@wenathlan/extension 1.1.52 → 1.1.53

package/extension/dist/background.js

@@ -2282,6 +2282,107 @@ var sessionmemory = class {
   async listmanualruns() {
     return await this.adapter.get("manualruns") ?? [];
   }
+  /** Stores one workflow version record with its change note; saving the same version again replaces its note while older versions survive for the timeline. */
+  async addworkflowversion(version) {
+    const versions = (await this.listworkflowversions()).filter((entry) => !(entry.workflowid === version.workflowid && entry.version === version.version));
+    await this.adapter.set("workflowversions", [version, ...versions]);
+  }
+  /** Returns every stored workflow version record, newest first, optionally filtered to one workflow. */
+  async listworkflowversions(workflowid) {
+    const versions = await this.adapter.get("workflowversions") ?? [];
+    return workflowid === void 0 ? versions : versions.filter((entry) => entry.workflowid === workflowid);
+  }
+  /** Stores one version diff result for the history view. */
+  async addversiondiff(diff) {
+    const diffs = (await this.listversiondiffs()).filter((entry) => !(entry.workflowid === diff.workflowid && entry.from === diff.from && entry.to === diff.to));
+    await this.adapter.set("versiondiffs", [diff, ...diffs]);
+  }
+  /** Returns every stored version diff result, newest first, optionally filtered to one workflow. */
+  async listversiondiffs(workflowid) {
+    const diffs = await this.adapter.get("versiondiffs") ?? [];
+    return workflowid === void 0 ? diffs : diffs.filter((entry) => entry.workflowid === workflowid);
+  }
+  /** Records one run history entry — the outcome, duration and trigger cause of one execution — under the user configured retention window with no code ceiling. */
+  async addrunhistory(entry) {
+    const entries = await this.gethistory();
+    const combined = [entry, ...entries];
+    const retention = (await this.getsettings())?.runhistoryretention;
+    await this.adapter.set("runhistory", retention === void 0 ? combined : combined.slice(0, retention));
+  }
+  /** Returns the stored run history, newest first, filtered by workflow, outcome and time floor; the filters stay user choices. */
+  async gethistory(filter) {
+    const entries = await this.adapter.get("runhistory") ?? [];
+    let filtered = entries;
+    if (filter?.workflowid !== void 0) filtered = filtered.filter((entry) => entry.workflowid === filter.workflowid);
+    if (filter?.outcome !== void 0) filtered = filtered.filter((entry) => entry.outcome === filter.outcome);
+    if (filter?.since !== void 0) filtered = filtered.filter((entry) => entry.endedat >= filter.since);
+    if (filter?.limit !== void 0) filtered = filtered.slice(0, filter.limit);
+    return filtered;
+  }
+  /** Stores the editor layout of one workflow so the canvas reopens exactly as left. */
+  async seteditorlayout(workflowid, layout) {
+    return this.adapter.set(`editorlayout${workflowid}`, layout);
+  }
+  /** Returns the stored editor layout of one workflow. */
+  async geteditorlayout(workflowid) {
+    return await this.adapter.get(`editorlayout${workflowid}`) ?? void 0;
+  }
+  /** Stores the breakpoint step ids of one workflow. */
+  async setworkflowbreakpoints(workflowid, stepids) {
+    return this.adapter.set(`workflowbreakpoints${workflowid}`, stepids);
+  }
+  /** Returns the stored breakpoint step ids of one workflow, oldest first. */
+  async getworkflowbreakpoints(workflowid) {
+    return await this.adapter.get(`workflowbreakpoints${workflowid}`) ?? [];
+  }
+  /** Stores one per site policy override; re-adding the same id replaces its deltas. */
+  async addsiteoverride(override) {
+    const overrides = (await this.listsiteoverrides()).filter((entry) => entry.id !== override.id);
+    await this.adapter.set("siteoverrides", [override, ...overrides]);
+  }
+  /** Returns every stored per site override, newest first, optionally filtered to one workflow. */
+  async listsiteoverrides(workflowid) {
+    const overrides = await this.adapter.get("siteoverrides") ?? [];
+    return workflowid === void 0 ? overrides : overrides.filter((entry) => entry.workflowid === workflowid);
+  }
+  /** Removes one per site override when the user deletes it. */
+  async removesiteoverride(id) {
+    await this.adapter.set("siteoverrides", (await this.listsiteoverrides()).filter((entry) => entry.id !== id));
+  }
+  /** Stores one watchdog event with its recovery outcome; the event history keeps the audit trail of every scan. */
+  async addwatchdogevent(event) {
+    const events = (await this.listwatchdogevents()).filter((entry) => entry.id !== event.id);
+    await this.adapter.set("watchdogevents", [event, ...events]);
+  }
+  /** Returns every stored watchdog event, newest first. */
+  async listwatchdogevents() {
+    return await this.adapter.get("watchdogevents") ?? [];
+  }
+  /** Stores one pending workflow import held for review; approving it later stores the record as runnable. */
+  async addworkflowimport(entry) {
+    const imports = (await this.listworkflowimports()).filter((candidate) => candidate.id !== entry.id);
+    await this.adapter.set("workflowimports", [entry, ...imports]);
+  }
+  /** Returns every pending workflow import, newest first. */
+  async listworkflowimports() {
+    return await this.adapter.get("workflowimports") ?? [];
+  }
+  /** Removes one pending import when the user approves or rejects it. */
+  async removeworkflowimport(id) {
+    await this.adapter.set("workflowimports", (await this.listworkflowimports()).filter((entry) => entry.id !== id));
+  }
+  /** Stores the per workflow background run flags so a workflow keeps running with the panel closed. */
+  async setbackgroundruns(flags) {
+    return this.adapter.set("backgroundruns", flags);
+  }
+  /** Returns the per workflow background run flags. */
+  async getbackgroundruns() {
+    return await this.adapter.get("backgroundruns") ?? {};
+  }
+  /** Removes one stored workflow record version; a rejected import or rollback disappears from the library while every other version survives. */
+  async removeworkflowversion(id, version) {
+    await this.adapter.set("workflowrecords", (await this.getworkflowrecordversions()).filter((entry) => !(entry.id === id && entry.version === version)));
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -3942,6 +4043,14 @@ async function runcontrolstep(input) {
 
 // workflow.ts
 var workflowkinds = ["composeworkflow", "savetemplate", "runworkflow", "dryrun", "delay", "waitelement", "compute", "extractvars"];
+function nestedparamof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const candidate = value;
+  if (typeof candidate.name !== "string" || !/^[a-z][a-z0-9]*$/.test(candidate.name)) return void 0;
+  if (!variablekinds.includes(candidate.kind)) return void 0;
+  if (candidate.default !== void 0 && !["string", "number", "boolean"].includes(typeof candidate.default) && !Array.isArray(candidate.default)) return void 0;
+  return { name: candidate.name, kind: candidate.kind, ...candidate.default !== void 0 ? { default: candidate.default } : {} };
+}
 function workflowstepof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
   const candidate = value;
@@ -3951,6 +4060,7 @@ function workflowstepof(value) {
   if (candidate.target !== void 0 && (typeof candidate.target !== "string" || !candidate.target)) return void 0;
   if (candidate.value !== void 0 && typeof candidate.value !== "string") return void 0;
   if (candidate.options !== void 0 && typeof candidate.options !== "string") return void 0;
+  if (candidate.breakpoint !== void 0 && typeof candidate.breakpoint !== "boolean") return void 0;
   const bindings = Array.isArray(candidate.bindings) ? candidate.bindings.flatMap((binding) => bindingof(binding) !== void 0 ? [bindingof(binding)] : []) : void 0;
   if (candidate.bindings !== void 0 && bindings === void 0) return void 0;
   if (Array.isArray(candidate.bindings) && bindings !== void 0 && bindings.length !== candidate.bindings.length) return void 0;
@@ -3958,14 +4068,20 @@ function workflowstepof(value) {
   if (candidate.expression !== void 0 && expression === void 0) return void 0;
   const extract = candidate.extract === void 0 ? void 0 : regexruleof(candidate.extract);
   if (candidate.extract !== void 0 && extract === void 0) return void 0;
-  return { id: candidate.id, kind: candidate.kind, label: candidate.label, ...candidate.target !== void 0 ? { target: candidate.target } : {}, ...candidate.value !== void 0 ? { value: candidate.value } : {}, ...candidate.options !== void 0 ? { options: candidate.options } : {}, ...bindings !== void 0 && bindings.length > 0 ? { bindings } : {}, ...expression !== void 0 ? { expression } : {}, ...extract !== void 0 ? { extract } : {} };
+  const params = Array.isArray(candidate.params) ? candidate.params.flatMap((param) => nestedparamof(param) !== void 0 ? [nestedparamof(param)] : []) : void 0;
+  if (candidate.params !== void 0 && params === void 0) return void 0;
+  if (Array.isArray(candidate.params) && params !== void 0 && params.length !== candidate.params.length) return void 0;
+  return { id: candidate.id, kind: candidate.kind, label: candidate.label, ...candidate.target !== void 0 ? { target: candidate.target } : {}, ...candidate.value !== void 0 ? { value: candidate.value } : {}, ...candidate.options !== void 0 ? { options: candidate.options } : {}, ...bindings !== void 0 && bindings.length > 0 ? { bindings } : {}, ...expression !== void 0 ? { expression } : {}, ...extract !== void 0 ? { extract } : {}, ...candidate.breakpoint === true ? { breakpoint: true } : {}, ...params !== void 0 && params.length > 0 ? { params } : {} };
 }
 function blockinvocationof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
   const candidate = value;
   if (typeof candidate.block !== "string" || !candidate.block.trim()) return void 0;
   if (typeof candidate.label !== "string" || !candidate.label.trim()) return void 0;
-  return { block: candidate.block, label: candidate.label };
+  const params = Array.isArray(candidate.params) ? candidate.params.flatMap((param) => nestedparamof(param) !== void 0 ? [nestedparamof(param)] : []) : void 0;
+  if (candidate.params !== void 0 && params === void 0) return void 0;
+  if (Array.isArray(candidate.params) && params !== void 0 && params.length !== candidate.params.length) return void 0;
+  return { block: candidate.block, label: candidate.label, ...params !== void 0 && params.length > 0 ? { params } : {} };
 }
 function workflowblockof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -4044,10 +4160,15 @@ function regexruleof(value) {
 function expandblocks(steps, blocks) {
   const byname = new Map(blocks.map((block) => [block.name, block]));
   const expanded = [];
-  const visit = (entries, path, inside) => {
+  const visit = (entries, path, inside, params) => {
+    let stamped = params === void 0;
     for (const entry of entries) {
       if ("kind" in entry && "label" in entry && !("block" in entry)) {
-        expanded.push(inside === void 0 ? entry : { ...entry, block: inside });
+        const marked = inside === void 0 ? entry : { ...entry, block: inside };
+        if (!stamped && params !== void 0) {
+          expanded.push({ ...marked, params });
+          stamped = true;
+        } else expanded.push(marked);
         continue;
       }
       const invocation = blockinvocationof(entry);
@@ -4055,7 +4176,7 @@ function expandblocks(steps, blocks) {
       if (path.includes(invocation.block)) throw new Error(`The block ${invocation.block} recurs inside itself and cannot expand.`);
       const block = byname.get(invocation.block);
       if (!block) throw new Error(`The block ${invocation.block} is not defined in the workflow.`);
-      visit(block.steps, [...path, invocation.block], invocation.block);
+      visit(block.steps, [...path, invocation.block], invocation.block, invocation.params ?? params);
     }
   };
