@wenathlan/extension 1.1.51 → 1.1.52

package/extension/dist/background.js

@@ -2211,6 +2211,77 @@ var sessionmemory = class {
     }
     return history2;
   }
+  /** Stores one armed trigger rule with its workflow reference; re-arming the same id replaces the rule while the fire history survives. */
+  async addtriggerule(rule) {
+    const rules = (await this.gettriggerules()).filter((entry) => entry.id !== rule.id);
+    await this.adapter.set("triggerules", [rule, ...rules]);
+  }
+  /** Returns every armed trigger rule, newest first. */
+  async gettriggerules() {
+    return await this.adapter.get("triggerules") ?? [];
+  }
+  /** Returns one armed trigger rule by its id. */
+  async gettriggerule(id) {
+    return (await this.gettriggerules()).find((rule) => rule.id === id);
+  }
+  /** Replaces one stored rule after an enable, disable, pause, resume, cooldown or fire bookkeeping change. */
+  async settriggerule(rule) {
+    const rules = await this.gettriggerules();
+    await this.adapter.set("triggerules", rules.map((entry) => entry.id === rule.id ? rule : entry));
+  }
+  /** Replaces every stored rule at once so the session pause and resume suspend and release the whole rule set atomically. */
+  async settriggerules(rules) {
+    return this.adapter.set("triggerules", rules);
+  }
+  /** Removes one armed rule when the user disarms it; the fire history survives for the audit trail. */
+  async removetriggerule(id) {
+    await this.adapter.set("triggerules", (await this.gettriggerules()).filter((rule) => rule.id !== id));
+  }
+  /** Lists every armed rule joined with the name of its composed workflow so the trigger list shows what each rule launches. */
+  async listtriggers() {
+    const rules = await this.gettriggerules();
+    const names = new Map((await this.listworkflows()).map((record2) => [record2.id, record2.name]));
+    return rules.map((rule) => ({ rule, ...names.has(rule.workflowid) ? { workflowname: names.get(rule.workflowid) } : {} }));
+  }
+  /** Records one trigger fire with the reviewed retention window; an absent window keeps every fire record while the rule counters always survive. */
+  async addtriggerfire(fire) {
+    const fires = await this.listtriggerfires();
+    const combined = [fire, ...fires];
+    const retention = (await this.getsettings())?.triggerretention;
+    await this.adapter.set("triggerfires", retention === void 0 ? combined : combined.slice(0, retention));
+  }
+  /** Returns every stored trigger fire record, newest first, optionally filtered to one rule. */
+  async listtriggerfires(ruleid) {
+    const fires = await this.adapter.get("triggerfires") ?? [];
+    return ruleid === void 0 ? fires : fires.filter((fire) => fire.ruleid === ruleid);
+  }
+  /** Stores the pending trigger queue: fires that arrived while the target run was busy or the session paused; the resume drains them through the same gates. */
+  async settriggerqueue(queue) {
+    return this.adapter.set("triggerqueue", queue);
+  }
+  /** Returns the pending trigger queue, oldest first. */
+  async gettriggerqueue() {
+    return await this.adapter.get("triggerqueue") ?? [];
+  }
+  /** Stores one verified webhook payload of a rule; the executor verifies the shared secret and the schema before anything persists. */
+  async addwebhookpayload(ruleid, payload, at) {
+    const stored = await this.adapter.get("webhookpayloads") ?? [];
+    await this.adapter.set("webhookpayloads", [{ ruleid, payload, at }, ...stored]);
+  }
+  /** Returns the stored webhook payloads of one rule, newest first; only secret verified deliveries ever reach this store. */
+  async listwebhookpayloads(ruleid) {
+    const stored = await this.adapter.get("webhookpayloads") ?? [];
+    return stored.filter((entry) => entry.ruleid === ruleid);
+  }
+  /** Stores one manual run preview with its step list so the panel renders it before confirmation. */
+  async addmanualrun(preview) {
+    const runs = (await this.listmanualruns()).filter((entry) => entry.id !== preview.id);
+    await this.adapter.set("manualruns", [preview, ...runs]);
+  }
+  /** Returns every stored manual run preview with its confirmation outcome, newest first. */
+  async listmanualruns() {
+    return await this.adapter.get("manualruns") ?? [];
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -4385,6 +4456,394 @@ function dryrunworkflow(input) {
   return { run: { ...run, state: "done", cursor: input.record.steps.length, endedat: input.now }, scopes, log };
 }
 
+// trigger.ts
+var triggerkinds = ["visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"];
+var triggerfamilies = ["visit", "url", "menu", "key", "button", "cron", "interval", "urllist", "webhook", "event"];
+var triggereventcatalog = ["mutate", "focus", "banner", "console", "error", "navigate"];
+var defaulttriggercooldown = 1e4;
+function triggerfamilyof(kind) {
+  const index = triggerkinds.indexOf(kind);
+  return index >= 0 ? triggerfamilies[index] : void 0;
+}
+function triggerlabel(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function positivewindow(value) {
+  if (value === void 0) return void 0;
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
+}
+function jitterwindow(value) {
+  if (value === void 0) return void 0;
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+function httpsorigin(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  try {
+    const parsed = new URL(value.trim());
+    if (parsed.protocol !== "https:") return void 0;
+    return parsed.origin;
+  } catch {
+    return void 0;
+  }
+}
+function webhookfieldof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.name !== "string" || !/^[a-z][a-z0-9]*$/i.test(candidate.name)) return void 0;
+  if (candidate.kind !== "string" && candidate.kind !== "number" && candidate.kind !== "boolean") return void 0;
+  if (candidate.required !== void 0 && typeof candidate.required !== "boolean") return void 0;
+  return { name: candidate.name, kind: candidate.kind, ...candidate.required === true ? { required: true } : {} };
+}
+function triggerpayloadof(family, value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (family === "visit") {
+    if (!Array.isArray(candidate.origins) || candidate.origins.length === 0) return void 0;
+    const origins = candidate.origins.map((origin) => httpsorigin(origin));
+    if (origins.some((origin) => origin === void 0)) return void 0;
+    return { origins: [...new Set(origins)] };
+  }
+  if (family === "url") {
+    if (typeof candidate.pattern !== "string" || !candidate.pattern.trim()) return void 0;
+    if (httpsorigin(candidate.pattern) === void 0) return void 0;
+    return { pattern: candidate.pattern.trim() };
+  }
+  if (family === "menu") {
+    const title = triggerlabel(candidate.title);
+    if (!title) return void 0;
+    return { title };
+  }
+  if (family === "key") {
+    if (typeof candidate.command !== "string" || !/^[a-z][a-z0-9-]*$/.test(candidate.command)) return void 0;
+    if (candidate.key !== void 0 && (typeof candidate.key !== "string" || !candidate.key.trim())) return void 0;
+    return { command: candidate.command, ...candidate.key !== void 0 ? { key: candidate.key } : {} };
+  }
+  if (family === "button") return {};
+  if (family === "cron") {
+    if (typeof candidate.cron !== "string" || !candidate.cron.trim()) return void 0;
+    if (cronparse(candidate.cron) === void 0) return void 0;
+    if (candidate.timezone !== void 0 && (typeof candidate.timezone !== "string" || !timezonevalid(candidate.timezone))) return void 0;
+    return { cron: candidate.cron.trim(), ...candidate.timezone !== void 0 ? { timezone: candidate.timezone } : {} };
+  }
+  if (family === "interval") {
+    const period = positivewindow(candidate.period);
+    if (period === void 0) return void 0;
+    const jitter = jitterwindow(candidate.jitter);
+    if (candidate.jitter !== void 0 && jitter === void 0) return void 0;
+    return { period, ...jitter !== void 0 ? { jitter } : {} };
+  }
+  if (family === "urllist") {
+    if (!Array.isArray(candidate.urls) || candidate.urls.length === 0) return void 0;
+    const urls = candidate.urls.map((url) => httpsorigin(url) === void 0 ? void 0 : url.trim());
+    if (urls.some((url) => url === void 0)) return void 0;
+    return { urls };
+  }
+  if (family === "webhook") {
+    if (typeof candidate.secret !== "string" || !webhooksecretok(candidate.secret)) return void 0;
+    if (!Array.isArray(candidate.schema) || candidate.schema.length === 0) return void 0;
+    const schema = candidate.schema.map((field) => webhookfieldof(field));
+    if (schema.some((field) => field === void 0)) return void 0;
+    const names = schema.map((field) => field.name);
+    if (new Set(names).size !== names.length) return void 0;
+    return { secret: candidate.secret, schema };
+  }
+  const events = candidate.events;
+  if (!Array.isArray(events) || events.length === 0) return void 0;
+  if (!events.every((name) => typeof name === "string" && triggereventcatalog.includes(name))) return void 0;
+  return { events: [...new Set(events)] };
+}
