "condition") {
+    const condition = conditionof(options.condition);
+    if (!condition) return { allowed: false, reason: "The condition step needs a reviewed boolean expression in its options." };
+    const operatorcheck = validatexpressionoperators(condition.expression);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return { allowed: true };
+  }
+  if (kind === "branch") {
+    const branch = branchof(options.branch);
+    if (!branch) return { allowed: false, reason: "The branch step needs reviewed unique paths with boolean match expressions and an else path in its options so every branch terminates." };
+    for (const path of [...branch.paths, branch.else]) {
+      if (path.when === void 0) continue;
+      const operatorcheck = validatexpressionoperators(path.when);
+      if (!operatorcheck.allowed) return operatorcheck;
+    }
+    return controlchildkinds(step);
+  }
+  if (kind === "loop") {
+    const loop = loopof(options.loop);
+    if (!loop) return { allowed: false, reason: "The loop step needs a reviewed list variable, distinct item and index variables, an optional positive safety bound and a non-empty body in its options; an absent bound keeps the documented default." };
+    return controlchildkinds(step);
+  }
+  if (kind === "repeatuntil") {
+    const repeat = repeatuntilof(options.repeatuntil);
+    if (!repeat) return { allowed: false, reason: "The repeat until step needs a reviewed convergence expression, an optional positive safety bound and a non-empty body in its options." };
+    const operatorcheck = validatexpressionoperators(repeat.until);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return controlchildkinds(step);
+  }
+  if (kind === "whileloop") {
+    const condition = whileof(options.while);
+    if (!condition) return { allowed: false, reason: "The while step needs a reviewed condition, a mandatory positive safety bound and a non-empty body in its options; a while loop without a safety bound is refused." };
+    const operatorcheck = validatexpressionoperators(condition.while);
+    if (!operatorcheck.allowed) return operatorcheck;
+    return controlchildkinds(step);
+  }
+  if (kind === "foreach") {
+    const foreach = foreachof(options.foreach);
+    if (!foreach) return { allowed: false, reason: "The foreach step needs a reviewed non-empty selector, distinct item and index variables and a non-empty body in its options." };
+    return controlchildkinds(step);
+  }
+  if (kind === "parallel") {
+    const parallel = parallelof(options.parallel);
+    if (!parallel) return { allowed: false, reason: "The parallel step needs uniquely identified branches with bodies and a join policy of the first, last or fail strategy with cancel or continue on branch failure in its options." };
+    return controlchildkinds(step);
+  }
+  if (kind === "trycatch") {
+    const fragile = tryof(options.try);
+    if (!fragile) return { allowed: false, reason: "The try step needs a fragile body, a catch handler and optional retry and timeout policies in its options: attempts stay user configured with no code ceiling, backoff is fixed or exponential and budgets are positive." };
+    return controlchildkinds(step);
+  }
+  return { allowed: true };
+}
+function controlchildkinds(step) {
+  const children = controlsteps({ id: step.id, kind: step.kind, label: step.summary, ...step.options !== void 0 ? { options: step.options } : {} });
+  for (const child of children) {
+    try {
+      actionrisk(child.kind);
+    } catch {
+      return { allowed: false, reason: `The ${child.kind} step inside the control payload of the ${step.kind} step is not a reviewed action kind.` };
+    }
+  }
   return { allowed: true };
 }
 function validateregexrule(pattern) {
@@ -5643,7 +6871,94 @@ function workflowgate(input) {
   }
   return { allowed: true };
 }
+function validatetriggergrammar(step, options) {
+  const family = triggerfamilyof(step.kind);
+  if (family === void 0) return { allowed: false, reason: "The trigger step is not a reviewed trigger kind." };
+  if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "Every trigger rule needs the reviewed id of the composed workflow it launches." };
+  if (options.reviewed !== true) return { allowed: false, reason: "Every trigger rule needs the explicit arm review with its match fields and bound workflow shown before it arms." };
+  if (options.label !== void 0 && (typeof options.label !== "string" || !options.label.trim())) return { allowed: false, reason: "The reviewed trigger label must be a non-empty string." };
+  if (options.cooldown !== void 0 && (typeof options.cooldown !== "number" || !Number.isFinite(options.cooldown) || options.cooldown <= 0)) return { allowed: false, reason: "The reviewed cooldown window must be a positive number of milliseconds with no code ceiling; the webhook and event families keep the documented default when the review configures none." };
+  const payload = options.rule;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { allowed: false, reason: `The ${step.kind} step needs its reviewed rule payload in options.` };
+  if (triggerpayloadof(family, payload) === void 0) {
+    if (family === "visit") return { allowed: false, reason: "The visit rule needs a non-empty reviewed list of HTTPS origins it fires on." };
+    if (family === "url") return { allowed: false, reason: "The url rule needs a reviewed HTTPS glob url pattern; `*` spans one path segment and `**` spans across segments." };
+    if (family === "menu") return { allowed: false, reason: "The menu rule needs a reviewed non-empty context menu entry title." };
+    if (family === "key") return { allowed: false, reason: "The keyboard shortcut rule needs a reviewed lowercase command name and an optional suggested key binding." };
+    if (family === "cron") return { allowed: false, reason: "The cron rule needs a reviewed five field cron expression of minutes, hours, days, months and weekdays with named weekdays and months and an optional resolvable timezone; unparseable schedules are refused." };
+    if (family === "interval") return { allowed: false, reason: "The interval rule needs a reviewed positive period in milliseconds with an optional zero or positive jitter window." };
+    if (family === "urllist") return { allowed: false, reason: "The url list rule needs a reviewed non-empty list of HTTPS urls its workflow runs across." };
+    if (family === "webhook") return { allowed: false, reason: `The webhook rule needs a reviewed shared secret of at least twenty four characters mixing letters and digits and a non-empty payload schema of named string, number or boolean fields.` };
+    if (family === "event") return { allowed: false, reason: `The page event rule needs a reviewed non-empty list of event names of the observed event catalog: ${triggereventcatalog.join(", ")}.` };
+    return { allowed: false, reason: "The trigger rule payload does not follow its family grammar." };
+  }
+  if (family === "cron") {
+    const candidate = payload;
+    if (typeof candidate.cron === "string" && cronparse(candidate.cron) === void 0) return { allowed: false, reason: "The cron expression does not parse as a five field schedule and is refused." };
+  }
+  if (family === "webhook") {
+    const candidate = payload;
+    if (typeof candidate.secret === "string" && !webhooksecretok(candidate.secret)) return { allowed: false, reason: "The webhook shared secret must hold at least twenty four characters mixing letters and digits; the entropy floor is a floor, never a cap." };
+  }
+  const armed = armrule({ family, workflowid: options.workflowid, ...typeof options.label === "string" && options.label.trim() ? { label: options.label } : {}, payload, ...typeof options.cooldown === "number" ? { cooldown: options.cooldown } : {}, now: 0 });
+  if (armed === void 0) return { allowed: false, reason: "The trigger rule payload does not arm as a reviewed rule." };
+  return { allowed: true };
+}
+function triggergate(input) {
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now: input.now, action: "arm the trigger rule" });
+  if (!gate.allowed) return gate;
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Trigger rules need the approved plan review before they arm." };
+  let triggeroptions = {};
+  try {
+    triggeroptions = parseoptions(input.step);
+  } catch {
+    triggeroptions = {};
+  }
+  if (triggeroptions.reviewed !== true) return { allowed: false, reason: "Every trigger rule needs the explicit arm review with its match fields and bound workflow shown before it arms." };
+  return { allowed: true };
+}
+function triggerorigins(step) {
+  let triggeroptions = {};
+  try {
+    triggeroptions = parseoptions(step);
+  } catch {
+    return [];
+  }
+  const family = triggerfamilyof(step.kind);
+  if (family === void 0) return [];
+  const armed = armrule({ family, workflowid: typeof triggeroptions.workflowid === "string" ? triggeroptions.workflowid : "", payload: triggeroptions.rule, ...typeof triggeroptions.cooldown === "number" ? { cooldown: triggeroptions.cooldown } : {}, now: 0 });
+  if (armed === void 0) return [];
+  const origins = [];
+  for (const origin of armed.origins ?? []) origins.push(origin);
+  if (armed.pattern !== void 0) {
+    try {
+      origins.push(new URL(armed.pattern).origin);
+    } catch {
+    }
+  }
+  for (const url of armed.urls ?? []) {
+    try {
+      origins.push(new URL(url).origin);
+    } catch {
+    }
+  }
+  return [...new Set(origins)];
+}
 function dryrunprojection(step) {
+  if (iscontrolflowkind(step.kind)) {
+    for (const child of controlsteps(step)) {
+      const childrisk = resolvedrisk({ id: child.id, kind: child.kind, summary: child.label, risk: "read", ...child.target !== void 0 ? { target: child.target } : {}, ...child.value !== void 0 ? { value: child.value } : {}, ...child.options !== void 0 ? { options: child.options } : {} });
+      if (childrisk !== "read") return void 0;
+    }