   visit(steps, [], void 0);
@@ -4423,6 +4544,17 @@ async function runworkflow(input) {
     if (step.block !== void 0 && step.block !== activeblock) {
       scopes = pushscope(scopes, step.block, scopes[scopes.length - 1].name);
       activeblock = step.block;
+      if (step.params) {
+        try {
+          for (const param of step.params) {
+            if (param.default === void 0) continue;
+            scopes = setvariable(scopes, param.name, param.kind, coercevariable(param.default, param.kind), input.now);
+          }
+        } catch (error) {
+          const reason = error instanceof Error ? error.message : String(error);
+          return { run: { ...run, state: "failed", endedat: Date.now(), failreason: `The nested parameter of block ${step.block} failed: ${reason}` }, scopes, log, outputs };
+        }
+      }
     } else if (step.block === void 0 && activeblock !== void 0) {
       while (scopes.length > 1) scopes = popscope(scopes);
       activeblock = void 0;
@@ -4455,6 +4587,27 @@ function dryrunworkflow(input) {
   }
   return { run: { ...run, state: "done", cursor: input.record.steps.length, endedat: input.now }, scopes, log };
 }
+function watchdogpass(input) {
+  const verdicts = [];
+  for (const run of input.runs) {
+    if (run.state !== "running") continue;
+    const lastcompletedat = input.lastcompletedat[run.id] ?? run.startedat;
+    const live = input.liveexecutors.includes(run.id);
+    const silence = input.now - lastcompletedat;
+    if (!live && input.config.zombiewindow !== void 0 && silence >= input.config.zombiewindow) {
+      verdicts.push({ runid: run.id, verdict: "zombie", action: "reap", reason: `The run ${run.id} lost its executor ${silence} ms ago and reaps as a zombie of a browser shutdown at its last checkpoint ${run.cursor}.`, ...lastcompletedat !== run.startedat ? { lastcompletedat } : {} });
+      continue;
+    }
+    if (!live) continue;
+    if (silence >= input.config.stallthreshold) {
+      const action = input.config.action;
+      verdicts.push({ runid: run.id, verdict: "stalled", action, reason: `The run ${run.id} completed no step for ${silence} ms past the reviewed threshold and the watchdog recovers it with ${action} at cursor ${run.cursor}.`, ...lastcompletedat !== run.startedat ? { lastcompletedat } : {} });
+      continue;
+    }
+    verdicts.push({ runid: run.id, verdict: "healthy", action: "none", reason: `The run ${run.id} completed its last step ${silence} ms ago and stays healthy.`, ...lastcompletedat !== run.startedat ? { lastcompletedat } : {} });
+  }
+  return verdicts;
+}
 
 // trigger.ts
 var triggerkinds = ["visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"];
@@ -7838,6 +7991,134 @@ function canpreview(input) {
   if (!targetactions.has(input.step.kind) && options.targetref === void 0) return { allowed: false, reason: "Only a target-based action can be previewed." };
   return validatestep(input.step, input.origin);
 }
+function reviewedkinds() {
+  return [...allowedactions].sort();
+}
+function editorsavegate(input) {
+  const gate = sessiongate({ session: input.session, tabid: input.session?.tabid ?? 0, origin: input.session?.origin ?? "https://example.com", now: input.now, action: "save the workflow editor canvas" });
+  if (!gate.allowed) return gate;
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Editor saves need the approved plan review before a new workflow version composes." };
+  const model = input.model;
+  if (typeof model.name !== "string" || !model.name.trim()) return { allowed: false, reason: "The workflow name of the canvas must be a non-empty string." };
+  if (typeof model.version !== "number" || !Number.isInteger(model.version) || model.version < 1) return { allowed: false, reason: "The workflow version of the canvas must be a positive integer." };
+  if (!Array.isArray(model.origins) || model.origins.length === 0) return { allowed: false, reason: "The canvas needs at least one granted HTTPS origin." };
+  const ids = /* @__PURE__ */ new Set();
+  for (const node of model.nodes) {
+    if (node.step === void 0 === (node.invocation === void 0)) return { allowed: false, reason: "Every canvas node must be exactly one workflow step or one block invocation." };
+    const id = node.id ?? (node.step !== void 0 ? node.step.id : node.invocation.block);
+    if (!id || ids.has(id)) return { allowed: false, reason: `The canvas node id ${id || "(empty)"} must be unique.` };
+    ids.add(id);
+  }
+  const reachable = /* @__PURE__ */ new Set();
+  for (const node of model.nodes) {
+    if (node.step !== void 0) {
+      reachable.add(node.step.id);
+      continue;
+    }
+    const walk = (entries) => {
+      for (const entry of entries) {
+        if (typeof entry.id === "string" && typeof entry.kind === "string") {
+          reachable.add(entry.id);
+          continue;
+        }
+        if (typeof entry.block === "string") {
+          const nested = model.blocks.find((candidate) => candidate.name === entry.block);
+          if (nested) walk(nested.steps);
+        }
+      }
+    };
+    const block = model.blocks.find((candidate) => candidate.name === node.invocation.block);
+    if (!block) return { allowed: false, reason: `The block ${node.invocation.block} of the canvas has no definition.` };
+    walk(block.steps);
+  }
+  let order = 0;
+  const positionof = /* @__PURE__ */ new Map();
+  for (const node of model.nodes) {
+    if (node.step !== void 0) {
+      positionof.set(node.step.id, order);
+      order += 1;
+      continue;
+    }
+    const walk = (entries) => {
+      for (const entry of entries) {
+        if (typeof entry.id === "string" && typeof entry.kind === "string") {
+          positionof.set(entry.id, order);
+          order += 1;
+          continue;
+        }
+        if (typeof entry.block === "string") {
+          const nested = model.blocks.find((candidate) => candidate.name === entry.block);
+          if (nested) walk(nested.steps);
+        }
+      }
+    };
+    walk(model.blocks.find((candidate) => candidate.name === node.invocation.block).steps);
+  }
+  for (const edge of model.edges) {
+    if (!reachable.has(edge.from)) return { allowed: false, reason: `The canvas edge of ${edge.variable} references the unknown source step ${edge.from}.` };
+    if (!reachable.has(edge.to)) return { allowed: false, reason: `The canvas edge of ${edge.variable} references the unknown target step ${edge.to}.` };
+    if ((positionof.get(edge.from) ?? -1) >= (positionof.get(edge.to) ?? -1)) return { allowed: false, reason: `The canvas edge of ${edge.variable} runs backwards and would form a cycle.` };
+  }
+  return { allowed: true };
+}
+function runreviewgranted(record2) {
+  if (record2.reviewstate === "pending") return { allowed: false, reason: "The workflow stays unreviewed: the import or rollback review must approve its expanded step list before any run." };
+  return { allowed: true };
+}
+var overrideknobs = ["loopbound", "stepms", "runms", "waitms", "delaybase"];
+function validatesiteoverride(override) {
+  if (typeof override.pattern !== "string" || !override.pattern.startsWith("https://") || !/[a-z0-9.-]+/i.test(override.pattern.slice(8))) return { allowed: false, reason: "The override pattern must be an https origin or a `*` subdomain glob of one." };
+  if (!override.pattern.includes("*")) {
+    try {
+      if (new URL(override.pattern).origin !== override.pattern) return { allowed: false, reason: "The override pattern must be a bare https origin or a `*` subdomain glob, never a path." };
+    } catch {
+      return { allowed: false, reason: "The override pattern must parse as an https origin or a `*` subdomain glob of one." };
+    }
+  }
+  for (const [knob, delta] of Object.entries(override.deltas)) {
+    if (!overrideknobs.includes(knob)) return { allowed: false, reason: `The override knob ${knob} is not one of the reviewed knobs: ${overrideknobs.join(", ")}.` };
+    if (typeof delta !== "number" || !Number.isFinite(delta) || delta <= 0) return { allowed: false, reason: `The override delta of ${knob} must be a positive user value with no code ceiling.` };
+  }
+  return { allowed: true };
+}
+function exportcontentreview(file) {
+  const secretkeys = /(secret|token|apikey|api_key|password|authorization|credential)/i;
+  const scan = (label, options) => {
+    if (options === void 0) return void 0;
+    let payload;
+    try {
+      payload = JSON.parse(options);
+    } catch {
+      return void 0;
+    }
+    const walk = (value, path) => {
+      if (!value || typeof value !== "object") return void 0;
+      for (const [key, entry] of Object.entries(value)) {
+        if (secretkeys.test(key)) return { allowed: false, reason: `The export of ${label} carries the secret field ${path}${key} and secrets never leave the browser.` };
+        const nested = walk(entry, `${path}${key}.`);
+        if (nested !== void 0) return nested;
+      }
+      return void 0;
+    };
+    return walk(payload, "");
+  };
+  for (const step of file.workflow.steps) {
+    const refusal = scan(`the step ${step.id}`, step.options);
+    if (refusal !== void 0) return refusal;
+  }
+  for (const template of file.templates) {
+    const refusal = scan(`the template ${template.name}`, template.step.options);
+    if (refusal !== void 0) return refusal;
+  }
+  return { allowed: true };
+}
+function watchdogconfigvalid(config) {
+  if (typeof config.enabled !== "boolean") return { allowed: false, reason: "The watchdog enabled flag must be a boolean." };
+  if (typeof config.stallthreshold !== "number" || !Number.isFinite(config.stallthreshold) || config.stallthreshold <= 0) return { allowed: false, reason: "The watchdog stall threshold must be a positive number of milliseconds with no code ceiling." };
+  if (!["retry", "pause", "cancel"].includes(config.action)) return { allowed: false, reason: "The watchdog recovery action must be retry, pause or cancel." };
+  if (config.zombiewindow !== void 0 && (typeof config.zombiewindow !== "number" || !Number.isFinite(config.zombiewindow) || config.zombiewindow <= 0)) return { allowed: false, reason: "The watchdog zombie window, when configured, must be a positive number of milliseconds with no code ceiling." };
+  return { allowed: true };
+}
 
 // progress.ts
 function emptyprogress(planid, now) {
@@ -8012,7 +8293,7 @@ function recordtrigger(progress, planid, stepid, entry, now) {
 }
 
 // version.ts
-var packageversion = "1.1.52";
+var packageversion = "1.1.53";
 
 // types.ts
 var protocolversion = packageversion;
@@ -8525,6 +8806,36 @@ function triggersummaryof(rule) {
   if (rule.schema !== void 0) summary.fields = rule.schema.length;
   return summary;
 }
+var workflowfileversion = 1;
+function editorstate(input) {
+  const editor = { versions: input.versions, diffs: input.diffs ?? [], history: input.history, breakpoints: input.breakpoints ?? [], overrides: input.overrides, imports: input.imports, backgroundruns: input.backgroundruns ?? {}, watchdog: { ...input.watchdog.config !== void 0 ? { config: input.watchdog.config } : {}, events: input.watchdog.events } };
+  return { version: protocolversion, editor, ...input.model !== void 0 ? { model: input.model } : {} };
+}
+function runhistoryquery(value) {
+  if (value === void 0 || value === null) return {};
+  const candidate = record(value);
+  const query = {};
+  if (candidate.workflowid !== void 0) {
+    if (typeof candidate.workflowid !== "string" || !candidate.workflowid.trim()) throw new Error("The run history workflow filter must be a non-empty string.");
+    query.workflowid = candidate.workflowid;
+  }
+  if (candidate.outcome !== void 0) {
+    if (typeof candidate.outcome !== "string" || !candidate.outcome.trim()) throw new Error("The run history outcome filter must be a non-empty string.");
+    query.outcome = candidate.outcome;
+  }
+  if (candidate.since !== void 0) {
+    if (typeof candidate.since !== "number" || !Number.isFinite(candidate.since)) throw new Error("The run history time floor must be a finite timestamp.");