+function webhooksecretok(secret) {
+  if (secret.length < 24) return false;
+  if (/^(.)\1+$/.test(secret)) return false;
+  return /[a-z]/i.test(secret) && /\d/.test(secret);
+}
+function timezonevalid(timezone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: timezone });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function armrule(input) {
+  if (typeof input.workflowid !== "string" || !input.workflowid.trim()) return void 0;
+  const payload = triggerpayloadof(input.family, input.payload);
+  if (!payload) return void 0;
+  if (input.cooldown !== void 0 && (typeof input.cooldown !== "number" || !Number.isFinite(input.cooldown) || input.cooldown <= 0)) return void 0;
+  const cooldown = input.cooldown ?? (input.family === "webhook" || input.family === "event" ? defaulttriggercooldown : 0);
+  const label = input.label ?? `The ${input.family} rule of ${input.workflowid}`;
+  return { id: input.id ?? crypto.randomUUID(), kind: input.family, workflowid: input.workflowid, label, ...payload, cooldown, state: { enabled: true, cooldown }, stats: { fires: 0, launches: 0, suppressions: 0 }, createdat: input.now };
+}
+function updaterule(rule, patch) {
+  return { ...rule, ...patch.state !== void 0 ? { state: { ...rule.state, ...patch.state } } : {}, ...patch.stats !== void 0 ? { stats: { ...rule.stats, ...patch.stats } } : {} };
+}
+function matchurl(pattern, url) {
+  let parsedpattern;
+  let parsedurl;
+  try {
+    parsedpattern = new URL(pattern);
+    parsedurl = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsedpattern.protocol !== parsedurl.protocol) return false;
+  if (parsedpattern.hostname !== parsedurl.hostname) return false;
+  if (parsedpattern.port !== "" && parsedpattern.port !== parsedurl.port) return false;
+  return globmatch(`${parsedpattern.pathname}${parsedpattern.search}`, `${parsedurl.pathname}${parsedurl.search}`);
+}
+function globmatch(pattern, text2) {
+  const escaped = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const expression = new RegExp(["^", pattern.split("**").map((segment) => segment.split("*").map(escaped).join("[^/]*")).join(".*"), "$"].join(""));
+  return expression.test(text2);
+}
+function visitmatch(origins, url) {
+  let origin = "";
+  try {
+    origin = new URL(url).origin;
+  } catch {
+    return false;
+  }
+  return origins.includes(origin);
+}
+function cronparse(expression) {
+  const fields = expression.trim().split(/\s+/);
+  if (fields.length !== 5) return void 0;
+  const minutes = cronfield(fields[0] ?? "", 0, 59);
+  const hours = cronfield(fields[1] ?? "", 0, 23);
+  const daysofmonth = cronfield(fields[2] ?? "", 1, 31);
+  const months = cronfield(fields[3] ?? "", 1, 12, monthnames);
+  const daysofweek = cronfield(fields[4] ?? "", 0, 7, weekdaynames, true);
+  if (!minutes || !hours || !daysofmonth || !months || !daysofweek) return void 0;
+  return { minutes, hours, daysofmonth, months, daysofweek: [...new Set(daysofweek.map((day) => day % 7))].sort((left, right) => left - right) };
+}
+var weekdaynames = { sun: 0, mon: 1, tue: 2, wed: 3, thu: 4, fri: 5, sat: 6 };
+var monthnames = { jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6, jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12 };
+function cronfield(field, min, max, names, sundayseven = false) {
+  const values = /* @__PURE__ */ new Set();
+  for (const part of field.split(",")) {
+    if (!part) return void 0;
+    const [range, stepstring] = part.split("/");
+    const step = stepstring === void 0 ? 1 : Number(stepstring);
+    if (!Number.isInteger(step) || step < 1) return void 0;
+    let low = min;
+    let high = max;
+    if (range !== void 0 && range !== "*") {
+      const bounds = range.split("-");
+      if (bounds.length > 2) return void 0;
+      const lowvalue = cronvalue(bounds[0] ?? "", min, max, names);
+      if (lowvalue === void 0) return void 0;
+      low = lowvalue;
+      high = lowvalue;
+      if (bounds.length === 2) {
+        const highvalue = cronvalue(bounds[1] ?? "", min, max, names);
+        if (highvalue === void 0 || highvalue < lowvalue) return void 0;
+        high = highvalue;
+      }
+    }
+    for (let value = low; value <= high; value += step) values.add(value);
+  }
+  const list = [...values];
+  if (list.some((value) => value < min || value > max)) return void 0;
+  if (sundayseven && values.has(7)) {
+    values.delete(7);
+    values.add(0);
+  }
+  return [...values].sort((left, right) => left - right);
+}
+function cronvalue(value, min, max, names) {
+  const candidate = names?.[value.toLowerCase()];
+  if (candidate !== void 0) return candidate;
+  if (!/^\d+$/.test(value)) return void 0;
+  const parsed = Number(value);
+  if (parsed < min || parsed > max) return void 0;
+  return parsed;
+}
+function calendarparts(at, timezone) {
+  if (timezone === void 0) {
+    const date = new Date(at);
+    return { minute: date.getUTCMinutes(), hour: date.getUTCHours(), day: date.getUTCDate(), month: date.getUTCMonth() + 1, weekday: date.getUTCDay() };
+  }
+  const parts = new Intl.DateTimeFormat("en-US", { timeZone: timezone, hourCycle: "h23", minute: "numeric", hour: "numeric", day: "numeric", month: "short", weekday: "short" }).formatToParts(new Date(at));
+  const pick = (type) => parts.find((part) => part.type === type)?.value ?? "";
+  const weekday = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"].indexOf(pick("weekday"));
+  const month = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"].indexOf(pick("month")) + 1;
+  return { minute: Number(pick("minute")), hour: Number(pick("hour")), day: Number(pick("day")), month, weekday };
+}
+function crondaymatch(schedule, parts) {
+  if (!schedule.months.includes(parts.month)) return false;
+  const domfull = schedule.daysofmonth.length === 31;
+  const dowfull = schedule.daysofweek.length === 7;
+  const dommatch = schedule.daysofmonth.includes(parts.day);
+  const dowmatch = schedule.daysofweek.includes(parts.weekday);
+  if (!domfull && !dowfull) return dommatch || dowmatch;
+  if (!domfull) return dommatch;
+  if (!dowfull) return dowmatch;
+  return true;
+}
+function cronnext(expression, from, timezone) {
+  const schedule = cronparse(expression);
+  if (!schedule) return void 0;
+  const minute = 6e4;
+  const hour = 60 * minute;
+  const day = 24 * hour;
+  let candidate = Math.floor(from / minute) * minute + minute;
+  const horizon = from + 4 * 366 * day;
+  while (candidate <= horizon) {
+    const parts = calendarparts(candidate, timezone);
+    if (!crondaymatch(schedule, parts)) {
+      candidate += day - parts.hour * hour - parts.minute * minute;
+      continue;
+    }
+    if (!schedule.hours.includes(parts.hour)) {
+      const later = schedule.hours.find((value) => value > parts.hour);
+      candidate += later === void 0 ? day - parts.hour * hour - parts.minute * minute : (later - parts.hour) * hour - parts.minute * minute;
+      continue;
+    }
+    if (!schedule.minutes.includes(parts.minute)) {
+      const later = schedule.minutes.find((value) => value > parts.minute);
+      candidate += later === void 0 ? (60 - parts.minute) * minute : (later - parts.minute) * minute;
+      continue;
+    }
+    return candidate;
+  }
+  return void 0;
+}
+function schedulecron(rule, from) {
+  return cronnext(rule.cron, from, rule.timezone);
+}
+function scheduleinterval(rule, lastfire, armedat, seed) {
+  const base = (lastfire ?? armedat) + rule.period;
+  const jitter = rule.jitter ?? 0;
+  if (jitter <= 0) return base;
+  return Math.max(0, Math.round(base - jitter / 2 + seededrandom(seed) * jitter));
+}
+function listdue(rules, now) {
+  return rules.flatMap((rule) => {
+    if (rule.state.nextfireat === void 0 || rule.state.nextfireat > now) return [];
+    if (!rule.state.enabled || rule.state.pausedat !== void 0) return [];
+    return [{ rule, overdueby: now - rule.state.nextfireat }];
+  });
+}
+function applycooldown(rule, now) {
+  const lastfireat = rule.state.lastfireat;
+  if (lastfireat === void 0 || rule.state.cooldown <= 0) return { suppressed: false, remaining: 0 };
+  const remaining = lastfireat + rule.state.cooldown - now;
+  return { suppressed: remaining > 0, remaining: Math.max(0, remaining) };
+}
+function evaluatetrigger(input) {
+  const rule = input.rule;
+  if (!rule.state.enabled) return { fired: false, suppressed: "disabled" };
+  if (rule.state.pausedat !== void 0) return { fired: false, suppressed: "paused" };
+  if (!input.workflowreviewed) return { fired: false, suppressed: "unreviewed" };
+  if (input.runactive) return { fired: false, suppressed: "dedupe" };
+  const cooldown = applycooldown(rule, input.now);
+  if (cooldown.suppressed) return { fired: false, suppressed: "cooldown", remaining: cooldown.remaining };
+  const fire = { id: crypto.randomUUID(), ruleid: rule.id, at: input.now, cause: input.cause, ...input.url !== void 0 ? { url: input.url } : {}, ...input.title !== void 0 ? { title: input.title } : {}, ...input.payload !== void 0 ? { payload: input.payload } : {} };
+  return { fired: true, fire };
+}
+function queuefire(queue, fire) {