+    if (step.kind === "condition") return "The condition step would evaluate its reviewed expression over the extracted values with no page side effect.";
+    if (step.kind === "branch") return "The branch step would choose one reviewed path by page state and only the chosen path would run.";
+    if (step.kind === "loop") return "The loop step would iterate its reviewed list binding the item and index variables per iteration inside the safety bound.";
+    if (step.kind === "repeatuntil") return "The repeat until step would rerun its body until the convergence expression holds inside the safety bound.";
+    if (step.kind === "whileloop") return "The while step would loop while its condition holds inside the reviewed safety bound.";
+    if (step.kind === "foreach") return "The foreach step would iterate the elements of its reviewed selector binding the item and index variables per iteration.";
+    if (step.kind === "parallel") return "The parallel step would run its branches concurrently and join their outcomes under the reviewed strategy.";
+    return "The try step would run its fragile body and only the catch handler on failure.";
+  }
   const risk = resolvedrisk({ id: step.id, kind: step.kind, summary: step.label, risk: "read", ...step.target !== void 0 ? { target: step.target } : {}, ...step.value !== void 0 ? { value: step.value } : {}, ...step.options !== void 0 ? { options: step.options } : {} });
   if (risk !== "read") return void 0;
   if (step.kind === "delay") return `The delay step would sleep its reviewed base inside the jitter window.`;
@@ -6225,6 +7540,10 @@ function validatestep(step, origin) {
     const workflowcheck = validateworkflowgrammar(step, options);
     if (!workflowcheck.allowed) return workflowcheck;
   }
+  if (istriggeraction(step.kind)) {
+    const triggercheck = validatetriggergrammar(step, options);
+    if (!triggercheck.allowed) return triggercheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -6419,33 +7738,37 @@ function canexecute(input) {
     const workflowgatecheck = workflowgate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
     if (!workflowgatecheck.allowed) return workflowgatecheck;
   }
+  if (istriggeraction(input.step.kind)) {
+    const triggergatecheck = triggergate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
+    if (!triggergatecheck.allowed) return triggergatecheck;
+  }
   if (iscontrolkind(input.step.kind)) {
     const controlgate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "control the network" });
     if (!controlgate.allowed) return controlgate;
-    let controloptions = {};
+    let controloptions2 = {};
     try {
-      controloptions = parseoptions(input.step);
+      controloptions2 = parseoptions(input.step);
     } catch {
-      controloptions = {};
+      controloptions2 = {};
     }
     if (input.step.kind === "blockrequest") {
       const blockgatecheck = blockgate(input.session, input.step, now);
       if (!blockgatecheck.allowed) return blockgatecheck;
-      const rule = blockruleof(controloptions.block);
+      const rule = blockruleof(controloptions2.block);
       if (rule) {
         const blockorigin = origincheck(input.session, rule.urlpattern);
         if (!blockorigin.allowed) return blockorigin;
       }
     }
     if (input.step.kind === "mockresponse" || input.step.kind === "rewriteheaders") {
-      const patterns = input.step.kind === "mockresponse" ? [mockspecof(controloptions.mock)?.urlpattern ?? ""] : Array.isArray(controloptions.rules) ? controloptions.rules.map((item) => item && typeof item === "object" && !Array.isArray(item) ? String(item.urlpattern ?? "") : "") : [];
+      const patterns = input.step.kind === "mockresponse" ? [mockspecof(controloptions2.mock)?.urlpattern ?? ""] : Array.isArray(controloptions2.rules) ? controloptions2.rules.map((item) => item && typeof item === "object" && !Array.isArray(item) ? String(item.urlpattern ?? "") : "") : [];
       for (const pattern of patterns) {
         const patterngate = origincheck(input.session, pattern);
         if (!patterngate.allowed) return patterngate;
       }
     }
     if (input.step.kind === "setcookies" || input.step.kind === "readcookies" || input.step.kind === "clearcookies") {
-      const domain = typeof controloptions.domain === "string" && controloptions.domain.trim() ? controloptions.domain : Array.isArray(controloptions.cookies) ? String(controloptions.cookies[0]?.domain ?? "") : "";
+      const domain = typeof controloptions2.domain === "string" && controloptions2.domain.trim() ? controloptions2.domain : Array.isArray(controloptions2.cookies) ? String(controloptions2.cookies[0]?.domain ?? "") : "";
       if (!domain) return { allowed: false, reason: "A reviewed cookie domain is required before cookie control runs." };
       const cookiegatecheck = cookiegate(input.session, domain, now);
       if (!cookiegatecheck.allowed) return cookiegatecheck;
@@ -6677,13 +8000,19 @@ function recordsession(progress, planid, stepid, entry, now) {
 }
 function recordworkflow(progress, planid, stepid, entry, now) {
   const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
-  const counts = `${entry.executed !== void 0 ? `${entry.executed} executed step${entry.executed === 1 ? "" : "s"}, ` : ""}${entry.refused !== void 0 ? `${entry.refused} refused step${entry.refused === 1 ? "" : "s"}, ` : ""}${entry.total !== void 0 ? `${entry.total} total step${entry.total === 1 ? "" : "s"}, ` : ""}`.replace(/, $/, "");
+  const counts = `${entry.executed !== void 0 ? `${entry.executed} executed step${entry.executed === 1 ? "" : "s"}, ` : ""}${entry.refused !== void 0 ? `${entry.refused} refused step${entry.refused === 1 ? "" : "s"}, ` : ""}${entry.total !== void 0 ? `${entry.total} total step${entry.total === 1 ? "" : "s"}, ` : ""}${entry.iterations !== void 0 ? `${entry.iterations} iteration${entry.iterations === 1 ? "" : "s"}, ` : ""}${entry.denominator !== void 0 ? `denominator ${entry.denominator}, ` : ""}`.replace(/, $/, "");
   const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { workflow: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function recordtrigger(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const counts = `${entry.fires !== void 0 ? `${entry.fires} fire${entry.fires === 1 ? "" : "s"}, ` : ""}${entry.launches !== void 0 ? `${entry.launches} launch${entry.launches === 1 ? "" : "es"}, ` : ""}${entry.suppressions !== void 0 ? `${entry.suppressions} suppression${entry.suppressions === 1 ? "" : "s"}, ` : ""}${entry.queued !== void 0 ? `${entry.queued} queued fire${entry.queued === 1 ? "" : "s"}, ` : ""}`.replace(/, $/, "");
+  const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { trigger: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.50";
+var packageversion = "1.1.52";
 
 // types.ts
 var protocolversion = packageversion;
@@ -6922,6 +8251,25 @@ function parseproposal(value, origin, grants) {
       }
       if (step.kind === "runworkflow" && workflowoptions.reviewed !== true) throw new Error("Workflow runs without the explicit run review of the expanded step list are refused.");
     }
+    if (istriggeraction(step.kind)) {
+      let triggeroptions = {};
+      try {
+        triggeroptions = parseoptions(step);
+      } catch {
+        triggeroptions = {};
+      }
+      if (triggeroptions.reviewed !== true) throw new Error("Trigger rules without the explicit arm review of their match fields and bound workflow are refused.");
+      for (const ruleorigin of triggerorigins(step)) {
+        const granted = covered.some((pattern) => {
+          try {
+            return new URL(ruleorigin).origin === new URL(pattern).origin;
+          } catch {
+            return false;
+          }
+        });
+        if (!granted) throw new Error(`The trigger on ${ruleorigin} stays outside the grants.`);
+      }
+    }
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
     const target = outboundtarget(step);
@@ -6983,7 +8331,7 @@ function parseproposal(value, origin, grants) {
 }
 function workflowoutcome(input) {
   const selected = input.stepid !== void 0 ? input.entries.filter((entry) => entry.stepid === input.stepid) : input.entries;
-  const steps = selected.map((entry) => ({ stepid: entry.stepid, label: entry.label, state: entry.state, duration: entry.duration, summary: entry.summary, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.produced !== void 0 ? { produced: entry.produced } : {}, ...entry.consumed !== void 0 ? { consumed: entry.consumed } : {}, ...entry.checkpoint === true ? { checkpoint: true } : {} }));
+  const steps = selected.map((entry) => ({ stepid: entry.stepid, label: entry.label, state: entry.state, duration: entry.duration, summary: entry.summary, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.produced !== void 0 ? { produced: entry.produced } : {}, ...entry.consumed !== void 0 ? { consumed: entry.consumed } : {}, ...entry.checkpoint === true ? { checkpoint: true } : {}, ...entry.details !== void 0 && entry.details.control !== void 0 ? { control: entry.details.control } : {} }));
   return { version: protocolversion, runid: input.run.id, workflowid: input.run.workflowid, state: input.run.state, ...input.run.dryrun === true ? { dryrun: true } : {}, steps };
 }
 function stepof(kind, candidate, index) {
@@ -7001,7 +8349,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed } } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed, ...input.workflow.timeout !== void 0 ? { timeout: input.workflow.timeout } : {}, ...input.workflow.retry !== void 0 ? { retry: input.workflow.retry } : {} } } : {}, ...input.trigger ? { trigger: { ruleid: input.trigger.ruleid, kind: input.trigger.kind, enabled: input.trigger.enabled, ...input.trigger.nextfireat !== void 0 ? { nextfireat: input.trigger.nextfireat } : {} } } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -7136,7 +8484,46 @@ function sessionreport(input) {
   return { version: protocolversion, records: input.records, events: input.events, folders: input.folders, diffs: input.diffs, ...input.auto !== void 0 ? { auto: input.auto } : {}, ...input.crashed === true ? { crashed: true } : {} };