+    query.since = candidate.since;
+  }
+  if (candidate.limit !== void 0) {
+    if (typeof candidate.limit !== "number" || !Number.isInteger(candidate.limit) || candidate.limit < 1) throw new Error("The run history entry count must be a positive integer with no code ceiling.");
+    query.limit = candidate.limit;
+  }
+  return query;
+}
+function runhistoryreport(input) {
+  return { version: protocolversion, entries: input.entries, query: input.query ?? {} };
+}
 
 // capture.ts
 var capturekinds = ["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"];
@@ -9101,6 +9412,488 @@ async function runbrowseraction(step, sessiontabid, windowid) {
   }
 }
 
+// workfloweditor.ts
+var palettecategories = ["actions", "controlflow", "waits", "variables", "triggers"];
+var palettenodes = [
+  { kind: "click", label: "Click an element", category: "actions", description: "Clicks the reviewed selector target." },
+  { kind: "type", label: "Type text", category: "actions", description: "Types the reviewed text into the target field." },
+  { kind: "navigate", label: "Navigate", category: "actions", description: "Navigates the tab to the reviewed url." },
+  { kind: "readtext", label: "Read text", category: "actions", description: "Reads the text of the target element." },
+  { kind: "scrapetable", label: "Scrape a table", category: "actions", description: "Extracts the reviewed table into a dataset." },
+  { kind: "fillform", label: "Fill a form", category: "actions", description: "Fills the reviewed form fields from a saved profile." },
+  { kind: "querytabs", label: "Query tabs", category: "actions", description: "Lists the tabs matching the reviewed query." },
+  { kind: "fetchurl", label: "Fetch a url", category: "actions", description: "Fetches the reviewed endpoint behind the call consent." },
+  { kind: "condition", label: "Condition", category: "controlflow", description: "Evaluates one reviewed boolean expression with no page side effect." },
+  { kind: "branch", label: "Branch", category: "controlflow", description: "Chooses one reviewed path by page state with a mandatory else path." },
+  { kind: "loop", label: "Loop a list", category: "controlflow", description: "Iterates a list variable binding the item and index per pass." },
+  { kind: "repeatuntil", label: "Repeat until", category: "controlflow", description: "Reruns the body until the convergence expression holds." },
+  { kind: "whileloop", label: "While loop", category: "controlflow", description: "Loops while the condition holds inside the reviewed bound." },
+  { kind: "foreach", label: "For each element", category: "controlflow", description: "Iterates the elements of the reviewed selector." },
+  { kind: "parallel", label: "Parallel branches", category: "controlflow", description: "Runs branches concurrently and joins them under the reviewed strategy." },
+  { kind: "trycatch", label: "Try catch", category: "controlflow", description: "Wraps fragile steps with a catch handler, retries and timeouts." },
+  { kind: "delay", label: "Delay", category: "waits", description: "Sleeps the reviewed base inside the jitter window." },
+  { kind: "waitelement", label: "Wait for element", category: "waits", description: "Polls the reviewed selector until appearance or timeout." },
+  { kind: "wait", label: "Wait", category: "waits", description: "Waits the reviewed duration." },
+  { kind: "waitfor", label: "Wait for target", category: "waits", description: "Waits until the reviewed target exists." },
+  { kind: "waittext", label: "Wait for text", category: "waits", description: "Waits until the reviewed text appears." },
+  { kind: "waitquiet", label: "Wait for quiet", category: "waits", description: "Waits until the page stops mutating." },
+  { kind: "waitload", label: "Wait for load", category: "waits", description: "Waits until the navigation settles." },
+  { kind: "compute", label: "Compute", category: "variables", description: "Evaluates one reviewed expression into the result variable." },
+  { kind: "extractvars", label: "Extract variables", category: "variables", description: "Applies the reviewed regex and stores the named captures." },
+  { kind: "savetemplate", label: "Save template", category: "variables", description: "Shares the reviewed step as a reusable template." },
+  { kind: "visitrule", label: "Visit rule", category: "triggers", description: "Fires on navigations to the reviewed origins." },
+  { kind: "urlrule", label: "Url rule", category: "triggers", description: "Fires when the url matches the reviewed glob pattern." },
+  { kind: "cronrule", label: "Cron rule", category: "triggers", description: "Fires on the reviewed five field cron schedule." },
+  { kind: "intervalrule", label: "Interval rule", category: "triggers", description: "Fires every reviewed period with the jitter spread." },
+  { kind: "webhookrule", label: "Webhook rule", category: "triggers", description: "Fires on a secret verified webhook delivery." },
+  { kind: "eventrule", label: "Event rule", category: "triggers", description: "Fires on the observed page events of the catalog." }
+];
+var optionschemas = {
+  delay: [{ name: "base", kind: "number", required: true }, { name: "jitter", kind: "number" }],
+  waitelement: [{ name: "timeout", kind: "number" }, { name: "poll", kind: "number" }],
+  compute: [{ name: "expression", kind: "string", required: true }],
+  extractvars: [{ name: "rule", kind: "string", required: true }],
+  composeworkflow: [{ name: "name", kind: "string", required: true }, { name: "version", kind: "number" }],
+  runworkflow: [{ name: "workflowid", kind: "string", required: true }, { name: "reviewed", kind: "boolean", required: true }, { name: "variables", kind: "string" }, { name: "background", kind: "boolean" }],
+  dryrun: [{ name: "workflowid", kind: "string", required: true }],
+  loop: [{ name: "loop", kind: "string", required: true }],
+  repeatuntil: [{ name: "repeatuntil", kind: "string", required: true }],
+  whileloop: [{ name: "whileloop", kind: "string", required: true }],
+  foreach: [{ name: "foreach", kind: "string", required: true }],
+  parallel: [{ name: "parallel", kind: "string", required: true }],
+  trycatch: [{ name: "trycatch", kind: "string", required: true }]
+};
+function stepcategory(kind) {
+  if (triggerkinds.includes(kind)) return "triggers";
+  if (controlflowkinds.includes(kind)) return "controlflow";
+  if (kind.startsWith("wait") || kind === "spawait" || kind === "delay") return "waits";
+  if (kind === "compute" || kind === "extractvars" || kind === "savetemplate") return "variables";
+  return "actions";
+}
+function buildsteplibrary(kinds) {
+  return [...new Set(kinds)].sort().map((kind) => ({ kind, category: stepcategory(kind), optionschema: optionschemas[kind] ?? [] }));
+}
+var noderowheight = 96;
+var blockcolumnwidth = 280;
+var canvasoriginx = 40;
+function nodeidof(node) {
+  return node.id ?? (node.step !== void 0 ? node.step.id : node.invocation !== void 0 ? node.invocation.block : "");
+}
+function layoutsizeof(nodes) {
+  const width = Math.max(640, ...nodes.map((node) => node.x + blockcolumnwidth)) + 40;
+  const height = Math.max(480, ...nodes.map((node) => node.y + noderowheight)) + 40;
+  return { width, height };
+}
+function loadworkflow(record2, layout) {
+  const blocks = record2.blocks.map((block) => ({ ...block, steps: block.steps.map((entry) => ({ ...entry })) }));
+  const blockcolumn = (blockname) => {
+    const index2 = blocks.findIndex((block) => block.name === blockname);
+    return index2 < 0 ? canvasoriginx : canvasoriginx + (index2 + 1) * blockcolumnwidth;
+  };
+  const invocationcount = /* @__PURE__ */ new Map();
+  const nodes = [];
+  const edges = [];
+  let index = 0;
+  while (index < record2.steps.length) {
+    const step = record2.steps[index];
+    for (const binding of step.bindings ?? []) edges.push({ from: binding.stepid, to: step.id, variable: binding.variable, kind: binding.kind, ...binding.path !== void 0 ? { path: binding.path } : {} });
+    if (step.block === void 0) {
+      const { bindings, block, params: params2, ...rest } = step;
+      void bindings;
+      void block;
+      void params2;
+      nodes.push({ step: { ...rest }, x: canvasoriginx, y: 60 + nodes.length * noderowheight });
+      index += 1;
+      continue;
+    }
+    const blockname = step.block;
+    let end = index;
+    while (end < record2.steps.length && record2.steps[end].block === blockname) end += 1;
+    const region = record2.steps.slice(index, end);
+    const count = (invocationcount.get(blockname) ?? 0) + 1;
+    invocationcount.set(blockname, count);
+    const params = region.flatMap((entry) => entry.params ?? []);
+    nodes.push({ id: count === 1 ? blockname : `${blockname}${count}`, invocation: { block: blockname, label: blockname, ...params.length > 0 ? { params: params.map((param) => ({ ...param })) } : {} }, x: blockcolumn(blockname), y: 60 + nodes.length * noderowheight });
+    index = end;
+  }
+  const size = layouttypeof(nodes, layout);
+  const model = { workflowid: record2.id, name: record2.name, version: record2.version, origins: [...record2.origins], nodes, edges, blocks, layout: size, minimap: emptyminimap(), dirty: false };
+  return { ...model, minimap: renderminimap(model).minimap };
+}
+function layouttypeof(nodes, layout) {
+  const size = layoutsizeof(nodes);
+  if (!layout) return { width: size.width, height: size.height, viewportx: 0, viewporty: 0, zoom: 1 };
+  return { width: Math.max(size.width, layout.width), height: Math.max(size.height, layout.height), viewportx: layout.viewportx, viewporty: layout.viewporty, zoom: layout.zoom };
+}
+function emptyminimap() {
+  return { width: 160, height: 100, scale: 0, zoom: 1, viewport: { x: 0, y: 0, width: 0, height: 0 } };
+}
+function saveworkflow(model, input) {
+  if (typeof model.name !== "string" || !model.name.trim()) throw new Error("The workflow name must be a non-empty string.");
+  if (typeof model.version !== "number" || !Number.isInteger(model.version) || model.version < 1) throw new Error("The workflow version must be a positive integer.");
+  if (!Array.isArray(model.origins) || model.origins.length === 0) throw new Error("A workflow needs at least one granted HTTPS origin.");
+  const ids = /* @__PURE__ */ new Set();
+  for (const node of model.nodes) {
+    if (node.step === void 0 === (node.invocation === void 0)) throw new Error("Every canvas node must be exactly one workflow step or one block invocation.");
+    const id = nodeidof(node);
+    if (!id || ids.has(id)) throw new Error(`The canvas node id ${id || "(empty)"} must be unique.`);
+    ids.add(id);
+  }
+  const positionof = /* @__PURE__ */ new Map();
+  let position = 0;
+  for (const node of model.nodes) {
+    if (node.step !== void 0) {
+      positionof.set(node.step.id, position);
+      position += 1;
+      continue;
+    }
+    const block = model.blocks.find((entry) => entry.name === node.invocation?.block);
+    if (!block) throw new Error(`The block ${node.invocation?.block ?? ""} of the canvas has no definition.`);
+    const walk = (entries2) => {
+      for (const entry of entries2) {
+        if ("kind" in entry && "label" in entry && !("block" in entry)) {
+          positionof.set(entry.id, position);
+          position += 1;
+          continue;
+        }
+        const nested = model.blocks.find((candidate) => candidate.name === entry.block);
+        if (!nested) throw new Error(`The block ${entry.block} of the canvas has no definition.`);
+        walk(nested.steps);
+      }
+    };
+    walk(block.steps);
+  }
+  for (const edge of model.edges) {
+    if (!positionof.has(edge.from)) throw new Error(`The edge of ${edge.variable} references the unknown source step ${edge.from}.`);
+    if (!positionof.has(edge.to)) throw new Error(`The edge of ${edge.variable} references the unknown target step ${edge.to}.`);