+  if (queue.some((pending) => pending.ruleid === fire.ruleid)) return { queue, queued: false, deduped: true };
+  return { queue: [...queue, fire], queued: true, deduped: false };
+}
+async function drainqueue(queue, launch) {
+  let remaining = [...queue];
+  let launched = 0;
+  while (remaining.length > 0) {
+    const fire = remaining[0];
+    try {
+      await launch(fire);
+    } catch {
+      return { launched, remaining };
+    }
+    remaining = remaining.slice(1);
+    launched += 1;
+  }
+  return { launched, remaining };
+}
+function verifywebhook(input) {
+  if (typeof input.rule.secret !== "string" || !input.rule.secret) return { verified: false, reason: "The webhook rule carries no reviewed secret." };
+  if (!secrectsmatch(input.secret, input.rule.secret)) return { verified: false, reason: "The webhook secret does not match the reviewed secret of the rule." };
+  const payload = input.payload;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { verified: false, reason: "The webhook payload must be a JSON object." };
+  const candidate = payload;
+  for (const field of input.rule.schema ?? []) {
+    const value = candidate[field.name];
+    if (value === void 0) {
+      if (field.required === true) return { verified: false, reason: `The required webhook field ${field.name} is missing.` };
+      continue;
+    }
+    if (typeof value !== field.kind) return { verified: false, reason: `The webhook field ${field.name} is not a ${field.kind}.` };
+  }
+  return { verified: true };
+}
+function secrectsmatch(left, right) {
+  if (left.length !== right.length) return false;
+  let same = true;
+  for (let index = 0; index < left.length; index += 1) if (left.charCodeAt(index) !== right.charCodeAt(index)) same = false;
+  return same;
+}
+function eventrulematches(rule, event) {
+  return (rule.events ?? []).includes(event);
+}
+function observeevents(rules, event) {
+  if (!triggereventcatalog.includes(event)) return [];
+  return rules.filter((rule) => rule.kind === "event" && rule.state.enabled && rule.state.pausedat === void 0 && eventrulematches(rule, event));
+}
+function pauseall(rules, now) {
+  return rules.map((rule) => rule.state.enabled && rule.state.pausedat === void 0 ? updaterule(rule, { state: { pausedat: now } }) : rule);
+}
+function resumeall(rules) {
+  return rules.map((rule) => {
+    if (rule.state.pausedat === void 0) return rule;
+    const state = { ...rule.state };
+    delete state.pausedat;
+    return { ...rule, state };
+  });
+}
+function manualpreview(record2, now) {
+  return { id: crypto.randomUUID(), workflowid: record2.id, preview: record2.steps.map((step) => ({ stepid: step.id, kind: step.kind, label: step.label, ...step.block !== void 0 ? { block: step.block } : {}, ...controlsummary(step) !== void 0 ? { control: controlsummary(step) } : {} })), at: now };
+}
+function confirmmanualrun(preview, confirmed, now) {
+  return { ...preview, confirmed, decidedat: now };
+}
+function triggersummary(rule) {
+  return {
+    kind: rule.kind,
+    workflowid: rule.workflowid,
+    label: rule.label,
+    ...rule.origins !== void 0 ? { origins: rule.origins } : {},
+    ...rule.pattern !== void 0 ? { pattern: rule.pattern } : {},
+    ...rule.title !== void 0 ? { title: rule.title } : {},
+    ...rule.command !== void 0 ? { command: rule.command } : {},
+    ...rule.key !== void 0 ? { key: rule.key } : {},
+    ...rule.cron !== void 0 ? { cron: rule.cron, ...rule.timezone !== void 0 ? { timezone: rule.timezone } : {} } : {},
+    ...rule.period !== void 0 ? { period: rule.period, ...rule.jitter !== void 0 ? { jitter: rule.jitter } : {} } : {},
+    ...rule.urls !== void 0 ? { urls: rule.urls } : {},
+    ...rule.events !== void 0 ? { events: rule.events } : {},
+    ...rule.schema !== void 0 ? { fields: rule.schema.length } : {},
+    cooldown: rule.state.cooldown,
+    enabled: rule.state.enabled,
+    ...rule.state.nextfireat !== void 0 ? { nextfireat: rule.state.nextfireat } : {}
+  };
+}
+function ruleorigins(rule) {
+  const origins = /* @__PURE__ */ new Set();
+  for (const origin of rule.origins ?? []) origins.add(origin);
+  if (rule.pattern !== void 0) {
+    const origin = httpsorigin(rule.pattern);
+    if (origin !== void 0) origins.add(origin);
+  }
+  for (const url of rule.urls ?? []) {
+    const origin = httpsorigin(url);
+    if (origin !== void 0) origins.add(origin);
+  }
+  return [...origins];
+}
+function ruleoriginsgranted(rule, workfloworigins) {
+  const granted = new Set(workfloworigins);
+  return ruleorigins(rule).every((origin) => granted.has(origin));
+}
+
 // netauth.ts
 function oauthflowof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -4618,7 +5077,7 @@ function consolediff(input) {
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow", "visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
 var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars", "condition", "branch"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
@@ -4642,6 +5101,7 @@ var profileractions = /* @__PURE__ */ new Set(["measureflow", "heapshot", "track
 var emulationactions = /* @__PURE__ */ new Set(["emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "blackboxscripts"]);
 var sessionactions = /* @__PURE__ */ new Set(["persiststate", "capturesession", "restoresession", "namedsessions", "diffsessions", "searchsessions", "exportsessions", "importsessions"]);
 var workflowactions = /* @__PURE__ */ new Set(["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars", "condition", "branch", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
+var triggeractions = /* @__PURE__ */ new Set(["visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"]);
 var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
@@ -4663,6 +5123,9 @@ function issessionkind(kind) {
 function isworkflowkind(kind) {
   return workflowactions.has(kind);
 }
+function istriggeraction(kind) {
+  return triggeractions.has(kind);
+}
 function isdebugkind(kind) {
   return debugactions.has(kind);
 }
@@ -6408,6 +6871,79 @@ function workflowgate(input) {
   }
   return { allowed: true };
 }
+function validatetriggergrammar(step, options) {
+  const family = triggerfamilyof(step.kind);
+  if (family === void 0) return { allowed: false, reason: "The trigger step is not a reviewed trigger kind." };
+  if (typeof options.workflowid !== "string" || !options.workflowid.trim()) return { allowed: false, reason: "Every trigger rule needs the reviewed id of the composed workflow it launches." };
+  if (options.reviewed !== true) return { allowed: false, reason: "Every trigger rule needs the explicit arm review with its match fields and bound workflow shown before it arms." };
+  if (options.label !== void 0 && (typeof options.label !== "string" || !options.label.trim())) return { allowed: false, reason: "The reviewed trigger label must be a non-empty string." };
+  if (options.cooldown !== void 0 && (typeof options.cooldown !== "number" || !Number.isFinite(options.cooldown) || options.cooldown <= 0)) return { allowed: false, reason: "The reviewed cooldown window must be a positive number of milliseconds with no code ceiling; the webhook and event families keep the documented default when the review configures none." };
+  const payload = options.rule;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { allowed: false, reason: `The ${step.kind} step needs its reviewed rule payload in options.` };
+  if (triggerpayloadof(family, payload) === void 0) {
+    if (family === "visit") return { allowed: false, reason: "The visit rule needs a non-empty reviewed list of HTTPS origins it fires on." };
+    if (family === "url") return { allowed: false, reason: "The url rule needs a reviewed HTTPS glob url pattern; `*` spans one path segment and `**` spans across segments." };
+    if (family === "menu") return { allowed: false, reason: "The menu rule needs a reviewed non-empty context menu entry title." };
+    if (family === "key") return { allowed: false, reason: "The keyboard shortcut rule needs a reviewed lowercase command name and an optional suggested key binding." };
+    if (family === "cron") return { allowed: false, reason: "The cron rule needs a reviewed five field cron expression of minutes, hours, days, months and weekdays with named weekdays and months and an optional resolvable timezone; unparseable schedules are refused." };
+    if (family === "interval") return { allowed: false, reason: "The interval rule needs a reviewed positive period in milliseconds with an optional zero or positive jitter window." };
+    if (family === "urllist") return { allowed: false, reason: "The url list rule needs a reviewed non-empty list of HTTPS urls its workflow runs across." };
+    if (family === "webhook") return { allowed: false, reason: `The webhook rule needs a reviewed shared secret of at least twenty four characters mixing letters and digits and a non-empty payload schema of named string, number or boolean fields.` };
+    if (family === "event") return { allowed: false, reason: `The page event rule needs a reviewed non-empty list of event names of the observed event catalog: ${triggereventcatalog.join(", ")}.` };