 }
 function workflowreport(input) {
-  return { version: protocolversion, workflows: input.workflows, runs: input.runs, templates: input.templates, log: input.log ?? [], scopes: input.scopes ?? [], provenance: input.provenance ?? [] };
+  return { version: protocolversion, workflows: input.workflows, runs: input.runs, templates: input.templates, log: input.log ?? [], scopes: input.scopes ?? [], provenance: input.provenance ?? [], control: input.control ?? [] };
+}
+function triggerlist(input) {
+  const names = new Map(input.workflows.map((record2) => [record2.id, record2.name]));
+  const rules = input.rules.map((rule) => {
+    const workflowname = names.get(rule.workflowid);
+    return {
+      id: rule.id,
+      kind: rule.kind,
+      workflowid: rule.workflowid,
+      ...workflowname !== void 0 ? { workflowname } : {},
+      label: rule.label,
+      enabled: rule.state.enabled,
+      ...rule.state.pausedat !== void 0 ? { paused: true } : {},
+      cooldown: rule.state.cooldown,
+      ...rule.state.lastfireat !== void 0 ? { lastfireat: rule.state.lastfireat } : {},
+      ...rule.state.nextfireat !== void 0 ? { nextfireat: rule.state.nextfireat } : {},
+      fires: rule.stats.fires,
+      launches: rule.stats.launches,
+      suppressions: rule.stats.suppressions,
+      summary: triggersummaryof(rule)
+    };
+  });
+  return { version: protocolversion, rules, queued: (input.queue ?? []).length };
+}
+function triggersummaryof(rule) {
+  const summary = { kind: rule.kind, workflowid: rule.workflowid };
+  if (rule.origins !== void 0) summary.origins = rule.origins;
+  if (rule.pattern !== void 0) summary.pattern = rule.pattern;
+  if (rule.title !== void 0) summary.title = rule.title;
+  if (rule.command !== void 0) summary.command = rule.command;
+  if (rule.key !== void 0) summary.key = rule.key;
+  if (rule.cron !== void 0) summary.cron = rule.cron;
+  if (rule.timezone !== void 0) summary.timezone = rule.timezone;
+  if (rule.period !== void 0) summary.period = rule.period;
+  if (rule.jitter !== void 0) summary.jitter = rule.jitter;
+  if (rule.urls !== void 0) summary.urls = rule.urls;
+  if (rule.events !== void 0) summary.events = rule.events;
+  if (rule.schema !== void 0) summary.fields = rule.schema.length;
+  return summary;
 }
 
 // capture.ts
@@ -8866,7 +10253,7 @@ function stepoptions2(step) {
 }
 async function refreshcapabilities() {
   const report = await readcapabilities();
-  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds], sessions: [...sessionkinds], workflow: [...workflowkinds] };
+  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds], profile: [...profilerkinds], emulation: [...emulationkinds], sessions: [...sessionkinds], workflow: [...workflowkinds, ...controlflowkinds] };
   await memory.setcapabilities(withmedia);
   return withmedia;
 }
@@ -9189,6 +10576,8 @@ async function executewatchstep(step, session, plan, tabid2, origin) {
       const record2 = entry;
       await memory.addmutationevent({ ...record2, sessionid: session.id });
     }
+    void evaluatepagetriggers("mutate").catch(() => {
+    });
   }
   if (step.kind === "watchfocus") {
     for (const entry of detailarray(output.details, "events")) {
@@ -9196,6 +10585,8 @@ async function executewatchstep(step, session, plan, tabid2, origin) {
       const record2 = entry;
       await memory.addfocusevent({ ...record2, sessionid: session.id });
     }
+    void evaluatepagetriggers("focus").catch(() => {
+    });
   }
   if (step.kind === "watchbanner") {
     for (const entry of detailarray(output.details, "banners")) {
@@ -9203,6 +10594,8 @@ async function executewatchstep(step, session, plan, tabid2, origin) {
       const record2 = entry;
       await memory.addbanner({ ...record2, sessionid: session.id });
     }
+    void evaluatepagetriggers("banner").catch(() => {
+    });
   }
   await audit("watch", `Watch ${watchid} closed after its reviewed lifetime of ${lifetime} milliseconds.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
   return { output, watch };
@@ -9330,6 +10723,8 @@ async function tracktabupdate(tabid2, changeinfo) {
 }
 chrome.tabs.onUpdated.addListener((tabid2, changeinfo) => {
   void tracktabupdate(tabid2, changeinfo);
+  if (typeof changeinfo.url === "string" && changeinfo.url.startsWith("https://")) void evaluatenavigationtriggers(changeinfo.url).catch(() => {
+  });
 });
 chrome.tabs.onActivated.addListener((activeinfo) => {
   void recordtabwatchevent("activated", activeinfo.tabId);
@@ -11566,7 +12961,7 @@ async function executehttpstep(step, session, plan, tabid2, origin) {
 var activesockets = /* @__PURE__ */ new Map();
 var channelbuses = /* @__PURE__ */ new Map();
 var netpoll = 100;
-function waitsome(milliseconds) {
+function waitsome2(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
 }
 async function queueinboundmessage(channelid, payload) {
@@ -11654,7 +13049,7 @@ async function runsubscription(subscription, controller) {
     }
     if (controller.signal.aborted) break;
     if (subscription.lifetime !== void 0 && Date.now() - startedat >= subscription.lifetime) break;
-    await waitsome(netpoll * 10);
+    await waitsome2(netpoll * 10);
   }
   const closed = { ...current, state: "closed", closedat: Date.now() };
   await memory.setsubscription(closed);
@@ -11748,7 +13143,7 @@ async function executesocketstep(step, session, plan, tabid2, origin) {
       const queued = await memory.getmessages(channelid);
       matched = queued.filter((envelope) => matchmessage(filter, envelope)).slice(0, filter.limit ?? (matched.length || void 0));
       if (matched.length >= (filter.limit ?? 1) || Date.now() >= deadline) break;
-      await waitsome(netpoll);
+      await waitsome2(netpoll);
     }
     await memory.drainmessages(matched.map((envelope) => ({ channelid: envelope.channelid, sequence: envelope.sequence })));
     await audit("socket", `The message wait on channel ${channelid} matched ${matched.length} envelope${matched.length === 1 ? "" : "s"} of the reviewed filter within the ${budget} millisecond budget; payload values stay out of the audit trail.`, extra);
@@ -11809,7 +13204,7 @@ async function executesocketstep(step, session, plan, tabid2, origin) {
           break;
         }
         stopcursor = decision.cursor;
-        await waitsome(decision.next?.wait ?? cursor.interval);
+        await waitsome2(decision.next?.wait ?? cursor.interval);
         next = { url: decision.next?.url ?? next.url, ...decision.next?.body !== void 0 ? { body: decision.next.body } : {} };
       }
     } finally {
@@ -11831,7 +13226,7 @@ async function executenetwatchstep(step, session, plan, tabid2, origin) {
     const limit = typeof options.limit === "number" && Number.isInteger(options.limit) && options.limit >= 1 ? options.limit : void 0;
     const before = await bridgecall(tabid2, "resourcerecords");
     const known = new Set(resourcefacts(before ?? []).map((fact) => `${fact.url}@${fact.start}`));
-    if (window2 > 0) await waitsome(window2);
+    if (window2 > 0) await waitsome2(window2);
     const after = await bridgecall(tabid2, "resourcerecords");
     const fresh = resourcefacts(after ?? []).filter((fact) => !known.has(`${fact.url}@${fact.start}`));
     const chosen = limit !== void 0 ? fresh.slice(0, limit) : fresh;
@@ -12012,6 +13407,10 @@ async function executetimelinestep(step, session, plan, tabid2, origin) {
   const watcherstate = activetimelinewatchers.get(watchid);
   activetimelinewatchers.delete(watchid);
   await memory.closewatch(watchid, Date.now());
+  if (step.kind === "watchconsole" || step.kind === "watcherrors") {
+    void evaluatepagetriggers(step.kind === "watchconsole" ? "console" : "error").catch(() => {
+    });
+  }
   await audit("timeline", `Watcher ${watchid} detached cleanly after its reviewed window of ${watchwindow} milliseconds.`, extra);
   if (watcherstate?.cancelled) {
     await audit("timeline", `Watcher ${watchid} cancelled on run cancel or the killswitch; the captured window is discarded.`, extra);
@@ -13342,7 +14741,7 @@ async function sleepreviewed(sampled, stepid) {
     } catch {
     }
   }
-  await waitsome(sampled);
+  await waitsome2(sampled);
   return "timer";
 }
 async function executewaitelement(step, tabid2) {
@@ -13360,7 +14759,7 @@ async function executewaitelement(step, tabid2) {
     const probe = await bridgecall(tabid2, "elementrect", wait.selector).catch(() => void 0);
     if (probe?.ok) return { ok: true, summary: `Selector ${wait.selector} appeared after ${Date.now() - startedat} milliseconds of polling every ${wait.poll} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat, poll: wait.poll } };
     if (singlepass || Date.now() >= deadline) break;
-    await waitsome(pass + 1 < plan.probes ? wait.poll : plan.lastwait);
+    await waitsome2(pass + 1 < plan.probes ? wait.poll : plan.lastwait);
   }
   return { ok: false, summary: `Selector ${wait.selector} did not appear within the reviewed timeout of ${wait.timeout} milliseconds.`, details: { selector: wait.selector, waited: Date.now() - startedat } };
 }
@@ -13475,13 +14874,26 @@ async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
   activeworkflowruns.set(run.id, guards);
   await audit("workflow", `Started the run ${run.id} of the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} reviewed steps; every step passes the session, plan review and origin gates.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
   const context = { session, plan, tabid: tabid2, origin };
-  const execute = async (workflowstep) => {
+  const executesteprouted = async (workflowstep, stepcontext) => {
     if (guards.cancelled) return { ok: false, summary: `The run was cancelled before the ${workflowstep.label} step dispatched.` };
-    return await dispatchworkflowstep(workflowstep, context);
+    if (!iscontrolflowkind(workflowstep.kind)) return await dispatchworkflowstep(workflowstep, context);