+    if (positionof.get(edge.from) >= positionof.get(edge.to)) throw new Error(`The edge of ${edge.variable} runs backwards from ${edge.from} into ${edge.to} and would form a cycle.`);
+  }
+  const bindingsof = (stepid) => model.edges.filter((edge) => edge.to === stepid).map((edge) => ({ variable: edge.variable, kind: edge.kind, stepid: edge.from, ...edge.path !== void 0 ? { path: edge.path } : {} }));
+  const entries = [];
+  const attached = /* @__PURE__ */ new Map();
+  for (const node of model.nodes) {
+    if (node.invocation !== void 0) {
+      entries.push({ ...node.invocation });
+      continue;
+    }
+    const step = node.step;
+    const bindings = bindingsof(step.id);
+    const { block, params, ...rest } = { ...step, ...bindings.length > 0 ? { bindings } : {} };
+    void params;
+    const carried = rest;
+    if (block !== void 0) {
+      if (!model.blocks.some((candidate) => candidate.name === block)) throw new Error(`The step ${step.id} attaches to the unknown block ${block}.`);
+      const list = attached.get(block) ?? [];
+      list.push(carried);
+      attached.set(block, list);
+      continue;
+    }
+    entries.push(carried);
+  }
+  const blocks = model.blocks.map((block) => {
+    const snapped = attached.get(block.name) ?? [];
+    const snappedids = new Set(snapped.map((step) => step.id));
+    const carried = [];
+    for (const entry of block.steps) {
+      if ("kind" in entry && "label" in entry && !("block" in entry) && snappedids.has(entry.id)) continue;
+      carried.push(entry);
+    }
+    const steps = [...carried, ...snapped];
+    const withbindings = [];
+    for (const entry of steps) {
+      if (!("kind" in entry && "label" in entry && !("block" in entry))) {
+        withbindings.push(entry);
+        continue;
+      }
+      const bindings = bindingsof(entry.id);
+      const { block: inner, params, ...rest } = { ...entry, ...bindings.length > 0 ? { bindings } : {} };
+      void inner;
+      void params;
+      withbindings.push(rest);
+    }
+    return { ...block, steps: withbindings };
+  });
+  const composed = composeworkflow({ id: model.workflowid, name: model.name, version: model.version, origins: [...model.origins], steps: entries, blocks: blocks.map((block) => ({ ...block })), now: input.now, ...input.kindallowed !== void 0 ? { kindallowed: input.kindallowed } : {}, ...input.riskof !== void 0 ? { riskof: input.riskof } : {} });
+  const checked = validateworkflow(composed, input.kindallowed !== void 0 ? { kindallowed: input.kindallowed } : {});
+  if (!checked.allowed) throw new Error(checked.reason ?? "The canvas model failed the workflow grammar.");
+  return composed;
+}
+function renderminimap(model, width = 160, height = 100) {
+  if (!Number.isFinite(width) || width <= 0 || !Number.isFinite(height) || height <= 0) throw new Error("The mini map size must be positive.");
+  const canvaswidth = Math.max(1, model.layout.width);
+  const canvasheight = Math.max(1, model.layout.height);
+  const scale = Math.min(width / canvaswidth, height / canvasheight);
+  const zoom = model.layout.zoom > 0 ? model.layout.zoom : 1;
+  const visiblewidth = canvaswidth / zoom;
+  const visibleheight = canvasheight / zoom;
+  const viewport = {
+    x: Math.max(0, Math.min(model.layout.viewportx, canvaswidth)) * scale,
+    y: Math.max(0, Math.min(model.layout.viewporty, canvasheight)) * scale,
+    width: visiblewidth * scale,
+    height: visibleheight * scale
+  };
+  const nodes = model.nodes.map((node) => ({ id: nodeidof(node), x: node.x * scale, y: node.y * scale }));
+  return { minimap: { width, height, scale, zoom, viewport }, nodes };
+}
+function runtobreakpoint(input) {
+  const cursor = input.cursor !== void 0 && Number.isInteger(input.cursor) && input.cursor >= 0 ? input.cursor : 0;
+  const marked = new Set(input.breakpoints);
+  for (let index = cursor; index < input.record.steps.length; index += 1) {
+    const step = input.record.steps[index];
+    if (step.breakpoint === true || marked.has(step.id)) {
+      return { until: index, pausat: step.id, remaining: input.record.steps.length - index };
+    }
+  }
+  return { until: input.record.steps.length, pausat: void 0, remaining: 0 };
+}
+function diffversions(from, to, now) {
+  const fromsteps = new Map(from.steps.map((step) => [step.id, step]));
+  const tosteps = new Map(to.steps.map((step) => [step.id, step]));
+  const added = [];
+  const removed = [];
+  const changed = [];
+  for (const step of to.steps) {
+    const prior = fromsteps.get(step.id);
+    if (!prior) {
+      added.push({ stepid: step.id, kind: step.kind, label: step.label });
+      continue;
+    }
+    const changes = [];
+    if (prior.label !== step.label) changes.push("label");
+    if (prior.kind !== step.kind) changes.push("kind");
+    if (prior.target !== step.target) changes.push("target");
+    if (prior.value !== step.value) changes.push("value");
+    if (prior.options !== step.options) changes.push("options");
+    if (JSON.stringify(prior.expression) !== JSON.stringify(step.expression)) changes.push("expression");
+    if (JSON.stringify(prior.extract) !== JSON.stringify(step.extract)) changes.push("extract");
+    if (JSON.stringify(prior.bindings) !== JSON.stringify(step.bindings)) changes.push("bindings");
+    if (changes.length > 0) changed.push({ stepid: step.id, kind: step.kind, label: step.label, changes });
+  }
+  for (const step of from.steps) {
+    if (!tosteps.has(step.id)) removed.push({ stepid: step.id, kind: step.kind, label: step.label });
+  }
+  return { workflowid: to.id, from: from.version, to: to.version, added, removed, changed, at: now };
+}
+function exportworkflow(record2, format, note, now) {
+  const file = { format: workflowfileversion, exportedat: now ?? Date.now(), workflow: record2, ...note !== void 0 && note.trim() !== "" ? { note } : {}, templates: [] };
+  return { format, contents: serializefile(file, format), file };
+}
+function shareworkflow(record2, templates, format, note, now) {
+  const file = { format: workflowfileversion, exportedat: now ?? Date.now(), workflow: record2, ...note !== void 0 && note.trim() !== "" ? { note } : {}, templates: templates.map((template) => ({ ...template })) };
+  return { format, contents: serializefile(file, format), file };
+}
+function importworkflow(input) {
+  const format = input.format ?? (input.contents.trimStart().startsWith("{") ? "json" : "yaml");
+  const parsed = parsefile(input.contents, format);
+  if (parsed.format !== workflowfileversion) throw new Error(`The workflow file format ${String(parsed.format)} is not the reviewed format ${workflowfileversion}.`);
+  const candidate = parsed.workflow;
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) throw new Error("The workflow file carries no workflow record.");
+  const fields = candidate;
+  const stepsvalue = fields.steps;
+  if (!Array.isArray(stepsvalue) || stepsvalue.length === 0) throw new Error("An imported workflow needs at least one step.");
+  const steps = [];
+  for (const entry of stepsvalue) {
+    const step = workflowstepof(entry);
+    if (step) {
+      steps.push(step);
+      continue;
+    }
+    throw new Error("Every imported workflow entry must be a reviewed step.");
+  }
+  const composed = composeworkflow({
+    id: typeof fields.id === "string" && fields.id.trim() !== "" ? fields.id : crypto.randomUUID(),
+    name: typeof fields.name === "string" ? fields.name : "",
+    version: typeof fields.version === "number" ? fields.version : 1,
+    origins: Array.isArray(fields.origins) ? fields.origins.filter((origin) => typeof origin === "string") : [],
+    steps,
+    now: input.now ?? Date.now(),
+    ...input.kindallowed !== void 0 ? { kindallowed: input.kindallowed } : {},
+    ...input.riskof !== void 0 ? { riskof: input.riskof } : {}
+  });
+  const templatesvalue = parsed.templates;
+  if (templatesvalue !== void 0 && !Array.isArray(templatesvalue)) throw new Error("The packed templates of the workflow file must be a list.");
+  const templates = [];
+  for (const entry of templatesvalue ?? []) {
+    const template = steptemplateof(entry);
+    if (!template) throw new Error("A packed template of the workflow file does not carry one reviewed step.");
+    templates.push(template);
+  }
+  const record2 = { ...composed, reviewstate: "pending" };
+  return { record: record2, templates, file: { ...parsed, workflow: record2 } };
+}
+function originmatches(pattern, origin) {
+  if (pattern === origin) return true;
+  const glob = pattern.replace(/\./g, "\\.").replace(/\*/g, "[^.]+");
+  if (!glob.startsWith("https://")) return false;
+  return new RegExp(`^${glob}$`).test(origin);
+}
+function applyoverride(record2, override) {
+  const matching = record2.origins.filter((origin) => originmatches(override.pattern, origin));
+  if (matching.length === 0) throw new Error(`The override pattern ${override.pattern} matches none of the workflow origins ${record2.origins.join(", ")}.`);
+  const knobs = /* @__PURE__ */ new Set(["loopbound", "stepms", "runms", "waitms", "delaybase"]);
+  for (const knob of Object.keys(override.deltas)) {
+    if (!knobs.has(knob)) throw new Error(`The override knob ${knob} is not one of the reviewed knobs: ${[...knobs].join(", ")}.`);
+    if (typeof override.deltas[knob] !== "number" || !Number.isFinite(override.deltas[knob]) || override.deltas[knob] <= 0) throw new Error(`The override delta of ${knob} must be a positive number with no code ceiling.`);
+  }
+  const apply = (step) => {
+    if (Object.keys(override.deltas).length === 0) return step;
+    let payload = {};
+    try {
+      payload = step.options !== void 0 ? JSON.parse(step.options) : {};
+    } catch {
+      payload = {};
+    }
+    const bodyof = (key) => payload[key] !== void 0 && typeof payload[key] === "object" && !Array.isArray(payload[key]) ? payload[key] : {};
+    if (override.deltas.loopbound !== void 0 && ["loop", "repeatuntil", "whileloop"].includes(step.kind)) {
+      const body = bodyof(step.kind);
+      body.bound = override.deltas.loopbound;
+      payload[step.kind] = body;
+    }
+    if ((override.deltas.stepms !== void 0 || override.deltas.runms !== void 0) && step.kind === "trycatch") {
+      const body = bodyof("trycatch");
+      const timeout = body.timeout !== void 0 && typeof body.timeout === "object" && !Array.isArray(body.timeout) ? body.timeout : {};
+      if (override.deltas.stepms !== void 0) timeout.stepms = override.deltas.stepms;
+      if (override.deltas.runms !== void 0) timeout.runms = override.deltas.runms;
+      body.timeout = timeout;
+      payload.trycatch = body;
+    }
+    if (override.deltas.waitms !== void 0 && step.kind === "waitelement") {
+      payload.timeout = override.deltas.waitms;
+    }
+    if (override.deltas.delaybase !== void 0 && step.kind === "delay") {
+      payload.base = override.deltas.delaybase;
+    }
+    const changed = Object.keys(payload).length > 0;
+    return changed ? { ...step, options: JSON.stringify(payload) } : step;
+  };
+  return { ...record2, steps: record2.steps.map(apply) };
+}
+function serializefile(file, format) {
+  if (format === "json") return JSON.stringify(file, null, 2);
+  return yamlvalue(file, 0).join("\n") + "\n";
+}
+function parsefile(contents, format) {
+  if (format === "json") {
+    const parsed = JSON.parse(contents);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("The workflow file is not a json object.");
+    return parsed;
+  }
+  const lines = contents.split(/\r?\n/).map((line) => line.replace(/\t/g, "  ")).filter((line) => line.trim() !== "" && !line.trim().startsWith("#"));
+  if (lines.length === 0) throw new Error("The yaml workflow file is empty.");
+  const { value, next } = yamlblock(lines, 0, indentof(lines[0]));
+  if (next < lines.length) throw new Error("The yaml workflow file carries content outside the documented subset.");
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("The yaml workflow file is not a mapping.");