+    return { allowed: false, reason: "The trigger rule payload does not follow its family grammar." };
+  }
+  if (family === "cron") {
+    const candidate = payload;
+    if (typeof candidate.cron === "string" && cronparse(candidate.cron) === void 0) return { allowed: false, reason: "The cron expression does not parse as a five field schedule and is refused." };
+  }
+  if (family === "webhook") {
+    const candidate = payload;
+    if (typeof candidate.secret === "string" && !webhooksecretok(candidate.secret)) return { allowed: false, reason: "The webhook shared secret must hold at least twenty four characters mixing letters and digits; the entropy floor is a floor, never a cap." };
+  }
+  const armed = armrule({ family, workflowid: options.workflowid, ...typeof options.label === "string" && options.label.trim() ? { label: options.label } : {}, payload, ...typeof options.cooldown === "number" ? { cooldown: options.cooldown } : {}, now: 0 });
+  if (armed === void 0) return { allowed: false, reason: "The trigger rule payload does not arm as a reviewed rule." };
+  return { allowed: true };
+}
+function triggergate(input) {
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now: input.now, action: "arm the trigger rule" });
+  if (!gate.allowed) return gate;
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Trigger rules need the approved plan review before they arm." };
+  let triggeroptions = {};
+  try {
+    triggeroptions = parseoptions(input.step);
+  } catch {
+    triggeroptions = {};
+  }
+  if (triggeroptions.reviewed !== true) return { allowed: false, reason: "Every trigger rule needs the explicit arm review with its match fields and bound workflow shown before it arms." };
+  return { allowed: true };
+}
+function triggerorigins(step) {
+  let triggeroptions = {};
+  try {
+    triggeroptions = parseoptions(step);
+  } catch {
+    return [];
+  }
+  const family = triggerfamilyof(step.kind);
+  if (family === void 0) return [];
+  const armed = armrule({ family, workflowid: typeof triggeroptions.workflowid === "string" ? triggeroptions.workflowid : "", payload: triggeroptions.rule, ...typeof triggeroptions.cooldown === "number" ? { cooldown: triggeroptions.cooldown } : {}, now: 0 });
+  if (armed === void 0) return [];
+  const origins = [];
+  for (const origin of armed.origins ?? []) origins.push(origin);
+  if (armed.pattern !== void 0) {
+    try {
+      origins.push(new URL(armed.pattern).origin);
+    } catch {
+    }
+  }
+  for (const url of armed.urls ?? []) {
+    try {
+      origins.push(new URL(url).origin);
+    } catch {
+    }
+  }
+  return [...new Set(origins)];
+}
 function dryrunprojection(step) {
   if (iscontrolflowkind(step.kind)) {
     for (const child of controlsteps(step)) {
@@ -7004,6 +7540,10 @@ function validatestep(step, origin) {
     const workflowcheck = validateworkflowgrammar(step, options);
     if (!workflowcheck.allowed) return workflowcheck;
   }
+  if (istriggeraction(step.kind)) {
+    const triggercheck = validatetriggergrammar(step, options);
+    if (!triggercheck.allowed) return triggercheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -7198,6 +7738,10 @@ function canexecute(input) {
     const workflowgatecheck = workflowgate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
     if (!workflowgatecheck.allowed) return workflowgatecheck;
   }
+  if (istriggeraction(input.step.kind)) {
+    const triggergatecheck = triggergate({ session: input.session, plan: input.plan, step: input.step, tabid: input.tabid, origin: input.origin, now });
+    if (!triggergatecheck.allowed) return triggergatecheck;
+  }
   if (iscontrolkind(input.step.kind)) {
     const controlgate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "control the network" });
     if (!controlgate.allowed) return controlgate;
@@ -7460,9 +8004,15 @@ function recordworkflow(progress, planid, stepid, entry, now) {
   const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { workflow: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function recordtrigger(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const counts = `${entry.fires !== void 0 ? `${entry.fires} fire${entry.fires === 1 ? "" : "s"}, ` : ""}${entry.launches !== void 0 ? `${entry.launches} launch${entry.launches === 1 ? "" : "es"}, ` : ""}${entry.suppressions !== void 0 ? `${entry.suppressions} suppression${entry.suppressions === 1 ? "" : "s"}, ` : ""}${entry.queued !== void 0 ? `${entry.queued} queued fire${entry.queued === 1 ? "" : "s"}, ` : ""}`.replace(/, $/, "");
+  const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { trigger: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.51";
+var packageversion = "1.1.52";
 
 // types.ts
 var protocolversion = packageversion;
@@ -7701,6 +8251,25 @@ function parseproposal(value, origin, grants) {
       }
       if (step.kind === "runworkflow" && workflowoptions.reviewed !== true) throw new Error("Workflow runs without the explicit run review of the expanded step list are refused.");
     }
+    if (istriggeraction(step.kind)) {
+      let triggeroptions = {};
+      try {
+        triggeroptions = parseoptions(step);
+      } catch {
+        triggeroptions = {};
+      }
+      if (triggeroptions.reviewed !== true) throw new Error("Trigger rules without the explicit arm review of their match fields and bound workflow are refused.");
+      for (const ruleorigin of triggerorigins(step)) {
+        const granted = covered.some((pattern) => {
+          try {
+            return new URL(ruleorigin).origin === new URL(pattern).origin;
+          } catch {
+            return false;
+          }
+        });
+        if (!granted) throw new Error(`The trigger on ${ruleorigin} stays outside the grants.`);
+      }
+    }
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
     const target = outboundtarget(step);
@@ -7780,7 +8349,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed, ...input.workflow.timeout !== void 0 ? { timeout: input.workflow.timeout } : {}, ...input.workflow.retry !== void 0 ? { retry: input.workflow.retry } : {} } } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed, ...input.workflow.timeout !== void 0 ? { timeout: input.workflow.timeout } : {}, ...input.workflow.retry !== void 0 ? { retry: input.workflow.retry } : {} } } : {}, ...input.trigger ? { trigger: { ruleid: input.trigger.ruleid, kind: input.trigger.kind, enabled: input.trigger.enabled, ...input.trigger.nextfireat !== void 0 ? { nextfireat: input.trigger.nextfireat } : {} } } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -7917,6 +8486,45 @@ function sessionreport(input) {
 function workflowreport(input) {
   return { version: protocolversion, workflows: input.workflows, runs: input.runs, templates: input.templates, log: input.log ?? [], scopes: input.scopes ?? [], provenance: input.provenance ?? [], control: input.control ?? [] };
 }
+function triggerlist(input) {
+  const names = new Map(input.workflows.map((record2) => [record2.id, record2.name]));
+  const rules = input.rules.map((rule) => {
+    const workflowname = names.get(rule.workflowid);
+    return {
+      id: rule.id,
+      kind: rule.kind,
+      workflowid: rule.workflowid,
+      ...workflowname !== void 0 ? { workflowname } : {},
+      label: rule.label,
+      enabled: rule.state.enabled,
+      ...rule.state.pausedat !== void 0 ? { paused: true } : {},
+      cooldown: rule.state.cooldown,
+      ...rule.state.lastfireat !== void 0 ? { lastfireat: rule.state.lastfireat } : {},
+      ...rule.state.nextfireat !== void 0 ? { nextfireat: rule.state.nextfireat } : {},
+      fires: rule.stats.fires,
+      launches: rule.stats.launches,
+      suppressions: rule.stats.suppressions,
+      summary: triggersummaryof(rule)
+    };
+  });
+  return { version: protocolversion, rules, queued: (input.queue ?? []).length };
+}
+function triggersummaryof(rule) {
+  const summary = { kind: rule.kind, workflowid: rule.workflowid };
+  if (rule.origins !== void 0) summary.origins = rule.origins;
+  if (rule.pattern !== void 0) summary.pattern = rule.pattern;
+  if (rule.title !== void 0) summary.title = rule.title;
+  if (rule.command !== void 0) summary.command = rule.command;
+  if (rule.key !== void 0) summary.key = rule.key;
+  if (rule.cron !== void 0) summary.cron = rule.cron;
+  if (rule.timezone !== void 0) summary.timezone = rule.timezone;
+  if (rule.period !== void 0) summary.period = rule.period;
+  if (rule.jitter !== void 0) summary.jitter = rule.jitter;
+  if (rule.urls !== void 0) summary.urls = rule.urls;
+  if (rule.events !== void 0) summary.events = rule.events;
+  if (rule.schema !== void 0) summary.fields = rule.schema.length;
+  return summary;
+}
 
 // capture.ts
 var capturekinds = ["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"];
@@ -9968,6 +10576,8 @@ async function executewatchstep(step, session, plan, tabid2, origin) {
       const record2 = entry;
       await memory.addmutationevent({ ...record2, sessionid: session.id });