+    const controlled = await runcontrolstep({
+      step: workflowstep,
+      scopes: stepcontext.scopes,
+      outputs: stepcontext.outputs ?? {},
+      execute: async (dispatched, inner) => await executesteprouted(dispatched, inner),
+      now: Date.now(),
+      runid: run.id,
+      pagestate: await pagestateof(tabid2),
+      resolveelements: async (selector) => await resolveelements(tabid2, selector)
+    });
+    return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
   };
+  const execute = async (workflowstep, stepcontext) => await executesteprouted(workflowstep, stepcontext);
   let result;
+  const runbudget = options.timeout && typeof options.timeout === "object" && !Array.isArray(options.timeout) && typeof options.timeout.runms === "number" && Number.isFinite(options.timeout.runms) && options.timeout.runms > 0 ? options.timeout.runms : void 0;
   try {
-    result = await runworkflow({
+    const launch = () => runworkflow({
       record: record2,
       run,
       scopes: runscopes(options.variables),
@@ -13497,6 +14909,18 @@ async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
         await refreshbadge();
       }
     });
+    if (runbudget === void 0) {
+      result = await launch();
+    } else {
+      const raced = await applyruntimeout({ budgetms: runbudget, run: launch });
+      if (raced.cancelled) {
+        guards.cancelled = true;
+        const aborted = await storetimeoutabort(run, step, raced.error.message, runbudget);
+        result = { run: aborted.run, scopes: [], log: aborted.log, outputs: {} };
+      } else {
+        result = raced.value;
+      }
+    }
   } finally {
     activeworkflowruns.delete(run.id);
   }
@@ -13506,12 +14930,240 @@ async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
     if (!stored.some((candidate) => candidate.stepid === entry.stepid && candidate.startedat === entry.startedat)) await memory.addrunlogentry(run.id, entry);
   }
   await memory.setrunscopes(run.id, result.scopes);
+  const decisions = [];
+  for (const entry of result.log) {
+    const control = entry.details?.control;
+    if (control && typeof control === "object" && !Array.isArray(control)) {
+      const decision = control;
+      decisions.push(decision);
+      await memory.addcontroldecision(run.id, decision);
+    }
+  }
+  for (const decision of decisions) await auditcontroldecision(run.id, decision, session.id, plan.id);
+  const loopbounds = record2.steps.flatMap((controlstep) => {
+    const summary = controlsummary(controlstep);
+    return summary !== void 0 && summary.bound !== void 0 && (controlstep.kind === "loop" || controlstep.kind === "repeatuntil" || controlstep.kind === "whileloop") ? [summary.bound] : [];
+  });
+  if (loopbounds.length > 0) {
+    const iterations = decisions.filter((decision) => decision.kind === "loop").reduce((total, decision) => total + (decision.loops?.length ?? 0), 0);
+    const denominator = loopbounds.reduce((total, bound) => total + bound, 0);
+    await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "control", detail: `The control flow steps of the workflow ${record2.name} ran their loops toward the reviewed bounds`, runid: run.id, iterations, denominator }, Date.now()));
+  }
   const executed = result.run.cursor;
   await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "run", detail: `Ran the workflow ${record2.name}`, runid: run.id, executed, total: record2.steps.length }, Date.now()));
   await audit("workflow", `The run ${run.id} of the workflow ${record2.name} ended ${result.run.state} after ${executed} of ${record2.steps.length} steps${result.run.failreason !== void 0 ? ` with the failure ${result.run.failreason}` : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
   await refreshbadge();
   return { ok: result.run.state === "done", summary: `The workflow run ended ${result.run.state} after ${executed} of ${record2.steps.length} steps.`, details: { runid: run.id, state: result.run.state, executed, total: record2.steps.length, ...result.run.failreason !== void 0 ? { failreason: result.run.failreason } : {} } };
 }
+async function pagestateof(tabid2) {
+  const tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+  if (!tab) return {};
+  return { ...tab.url !== void 0 ? { url: tab.url } : {}, ...tab.title !== void 0 ? { title: tab.title } : {}, ...tab.status !== void 0 ? { ready: tab.status === "complete" } : {} };
+}
+async function resolveelements(tabid2, selector) {
+  const resolved = await bridgecall(tabid2, "queryelements", selector).catch(() => void 0);
+  if (!resolved?.ok) return [];
+  return resolved.selectors ?? [];
+}
+async function storetimeoutabort(run, step, message, budget) {
+  const at = Date.now();
+  const aborted = { ...run, state: "failed", endedat: at, failreason: message };
+  const entry = { stepid: step.id, label: `Run budget of ${step.id}`, state: "failed", startedat: at, duration: 0, summary: message, details: { errorclass: "timeout", budget, cancelled: true, control: { runid: run.id, stepid: step.id, kind: "timeout", at, timeouts: [{ stepid: step.id, budget, scope: "run", at }] } } };
+  const decision = entry.details?.control;
+  await memory.addcontroldecision(run.id, decision);
+  await memory.addrunlogentry(run.id, entry);
+  await audit("workflow", `The run ${run.id} exceeded its reviewed budget of ${budget} milliseconds and was cancelled with the cancelled error class.`, { planid: step.id });
+  return { run: aborted, log: [entry] };
+}
+async function executetriggerstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const family = triggerfamilyof(step.kind);
+  if (!family) throw new Error(`The ${step.kind} step is not a reviewed trigger kind.`);
+  const workflowid = typeof options.workflowid === "string" ? options.workflowid : "";
+  const record2 = await memory.getworkflowrecord(workflowid);
+  if (!record2) throw new Error(`No composed workflow matches ${workflowid || "the reviewed id"}; trigger rules bind to workflows already composed and reviewed.`);
+  const armed = armrule({ family, workflowid, ...typeof options.label === "string" && options.label.trim() ? { label: options.label } : {}, payload: options.rule, ...typeof options.cooldown === "number" ? { cooldown: options.cooldown } : {}, now: Date.now() });
+  if (!armed) throw new Error(`The ${step.kind} payload does not arm as a reviewed rule.`);
+  if (!ruleoriginsgranted(armed, record2.origins)) throw new Error("The trigger touches origins outside the workflow grant list; review the rule or the workflow origins.");
+  for (const matchorigin of armed.origins ?? []) {
+    if (!origingranted(session, matchorigin)) throw new Error(`The trigger origin ${matchorigin} falls outside the session grants.`);
+  }
+  if (armed.pattern !== void 0) {
+    let patternorigin2 = "";
+    try {
+      patternorigin2 = new URL(armed.pattern).origin;
+    } catch {
+      patternorigin2 = "";
+    }
+    if (patternorigin2 && !origingranted(session, patternorigin2)) throw new Error(`The trigger origin ${patternorigin2} falls outside the session grants.`);
+  }
+  for (const url of armed.urls ?? []) {
+    let listorigin = "";
+    try {
+      listorigin = new URL(url).origin;
+    } catch {
+      listorigin = "";
+    }
+    if (listorigin && !origingranted(session, listorigin)) throw new Error(`The trigger origin ${listorigin} falls outside the session grants.`);
+  }
+  const nextfireat = family === "cron" && armed.cron !== void 0 ? schedulecron({ cron: armed.cron, ...armed.timezone !== void 0 ? { timezone: armed.timezone } : {} }, Date.now()) : family === "interval" && armed.period !== void 0 ? scheduleinterval({ period: armed.period, ...armed.jitter !== void 0 ? { jitter: armed.jitter } : {} }, void 0, Date.now(), hashseed(armed.id)) : void 0;
+  const rule = { ...armed, ...nextfireat !== void 0 ? { state: { ...armed.state, nextfireat } } : {} };
+  await memory.addtriggerule(rule);
+  await registermenurule(rule);
+  await scheduletriggerwakes();
+  await memory.setprogress(recordtrigger(await memory.getprogress(), plan.id, step.id, { family: "arm", detail: `Armed the ${family} rule for the workflow ${record2.name}`, ruleid: rule.id, ...nextfireat !== void 0 ? { nextfireat } : {} }, Date.now()));
+  await audit("trigger", `Armed the ${family} rule ${rule.id} for the workflow ${record2.name} version ${record2.version} behind the explicit arm review; the rule starts ${rule.state.enabled ? "enabled" : "disabled"} with a cooldown of ${rule.state.cooldown} millisecond${rule.state.cooldown === 1 ? "" : "s"}${nextfireat !== void 0 ? ` and the next fire scheduled` : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+  void origin;
+  void tabid2;
+  return { ok: true, summary: `Armed the ${family} rule for the workflow ${record2.name}${nextfireat !== void 0 ? " with the next fire scheduled" : ""}.`, details: { trigger: { ruleid: rule.id, kind: family, enabled: rule.state.enabled, ...nextfireat !== void 0 ? { nextfireat } : {} } } };
+}
+async function runofworkflowactive(workflowid) {
+  if ([...activeworkflowruns.keys()].length === 0) return false;
+  for (const run of await memory.listworkflowruns()) {
+    if (run.workflowid === workflowid && run.state === "running") return true;
+  }
+  return false;
+}
+async function launchtriggerrun(fire, rule) {
+  const session = await memory.getsession();
+  const plan = await memory.getplan();
+  const now = Date.now();
+  if (!session || session.stoppedat || session.pausedat || session.expiresat <= now) return { launched: false, reason: "The trigger launch needs a live, unpaused browser session." };
+  if (!plan || plan.state !== "approved") return { launched: false, reason: "The trigger launch needs the approved plan review." };
+  const record2 = await memory.getworkflowrecord(rule.workflowid);
+  if (!record2) return { launched: false, reason: "The workflow of the trigger rule is no longer composed; evaluation skips the rule." };
+  for (const workfloworigin of record2.origins) {