+  return value;
+}
+function indentof(line) {
+  const match = /^ */.exec(line);
+  return match ? match[0].length : 0;
+}
+function yamlscalar(value) {
+  if (value === null || value === void 0) return "null";
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return JSON.stringify(String(value));
+}
+function yamlvalue(value, indent) {
+  const pad = " ".repeat(indent);
+  if (value === null || value === void 0 || typeof value !== "object") return [`${pad}${yamlscalar(value)}`];
+  if (Array.isArray(value)) {
+    if (value.length === 0) return [`${pad}[]`];
+    const lines2 = [];
+    for (const item of value) {
+      if (item !== null && typeof item === "object") {
+        lines2.push(`${pad}-`);
+        lines2.push(...yamlvalue(item, indent + 2));
+      } else {
+        lines2.push(`${pad}- ${yamlscalar(item)}`);
+      }
+    }
+    return lines2;
+  }
+  const entries = Object.entries(value);
+  if (entries.length === 0) return [`${pad}{}`];
+  const lines = [];
+  for (const [key, entry] of entries) {
+    if (entry !== null && typeof entry === "object") {
+      if (Array.isArray(entry) && entry.length === 0) {
+        lines.push(`${pad}${key}: []`);
+        continue;
+      }
+      if (!Array.isArray(entry) && Object.keys(entry).length === 0) {
+        lines.push(`${pad}${key}: {}`);
+        continue;
+      }
+      lines.push(`${pad}${key}:`);
+      lines.push(...yamlvalue(entry, indent + 2));
+    } else {
+      lines.push(`${pad}${key}: ${yamlscalar(entry)}`);
+    }
+  }
+  return lines;
+}
+function yamlblock(lines, start, indent) {
+  const first = lines[start];
+  if (/^\s*-\s/.test(first) || /^\s*-$/.test(first)) {
+    const items = [];
+    let index2 = start;
+    while (index2 < lines.length) {
+      const line = lines[index2];
+      if (indentof(line) !== indent || !/^\s*-\s?/.test(line)) break;
+      const rest = line.slice(indent + 1).trim();
+      if (rest !== "") {
+        items.push(yamlscalarvalue(rest));
+        index2 += 1;
+        continue;
+      }
+      const nested = yamlblock(lines, index2 + 1, indent + 2);
+      items.push(nested.value);
+      index2 = nested.next;
+    }
+    return { value: items, next: index2 };
+  }
+  const mapping = {};
+  let index = start;
+  while (index < lines.length) {
+    const line = lines[index];
+    if (indentof(line) !== indent) break;
+    const match = /^([A-Za-z][A-Za-z0-9]*):(?:\s(.*))?$/.exec(line.slice(indent));
+    if (!match) break;
+    const key = match[1];
+    const rest = match[2];
+    if (rest !== void 0 && rest !== "") {
+      if (rest === "[]") {
+        mapping[key] = [];
+        index += 1;
+        continue;
+      }
+      if (rest === "{}") {
+        mapping[key] = {};
+        index += 1;
+        continue;
+      }
+      mapping[key] = yamlscalarvalue(rest);
+      index += 1;
+      continue;
+    }
+    const nested = yamlblock(lines, index + 1, indent + 2);
+    mapping[key] = nested.value;
+    index = nested.next;
+  }
+  if (index === start) throw new Error("The yaml workflow file left the documented subset.");
+  return { value: mapping, next: index };
+}
+function yamlscalarvalue(text2) {
+  if (text2.startsWith('"')) {
+    const parsed = JSON.parse(text2);
+    return typeof parsed === "string" ? parsed : text2;
+  }
+  if (text2 === "true") return true;
+  if (text2 === "false") return false;
+  if (text2 === "null") return null;
+  if (/^-?\d+(?:\.\d+)?$/.test(text2)) return Number(text2);
+  return text2;
+}
+
 // extension/pagesession.ts
 function capturepagestate(sections) {
   const wants = (section) => sections.includes(section);
@@ -14853,12 +15646,24 @@ function workflowstepofentry(value) {
 async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
   const options = stepoptions2(step);
   const workflowid = typeof options.workflowid === "string" ? options.workflowid : "";
-  const record2 = await memory.getworkflowrecord(workflowid);
-  if (!record2) throw new Error(`No composed workflow matches ${workflowid || "the reviewed id"}.`);
-  for (const workfloworigin of record2.origins) {
+  const storedrecord = await memory.getworkflowrecord(workflowid);
+  if (!storedrecord) throw new Error(`No composed workflow matches ${workflowid || "the reviewed id"}.`);
+  for (const workfloworigin of storedrecord.origins) {
     if (!origingranted(session, workfloworigin)) throw new Error(`The workflow origin ${workfloworigin} falls outside the session grants.`);
   }
-  const run = newworkflowrun({ workflowid: record2.id, dryrun: dry, now: Date.now() });
+  const reviewgate = runreviewgranted(storedrecord);
+  if (!reviewgate.allowed) throw new Error(reviewgate.reason ?? "The workflow stays unreviewed until its import or rollback review approves the expanded step list.");
+  let record2 = storedrecord;
+  for (const override of await memory.listsiteoverrides(storedrecord.id)) {
+    try {
+      record2 = applyoverride(record2, override);
+      await audit("workflow", `Applied the per site override ${override.id} of the pattern ${override.pattern} to the workflow ${record2.name}: ${Object.entries(override.deltas).map(([knob, delta]) => `${knob} ${delta}`).join(", ") || "no delta"}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    } catch (error) {
+      await audit("workflow", `Skipped the per site override ${override.id} of the pattern ${override.pattern} for the workflow ${storedrecord.name}: ${error instanceof Error ? error.message : String(error)}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    }
+  }
+  const backgroundflag = (await memory.getbackgroundruns())[record2.id] === true || options.background === true;
+  const run = { ...newworkflowrun({ workflowid: record2.id, dryrun: dry, now: Date.now() }), ...backgroundflag === true && !dry ? { background: true } : {} };
   await memory.setworkflowrun(run);
   await memory.setrunscopes(run.id, runscopes(options.variables));
   if (dry) {
@@ -14870,6 +15675,30 @@ async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
     await audit("workflow", `The dry run of the workflow ${record2.name} evaluated ${evaluated.log.length} step${evaluated.log.length === 1 ? "" : "s"} read only; ${refused} step${refused === 1 ? "" : "s"} refused for lacking a read only projection and nothing was mutated.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
     return { ok: true, summary: `The dry run evaluated ${evaluated.log.length} steps read only; ${refused} refused for lacking a read only projection.`, details: { runid: run.id, state: evaluated.run.state, dryrun: true, executed: evaluated.log.length - refused, refused, total: record2.steps.length } };
   }
+  if (run.background === true) {
+    await audit("workflow", `Started the background run ${run.id} of the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} reviewed steps; the panel may close, every step checkpoints and the worker wake restores the run through the same gates.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+    void performworkflowrun({ record: record2, run, step, session, plan, tabid: tabid2, origin, options, dry }).catch(async (error) => {
+      const reason = error instanceof Error ? error.message : String(error);
+      await memory.setworkflowrun({ ...run, state: "failed", endedat: Date.now(), failreason: reason });
+      await memory.addrunhistory({ runid: run.id, workflowid: record2.id, outcome: "failed", steps: run.cursor, total: record2.steps.length, duration: Date.now() - run.startedat, cause: runcauseof(options), startedat: run.startedat, endedat: Date.now() });
+      await audit("error", `The background run ${run.id} of the workflow ${record2.name} failed: ${reason}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
+      await refreshbadge().catch(() => {
+      });
+    });
+    return { ok: true, summary: `The workflow run ${run.id} started in the background with ${record2.steps.length} reviewed steps and the panel may close; the checkpoints restore it on every worker wake.`, details: { runid: run.id, state: "running", background: true, executed: 0, total: record2.steps.length } };
+  }
+  return await performworkflowrun({ record: record2, run, step, session, plan, tabid: tabid2, origin, options, dry });
+}
+function runcauseof(options) {
+  const variables = options.variables;
+  if (variables !== null && typeof variables === "object" && !Array.isArray(variables)) {
+    const cause = variables.triggercause;
+    if (typeof cause === "string" && cause.trim() !== "") return cause;
+  }
+  return "manual";
+}
+async function performworkflowrun(input) {
+  const { record: record2, run, step, session, plan, tabid: tabid2, origin, options, dry } = input;
   const guards = { cancelled: false };
   activeworkflowruns.set(run.id, guards);
   await audit("workflow", `Started the run ${run.id} of the workflow ${record2.name} version ${record2.version} with ${record2.steps.length} reviewed steps; every step passes the session, plan review and origin gates.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
@@ -14951,6 +15780,8 @@ async function executeworkflowrun(step, session, plan, tabid2, origin, dry) {
   }
   const executed = result.run.cursor;
   await memory.setprogress(recordworkflow(await memory.getprogress(), plan.id, step.id, { family: "run", detail: `Ran the workflow ${record2.name}`, runid: run.id, executed, total: record2.steps.length }, Date.now()));
+  const endedat = result.run.endedat ?? Date.now();
+  await memory.addrunhistory({ runid: run.id, workflowid: record2.id, outcome: result.run.state, steps: executed, total: record2.steps.length, duration: Math.max(0, endedat - run.startedat), cause: runcauseof(options), startedat: run.startedat, endedat, ...dry === true ? { dryrun: true } : {} });
   await audit("workflow", `The run ${run.id} of the workflow ${record2.name} ended ${result.run.state} after ${executed} of ${record2.steps.length} steps${result.run.failreason !== void 0 ? ` with the failure ${result.run.failreason}` : ""}.`, { sessionid: session.id, planid: plan.id, stepid: step.id });
   await refreshbadge();
   return { ok: result.run.state === "done", summary: `The workflow run ended ${result.run.state} after ${executed} of ${record2.steps.length} steps.`, details: { runid: run.id, state: result.run.state, executed, total: record2.steps.length, ...result.run.failreason !== void 0 ? { failreason: result.run.failreason } : {} } };
@@ -15506,7 +16337,7 @@ async function handlerequest(message, sender) {
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, trigger: triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() }), triggerretention: runsettings?.triggerretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id), control: await memory.listcontroldecisions(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, trigger: triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() }), triggerretention: runsettings?.triggerretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id), control: await memory.listcontroldecisions(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, runhistoryretention: runsettings?.runhistoryretention, editor: editorstate({ versions: await memory.listworkflowversions(), diffs: await memory.listversiondiffs(), history: await memory.gethistory(), overrides: await memory.listsiteoverrides(), imports: (await memory.listworkflowimports()).map((entry) => ({ id: entry.id, workflowid: entry.record.id, name: entry.record.name, version: entry.record.version, steps: entry.record.steps.length, risk: entry.record.risk, importedat: entry.importedat, ...entry.filename !== void 0 ? { filename: entry.filename } : {} })), backgroundruns: await memory.getbackgroundruns(), watchdog: { ...runsettings?.watchdog !== void 0 ? { config: runsettings.watchdog } : {}, events: await memory.listwatchdogevents() } }), ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -16728,8 +17559,13 @@ async function handlerequest(message, sender) {