     }
+    void evaluatepagetriggers("mutate").catch(() => {
+    });
   }
   if (step.kind === "watchfocus") {
     for (const entry of detailarray(output.details, "events")) {
@@ -9975,6 +10585,8 @@ async function executewatchstep(step, session, plan, tabid2, origin) {
       const record2 = entry;
       await memory.addfocusevent({ ...record2, sessionid: session.id });
     }
+    void evaluatepagetriggers("focus").catch(() => {
+    });
   }
   if (step.kind === "watchbanner") {
     for (const entry of detailarray(output.details, "banners")) {
@@ -9982,6 +10594,8 @@ async function executewatchstep(step, session, plan, tabid2, origin) {
       const record2 = entry;
       await memory.addbanner({ ...record2, sessionid: session.id });
     }
+    void evaluatepagetriggers("banner").catch(() => {
+    });
   }
   await audit("watch", `Watch ${watchid} closed after its reviewed lifetime of ${lifetime} milliseconds.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
   return { output, watch };
@@ -10109,6 +10723,8 @@ async function tracktabupdate(tabid2, changeinfo) {
 }
 chrome.tabs.onUpdated.addListener((tabid2, changeinfo) => {
   void tracktabupdate(tabid2, changeinfo);
+  if (typeof changeinfo.url === "string" && changeinfo.url.startsWith("https://")) void evaluatenavigationtriggers(changeinfo.url).catch(() => {
+  });
 });
 chrome.tabs.onActivated.addListener((activeinfo) => {
   void recordtabwatchevent("activated", activeinfo.tabId);
@@ -12791,6 +13407,10 @@ async function executetimelinestep(step, session, plan, tabid2, origin) {
   const watcherstate = activetimelinewatchers.get(watchid);
   activetimelinewatchers.delete(watchid);
   await memory.closewatch(watchid, Date.now());
+  if (step.kind === "watchconsole" || step.kind === "watcherrors") {
+    void evaluatepagetriggers(step.kind === "watchconsole" ? "console" : "error").catch(() => {
+    });
+  }
   await audit("timeline", `Watcher ${watchid} detached cleanly after its reviewed window of ${watchwindow} milliseconds.`, extra);
   if (watcherstate?.cancelled) {
     await audit("timeline", `Watcher ${watchid} cancelled on run cancel or the killswitch; the captured window is discarded.`, extra);
@@ -14355,6 +14975,187 @@ async function storetimeoutabort(run, step, message, budget) {
   await audit("workflow", `The run ${run.id} exceeded its reviewed budget of ${budget} milliseconds and was cancelled with the cancelled error class.`, { planid: step.id });
   return { run: aborted, log: [entry] };
 }
+async function executetriggerstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const family = triggerfamilyof(step.kind);
+  if (!family) throw new Error(`The ${step.kind} step is not a reviewed trigger kind.`);
+  const workflowid = typeof options.workflowid === "string" ? options.workflowid : "";
+  const record2 = await memory.getworkflowrecord(workflowid);
+  if (!record2) throw new Error(`No composed workflow matches ${workflowid || "the reviewed id"}; trigger rules bind to workflows already composed and reviewed.`);
+  const armed = armrule({ family, workflowid, ...typeof options.label === "string" && options.label.trim() ? { label: options.label } : {}, payload: options.rule, ...typeof options.cooldown === "number" ? { cooldown: options.cooldown } : {}, now: Date.now() });
+  if (!armed) throw new Error(`The ${step.kind} payload does not arm as a reviewed rule.`);
+  if (!ruleoriginsgranted(armed, record2.origins)) throw new Error("The trigger touches origins outside the workflow grant list; review the rule or the workflow origins.");
+  for (const matchorigin of armed.origins ?? []) {
+    if (!origingranted(session, matchorigin)) throw new Error(`The trigger origin ${matchorigin} falls outside the session grants.`);
+  }
+  if (armed.pattern !== void 0) {
+    let patternorigin2 = "";
+    try {
+      patternorigin2 = new URL(armed.pattern).origin;
+    } catch {
+      patternorigin2 = "";
+    }
+    if (patternorigin2 && !origingranted(session, patternorigin2)) throw new Error(`The trigger origin ${patternorigin2} falls outside the session grants.`);
+  }
+  for (const url of armed.urls ?? []) {
+    let listorigin = "";
+    try {
+      listorigin = new URL(url).origin;
+    } catch {
+      listorigin = "";
+    }
+    if (listorigin && !origingranted(session, listorigin)) throw new Error(`The trigger origin ${listorigin} falls outside the session grants.`);
+  }
+  const nextfireat = family === "cron" && armed.cron !== void 0 ? schedulecron({ cron: armed.cron, ...armed.timezone !== void 0 ? { timezone: armed.timezone } : {} }, Date.now()) : family === "interval" && armed.period !== void 0 ? scheduleinterval({ period: armed.period, ...armed.jitter !== void 0 ? { jitter: armed.jitter } : {} }, void 0, Date.now(), hashseed(armed.id)) : void 0;
+  const rule = { ...armed, ...nextfireat !== void 0 ? { state: { ...armed.state, nextfireat } } : {} };
+  await memory.addtriggerule(rule);
+  await registermenurule(rule);
+  await scheduletriggerwakes();
+  await memory.setprogress(recordtrigger(await memory.getprogress(), plan.id, step.id, { family: "arm", detail: `Armed the ${family} rule for the workflow ${record2.name}`, ruleid: rule.id, ...nextfireat !== void 0 ? { nextfireat } : {} }, Date.now()));
+  await audit("trigger", `Armed the ${family} rule ${rule.id} for the workflow ${record2.name} version ${record2.version} behind the explicit arm review; the rule starts ${rule.state.enabled ? "enabled" : "disabled"} with a cooldown of ${rule.state.cooldown} millisecond${rule.state.cooldown === 1 ? "" : "s"}${nextfireat !== void 0 ? ` and the next fire scheduled` : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+  void origin;
+  void tabid2;
+  return { ok: true, summary: `Armed the ${family} rule for the workflow ${record2.name}${nextfireat !== void 0 ? " with the next fire scheduled" : ""}.`, details: { trigger: { ruleid: rule.id, kind: family, enabled: rule.state.enabled, ...nextfireat !== void 0 ? { nextfireat } : {} } } };
+}
+async function runofworkflowactive(workflowid) {
+  if ([...activeworkflowruns.keys()].length === 0) return false;
+  for (const run of await memory.listworkflowruns()) {
+    if (run.workflowid === workflowid && run.state === "running") return true;
+  }
+  return false;
+}
+async function launchtriggerrun(fire, rule) {
+  const session = await memory.getsession();
+  const plan = await memory.getplan();
+  const now = Date.now();
+  if (!session || session.stoppedat || session.pausedat || session.expiresat <= now) return { launched: false, reason: "The trigger launch needs a live, unpaused browser session." };
+  if (!plan || plan.state !== "approved") return { launched: false, reason: "The trigger launch needs the approved plan review." };
+  const record2 = await memory.getworkflowrecord(rule.workflowid);
+  if (!record2) return { launched: false, reason: "The workflow of the trigger rule is no longer composed; evaluation skips the rule." };
+  for (const workfloworigin of record2.origins) {
+    if (!origingranted(session, workfloworigin)) return { launched: false, reason: `The workflow origin ${workfloworigin} falls outside the session grants.` };
+  }
+  const variables = { triggercause: fire.cause, triggerrule: rule.id };
+  if (fire.url !== void 0) variables.triggerurl = fire.url;
+  if (fire.title !== void 0) variables.triggertitle = fire.title;
+  if (fire.payload !== void 0) variables.triggerpayload = JSON.stringify(fire.payload);
+  const runstep2 = { id: `trigger${fire.id}`, kind: "runworkflow", summary: `The ${rule.kind} trigger run of ${record2.name}`, risk: "sensitive", options: JSON.stringify({ workflowid: rule.workflowid, reviewed: true, variables }) };
+  const output = await executeworkflowstep(runstep2, session, plan, session.tabid, session.origin).catch((error) => ({ ok: false, summary: error instanceof Error ? error.message : String(error), details: {} }));
+  const launched = Boolean(output.ok);
+  const runid = output.details?.runid;
+  await memory.settriggerule(updaterule(rule, { state: { lastfireat: fire.at, ...nextfireof(rule, fire.at) !== void 0 ? { nextfireat: nextfireof(rule, fire.at) } : {} }, stats: { launches: rule.stats.launches + (launched ? 1 : 0) } }));
+  await memory.addtriggerfire(fire);
+  await audit("trigger", `The ${rule.kind} rule ${rule.id} fired on ${fire.cause}${fire.url !== void 0 ? ` at ${fire.url}` : ""} and ${launched ? `launched the run ${runid ?? ""} of the workflow ${record2.name}` : `refused the launch: ${output.ok === false ? output.summary : "the run ended"}`}; the arm review, the live session, the approved plan and the origin gates all re-passed.`, { sessionid: session.id, planid: plan.id });
+  if (launched) await notifytriggerfired(fire, rule, runid);
+  await refreshbadge();
+  return { launched, ...runid !== void 0 ? { runid } : {}, ...launched ? {} : { reason: output.ok === false ? output.summary : "the run ended" } };
+}
+function nextfireof(rule, after) {
+  if (rule.kind === "cron" && rule.cron !== void 0) return schedulecron({ cron: rule.cron, ...rule.timezone !== void 0 ? { timezone: rule.timezone } : {} }, after);