+    if (!origingranted(session, workfloworigin)) return { launched: false, reason: `The workflow origin ${workfloworigin} falls outside the session grants.` };
+  }
+  const variables = { triggercause: fire.cause, triggerrule: rule.id };
+  if (fire.url !== void 0) variables.triggerurl = fire.url;
+  if (fire.title !== void 0) variables.triggertitle = fire.title;
+  if (fire.payload !== void 0) variables.triggerpayload = JSON.stringify(fire.payload);
+  const runstep2 = { id: `trigger${fire.id}`, kind: "runworkflow", summary: `The ${rule.kind} trigger run of ${record2.name}`, risk: "sensitive", options: JSON.stringify({ workflowid: rule.workflowid, reviewed: true, variables }) };
+  const output = await executeworkflowstep(runstep2, session, plan, session.tabid, session.origin).catch((error) => ({ ok: false, summary: error instanceof Error ? error.message : String(error), details: {} }));
+  const launched = Boolean(output.ok);
+  const runid = output.details?.runid;
+  await memory.settriggerule(updaterule(rule, { state: { lastfireat: fire.at, ...nextfireof(rule, fire.at) !== void 0 ? { nextfireat: nextfireof(rule, fire.at) } : {} }, stats: { launches: rule.stats.launches + (launched ? 1 : 0) } }));
+  await memory.addtriggerfire(fire);
+  await audit("trigger", `The ${rule.kind} rule ${rule.id} fired on ${fire.cause}${fire.url !== void 0 ? ` at ${fire.url}` : ""} and ${launched ? `launched the run ${runid ?? ""} of the workflow ${record2.name}` : `refused the launch: ${output.ok === false ? output.summary : "the run ended"}`}; the arm review, the live session, the approved plan and the origin gates all re-passed.`, { sessionid: session.id, planid: plan.id });
+  if (launched) await notifytriggerfired(fire, rule, runid);
+  await refreshbadge();
+  return { launched, ...runid !== void 0 ? { runid } : {}, ...launched ? {} : { reason: output.ok === false ? output.summary : "the run ended" } };
+}
+function nextfireof(rule, after) {
+  if (rule.kind === "cron" && rule.cron !== void 0) return schedulecron({ cron: rule.cron, ...rule.timezone !== void 0 ? { timezone: rule.timezone } : {} }, after);
+  if (rule.kind === "interval" && rule.period !== void 0) return scheduleinterval({ period: rule.period, ...rule.jitter !== void 0 ? { jitter: rule.jitter } : {} }, after, rule.createdat, hashseed(rule.id));
+  return void 0;
+}
+async function firetrigger(rule, cause, url, title, payload) {
+  const now = Date.now();
+  const record2 = await memory.getworkflowrecord(rule.workflowid);
+  const runactive = await runofworkflowactive(rule.workflowid);
+  const decision = evaluatetrigger({ rule, now, cause, ...url !== void 0 ? { url } : {}, ...title !== void 0 ? { title } : {}, ...payload !== void 0 ? { payload } : {}, runactive: false, workflowreviewed: record2 !== void 0 });
+  if (!decision.fired || decision.fire === void 0) {
+    await memory.settriggerule(updaterule(rule, { stats: { suppressions: rule.stats.suppressions + 1 } }));
+    await audit("trigger", `The ${rule.kind} rule ${rule.id} suppressed a ${cause} fire inside the ${decision.suppressed ?? "review"} gate${decision.remaining !== void 0 ? ` with ${decision.remaining} millisecond${decision.remaining === 1 ? "" : "s"} of cooldown left` : ""}.`, {});
+    return { fired: false, ...decision.suppressed !== void 0 ? { suppressed: decision.suppressed } : {} };
+  }
+  if (runactive) {
+    const queued = queuefire(await memory.gettriggerqueue(), decision.fire);
+    await memory.settriggerqueue(queued.queue);
+    await memory.settriggerule(updaterule(rule, { stats: { suppressions: rule.stats.suppressions + 1 } }));
+    await audit("trigger", `The ${rule.kind} rule ${rule.id} fired on ${cause} while its workflow run was busy${queued.deduped ? " and the queue kept the pending fire already waiting" : " and the fire queued for the run to settle"}.`, {});
+    await refreshbadge();
+    return { fired: true, queued: true };
+  }
+  await memory.settriggerule(updaterule(rule, { stats: { fires: rule.stats.fires + 1 } }));
+  const launch = await launchtriggerrun(decision.fire, rule);
+  return { fired: true, ...launch.launched ? {} : { suppressed: launch.reason } };
+}
+async function draintriggerqueue() {
+  const queue = await memory.gettriggerqueue();
+  if (queue.length === 0) return { launched: 0, remaining: 0 };
+  const result = await drainqueue(queue, async (fire) => {
+    const rule = await memory.gettriggerule(fire.ruleid);
+    if (!rule) return;
+    await memory.settriggerule(updaterule(rule, { stats: { fires: rule.stats.fires + 1 } }));
+    await launchtriggerrun(fire, rule);
+  });
+  await memory.settriggerqueue(result.remaining);
+  await audit("trigger", `The trigger queue drained ${result.launched} queued fire${result.launched === 1 ? "" : "s"} with ${result.remaining} still waiting.`, {});
+  await refreshbadge();
+  return { launched: result.launched, remaining: result.remaining.length };
+}
+async function evaluatenavigationtriggers(url, title) {
+  if (!url.startsWith("https://")) return;
+  const session = await memory.getsession();
+  if (!session || session.stoppedat) return;
+  for (const { rule } of await memory.listtriggers()) {
+    if (!rule.state.enabled || rule.state.pausedat !== void 0) continue;
+    if (rule.kind === "visit" && rule.origins !== void 0 && visitmatch(rule.origins, url)) await firetrigger(rule, "visit", url, title);
+    if (rule.kind === "url" && rule.pattern !== void 0 && matchurl(rule.pattern, url)) await firetrigger(rule, "url", url, title);
+  }
+  await evaluatepagetriggers("navigate", url, title);
+}
+async function evaluatepagetriggers(event, url, title) {
+  const session = await memory.getsession();
+  if (!session || session.stoppedat || session.pausedat) return;
+  for (const rule of observeevents(await memory.gettriggerules(), event)) {
+    await firetrigger(rule, "event", url, title, { event });
+  }
+}
+async function evaluatelistedtriggers() {
+  const rules = await memory.gettriggerules();
+  const due = listdue(rules, Date.now());
+  for (const entry of due) {
+    await firetrigger(entry.rule, "schedule");
+  }
+  await scheduletriggerwakes();
+  return { due: due.length };
+}
+async function registermenurule(rule) {
+  if (rule.kind !== "menu" || rule.title === void 0) return;
+  const menus = chrome.contextMenus;
+  if (typeof menus?.create !== "function") {
+    await audit("trigger", `The menu rule ${rule.id} stays armed without its context menu entry because the browser exposes no context menus api under the current permission set; the manual run path stays available in the panel.`, {});
+    return;
+  }
+  try {
+    menus.create({ id: `devthinktrigger${rule.id}`, title: rule.title, contexts: ["page", "selection", "link"] });
+  } catch {
+  }
+}
+async function registermenurules() {
+  for (const { rule } of await memory.listtriggers()) await registermenurule(rule);
+}
+async function scheduletriggerwakes() {
+  const alarms = chrome.alarms;
+  if (typeof alarms?.create !== "function") return;
+  try {
+    const rules = await memory.gettriggerules();
+    const scheduled = rules.filter((rule) => rule.state.enabled && rule.state.pausedat === void 0 && rule.state.nextfireat !== void 0);
+    if (scheduled.length === 0) return;
+    const next = Math.min(...scheduled.map((rule) => rule.state.nextfireat));
+    const oneminute = 6e4;
+    alarms.create("devthinktriggerwake", { when: Math.max(Date.now() + oneminute, next) });
+  } catch {
+  }
+}
+async function notifytriggerfired(fire, rule, runid) {
+  const notifications = chrome.notifications;
+  if (typeof notifications?.create === "function") {
+    try {
+      notifications.create(`devthinktrigger${fire.id}`, { type: "basic", iconUrl: "icon128.png", title: "Devthink trigger fired", message: `The ${rule.kind} rule fired on ${fire.cause}${runid !== void 0 ? ` and launched run ${runid}` : ""}.` });
+    } catch {
+    }
+  }
+  void runid;
+}
+async function auditcontroldecision(runid, decision, sessionid, planid) {
+  if (decision.kind === "branch" && decision.branch !== void 0) await audit("workflow", `The branch step ${decision.stepid} of the run ${runid} chose the path ${decision.branch.path}: ${decision.branch.reason}`, { sessionid, planid });
+  else if (decision.kind === "loop" && decision.loops !== void 0) await audit("workflow", `The loop step ${decision.stepid} of the run ${runid} recorded ${decision.loops.length} iteration counter${decision.loops.length === 1 ? "" : "s"} with the paths ${decision.loops.map((counter) => counter.path).join(", ")}.`, { sessionid, planid });
+  else if (decision.kind === "join" && decision.join !== void 0) await audit("workflow", `The join of the parallel step ${decision.stepid} of the run ${runid} merged ${decision.join.merged.length} variable${decision.join.merged.length === 1 ? "" : "s"} under the ${decision.join.strategy} strategy${decision.join.conflicts.length > 0 ? ` with the conflicts ${decision.join.conflicts.join(", ")}` : " with no conflict"}.`, { sessionid, planid });
+  else if (decision.kind === "catch" && decision.catch !== void 0) await audit("workflow", `The catch handler of the try step ${decision.stepid} of the run ${runid} ran after the ${decision.catch.errorclass} failure${decision.catch.rerun ? " and reran the fragile body" : ""}.`, { sessionid, planid });
+  else if (decision.kind === "retry" && decision.retries !== void 0) await audit("workflow", `The retry policy of the try step ${decision.stepid} of the run ${runid} ran ${decision.retries.length} retry attempt${decision.retries.length === 1 ? "" : "s"} with the backoff durations ${decision.retries.map((attempt) => `${attempt.delay} ms`).join(", ")}.`, { sessionid, planid });
+  else if (decision.kind === "timeout" && decision.timeouts !== void 0) await audit("workflow", `The timeout policy of the try step ${decision.stepid} of the run ${runid} aborted ${decision.timeouts.length} step${decision.timeouts.length === 1 ? "" : "s"} that exceeded their reviewed budgets.`, { sessionid, planid });