       if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Workflow runs need an active browser session behind the consent gates.");
       const record2 = await memory.getworkflowrecord(inputapprove.workflowid?.trim() ?? "");
       if (!record2) throw new Error(`No composed workflow matches ${inputapprove.workflowid ?? ""}.`);
-      await audit("workflow", `The user approved the run review of the workflow ${record2.name} version ${record2.version} with its ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"} shown; the run still passes every consent gate per step.`, { sessionid: session.id });
-      return { approved: true, steps: record2.steps.length, risk: record2.risk };
+      if (record2.reviewstate === "pending") {
+        await memory.addworkflowrecord({ ...record2, reviewstate: "approved" });
+        await memory.removeworkflowversion(record2.id, record2.version).catch(() => {
+        });
+      }
+      await audit("workflow", `The user approved the run review of the workflow ${record2.name} version ${record2.version} with its ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"} shown${record2.reviewstate === "pending" ? "; the pending import or rollback review cleared and the workflow may run again" : ""}; the run still passes every consent gate per step.`, { sessionid: session.id });
+      return { approved: true, steps: record2.steps.length, risk: record2.risk, ...record2.reviewstate === "pending" ? { reviewstate: "approved" } : {} };
     }
     case "executeworkflowstep": {
       const inputsingle = message;
@@ -16775,8 +17611,8 @@ async function handlerequest(message, sender) {
       const guards = activeworkflowruns.get(stored.id);
       if (guards) guards.cancelled = true;
       const paused = pauserun(stored, Date.now());
-      await memory.setworkflowrun(paused);
-      await audit("workflow", `Paused the workflow run ${paused.id} at the checkpoint of step cursor ${paused.cursor}; the resume continues exactly there.`, {});
+      await memory.setworkflowrun({ ...paused, pausekind: "user" });
+      await audit("workflow", `Paused the workflow run ${paused.id} at the checkpoint of step cursor ${paused.cursor}; the resume continues exactly there and the worker wake never auto-resumes a user pause.`, {});
       await refreshbadge();
       return { runid: paused.id, state: paused.state, cursor: paused.cursor };
     }
@@ -16801,6 +17637,27 @@ async function handlerequest(message, sender) {
         }
         return await dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin });
       };
+      const debugbreakpoints = Array.isArray(message.breakpoints) ? message.breakpoints.filter((id) => typeof id === "string") : void 0;
+      if (debugbreakpoints !== void 0) {
+        const startcursor = stored.run.cursor;
+        let segment = runtobreakpoint({ record: record2, cursor: startcursor, breakpoints: debugbreakpoints });
+        if (segment.until === startcursor && startcursor < record2.steps.length) segment = runtobreakpoint({ record: record2, cursor: startcursor + 1, breakpoints: debugbreakpoints });
+        if (segment.until === startcursor) {
+          await memory.setworkflowrun({ ...stored.run, state: "paused", pausedat: Date.now(), cursor: startcursor });
+          return { runid: stored.run.id, state: "paused", cursor: startcursor, ...segment.pausat !== void 0 ? { pausat: segment.pausat } : {}, remaining: segment.remaining };
+        }
+        const segmentresult = await runworkflowsegment({ record: record2, run: stored.run, startcursor, until: segment.until, session, plan, tabid: tab.id, origin, scopes, log, storedentries, execute: executeresume });
+        if (segmentresult.failed !== void 0) {
+          await memory.setworkflowrun({ ...stored.run, state: "failed", endedat: Date.now(), cursor: segmentresult.run.cursor, failreason: segmentresult.failed });
+          await audit("workflow", `The debug resume of the run ${stored.run.id} failed at step cursor ${segmentresult.run.cursor}: ${segmentresult.failed}.`, { sessionid: session.id, planid: plan.id });
+          await refreshbadge();
+          return { runid: stored.run.id, state: "failed", cursor: segmentresult.run.cursor, failreason: segmentresult.failed };
+        }
+        await memory.setworkflowrun({ ...stored.run, state: "paused", pausedat: Date.now(), cursor: segment.until });
+        await audit("workflow", `The debug resume of the run ${stored.run.id} ran ${segment.until - startcursor} step${segment.until - startcursor === 1 ? "" : "s"} and paused at the breakpoint ${segment.pausat ?? "end"} of step cursor ${segment.until}; ${segment.remaining} step${segment.remaining === 1 ? "" : "s"} remain.`, { sessionid: session.id, planid: plan.id });
+        await refreshbadge();
+        return { runid: stored.run.id, state: "paused", cursor: segment.until, ...segment.pausat !== void 0 ? { pausat: segment.pausat } : {}, remaining: segment.remaining };
+      }
       const resumed = await runworkflow({ record: record2, run: stored.run, scopes, log, execute: executeresume, now: Date.now(), gates: { sessionactive: Boolean(session && !session.stoppedat && !session.pausedat && session.expiresat > Date.now()), planapproved: plan.state === "approved", origingranted: (workfloworigin) => origingranted(session, workfloworigin) }, oncheckpoint: async (state) => {
         await memory.setworkflowrun(state.run);
         for (const entry of state.log.slice(storedentries)) await memory.addrunlogentry(state.run.id, entry);
@@ -17018,10 +17875,369 @@ async function handlerequest(message, sender) {
       const fires = await memory.listtriggerfires();
       return triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() });
     }
+    case "runtobreakpoint": {
+      const inputdebug = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      if (!session || session.stoppedat || session.pausedat || session.expiresat <= Date.now()) throw new Error("Debug runs need a live, unpaused browser session behind the consent gates.");
+      if (!plan || plan.state !== "approved") throw new Error("Debug runs need the approved plan review.");
+      const record2 = await memory.getworkflowrecord(inputdebug.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputdebug.workflowid ?? ""}.`);
+      for (const workfloworigin of record2.origins) {
+        if (!origingranted(session, workfloworigin)) throw new Error(`The workflow origin ${workfloworigin} falls outside the session grants.`);
+      }
+      const reviewgate = runreviewgranted(record2);
+      if (!reviewgate.allowed) throw new Error(reviewgate.reason ?? "The workflow stays unreviewed until its import or rollback review approves the expanded step list.");
+      const marked = [.../* @__PURE__ */ new Set([...await memory.getworkflowbreakpoints(record2.id), ...record2.steps.filter((step) => step.breakpoint === true).map((step) => step.id)])];
+      const segment = runtobreakpoint({ record: record2, cursor: 0, breakpoints: marked });
+      if (segment.pausat === void 0) throw new Error("No breakpoint marks any step of the workflow; mark one on the canvas before the debug run starts.");
+      const run = newworkflowrun({ workflowid: record2.id, now: Date.now() });
+      await memory.setworkflowrun(run);
+      await memory.setrunscopes(run.id, []);
+      if (segment.until === 0) {
+        await memory.setworkflowrun({ ...run, state: "paused", pausedat: Date.now(), cursor: 0 });
+        await audit("workflow", `The debug run ${run.id} of the workflow ${record2.name} paused at the first breakpoint ${segment.pausat} before any step ran; ${record2.steps.length} step${record2.steps.length === 1 ? "" : "s"} remain.`, { sessionid: session.id, planid: plan.id });
+        await refreshbadge();
+        return { runid: run.id, state: "paused", cursor: 0, pausat: segment.pausat, remaining: record2.steps.length };
+      }
+      const { tab, origin } = await activecontext();
+      const executedebug = async (dispatched, stepcontext) => {
+        if (iscontrolflowkind(dispatched.kind)) {
+          const controlled = await runcontrolstep({ step: dispatched, scopes: stepcontext.scopes, outputs: stepcontext.outputs ?? {}, execute: executedebug, now: Date.now(), runid: run.id, pagestate: await pagestateof(tab.id), resolveelements: async (selector) => await resolveelements(tab.id, selector) });
+          return { ...controlled.output, scopes: controlled.scopes, log: controlled.log };
+        }
+        return await dispatchworkflowstep(dispatched, { session, plan, tabid: tab.id, origin });
+      };
+      const segmentresult = await runworkflowsegment({ record: record2, run, startcursor: 0, until: segment.until, session, plan, tabid: tab.id, origin, scopes: [{ name: "root", variables: [] }], log: [], storedentries: 0, execute: executedebug });
+      if (segmentresult.failed !== void 0) {
+        await memory.setworkflowrun({ ...run, state: "failed", endedat: Date.now(), cursor: segmentresult.run.cursor, failreason: segmentresult.failed });
+        await memory.addrunhistory({ runid: run.id, workflowid: record2.id, outcome: "failed", steps: segmentresult.run.cursor, total: record2.steps.length, duration: Date.now() - run.startedat, cause: "debug", startedat: run.startedat, endedat: Date.now() });
+        await audit("workflow", `The debug run ${run.id} of the workflow ${record2.name} failed at step cursor ${segmentresult.run.cursor} before the breakpoint ${segment.pausat}: ${segmentresult.failed}.`, { sessionid: session.id, planid: plan.id });
+        await refreshbadge();
+        return { runid: run.id, state: "failed", cursor: segmentresult.run.cursor, failreason: segmentresult.failed };
+      }
+      await memory.setworkflowrun({ ...run, state: "paused", pausedat: Date.now(), cursor: segment.until });
+      await memory.addrunhistory({ runid: run.id, workflowid: record2.id, outcome: "paused", steps: segment.until, total: record2.steps.length, duration: Date.now() - run.startedat, cause: "debug", startedat: run.startedat, endedat: Date.now() });
+      await audit("workflow", `The debug run ${run.id} of the workflow ${record2.name} ran ${segment.until} step${segment.until === 1 ? "" : "s"} and paused at the breakpoint ${segment.pausat}; ${segment.remaining} step${segment.remaining === 1 ? "" : "s"} remain and the resume continues exactly there.`, { sessionid: session.id, planid: plan.id });
+      await refreshbadge();
+      return { runid: run.id, state: "paused", cursor: segment.until, pausat: segment.pausat, remaining: segment.remaining };
+    }
+    case "editormodel": {
+      const inputmodel = message;
+      const record2 = await memory.getworkflowrecord(inputmodel.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputmodel.workflowid ?? ""}.`);
+      const layout = await memory.geteditorlayout(record2.id);
+      const model = loadworkflow(record2, layout);
+      const breakpoints = await memory.getworkflowbreakpoints(record2.id);
+      const nodes = model.nodes.map((node) => node.step !== void 0 && breakpoints.includes(node.step.id) && node.step.breakpoint !== true ? { step: { ...node.step, breakpoint: true }, x: node.x, y: node.y } : node);
+      return { model: { ...model, nodes }, record: record2, versions: await memory.listworkflowversions(record2.id), breakpoints };
+    }
+    case "editorsave": {
+      const inputsave = message;
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      const model = inputsave.model;
+      if (!model) throw new Error("The editor save needs the canvas model.");
+      const gate = editorsavegate({ session, plan, model, now: Date.now() });
+      if (!gate.allowed) throw new Error(gate.reason ?? "The editor save failed its consent gate.");
+      const record2 = saveworkflow(model, { now: Date.now(), kindallowed: (kind) => {
+        try {
+          actionrisk(kind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, riskof: (kind) => actionrisk(kind) });
+      await memory.addworkflowrecord(record2);