+  if (rule.kind === "interval" && rule.period !== void 0) return scheduleinterval({ period: rule.period, ...rule.jitter !== void 0 ? { jitter: rule.jitter } : {} }, after, rule.createdat, hashseed(rule.id));
+  return void 0;
+}
+async function firetrigger(rule, cause, url, title, payload) {
+  const now = Date.now();
+  const record2 = await memory.getworkflowrecord(rule.workflowid);
+  const runactive = await runofworkflowactive(rule.workflowid);
+  const decision = evaluatetrigger({ rule, now, cause, ...url !== void 0 ? { url } : {}, ...title !== void 0 ? { title } : {}, ...payload !== void 0 ? { payload } : {}, runactive: false, workflowreviewed: record2 !== void 0 });
+  if (!decision.fired || decision.fire === void 0) {
+    await memory.settriggerule(updaterule(rule, { stats: { suppressions: rule.stats.suppressions + 1 } }));
+    await audit("trigger", `The ${rule.kind} rule ${rule.id} suppressed a ${cause} fire inside the ${decision.suppressed ?? "review"} gate${decision.remaining !== void 0 ? ` with ${decision.remaining} millisecond${decision.remaining === 1 ? "" : "s"} of cooldown left` : ""}.`, {});
+    return { fired: false, ...decision.suppressed !== void 0 ? { suppressed: decision.suppressed } : {} };
+  }
+  if (runactive) {
+    const queued = queuefire(await memory.gettriggerqueue(), decision.fire);
+    await memory.settriggerqueue(queued.queue);
+    await memory.settriggerule(updaterule(rule, { stats: { suppressions: rule.stats.suppressions + 1 } }));
+    await audit("trigger", `The ${rule.kind} rule ${rule.id} fired on ${cause} while its workflow run was busy${queued.deduped ? " and the queue kept the pending fire already waiting" : " and the fire queued for the run to settle"}.`, {});
+    await refreshbadge();
+    return { fired: true, queued: true };
+  }
+  await memory.settriggerule(updaterule(rule, { stats: { fires: rule.stats.fires + 1 } }));
+  const launch = await launchtriggerrun(decision.fire, rule);
+  return { fired: true, ...launch.launched ? {} : { suppressed: launch.reason } };
+}
+async function draintriggerqueue() {
+  const queue = await memory.gettriggerqueue();
+  if (queue.length === 0) return { launched: 0, remaining: 0 };
+  const result = await drainqueue(queue, async (fire) => {
+    const rule = await memory.gettriggerule(fire.ruleid);
+    if (!rule) return;
+    await memory.settriggerule(updaterule(rule, { stats: { fires: rule.stats.fires + 1 } }));
+    await launchtriggerrun(fire, rule);
+  });
+  await memory.settriggerqueue(result.remaining);
+  await audit("trigger", `The trigger queue drained ${result.launched} queued fire${result.launched === 1 ? "" : "s"} with ${result.remaining} still waiting.`, {});
+  await refreshbadge();
+  return { launched: result.launched, remaining: result.remaining.length };
+}
+async function evaluatenavigationtriggers(url, title) {
+  if (!url.startsWith("https://")) return;
+  const session = await memory.getsession();
+  if (!session || session.stoppedat) return;
+  for (const { rule } of await memory.listtriggers()) {
+    if (!rule.state.enabled || rule.state.pausedat !== void 0) continue;
+    if (rule.kind === "visit" && rule.origins !== void 0 && visitmatch(rule.origins, url)) await firetrigger(rule, "visit", url, title);
+    if (rule.kind === "url" && rule.pattern !== void 0 && matchurl(rule.pattern, url)) await firetrigger(rule, "url", url, title);
+  }
+  await evaluatepagetriggers("navigate", url, title);
+}
+async function evaluatepagetriggers(event, url, title) {
+  const session = await memory.getsession();
+  if (!session || session.stoppedat || session.pausedat) return;
+  for (const rule of observeevents(await memory.gettriggerules(), event)) {
+    await firetrigger(rule, "event", url, title, { event });
+  }
+}
+async function evaluatelistedtriggers() {
+  const rules = await memory.gettriggerules();
+  const due = listdue(rules, Date.now());
+  for (const entry of due) {
+    await firetrigger(entry.rule, "schedule");
+  }
+  await scheduletriggerwakes();
+  return { due: due.length };
+}
+async function registermenurule(rule) {
+  if (rule.kind !== "menu" || rule.title === void 0) return;
+  const menus = chrome.contextMenus;
+  if (typeof menus?.create !== "function") {
+    await audit("trigger", `The menu rule ${rule.id} stays armed without its context menu entry because the browser exposes no context menus api under the current permission set; the manual run path stays available in the panel.`, {});
+    return;
+  }
+  try {
+    menus.create({ id: `devthinktrigger${rule.id}`, title: rule.title, contexts: ["page", "selection", "link"] });
+  } catch {
+  }
+}
+async function registermenurules() {
+  for (const { rule } of await memory.listtriggers()) await registermenurule(rule);
+}
+async function scheduletriggerwakes() {
+  const alarms = chrome.alarms;
+  if (typeof alarms?.create !== "function") return;
+  try {
+    const rules = await memory.gettriggerules();
+    const scheduled = rules.filter((rule) => rule.state.enabled && rule.state.pausedat === void 0 && rule.state.nextfireat !== void 0);
+    if (scheduled.length === 0) return;
+    const next = Math.min(...scheduled.map((rule) => rule.state.nextfireat));
+    const oneminute = 6e4;
+    alarms.create("devthinktriggerwake", { when: Math.max(Date.now() + oneminute, next) });
+  } catch {
+  }
+}
+async function notifytriggerfired(fire, rule, runid) {
+  const notifications = chrome.notifications;
+  if (typeof notifications?.create === "function") {
+    try {
+      notifications.create(`devthinktrigger${fire.id}`, { type: "basic", iconUrl: "icon128.png", title: "Devthink trigger fired", message: `The ${rule.kind} rule fired on ${fire.cause}${runid !== void 0 ? ` and launched run ${runid}` : ""}.` });
+    } catch {
+    }
+  }
+  void runid;
+}
 async function auditcontroldecision(runid, decision, sessionid, planid) {
   if (decision.kind === "branch" && decision.branch !== void 0) await audit("workflow", `The branch step ${decision.stepid} of the run ${runid} chose the path ${decision.branch.path}: ${decision.branch.reason}`, { sessionid, planid });
   else if (decision.kind === "loop" && decision.loops !== void 0) await audit("workflow", `The loop step ${decision.stepid} of the run ${runid} recorded ${decision.loops.length} iteration counter${decision.loops.length === 1 ? "" : "s"} with the paths ${decision.loops.map((counter) => counter.path).join(", ")}.`, { sessionid, planid });
@@ -14448,6 +15249,9 @@ async function executeaction(step, session, plan, tabid2, origin, settings, verd
     } else if (isworkflowkind(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Workflow kinds refuse to run outside an approved session plan.");
       output = await executeworkflowstep(step, session, plan, tabid2, origin);
+    } else if (istriggeraction(step.kind)) {
+      if (!session || !plan || plan.state !== "approved") throw new Error("Trigger kinds refuse to run outside an approved session plan.");
+      output = await executetriggerstep(step, session, plan, tabid2, origin);
     } else {
       if (step.target && freshcheckkinds.has(step.kind)) {
         const fresh = await snapshot(tabid2);
@@ -14548,7 +15352,9 @@ async function pausesession() {
   if (session.pausedat) throw new Error("The browser session is already paused.");
   const paused = { ...session, pausedat: Date.now() };
   await memory.setsession(paused);
+  await memory.settriggerules(pauseall(await memory.gettriggerules(), Date.now()));
   await audit("pause", "The user paused the browser session; no action or preview can run.", { sessionid: session.id });
+  await audit("trigger", "The session pause suspended every armed trigger rule; fires that arrive while paused queue for the resume drain.", { sessionid: session.id });
   return paused;
 }
 async function resumesession() {
@@ -14558,7 +15364,11 @@ async function resumesession() {
   if (!session.pausedat) throw new Error("The browser session is not paused.");
   const resumed = { id: session.id, tabid: session.tabid, origin: session.origin, startedat: session.startedat, expiresat: session.expiresat, ...session.grants ? { grants: session.grants } : {} };
   await memory.setsession(resumed);
+  await memory.settriggerules(resumeall(await memory.gettriggerules()));
   await audit("resume", "The user resumed the browser session; reviewed actions can run again.", { sessionid: session.id });
+  await audit("trigger", "The session resume released the suspended trigger rules and drained the queued fires through the same gates.", { sessionid: session.id });
+  void draintriggerqueue().catch(() => {
+  });
   return resumed;
 }
 async function grantcapability(permission) {
@@ -14696,7 +15506,7 @@ async function handlerequest(message, sender) {
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id), control: await memory.listcontroldecisions(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, trigger: triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() }), triggerretention: runsettings?.triggerretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id), control: await memory.listcontroldecisions(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -14743,7 +15553,8 @@ async function handlerequest(message, sender) {