+}
 async function executestep(stepid) {
   const session = await memory.getsession();
   const plan = await memory.getplan();
@@ -13597,6 +15249,9 @@ async function executeaction(step, session, plan, tabid2, origin, settings, verd
     } else if (isworkflowkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Workflow kinds refuse to run outside an approved session plan.");
       output = await executeworkflowstep(step, session, plan, tabid2, origin);
+    } else if (istriggeraction(step.kind)) {
+      if (!session || !plan || plan.state !== "approved") throw new Error("Trigger kinds refuse to run outside an approved session plan.");
+      output = await executetriggerstep(step, session, plan, tabid2, origin);
     } else {
       if (step.target && freshcheckkinds.has(step.kind)) {
         const fresh = await snapshot(tabid2);
@@ -13697,7 +15352,9 @@ async function pausesession() {
   if (session.pausedat) throw new Error("The browser session is already paused.");
   const paused = { ...session, pausedat: Date.now() };
   await memory.setsession(paused);
+  await memory.settriggerules(pauseall(await memory.gettriggerules(), Date.now()));
   await audit("pause", "The user paused the browser session; no action or preview can run.", { sessionid: session.id });
+  await audit("trigger", "The session pause suspended every armed trigger rule; fires that arrive while paused queue for the resume drain.", { sessionid: session.id });
   return paused;
 }
 async function resumesession() {
@@ -13707,7 +15364,11 @@ async function resumesession() {
   if (!session.pausedat) throw new Error("The browser session is not paused.");
   const resumed = { id: session.id, tabid: session.tabid, origin: session.origin, startedat: session.startedat, expiresat: session.expiresat, ...session.grants ? { grants: session.grants } : {} };
   await memory.setsession(resumed);
+  await memory.settriggerules(resumeall(await memory.gettriggerules()));
   await audit("resume", "The user resumed the browser session; reviewed actions can run again.", { sessionid: session.id });
+  await audit("trigger", "The session resume released the suspended trigger rules and drained the queued fires through the same gates.", { sessionid: session.id });
+  void draintriggerqueue().catch(() => {
+  });
   return resumed;
 }
 async function grantcapability(permission) {
@@ -13845,7 +15506,7 @@ async function handlerequest(message, sender) {
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, trigger: triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() }), triggerretention: runsettings?.triggerretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id), control: await memory.listcontroldecisions(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -13892,7 +15553,8 @@ async function handlerequest(message, sender) {
       const network = outcome.details?.network;
       const timeline = outcome.details?.timeline;
       const sessionblock = outcome.details?.session;
-      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...capture ? { capture } : {}, ...media ? { media } : {}, ...network ? { network } : {}, ...timeline ? { timeline } : {}, ...sessionblock !== void 0 ? { session: { recordid: sessionblock.recordid ?? "", sections: sessionblock.sections ?? 0, ...sessionblock.matches !== void 0 ? { matches: sessionblock.matches } : {}, ...sessionblock.restored !== void 0 ? { restored: sessionblock.restored } : {}, ...sessionblock.skipped !== void 0 ? { skipped: sessionblock.skipped } : {}, ...sessionblock.cursor !== void 0 ? { cursor: sessionblock.cursor } : {}, ...sessionblock.bytes !== void 0 ? { bytes: sessionblock.bytes } : {} } } : {} }));
+      const triggerblock = outcome.details?.trigger;
+      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...triggerblock !== void 0 && triggerblock.ruleid !== void 0 ? { trigger: { ruleid: triggerblock.ruleid, kind: triggerblock.kind ?? "", enabled: triggerblock.enabled ?? true, ...triggerblock.nextfireat !== void 0 ? { nextfireat: triggerblock.nextfireat } : {} } } : {}, ...capture ? { capture } : {}, ...media ? { media } : {}, ...network ? { network } : {}, ...timeline ? { timeline } : {}, ...sessionblock !== void 0 ? { session: { recordid: sessionblock.recordid ?? "", sections: sessionblock.sections ?? 0, ...sessionblock.matches !== void 0 ? { matches: sessionblock.matches } : {}, ...sessionblock.restored !== void 0 ? { restored: sessionblock.restored } : {}, ...sessionblock.skipped !== void 0 ? { skipped: sessionblock.skipped } : {}, ...sessionblock.cursor !== void 0 ? { cursor: sessionblock.cursor } : {}, ...sessionblock.bytes !== void 0 ? { bytes: sessionblock.bytes } : {} } } : {} }));
     }
     case "map": {
       const plan = await memory.getplan();
@@ -15016,7 +16678,49 @@ async function handlerequest(message, sender) {
       const inputreview = message;
       const record2 = await memory.getworkflowrecord(inputreview.workflowid?.trim() ?? "");
       if (!record2) throw new Error(`No composed workflow matches ${inputreview.workflowid ?? ""}.`);
-      return { record: record2, steps: record2.steps.map((entry) => ({ id: entry.id, kind: entry.kind, label: entry.label, ...entry.target !== void 0 ? { target: entry.target } : {}, ...entry.value !== void 0 ? { value: entry.value } : {}, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.bindings !== void 0 ? { bindings: entry.bindings } : {}, ...entry.expression !== void 0 ? { expression: entry.expression } : {}, ...entry.extract !== void 0 ? { extract: entry.extract } : {} })), blocks: record2.blocks, risk: record2.risk, origins: record2.origins };
+      return { record: record2, steps: record2.steps.map((entry) => ({ id: entry.id, kind: entry.kind, label: entry.label, ...entry.target !== void 0 ? { target: entry.target } : {}, ...entry.value !== void 0 ? { value: entry.value } : {}, ...entry.block !== void 0 ? { block: entry.block } : {}, ...entry.bindings !== void 0 ? { bindings: entry.bindings } : {}, ...entry.expression !== void 0 ? { expression: entry.expression } : {}, ...entry.extract !== void 0 ? { extract: entry.extract } : {}, ...controlsummary(entry) !== void 0 ? { control: controlsummary(entry) } : {} })), blocks: record2.blocks, risk: record2.risk, origins: record2.origins };
+    }
+    case "setloopbound": {
+      const inputbound = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Editing a loop safety bound needs an active browser session behind the consent gates.");
+      const record2 = await memory.getworkflowrecord(inputbound.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputbound.workflowid ?? ""}.`);
+      if (typeof inputbound.bound !== "number" || !Number.isInteger(inputbound.bound) || inputbound.bound < 1) throw new Error("The loop safety bound must be a positive integer with no code ceiling.");
+      const target = record2.steps.find((entry) => entry.id === (inputbound.stepid ?? ""));
+      if (!target || target.kind !== "loop" && target.kind !== "repeatuntil") throw new Error(`No loop or repeat until step of the workflow matches ${inputbound.stepid ?? ""}.`);
+      let payload;
+      try {
+        payload = JSON.parse(target.options ?? "{}");
+      } catch {
+        payload = {};
+      }
+      const key = target.kind === "loop" ? "loop" : "repeatuntil";
+      const body = payload[key] && typeof payload[key] === "object" && !Array.isArray(payload[key]) ? payload[key] : {};
+      body.bound = inputbound.bound;
+      payload[key] = body;
+      const restep = { ...target, options: JSON.stringify(payload) };
+      const recomposed = composeworkflow({
+        id: record2.id,
+        name: record2.name,
+        version: record2.version + 1,
+        origins: [...record2.origins],
+        steps: record2.steps.map((entry) => entry.id === target.id ? restep : entry),
+        blocks: [...record2.blocks],
+        now: Date.now(),
+        kindallowed: (kind) => {
+          try {
+            actionrisk(kind);
+            return true;
+          } catch {
+            return false;
+          }
+        },
+        riskof: (kind) => actionrisk(kind)
+      });
+      await memory.addworkflowrecord(recomposed);
+      await audit("workflow", `The user edited the loop safety bound of the step ${target.id} of the workflow ${record2.name} to ${inputbound.bound} iterations; version ${recomposed.version} was recomposed and the older version survives for the audit trail.`, { sessionid: session.id });
+      return { workflowid: recomposed.id, stepid: target.id, bound: inputbound.bound, version: recomposed.version };
     }
     case "approveworkflowrun": {
       const inputapprove = message;
@@ -15039,8 +16743,24 @@ async function handlerequest(message, sender) {
       const step = record2.steps.find((entry) => entry.id === (inputsingle.stepid ?? ""));
       if (!step) throw new Error(`No step of the workflow matches ${inputsingle.stepid ?? ""}.`);
       const { tab, origin } = await activecontext();
-      const executed = await runstep({ step, scopes: await memory.getrunscopes(stored.run.id), outputs: {}, execute: async (dispatched) => dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin }), now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
+      const executestepsingle = async (dispatched, stepcontext) => {
+        if (iscontrolflowkind(dispatched.kind)) {
+          const controlled = await runcontrolstep({ step: dispatched, scopes: stepcontext.scopes, outputs: stepcontext.outputs ?? {}, execute: executestepsingle, now: Date.now(), runid: stored.run.id, pagestate: await pagestateof(tab.id), resolveelements: async (selector) => await resolveelements(tab.id, selector) });
+          return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
+        }
+        return await dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin });
+      };
+      const executed = await runstep({ step, scopes: await memory.getrunscopes(stored.run.id), outputs: {}, execute: executestepsingle, now: Date.now(), ...step.block !== void 0 ? { block: step.block } : {} });