+      await memory.addworkflowversion({ workflowid: record2.id, version: record2.version, createdat: Date.now(), note: typeof inputsave.note === "string" && inputsave.note.trim() !== "" ? inputsave.note.trim() : `Edited on the canvas with ${record2.steps.length} expanded steps`, steps: record2.steps.length, risk: record2.risk });
+      await memory.seteditorlayout(record2.id, model.layout);
+      await memory.setworkflowbreakpoints(record2.id, model.nodes.flatMap((node) => node.step?.breakpoint === true ? [node.step.id] : []));
+      await audit("workflow", `The user saved the workflow ${record2.name} as version ${record2.version} from the canvas editor: ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"} graded ${record2.risk}; the composition ran the full workflow grammar and every older version survives for the timeline.`, { ...session !== void 0 ? { sessionid: session.id } : {}, ...plan !== void 0 ? { planid: plan.id } : {} });
+      return { workflowid: record2.id, version: record2.version, steps: record2.steps.length, risk: record2.risk };
+    }
+    case "seteditorlayout": {
+      const inputlayout = message;
+      const workflowid = inputlayout.workflowid?.trim() ?? "";
+      const layout = inputlayout.layout;
+      if (!workflowid || !layout || !Number.isFinite(layout.width) || !Number.isFinite(layout.height) || !Number.isFinite(layout.zoom) || layout.zoom <= 0) throw new Error("The layout save needs the workflow id and a positive canvas layout.");
+      await memory.seteditorlayout(workflowid, layout);
+      return { workflowid, saved: true };
+    }
+    case "setworkflowbreakpoints": {
+      const inputbreakpoints = message;
+      const workflowid = inputbreakpoints.workflowid?.trim() ?? "";
+      if (!workflowid) throw new Error("The breakpoint save needs the workflow id.");
+      const stepids = Array.isArray(inputbreakpoints.stepids) ? inputbreakpoints.stepids.filter((id) => typeof id === "string" && id.trim() !== "") : [];
+      await memory.setworkflowbreakpoints(workflowid, stepids);
+      await audit("workflow", `The user set ${stepids.length} breakpoint${stepids.length === 1 ? "" : "s"} on the workflow ${workflowid}; a debug run pauses before every marked step.`, {});
+      return { workflowid, breakpoints: stepids.length };
+    }
+    case "steplibrarystore": {
+      return { categories: palettecategories, palette: palettenodes, library: buildsteplibrary(reviewedkinds()) };
+    }
+    case "importworkflow": {
+      const inputimport = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Importing a workflow file needs an active browser session behind the consent gates.");
+      if (typeof inputimport.contents !== "string" || inputimport.contents.trim() === "") throw new Error("The workflow import needs the file contents.");
+      const format = inputimport.format === "yaml" ? "yaml" : inputimport.format === "json" ? "json" : inputimport.contents.trimStart().startsWith("{") ? "json" : "yaml";
+      const loaded = importworkflow({ contents: inputimport.contents, format, now: Date.now(), kindallowed: (kind) => {
+        try {
+          actionrisk(kind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, riskof: (kind) => actionrisk(kind) });
+      const importid = randomid();
+      await memory.addworkflowrecord(loaded.record);
+      await memory.addworkflowimport({ id: importid, record: loaded.record, importedat: Date.now(), ...typeof inputimport.filename === "string" && inputimport.filename.trim() !== "" ? { filename: inputimport.filename.trim() } : {} });
+      for (const template of loaded.templates) await memory.addsteptemplate(template);
+      await audit("workflow", `Imported the workflow ${loaded.record.name} version ${loaded.record.version} from a ${format} file with ${loaded.record.steps.length} expanded step${loaded.record.steps.length === 1 ? "" : "s"} and ${loaded.templates.length} packed template${loaded.templates.length === 1 ? "" : "s"}; the record stays unreviewed until the import review approves its step list.`, { sessionid: session.id });
+      return { importid, workflowid: loaded.record.id, name: loaded.record.name, version: loaded.record.version, steps: loaded.record.steps.length, risk: loaded.record.risk, reviewstate: "pending", templates: loaded.templates.length };
+    }
+    case "approveimport": {
+      const inputapproveimport = message;
+      const session = await memory.getsession();
+      const pending = (await memory.listworkflowimports()).find((entry) => entry.id === (inputapproveimport.importid ?? ""));
+      if (!pending) throw new Error(`No pending workflow import matches ${inputapproveimport.importid ?? ""}.`);
+      const approved = { ...pending.record, reviewstate: "approved" };
+      await memory.addworkflowrecord(approved);
+      await memory.removeworkflowimport(pending.id);
+      await audit("workflow", `The user approved the import review of the workflow ${approved.name} version ${approved.version} with its ${approved.steps.length} expanded step${approved.steps.length === 1 ? "" : "s"} shown; the workflow may now run behind the same gates as every composed workflow.`, { ...session !== void 0 ? { sessionid: session.id } : {} });
+      return { workflowid: approved.id, version: approved.version, reviewstate: "approved" };
+    }
+    case "rejectimport": {
+      const inputreject = message;
+      const session = await memory.getsession();
+      const pending = (await memory.listworkflowimports()).find((entry) => entry.id === (inputreject.importid ?? ""));
+      if (!pending) throw new Error(`No pending workflow import matches ${inputreject.importid ?? ""}.`);
+      await memory.removeworkflowversion(pending.record.id, pending.record.version);
+      await memory.removeworkflowimport(pending.id);
+      await audit("workflow", `The user rejected the import review of the workflow ${pending.record.name} version ${pending.record.version}; the pending record left the library and nothing of the import runs.`, { ...session !== void 0 ? { sessionid: session.id } : {} });
+      return { rejected: true, importid: pending.id };
+    }
+    case "exportworkflow": {
+      const inputexport = message;
+      const session = await memory.getsession();
+      const record2 = await memory.getworkflowrecord(inputexport.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputexport.workflowid ?? ""}.`);
+      const format = inputexport.format === "yaml" ? "yaml" : "json";
+      const exported = exportworkflow(record2, format, typeof inputexport.note === "string" ? inputexport.note : void 0, Date.now());
+      const review = exportcontentreview(exported.file);
+      if (!review.allowed) throw new Error(review.reason ?? "The export carries a secret field and secrets never leave the browser.");
+      await audit("workflow", `Exported the workflow ${record2.name} version ${record2.version} as a ${format} file with ${record2.steps.length} expanded step${record2.steps.length === 1 ? "" : "s"}; the export content review verified that no secret field leaves the browser.`, { ...session !== void 0 ? { sessionid: session.id } : {} });
+      return { format, contents: exported.contents, filename: `${record2.name.replace(/[^a-z0-9]+/gi, "-").toLowerCase()}-v${record2.version}.${format}` };
+    }
+    case "shareworkflow": {
+      const inputshare = message;
+      const session = await memory.getsession();
+      const record2 = await memory.getworkflowrecord(inputshare.workflowid?.trim() ?? "");
+      if (!record2) throw new Error(`No composed workflow matches ${inputshare.workflowid ?? ""}.`);
+      const format = inputshare.format === "yaml" ? "yaml" : "json";
+      const templates = await memory.getsteptemplates();
+      const shared = shareworkflow(record2, templates, format, typeof inputshare.note === "string" ? inputshare.note : void 0, Date.now());
+      const review = exportcontentreview(shared.file);
+      if (!review.allowed) throw new Error(review.reason ?? "The share bundle carries a secret field and secrets never leave the browser.");
+      await audit("workflow", `Packed the workflow ${record2.name} version ${record2.version} with ${templates.length} shared step template${templates.length === 1 ? "" : "s"} into one ${format} share file; the export content review verified that no secret field leaves the browser.`, { ...session !== void 0 ? { sessionid: session.id } : {} });
+      return { format, contents: shared.contents, filename: `${record2.name.replace(/[^a-z0-9]+/gi, "-").toLowerCase()}-share-v${record2.version}.${format}` };
+    }
+    case "rollbackversion": {
+      const inputrollback = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("A version rollback needs an active browser session behind the consent gates.");
+      const versions = await memory.getworkflowrecordversions();
+      const target = versions.find((entry) => entry.id === (inputrollback.workflowid?.trim() ?? "") && entry.version === inputrollback.version);
+      if (!target) throw new Error(`No stored workflow version matches ${inputrollback.workflowid ?? ""} version ${String(inputrollback.version ?? "")}.`);
+      const latest = versions.filter((entry) => entry.id === target.id).reduce((max, entry) => Math.max(max, entry.version), 0);
+      const rolledback = composeworkflow({ id: target.id, name: target.name, version: latest + 1, origins: [...target.origins], steps: target.steps.map((step) => ({ ...step })), blocks: target.blocks.map((block) => ({ ...block })), now: Date.now(), kindallowed: (kind) => {
+        try {
+          actionrisk(kind);
+          return true;
+        } catch {
+          return false;
+        }
+      }, riskof: (kind) => actionrisk(kind) });
+      const pendingrollback = { ...rolledback, reviewstate: "pending" };
+      await memory.addworkflowrecord(pendingrollback);
+      await memory.addworkflowversion({ workflowid: rolledback.id, version: rolledback.version, createdat: Date.now(), note: `Rolled back to version ${target.version} of ${target.steps.length} steps`, steps: rolledback.steps.length, risk: rolledback.risk, rollback: true });
+      await audit("workflow", `The user rolled the workflow ${target.name} back to version ${target.version}; the restored steps stored as version ${rolledback.version} and the rollback review gates its first run like a fresh import.`, { sessionid: session.id });
+      return { workflowid: rolledback.id, version: rolledback.version, restoredfrom: target.version, steps: rolledback.steps.length, reviewstate: "pending" };
+    }
+    case "diffversions": {
+      const inputdiff = message;
+      const versions = await memory.getworkflowrecordversions();
+      const from = versions.find((entry) => entry.id === (inputdiff.workflowid?.trim() ?? "") && entry.version === inputdiff.from);
+      const to = versions.find((entry) => entry.id === (inputdiff.workflowid?.trim() ?? "") && entry.version === inputdiff.to);
+      if (!from || !to) throw new Error(`The version diff needs two stored versions of ${inputdiff.workflowid ?? ""}.`);
+      const diff = diffversions(from, to, Date.now());
+      await memory.addversiondiff(diff);
+      return diff;
+    }
+    case "runhistory": {
+      const query = runhistoryquery(message);
+      return runhistoryreport({ entries: await memory.gethistory(query), query });
+    }
+    case "setrunhistoryretention": {
+      const inputretention = message;
+      const settings = await memory.getsettings();
+      const retention = typeof inputretention.retention === "number" && Number.isInteger(inputretention.retention) && inputretention.retention >= 0 ? inputretention.retention : void 0;
+      await memory.setsettings({ ...settings, ...retention !== void 0 ? { runhistoryretention: retention } : {} });
+      await audit("configure", `The user set the run history retention to ${retention === void 0 ? "keep every entry" : `${retention} entr${retention === 1 ? "y" : "ies"}`}; no code ceiling applies.`);
+      return { runhistoryretention: retention };