       const network = outcome.details?.network;
       const timeline = outcome.details?.timeline;
       const sessionblock = outcome.details?.session;
-      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...capture ? { capture } : {}, ...media ? { media } : {}, ...network ? { network } : {}, ...timeline ? { timeline } : {}, ...sessionblock !== void 0 ? { session: { recordid: sessionblock.recordid ?? "", sections: sessionblock.sections ?? 0, ...sessionblock.matches !== void 0 ? { matches: sessionblock.matches } : {}, ...sessionblock.restored !== void 0 ? { restored: sessionblock.restored } : {}, ...sessionblock.skipped !== void 0 ? { skipped: sessionblock.skipped } : {}, ...sessionblock.cursor !== void 0 ? { cursor: sessionblock.cursor } : {}, ...sessionblock.bytes !== void 0 ? { bytes: sessionblock.bytes } : {} } } : {} }));
+      const triggerblock = outcome.details?.trigger;
+      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...triggerblock !== void 0 && triggerblock.ruleid !== void 0 ? { trigger: { ruleid: triggerblock.ruleid, kind: triggerblock.kind ?? "", enabled: triggerblock.enabled ?? true, ...triggerblock.nextfireat !== void 0 ? { nextfireat: triggerblock.nextfireat } : {} } } : {}, ...capture ? { capture } : {}, ...media ? { media } : {}, ...network ? { network } : {}, ...timeline ? { timeline } : {}, ...sessionblock !== void 0 ? { session: { recordid: sessionblock.recordid ?? "", sections: sessionblock.sections ?? 0, ...sessionblock.matches !== void 0 ? { matches: sessionblock.matches } : {}, ...sessionblock.restored !== void 0 ? { restored: sessionblock.restored } : {}, ...sessionblock.skipped !== void 0 ? { skipped: sessionblock.skipped } : {}, ...sessionblock.cursor !== void 0 ? { cursor: sessionblock.cursor } : {}, ...sessionblock.bytes !== void 0 ? { bytes: sessionblock.bytes } : {} } } : {} }));
     }
     case "map": {
       const plan = await memory.getplan();
@@ -16029,6 +16840,184 @@ async function handlerequest(message, sender) {
       if (!stored) throw new Error(`No workflow run matches ${inputoutcome.runid ?? ""}.`);
       return workflowoutcome({ run: stored.run, entries: stored.log, ...inputoutcome.stepid !== void 0 && inputoutcome.stepid !== "" ? { stepid: inputoutcome.stepid } : {} });
     }
+    case "triggerreview": {
+      const triggers = await memory.listtriggers();
+      const runs = await memory.listworkflowruns();
+      const queue = await memory.gettriggerqueue();
+      const rules = await Promise.all(triggers.map(async (entry) => {
+        const record2 = await memory.getworkflowrecord(entry.rule.workflowid);
+        return {
+          id: entry.rule.id,
+          kind: entry.rule.kind,
+          workflowid: entry.rule.workflowid,
+          ...entry.workflowname !== void 0 ? { workflowname: entry.workflowname } : {},
+          label: entry.rule.label,
+          enabled: entry.rule.state.enabled,
+          paused: entry.rule.state.pausedat !== void 0,
+          cooldown: entry.rule.state.cooldown,
+          ...entry.rule.state.lastfireat !== void 0 ? { lastfireat: entry.rule.state.lastfireat } : {},
+          ...entry.rule.state.nextfireat !== void 0 ? { nextfireat: entry.rule.state.nextfireat } : {},
+          fires: entry.rule.stats.fires,
+          launches: entry.rule.stats.launches,
+          suppressions: entry.rule.stats.suppressions,
+          summary: triggersummary(entry.rule),
+          steps: record2 ? record2.steps.map((inner) => ({ id: inner.id, kind: inner.kind, label: inner.label })) : [],
+          ...entry.rule.kind === "webhook" ? { deliveries: (await memory.listwebhookpayloads(entry.rule.id)).length } : {}
+        };
+      }));
+      const active = runs.filter((run) => run.state === "running").length;
+      return { rules, queued: queue.length, active, fires: (await memory.listtriggerfires()).slice(0, 50) };
+    }
+    case "toggletrigger": {
+      const inputtoggle = message;
+      const rule = await memory.gettriggerule(inputtoggle.ruleid ?? "");
+      if (!rule) throw new Error(`No armed trigger rule matches ${inputtoggle.ruleid ?? ""}.`);
+      if (typeof inputtoggle.enabled !== "boolean") throw new Error("The trigger toggle needs the reviewed enabled flag.");
+      const updated = updaterule(rule, { state: { enabled: inputtoggle.enabled } });
+      await memory.settriggerule(updated);
+      await audit("trigger", `The user ${inputtoggle.enabled ? "enabled" : "disabled"} the ${rule.kind} rule ${rule.id} of the workflow ${rule.workflowid}; disabled rules never fire until reenabled.`, {});
+      await scheduletriggerwakes();
+      return { ruleid: rule.id, enabled: updated.state.enabled };
+    }
+    case "createtrigger": {
+      const inputcreate = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Arming a trigger rule needs an active browser session behind the consent gates.");
+      if (!plan || plan.state !== "approved") throw new Error("Arming a trigger rule needs the approved plan review.");
+      const family = triggerfamilyof(`${inputcreate.family ?? ""}rule`);
+      if (!family) throw new Error("The trigger family is not a reviewed family.");
+      const step = { id: `panel${Date.now()}`, kind: `${family}rule`, summary: `The reviewed ${family} rule of the panel`, risk: "sensitive", options: JSON.stringify({ workflowid: inputcreate.workflowid ?? "", reviewed: true, ...typeof inputcreate.label === "string" ? { label: inputcreate.label } : {}, ...inputcreate.cooldown !== void 0 ? { cooldown: inputcreate.cooldown } : {}, rule: inputcreate.payload ?? {} }) };
+      const verdict = canexecute({ session, plan, step, tabid: session.tabid, origin: session.origin, now: Date.now() });
+      if (!verdict.allowed) throw new Error(verdict.reason ?? "The trigger rule was refused by the consent gates.");
+      return await executetriggerstep(step, session, plan, session.tabid, session.origin);
+    }
+    case "createvisitrule": {
+      const inputvisit = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Creating a visit rule needs an active browser session behind the consent gates.");
+      const tab = await chrome.tabs.get(session.tabid).catch(() => void 0);
+      const url = tab?.url ?? "";
+      let origin = "";
+      try {
+        origin = new URL(url).origin;
+      } catch {
+        origin = "";
+      }
+      if (!origin.startsWith("https://")) throw new Error("The current page carries no HTTPS origin to bind a visit rule to.");
+      return await handlerequest({ kind: "createtrigger", workflowid: inputvisit.workflowid ?? "", family: "visit", payload: { origins: [origin] }, label: `Visit ${origin}` }, {});
+    }
+    case "duplicatetrigger": {
+      const inputduplicate = message;
+      const rule = await memory.gettriggerule(inputduplicate.ruleid ?? "");
+      if (!rule) throw new Error(`No armed trigger rule matches ${inputduplicate.ruleid ?? ""}.`);
+      const record2 = await memory.getworkflowrecord(inputduplicate.workflowid ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputduplicate.workflowid ?? ""}.`);
+      const { state: rulestate, stats: rulestats, createdat: rulecreatedat, id: ruleid, workflowid: ruleworkflowid, label: rulelabel, cooldown: rulecooldown, ...familypayload } = rule;
+      void rulestate;
+      void rulestats;
+      void rulecreatedat;
+      void ruleid;
+      void ruleworkflowid;
+      void rulelabel;
+      const armed = armrule({ family: rule.kind, workflowid: record2.id, label: `${rule.label} for ${record2.name}`, payload: familypayload, ...rulecooldown !== void 0 ? { cooldown: rulecooldown } : {}, now: Date.now() });
+      if (!armed) throw new Error("The duplicated rule payload failed its family grammar.");
+      const nextfireat = rule.kind === "cron" && rule.cron !== void 0 ? schedulecron({ cron: rule.cron, ...rule.timezone !== void 0 ? { timezone: rule.timezone } : {} }, Date.now()) : rule.kind === "interval" && rule.period !== void 0 ? scheduleinterval({ period: rule.period, ...rule.jitter !== void 0 ? { jitter: rule.jitter } : {} }, void 0, Date.now(), hashseed(armed.id)) : void 0;
+      const duplicate = { ...armed, ...nextfireat !== void 0 ? { state: { ...armed.state, nextfireat } } : {} };
+      if (!ruleoriginsgranted(duplicate, record2.origins)) throw new Error("The duplicated rule touches origins outside the workflow grant list of its new workflow.");
+      await memory.addtriggerule(duplicate);
+      await registermenurule(duplicate);
+      await scheduletriggerwakes();
+      await audit("trigger", `The user duplicated the ${rule.kind} rule ${rule.id} to the workflow ${record2.name} as the rule ${duplicate.id}; the duplicated rule arms enabled with zeroed counters.`, {});
+      return { ruleid: duplicate.id, workflowid: duplicate.workflowid };
+    }
+    case "manualrun": {
+      const inputmanual = message;