       await memory.addrunlogentry(stored.run.id, executed.log);
+      if (executed.childlog !== void 0) for (const entry of executed.childlog) await memory.addrunlogentry(stored.run.id, entry);
+      for (const entry of [executed.log, ...executed.childlog ?? []]) {
+        const control = entry.details?.control;
+        if (control && typeof control === "object" && !Array.isArray(control)) {
+          const decision = control;
+          await memory.addcontroldecision(stored.run.id, decision);
+          await auditcontroldecision(stored.run.id, decision, session.id, plan.id);
+        }
+      }
       await memory.setrunscopes(stored.run.id, executed.scopes);
       const stepindex = record2.steps.findIndex((entry) => entry.id === step.id);
       const isthenext = stepindex === stored.run.cursor && executed.output.ok;
@@ -15073,15 +16793,32 @@ async function handlerequest(message, sender) {
       const scopes = await memory.getrunscopes(stored.run.id);
       const log = await memory.getrunlog(stored.run.id);
       const { tab, origin } = await activecontext();
-      const resumed = await runworkflow({ record: record2, run: stored.run, scopes, log, execute: async (dispatched) => dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin }), now: Date.now(), gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) }, oncheckpoint: async (state) => {
+      let storedentries = log.length;
+      const executeresume = async (dispatched, stepcontext) => {
+        if (iscontrolflowkind(dispatched.kind)) {
+          const controlled = await runcontrolstep({ step: dispatched, scopes: stepcontext.scopes, outputs: stepcontext.outputs ?? {}, execute: executeresume, now: Date.now(), runid: stored.run.id, pagestate: await pagestateof(tab.id), resolveelements: async (selector) => await resolveelements(tab.id, selector) });
+          return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
+        }
+        return await dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin });
+      };
+      const resumed = await runworkflow({ record: record2, run: stored.run, scopes, log, execute: executeresume, now: Date.now(), gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) }, oncheckpoint: async (state) => {
         await memory.setworkflowrun(state.run);
-        const last = state.log[state.log.length - 1];
-        if (last) await memory.addrunlogentry(state.run.id, last);
+        for (const entry of state.log.slice(storedentries)) await memory.addrunlogentry(state.run.id, entry);
+        storedentries = state.log.length;
         await memory.setrunscopes(state.run.id, state.scopes);
       } });
+      for (const entry of resumed.log.slice(storedentries)) await memory.addrunlogentry(stored.run.id, entry);
+      for (const entry of resumed.log.slice(log.length)) {
+        const control = entry.details?.control;
+        if (control && typeof control === "object" && !Array.isArray(control)) {
+          const decision = control;
+          await memory.addcontroldecision(stored.run.id, decision);
+          await auditcontroldecision(stored.run.id, decision, session.id, plan.id);
+        }
+      }
       await memory.setworkflowrun(resumed.run);
       await memory.setrunscopes(stored.run.id, resumed.scopes);
-      await audit("workflow", `Resumed the workflow run ${stored.run.id} from the checkpoint at step cursor ${stored.run.cursor}; the run ended ${resumed.run.state} at cursor ${resumed.run.cursor}.`, { sessionid: session.id, planid: plan.id });
+      await audit("workflow", `Resumed the workflow run ${stored.run.id} from the checkpoint at step cursor ${stored.run.cursor}; the run ended ${resumed.run.state} at cursor ${resumed.run.cursor} with ${resumed.log.length - log.length} new runlog entries.`, { sessionid: session.id, planid: plan.id });
       await refreshbadge();
       return { runid: resumed.run.id, state: resumed.run.state, cursor: resumed.run.cursor };
     }
@@ -15103,6 +16840,184 @@ async function handlerequest(message, sender) {
       if (!stored) throw new Error(`No workflow run matches ${inputoutcome.runid ?? ""}.`);
       return workflowoutcome({ run: stored.run, entries: stored.log, ...inputoutcome.stepid !== void 0 && inputoutcome.stepid !== "" ? { stepid: inputoutcome.stepid } : {} });
     }
+    case "triggerreview": {
+      const triggers = await memory.listtriggers();
+      const runs = await memory.listworkflowruns();
+      const queue = await memory.gettriggerqueue();
+      const rules = await Promise.all(triggers.map(async (entry) => {
+        const record2 = await memory.getworkflowrecord(entry.rule.workflowid);
+        return {
+          id: entry.rule.id,
+          kind: entry.rule.kind,
+          workflowid: entry.rule.workflowid,
+          ...entry.workflowname !== void 0 ? { workflowname: entry.workflowname } : {},
+          label: entry.rule.label,
+          enabled: entry.rule.state.enabled,
+          paused: entry.rule.state.pausedat !== void 0,
+          cooldown: entry.rule.state.cooldown,
+          ...entry.rule.state.lastfireat !== void 0 ? { lastfireat: entry.rule.state.lastfireat } : {},
+          ...entry.rule.state.nextfireat !== void 0 ? { nextfireat: entry.rule.state.nextfireat } : {},
+          fires: entry.rule.stats.fires,
+          launches: entry.rule.stats.launches,
+          suppressions: entry.rule.stats.suppressions,
+          summary: triggersummary(entry.rule),
+          steps: record2 ? record2.steps.map((inner) => ({ id: inner.id, kind: inner.kind, label: inner.label })) : [],
+          ...entry.rule.kind === "webhook" ? { deliveries: (await memory.listwebhookpayloads(entry.rule.id)).length } : {}
+        };
+      }));
+      const active = runs.filter((run) => run.state === "running").length;
+      return { rules, queued: queue.length, active, fires: (await memory.listtriggerfires()).slice(0, 50) };
+    }
+    case "toggletrigger": {
+      const inputtoggle = message;
+      const rule = await memory.gettriggerule(inputtoggle.ruleid ?? "");
+      if (!rule) throw new Error(`No armed trigger rule matches ${inputtoggle.ruleid ?? ""}.`);
+      if (typeof inputtoggle.enabled !== "boolean") throw new Error("The trigger toggle needs the reviewed enabled flag.");
+      const updated = updaterule(rule, { state: { enabled: inputtoggle.enabled } });
+      await memory.settriggerule(updated);
+      await audit("trigger", `The user ${inputtoggle.enabled ? "enabled" : "disabled"} the ${rule.kind} rule ${rule.id} of the workflow ${rule.workflowid}; disabled rules never fire until reenabled.`, {});
+      await scheduletriggerwakes();
+      return { ruleid: rule.id, enabled: updated.state.enabled };
+    }
+    case "createtrigger": {
+      const inputcreate = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Arming a trigger rule needs an active browser session behind the consent gates.");
+      if (!plan || plan.state !== "approved") throw new Error("Arming a trigger rule needs the approved plan review.");
+      const family = triggerfamilyof(`${inputcreate.family ?? ""}rule`);
+      if (!family) throw new Error("The trigger family is not a reviewed family.");
+      const step = { id: `panel${Date.now()}`, kind: `${family}rule`, summary: `The reviewed ${family} rule of the panel`, risk: "sensitive", options: JSON.stringify({ workflowid: inputcreate.workflowid ?? "", reviewed: true, ...typeof inputcreate.label === "string" ? { label: inputcreate.label } : {}, ...inputcreate.cooldown !== void 0 ? { cooldown: inputcreate.cooldown } : {}, rule: inputcreate.payload ?? {} }) };
+      const verdict = canexecute({ session, plan, step, tabid: session.tabid, origin: session.origin, now: Date.now() });
+      if (!verdict.allowed) throw new Error(verdict.reason ?? "The trigger rule was refused by the consent gates.");
+      return await executetriggerstep(step, session, plan, session.tabid, session.origin);
+    }
+    case "createvisitrule": {
+      const inputvisit = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Creating a visit rule needs an active browser session behind the consent gates.");
+      const tab = await chrome.tabs.get(session.tabid).catch(() => void 0);
+      const url = tab?.url ?? "";
+      let origin = "";
+      try {
+        origin = new URL(url).origin;
+      } catch {
+        origin = "";
+      }
+      if (!origin.startsWith("https://")) throw new Error("The current page carries no HTTPS origin to bind a visit rule to.");
+      return await handlerequest({ kind: "createtrigger", workflowid: inputvisit.workflowid ?? "", family: "visit", payload: { origins: [origin] }, label: `Visit ${origin}` }, {});
+    }
+    case "duplicatetrigger": {
+      const inputduplicate = message;
+      const rule = await memory.gettriggerule(inputduplicate.ruleid ?? "");
+      if (!rule) throw new Error(`No armed trigger rule matches ${inputduplicate.ruleid ?? ""}.`);
+      const record2 = await memory.getworkflowrecord(inputduplicate.workflowid ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputduplicate.workflowid ?? ""}.`);
+      const { state: rulestate, stats: rulestats, createdat: rulecreatedat, id: ruleid, workflowid: ruleworkflowid, label: rulelabel, cooldown: rulecooldown, ...familypayload } = rule;
+      void rulestate;
+      void rulestats;
+      void rulecreatedat;
+      void ruleid;
+      void ruleworkflowid;
+      void rulelabel;
+      const armed = armrule({ family: rule.kind, workflowid: record2.id, label: `${rule.label} for ${record2.name}`, payload: familypayload, ...rulecooldown !== void 0 ? { cooldown: rulecooldown } : {}, now: Date.now() });
+      if (!armed) throw new Error("The duplicated rule payload failed its family grammar.");
+      const nextfireat = rule.kind === "cron" && rule.cron !== void 0 ? schedulecron({ cron: rule.cron, ...rule.timezone !== void 0 ? { timezone: rule.timezone } : {} }, Date.now()) : rule.kind === "interval" && rule.period !== void 0 ? scheduleinterval({ period: rule.period, ...rule.jitter !== void 0 ? { jitter: rule.jitter } : {} }, void 0, Date.now(), hashseed(armed.id)) : void 0;