+    }
+    case "setbackgroundrun": {
+      const inputbackground = message;
+      const workflowid = inputbackground.workflowid?.trim() ?? "";
+      if (!workflowid) throw new Error("The background run toggle needs the workflow id.");
+      const flags = await memory.getbackgroundruns();
+      const enabled = inputbackground.enabled === true;
+      await memory.setbackgroundruns({ ...flags, [workflowid]: enabled });
+      await audit("workflow", `The user ${enabled ? "enabled" : "disabled"} the background run toggle of the workflow ${workflowid}${enabled ? "; its runs keep executing in the service worker with the panel closed and every worker wake restores an interrupted run through the same gates" : ""}.`, {});
+      return { workflowid, enabled };
+    }
+    case "setwatchdog": {
+      const inputwatchdog = message;
+      const config = inputwatchdog.config;
+      if (!config) throw new Error("The watchdog save needs the configuration.");
+      const check = watchdogconfigvalid(config);
+      if (!check.allowed) throw new Error(check.reason ?? "The watchdog configuration failed its review.");
+      const settings = await memory.getsettings();
+      await memory.setsettings({ ...settings, watchdog: config });
+      await audit("configure", `The user configured the workflow watchdog: stall threshold ${config.stallthreshold} ms, recovery ${config.action}${config.zombiewindow !== void 0 ? `, zombie window ${config.zombiewindow} ms` : ""}; both stay user values with no code ceiling.`, {});
+      return { watchdog: config };
+    }
+    case "watchdogscan": {
+      const events = await runwatchdog();
+      return { events, config: (await memory.getsettings())?.watchdog };
+    }
+    case "setsiteoverride": {
+      const inputoverride = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("A per site override needs an active browser session behind the consent gates.");
+      const workflowid = inputoverride.workflowid?.trim() ?? "";
+      if (!workflowid) throw new Error("The per site override needs the workflow id.");
+      const record2 = await memory.getworkflowrecord(workflowid);
+      if (!record2) throw new Error(`No composed workflow matches ${workflowid}.`);
+      const deltas = inputoverride.deltas !== void 0 && typeof inputoverride.deltas === "object" && !Array.isArray(inputoverride.deltas) ? inputoverride.deltas : {};
+      const check = validatesiteoverride({ pattern: inputoverride.pattern ?? "", deltas });
+      if (!check.allowed) throw new Error(check.reason ?? "The per site override failed its review.");
+      const override = { id: typeof inputoverride.id === "string" && inputoverride.id.trim() !== "" ? inputoverride.id : randomid(), workflowid, pattern: inputoverride.pattern.trim(), deltas, createdat: Date.now() };
+      await memory.addsiteoverride(override);
+      await audit("workflow", `The user attached the per site override ${override.pattern} to the workflow ${record2.name}: ${Object.entries(deltas).map(([knob, delta]) => `${knob} ${delta}`).join(", ") || "no delta"}; the override adjusts only the reviewed knobs.`, { sessionid: session.id });
+      return { override };
+    }
+    case "removesiteoverride": {
+      const inputremove = message;
+      const removed = (await memory.listsiteoverrides()).find((entry) => entry.id === (inputremove.id ?? ""));
+      if (!removed) throw new Error(`No per site override matches ${inputremove.id ?? ""}.`);
+      await memory.removesiteoverride(removed.id);
+      await audit("workflow", `The user removed the per site override ${removed.pattern} of the workflow ${removed.workflowid}.`, {});
+      return { removed: removed.id };
+    }
     default:
       throw new Error("Unknown Devthink request.");
   }
 }
+async function runworkflowsegment(input) {
+  const segmentids = new Set(input.record.steps.slice(input.startcursor, input.until).map((entry) => entry.id));
+  const steps = input.record.steps.slice(input.startcursor, input.until).map((entry) => {
+    const bindings = (entry.bindings ?? []).filter((binding) => segmentids.has(binding.stepid));
+    return { ...entry, ...bindings.length > 0 ? { bindings } : {} };
+  });
+  const segmentrecord = composeworkflow({ id: input.record.id, name: input.record.name, version: input.record.version, origins: [...input.record.origins], steps, blocks: [], now: Date.now(), kindallowed: (kind) => {
+    try {
+      actionrisk(kind);
+      return true;
+    } catch {
+      return false;
+    }
+  }, riskof: (kind) => actionrisk(kind) });
+  const { pausedat, ...baserun } = input.run;
+  void pausedat;
+  const segmentrun = { ...baserun, state: "running", cursor: 0 };
+  let storedentries = input.storedentries;
+  const result = await runworkflow({ record: segmentrecord, run: segmentrun, scopes: input.scopes, log: input.log, execute: input.execute, now: Date.now(), gates: { sessionactive: Boolean(input.session && !input.session.stoppedat && !input.session.pausedat && input.session.expiresat > Date.now()), planapproved: input.plan.state === "approved", origingranted: (workfloworigin) => origingranted(input.session, workfloworigin) }, oncheckpoint: async (state) => {
+    await memory.setworkflowrun({ ...state.run, cursor: input.startcursor + state.run.cursor, ...state.run.background === true ? { background: true } : {} });
+    for (const entry of state.log.slice(storedentries)) await memory.addrunlogentry(state.run.id, entry);
+    storedentries = state.log.length;
+    await memory.setrunscopes(state.run.id, state.scopes);
+  } });
+  for (const entry of result.log.slice(storedentries)) await memory.addrunlogentry(input.run.id, entry);
+  for (const entry of result.log.slice(input.log.length)) {
+    const control = entry.details?.control;
+    if (control && typeof control === "object" && !Array.isArray(control)) {
+      const decision = control;
+      await memory.addcontroldecision(input.run.id, decision);
+      await auditcontroldecision(input.run.id, decision, input.session.id, input.plan.id);
+    }
+  }
+  await memory.setrunscopes(input.run.id, result.scopes);
+  const mapped = { ...input.run, state: result.run.state, cursor: input.startcursor + result.run.cursor, ...result.run.failreason !== void 0 ? { failreason: result.run.failreason } : {}, ...result.run.endedat !== void 0 ? { endedat: result.run.endedat } : {} };
+  return { run: mapped, scopes: result.scopes, log: result.log, ...result.run.state === "failed" ? { failed: result.run.failreason ?? "The segment failed." } : {} };
+}
+async function runwatchdog() {
+  const config = (await memory.getsettings())?.watchdog;
+  if (!config || !config.enabled) return [];
+  const runs = await memory.listworkflowruns();
+  const lastcompletedat = {};
+  for (const run of runs) {
+    const log = await memory.getrunlog(run.id);
+    const last = [...log].reverse().find((entry) => entry.state === "done");
+    lastcompletedat[run.id] = last !== void 0 ? last.startedat + last.duration : run.startedat;
+  }
+  const verdicts = watchdogpass({ runs, lastcompletedat, liveexecutors: [...activeworkflowruns.keys()], config, now: Date.now() });
+  const events = [];
+  for (const verdict of verdicts) {
+    if (verdict.verdict === "healthy") continue;
+    const run = runs.find((entry) => entry.id === verdict.runid);
+    if (!run) continue;
+    let outcome = "";
+    if (verdict.action === "pause") {
+      const guards = activeworkflowruns.get(run.id);
+      if (guards) guards.cancelled = true;
+      await memory.setworkflowrun({ ...run, state: "paused", pausedat: Date.now(), pausekind: "watchdog" });
+      outcome = `Paused at the checkpoint of step cursor ${run.cursor}; a user resume continues exactly there.`;
+    } else if (verdict.action === "cancel" || verdict.action === "reap") {
+      const guards = activeworkflowruns.get(run.id);
+      if (guards) guards.cancelled = true;
+      const cancelled = cancelrun(run, verdict.action === "reap" ? "The watchdog reaped the run as a zombie of a browser shutdown." : "The watchdog cancelled the stalled run.", Date.now());
+      await memory.setworkflowrun(cancelled);
+      outcome = verdict.action === "reap" ? "Reaped as a zombie of a browser shutdown at its last checkpoint." : "Cancelled as stalled beyond the reviewed threshold.";
+    } else if (verdict.action === "retry") {
+      await handlerequest({ kind: "resumeworkflowrun", runid: run.id }, {}).catch(() => {
+      });
+      outcome = `Retried the stalled step at cursor ${run.cursor} through the run gates.`;
+    }
+    const event = { id: randomid(), runid: run.id, verdict: verdict.verdict, action: verdict.action, outcome: `${verdict.reason} ${outcome}`.trim(), at: Date.now() };
+    await memory.addwatchdogevent(event);
+    await audit("workflow", `The watchdog marked the run ${run.id} ${verdict.verdict} and recovered it with ${verdict.action}: ${outcome}`, {});
+    events.push(event);
+  }
+  await refreshbadge().catch(() => {
+  });
+  return events;
+}
+async function restorebackgroundruns() {
+  const session = await memory.getsession();
+  const plan = await memory.getplan();
+  if (!session || session.stoppedat || session.pausedat || session.expiresat <= Date.now() || !plan || plan.state !== "approved") return;
+  const flags = await memory.getbackgroundruns();
+  for (const run of await memory.listworkflowruns()) {
+    if (run.state !== "paused" || run.background !== true || run.pausekind === "user" || run.pausekind === "watchdog") continue;
+    if (flags[run.workflowid] !== true) continue;
+    const record2 = await memory.getworkflowrecord(run.workflowid);
+    if (!record2) continue;
+    let granted = true;
+    for (const workfloworigin of record2.origins) {
+      if (!origingranted(session, workfloworigin)) granted = false;
+    }
+    if (!granted) continue;
+    const resumed = await handlerequest({ kind: "resumeworkflowrun", runid: run.id }, {}).catch(() => void 0);
+    if (resumed === void 0) continue;
+    await audit("workflow", `The worker wake restored the background run ${run.id} of the workflow ${record2.name} from its checkpoint at step cursor ${run.cursor}; the session, plan and origin gates re-passed.`, { sessionid: session.id, planid: plan.id });
+  }
+}
 chrome.runtime.onMessage.addListener((message, sender, sendresponse) => {
   handlerequest(message, sender).then((value) => sendresponse({ ok: true, value })).catch((error) => sendresponse({ ok: false, error: error instanceof Error ? error.message : String(error) }));
   return true;
@@ -17042,12 +18258,15 @@ async function detectcrash() {
 }
 chrome.runtime.onStartup.addListener(() => {
   void detectcrash();
-  void pauseinterruptedworkflowruns();
+  void pauseinterruptedworkflowruns().then(() => restorebackgroundruns()).catch(() => {
+  });
+  void runwatchdog().catch(() => {
+  });
 });
 async function pauseinterruptedworkflowruns() {
   for (const run of await memory.listworkflowruns()) {
     if (run.state !== "running") continue;
-    await memory.setworkflowrun({ ...run, state: "paused", pausedat: Date.now() });
+    await memory.setworkflowrun({ ...run, state: "paused", pausedat: Date.now(), pausekind: "interrupt" });
     await audit("workflow", `The service worker restart paused the workflow run ${run.id} at its last checkpoint of step cursor ${run.cursor}; the resume continues exactly there.`, {});
   }
 }
@@ -17181,13 +18400,17 @@ chrome.runtime.onConnect.addListener((port) => {
   }
 }
 setInterval(() => {
-  void evaluatelistedtriggers().then(() => draintriggerqueue()).catch(() => {
+  void evaluatelistedtriggers().then(() => draintriggerqueue()).then(() => runwatchdog()).then(() => restorebackgroundruns()).catch(() => {
   });
 }, 3e4);
 async function restoretriggers() {
   await registermenurules();
   await evaluatelistedtriggers();
   await draintriggerqueue();
+  await runwatchdog().catch(() => {
+  });
+  await restorebackgroundruns().catch(() => {
+  });
 }
 restoretriggers().catch(() => {
 });