+      const record2 = await memory.getworkflowrecord(inputmanual.workflowid ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputmanual.workflowid ?? ""}.`);
+      const preview = manualpreview(record2, Date.now());
+      await memory.addmanualrun(preview);
+      await audit("trigger", `The user opened the manual run preview of the workflow ${record2.name} with its ${preview.preview.length} expanded step${preview.preview.length === 1 ? "" : "s"}; nothing runs before the confirmation.`, {});
+      return { manualrun: preview, workflowname: record2.name };
+    }
+    case "confirmmanualrun": {
+      const inputconfirm = message;
+      const stored = (await memory.listmanualruns()).find((entry) => entry.id === (inputconfirm.previewid ?? ""));
+      if (!stored) throw new Error(`No manual run preview matches ${inputconfirm.previewid ?? ""}.`);
+      if (typeof inputconfirm.confirmed !== "boolean") throw new Error("The manual run confirmation needs the reviewed confirmed flag.");
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || session.stoppedat || session.pausedat || session.expiresat <= Date.now()) throw new Error("Confirming a manual run needs a live, unpaused browser session behind the consent gates.");
+      if (!plan || plan.state !== "approved") throw new Error("Confirming a manual run needs the approved plan review.");
+      const record2 = await memory.getworkflowrecord(stored.workflowid);
+      if (!record2) throw new Error("The workflow of the manual run preview is no longer composed in the library.");
+      const decided = confirmmanualrun(stored, inputconfirm.confirmed, Date.now());
+      await memory.addmanualrun(decided);
+      if (!inputconfirm.confirmed) {
+        await audit("trigger", `The user cancelled the manual run of the workflow ${record2.name} after its step preview; nothing ran.`, { sessionid: session.id, planid: plan.id });
+        return { confirmed: false };
+      }
+      const runstep2 = { id: `manual${decided.id}`, kind: "runworkflow", summary: `The manual run of ${record2.name}`, risk: "sensitive", options: JSON.stringify({ workflowid: record2.id, reviewed: true }) };
+      const output = await executeworkflowstep(runstep2, session, plan, session.tabid, session.origin).catch((error) => ({ ok: false, summary: error instanceof Error ? error.message : String(error), details: {} }));
+      await audit("trigger", `The user approved the manual run of the workflow ${record2.name} after its ${decided.preview.length} step preview; the run ended ${output.ok ? "done" : "failed"}.`, { sessionid: session.id, planid: plan.id });
+      return { confirmed: true, runid: output.details?.runid, state: output.ok ? "done" : "failed" };
+    }
+    case "firetrigger": {
+      const inputfire = message;
+      const rule = await memory.gettriggerule(inputfire.ruleid ?? "");
+      if (!rule) throw new Error(`No armed trigger rule matches ${inputfire.ruleid ?? ""}.`);
+      const result = await firetrigger(rule, "manual");
+      return { fired: result.fired, ...result.queued !== void 0 ? { queued: result.queued } : {}, ...result.suppressed !== void 0 ? { suppressed: result.suppressed } : {} };
+    }
+    case "receivewebhook": {
+      const inputwebhook = message;
+      const rule = await memory.gettriggerule(inputwebhook.ruleid ?? "");
+      if (!rule || rule.kind !== "webhook") throw new Error(`No webhook rule matches ${inputwebhook.ruleid ?? ""}.`);
+      const verification = verifywebhook({ rule, secret: inputwebhook.secret ?? "", payload: inputwebhook.payload });
+      if (!verification.verified) {
+        await memory.settriggerule(updaterule(rule, { stats: { suppressions: rule.stats.suppressions + 1 } }));
+        await audit("trigger", `A webhook delivery for the rule ${rule.id} was refused: ${verification.reason}; only secret verified payloads ever persist.`, {});
+        return { verified: false, reason: verification.reason };
+      }
+      await memory.addwebhookpayload(rule.id, inputwebhook.payload, Date.now());
+      const result = await firetrigger(rule, "webhook", void 0, void 0, inputwebhook.payload);
+      return { verified: true, fired: result.fired, ...result.queued !== void 0 ? { queued: result.queued } : {}, ...result.suppressed !== void 0 ? { suppressed: result.suppressed } : {} };
+    }
+    case "rotatetriggersecret": {
+      const inputrotate = message;
+      const rule = await memory.gettriggerule(inputrotate.ruleid ?? "");
+      if (!rule || rule.kind !== "webhook") throw new Error(`No webhook rule matches ${inputrotate.ruleid ?? ""}.`);
+      const bytes = crypto.getRandomValues(new Uint8Array(24));
+      const secret = [...bytes].map((byte) => (byte % 36).toString(36)).join("").padEnd(24, "7x9k2m").slice(0, 24);
+      const rotated = { ...rule, secret, state: { ...rule.state }, stats: { ...rule.stats } };
+      await memory.settriggerule(rotated);
+      await audit("trigger", `The user rotated the shared secret of the webhook rule ${rule.id}; the previous secret stops verifying immediately and the new secret was shown once.`, {});
+      return { ruleid: rule.id, secret };
+    }
+    case "settriggerretention": {
+      const inputretention = message;
+      const settings = await memory.getsettings();
+      const retention = typeof inputretention.retention === "number" && Number.isInteger(inputretention.retention) && inputretention.retention >= 0 ? inputretention.retention : void 0;
+      await memory.setsettings({ ...settings, ...retention !== void 0 ? { triggerretention: retention } : {} });
+      await audit("configure", `The user set the trigger fire retention to ${retention === void 0 ? "keep every fire record" : `${retention} fire record${retention === 1 ? "" : "s"}`}; the rule counters always survive and no code ceiling applies.`);
+      return { triggerretention: retention };
+    }
+    case "triggerhistory": {
+      const inputhistory = message;
+      const fires = await memory.listtriggerfires(inputhistory.ruleid);
+      return { fires };
+    }
+    case "buttontrigger": {
+      const rules = (await memory.gettriggerules()).filter((rule) => rule.kind === "button" && rule.state.enabled && rule.state.pausedat === void 0);
+      if (rules.length === 0) return { fired: false, reason: "No enabled button rule is armed." };
+      const results = [];
+      for (const rule of rules) results.push({ ruleid: rule.id, ...await firetrigger(rule, "button") });
+      return { fired: results.some((entry) => entry.fired), rules: results };
+    }
+    case "triggerfiredreport": {
+      const fires = await memory.listtriggerfires();
+      return triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() });
+    }
     default:
       throw new Error("Unknown Devthink request.");
   }
@@ -16128,4 +17117,78 @@ chrome.runtime.onConnect.addListener((port) => {
     handlerequest(message, port.sender ?? {}).then((value) => port.postMessage({ ok: true, value })).catch((error) => port.postMessage({ ok: false, error: error instanceof Error ? error.message : String(error) }));
   });
 });
+{
+  const webnavigation = chrome.webNavigation;
+  try {
+    webnavigation?.onCommitted?.addListener((details) => {
+      if (details.frameId !== 0 || !details.url.startsWith("https://")) return;
+      void evaluatenavigationtriggers(details.url).catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+{
+  const menus = chrome.contextMenus;
+  try {
+    menus?.onClicked?.addListener((info) => {
+      const menuid = typeof info.menuItemId === "string" ? info.menuItemId : "";
+      if (!menuid.startsWith("devthinktrigger")) return;
+      void (async () => {
+        const rule = await memory.gettriggerule(menuid.slice("devthinktrigger".length));
+        if (!rule) return;
+        await firetrigger(rule, "menu");
+      })().catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+{
+  const commands = chrome.commands;
+  try {
+    commands?.onCommand?.addListener((command) => {
+      void (async () => {
+        for (const { rule } of await memory.listtriggers()) {
+          if (rule.kind !== "key" || rule.command !== command) continue;
+          await firetrigger(rule, "key");
+        }
+      })().catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+{
+  const action = chrome.action;
+  try {
+    action?.onClicked?.addListener(() => {
+      void handlerequest({ kind: "buttontrigger" }, {}).catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+{
+  const alarms = chrome.alarms;
+  try {
+    alarms?.onAlarm?.addListener((alarm) => {
+      if (alarm.name !== "devthinktriggerwake") return;
+      void evaluatelistedtriggers().then(() => draintriggerqueue()).catch(() => {
+      });
+    });
+  } catch {
+  }
+}
+setInterval(() => {
+  void evaluatelistedtriggers().then(() => draintriggerqueue()).catch(() => {
+  });
+}, 3e4);
+async function restoretriggers() {
+  await registermenurules();
+  await evaluatelistedtriggers();
+  await draintriggerqueue();
+}
+restoretriggers().catch(() => {
+});
 //# sourceMappingURL=background.js.map