+      const duplicate = { ...armed, ...nextfireat !== void 0 ? { state: { ...armed.state, nextfireat } } : {} };
+      if (!ruleoriginsgranted(duplicate, record2.origins)) throw new Error("The duplicated rule touches origins outside the workflow grant list of its new workflow.");
+      await memory.addtriggerule(duplicate);
+      await registermenurule(duplicate);
+      await scheduletriggerwakes();
+      await audit("trigger", `The user duplicated the ${rule.kind} rule ${rule.id} to the workflow ${record2.name} as the rule ${duplicate.id}; the duplicated rule arms enabled with zeroed counters.`, {});
+      return { ruleid: duplicate.id, workflowid: duplicate.workflowid };
+    }
+    case "manualrun": {
+      const inputmanual = message;
+      const record2 = await memory.getworkflowrecord(inputmanual.workflowid ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputmanual.workflowid ?? ""}.`);
+      const preview = manualpreview(record2, Date.now());
+      await memory.addmanualrun(preview);
+      await audit("trigger", `The user opened the manual run preview of the workflow ${record2.name} with its ${preview.preview.length} expanded step${preview.preview.length === 1 ? "" : "s"}; nothing runs before the confirmation.`, {});
+      return { manualrun: preview, workflowname: record2.name };
+    }
+    case "confirmmanualrun": {
+      const inputconfirm = message;
+      const stored = (await memory.listmanualruns()).find((entry) => entry.id === (inputconfirm.previewid ?? ""));
+      if (!stored) throw new Error(`No manual run preview matches ${inputconfirm.previewid ?? ""}.`);
+      if (typeof inputconfirm.confirmed !== "boolean") throw new Error("The manual run confirmation needs the reviewed confirmed flag.");
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || session.stoppedat || session.pausedat || session.expiresat <= Date.now()) throw new Error("Confirming a manual run needs a live, unpaused browser session behind the consent gates.");
+      if (!plan || plan.state !== "approved") throw new Error("Confirming a manual run needs the approved plan review.");
+      const record2 = await memory.getworkflowrecord(stored.workflowid);
+      if (!record2) throw new Error("The workflow of the manual run preview is no longer composed in the library.");
+      const decided = confirmmanualrun(stored, inputconfirm.confirmed, Date.now());
+      await memory.addmanualrun(decided);
+      if (!inputconfirm.confirmed) {
+        await audit("trigger", `The user cancelled the manual run of the workflow ${record2.name} after its step preview; nothing ran.`, { sessionid: session.id, planid: plan.id });
+        return { confirmed: false };
+      }
+      const runstep2 = { id: `manual${decided.id}`, kind: "runworkflow", summary: `The manual run of ${record2.name}`, risk: "sensitive", options: JSON.stringify({ workflowid: record2.id, reviewed: true }) };
+      const output = await executeworkflowstep(runstep2, session, plan, session.tabid, session.origin).catch((error) => ({ ok: false, summary: error instanceof Error ? error.message : String(error), details: {} }));
+      await audit("trigger", `The user approved the manual run of the workflow ${record2.name} after its ${decided.preview.length} step preview; the run ended ${output.ok ? "done" : "failed"}.`, { sessionid: session.id, planid: plan.id });
+      return { confirmed: true, runid: output.details?.runid, state: output.ok ? "done" : "failed" };
+    }
+    case "firetrigger": {
+      const inputfire = message;
+      const rule = await memory.gettriggerule(inputfire.ruleid ?? "");
+      if (!rule) throw new Error(`No armed trigger rule matches ${inputfire.ruleid ?? ""}.`);
+      const result = await firetrigger(rule, "manual");
+      return { fired: result.fired, ...result.queued !== void 0 ? { queued: result.queued } : {}, ...result.suppressed !== void 0 ? { suppressed: result.suppressed } : {} };
+    }
+    case "receivewebhook": {
+      const inputwebhook = message;
+      const rule = await memory.gettriggerule(inputwebhook.ruleid ?? "");
+      if (!rule || rule.kind !== "webhook") throw new Error(`No webhook rule matches ${inputwebhook.ruleid ?? ""}.`);
+      const verification = verifywebhook({ rule, secret: inputwebhook.secret ?? "", payload: inputwebhook.payload });
+      if (!verification.verified) {
+        await memory.settriggerule(updaterule(rule, { stats: { suppressions: rule.stats.suppressions + 1 } }));
+        await audit("trigger", `A webhook delivery for the rule ${rule.id} was refused: ${verification.reason}; only secret verified payloads ever persist.`, {});
+        return { verified: false, reason: verification.reason };
+      }
+      await memory.addwebhookpayload(rule.id, inputwebhook.payload, Date.now());
+      const result = await firetrigger(rule, "webhook", void 0, void 0, inputwebhook.payload);
+      return { verified: true, fired: result.fired, ...result.queued !== void 0 ? { queued: result.queued } : {}, ...result.suppressed !== void 0 ? { suppressed: result.suppressed } : {} };
+    }
+    case "rotatetriggersecret": {
+      const inputrotate = message;
+      const rule = await memory.gettriggerule(inputrotate.ruleid ?? "");
+      if (!rule || rule.kind !== "webhook") throw new Error(`No webhook rule matches ${inputrotate.ruleid ?? ""}.`);
+      const bytes = crypto.getRandomValues(new Uint8Array(24));
+      const secret = [...bytes].map((byte) => (byte % 36).toString(36)).join("").padEnd(24, "7x9k2m").slice(0, 24);
+      const rotated = { ...rule, secret, state: { ...rule.state }, stats: { ...rule.stats } };
+      await memory.settriggerule(rotated);
+      await audit("trigger", `The user rotated the shared secret of the webhook rule ${rule.id}; the previous secret stops verifying immediately and the new secret was shown once.`, {});
+      return { ruleid: rule.id, secret };
+    }
+    case "settriggerretention": {
+      const inputretention = message;
+      const settings = await memory.getsettings();
+      const retention = typeof inputretention.retention === "number" && Number.isInteger(inputretention.retention) && inputretention.retention >= 0 ? inputretention.retention : void 0;
+      await memory.setsettings({ ...settings, ...retention !== void 0 ? { triggerretention: retention } : {} });
+      await audit("configure", `The user set the trigger fire retention to ${retention === void 0 ? "keep every fire record" : `${retention} fire record${retention === 1 ? "" : "s"}`}; the rule counters always survive and no code ceiling applies.`);
+      return { triggerretention: retention };
+    }
+    case "triggerhistory": {
+      const inputhistory = message;
+      const fires = await memory.listtriggerfires(inputhistory.ruleid);
+      return { fires };
+    }
+    case "buttontrigger": {
+      const rules = (await memory.gettriggerules()).filter((rule) => rule.kind === "button" && rule.state.enabled && rule.state.pausedat === void 0);
+      if (rules.length === 0) return { fired: false, reason: "No enabled button rule is armed." };
+      const results = [];
+      for (const rule of rules) results.push({ ruleid: rule.id, ...await firetrigger(rule, "button") });
+      return { fired: results.some((entry) => entry.fired), rules: results };
+    }
+    case "triggerfiredreport": {
+      const fires = await memory.listtriggerfires();
+      return triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() });
+    }
     default:
       throw new Error("Unknown Devthink request.");
   }
@@ -15202,4 +17117,78 @@ chrome.runtime.onConnect.addListener((port) => {
     handlerequest(message, port.sender ?? {}).then((value) => port.postMessage({ ok: true, value })).catch((error) => port.postMessage({ ok: false, error: error instanceof Error ? error.message : String(error) }));
   });
 });
+{
+  const webnavigation = chrome.webNavigation;
+  try {
+    webnavigation?.onCommitted?.addListener((details) => {
+      if (details.frameId !== 0 || !details.url.startsWith("https://")) return;
+      void evaluatenavigationtriggers(details.url).catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+{
+  const menus = chrome.contextMenus;
+  try {
+    menus?.onClicked?.addListener((info) => {
+      const menuid = typeof info.menuItemId === "string" ? info.menuItemId : "";
+      if (!menuid.startsWith("devthinktrigger")) return;
+      void (async () => {
+        const rule = await memory.gettriggerule(menuid.slice("devthinktrigger".length));
+        if (!rule) return;
+        await firetrigger(rule, "menu");
+      })().catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+{
+  const commands = chrome.commands;
+  try {
+    commands?.onCommand?.addListener((command) => {
+      void (async () => {
+        for (const { rule } of await memory.listtriggers()) {
+          if (rule.kind !== "key" || rule.command !== command) continue;
+          await firetrigger(rule, "key");
+        }
+      })().catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+{
+  const action = chrome.action;
+  try {
+    action?.onClicked?.addListener(() => {
+      void handlerequest({ kind: "buttontrigger" }, {}).catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+{
+  const alarms = chrome.alarms;
+  try {
+    alarms?.onAlarm?.addListener((alarm) => {
+      if (alarm.name !== "devthinktriggerwake") return;
+      void evaluatelistedtriggers().then(() => draintriggerqueue()).catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+setInterval(() => {
+  void evaluatelistedtriggers().then(() => draintriggerqueue()).catch(() => {
+  });
+}, 3e4);
+async function restoretriggers() {
+  await registermenurules();
+  await evaluatelistedtriggers();
+  await draintriggerqueue();
+}
+restoretriggers().catch(() => {
+});
 //# sourceMappingURL=background.js.map