@workglow/task-graph 0.1.2 → 0.2.1

package/dist/bun.js

@@ -39,6 +39,11 @@ var TaskConfigSchema = {
       type: "object",
       additionalProperties: true,
       "x-ui-hidden": true
+    },
+    defaults: {
+      type: "object",
+      additionalProperties: true,
+      "x-ui-hidden": true
     }
   },
   additionalProperties: false
@@ -257,6 +262,316 @@ class DataflowArrow extends Dataflow {
     super(sourceTaskId, sourceTaskPortId, targetTaskId, targetTaskPortId);
   }
 }
+// src/task/TaskEntitlements.ts
+var Entitlements = {
+  NETWORK: "network",
+  NETWORK_HTTP: "network:http",
+  NETWORK_WEBSOCKET: "network:websocket",
+  NETWORK_PRIVATE: "network:private",
+  FILESYSTEM: "filesystem",
+  FILESYSTEM_READ: "filesystem:read",
+  FILESYSTEM_WRITE: "filesystem:write",
+  CODE_EXECUTION: "code-execution",
+  CODE_EXECUTION_JS: "code-execution:javascript",
+  CREDENTIAL: "credential",
+  AI: "ai",
+  AI_MODEL: "ai:model",
+  AI_INFERENCE: "ai:inference",
+  MCP: "mcp",
+  MCP_TOOL_CALL: "mcp:tool-call",
+  MCP_RESOURCE_READ: "mcp:resource-read",
+  MCP_PROMPT_GET: "mcp:prompt-get",
+  MCP_STDIO: "mcp:stdio",
+  STORAGE: "storage",
+  STORAGE_READ: "storage:read",
+  STORAGE_WRITE: "storage:write"
+};
+var EMPTY_ENTITLEMENTS = Object.freeze({
+  entitlements: Object.freeze([])
+});
+function entitlementCovers(granted, required) {
+  return required === granted || required.startsWith(granted + ":");
+}
+function resourcePatternMatches(grantPattern, requiredResource) {
+  if (grantPattern === requiredResource)
+    return true;
+  const starIdx = grantPattern.indexOf("*");
+  if (starIdx === -1)
+    return false;
+  const prefix = grantPattern.slice(0, starIdx);
+  const suffix = grantPattern.slice(starIdx + 1);
+  if (!requiredResource.startsWith(prefix))
+    return false;
+  if (!requiredResource.endsWith(suffix))
+    return false;
+  return requiredResource.length >= prefix.length + suffix.length;
+}
+function grantCoversResources(grant, required) {
+  if (grant.resources === undefined)
+    return true;
+  if (required.resources === undefined)
+    return false;
+  return required.resources.every((req) => grant.resources.some((pat) => resourcePatternMatches(pat, req)));
+}
+function mergeEntitlements(a, b) {
+  if (a.entitlements.length === 0)
+    return b;
+  if (b.entitlements.length === 0)
+    return a;
+  const merged = new Map;
+  for (const entitlement of a.entitlements) {
+    merged.set(entitlement.id, entitlement);
+  }
+  for (const entitlement of b.entitlements) {
+    const existing = merged.get(entitlement.id);
+    if (existing) {
+      merged.set(entitlement.id, mergeEntitlementPair(existing, entitlement));
+    } else {
+      merged.set(entitlement.id, entitlement);
+    }
+  }
+  return { entitlements: Array.from(merged.values()) };
+}
+function mergeEntitlementPair(a, b) {
+  const optional = (a.optional ?? false) && (b.optional ?? false) ? true : undefined;
+  const reason = a.reason ?? b.reason;
+  const resources = mergeResources(a.resources, b.resources);
+  const result = {
+    id: a.id,
+    ...reason !== undefined && { reason },
+    ...optional === true && { optional: true },
+    ...resources !== undefined && { resources }
+  };
+  return result;
+}
+function mergeResources(a, b) {
+  if (a === undefined || b === undefined)
+    return;
+  const set = new Set([...a, ...b]);
+  return Array.from(set);
+}
+
+// src/task-graph/GraphEntitlementUtils.ts
+function computeGraphEntitlements(graph, options) {
+  const tasks = graph.getTasks();
+  if (tasks.length === 0)
+    return EMPTY_ENTITLEMENTS;
+  const trackOrigins = options?.trackOrigins ?? false;
+  const conditionalBranches = options?.conditionalBranches ?? "all";
+  const merged = new Map;
+  for (const task of tasks) {
+    if (conditionalBranches === "active" && task.status !== undefined) {
+      if (task.status === TaskStatus.DISABLED)
+        continue;
+    }
+    const taskEntitlements = task.entitlements();
+    for (const entitlement of taskEntitlements.entitlements) {
+      const existing = merged.get(entitlement.id);
+      if (existing) {
+        existing.entitlement = mergeEntitlementPair(existing.entitlement, entitlement);
+        if (trackOrigins) {
+          existing.sourceTaskIds.push(task.id);
+        }
+      } else {
+        merged.set(entitlement.id, {
+          entitlement,
+          sourceTaskIds: trackOrigins ? [task.id] : []
+        });
+      }
+    }
+  }
+  if (merged.size === 0)
+    return EMPTY_ENTITLEMENTS;
+  if (trackOrigins) {
+    const entitlements = [];
+    for (const { entitlement, sourceTaskIds } of merged.values()) {
+      entitlements.push({ ...entitlement, sourceTaskIds });
+    }
+    return { entitlements };
+  }
+  return { entitlements: Array.from(merged.values()).map((e) => e.entitlement) };
+}
+// src/task/InputResolver.ts
+import { getInputResolvers } from "@workglow/util";
+function getSchemaFormat(schema, visited = new WeakSet) {
+  if (typeof schema !== "object" || schema === null)
+    return;
+  if (visited.has(schema))
+    return;
+  visited.add(schema);
+  const s = schema;
+  if (typeof s.format === "string")
+    return s.format;
+  const variants = s.oneOf ?? s.anyOf;
+  if (Array.isArray(variants)) {
+    for (const variant of variants) {
+      if (typeof variant === "object" && variant !== null) {
+        const v = variant;
+        if (typeof v.format === "string")
+          return v.format;
+      }
+    }
+  }
+  const allOf = s.allOf;
+  if (Array.isArray(allOf)) {
+    for (const sub of allOf) {
+      const fmt = getSchemaFormat(sub, visited);
+      if (fmt !== undefined)
+        return fmt;
+    }
+  }
+  return;
+}
+function getObjectSchema(schema, visited = new WeakSet) {
+  if (typeof schema !== "object" || schema === null)
+    return;
+  if (visited.has(schema))
+    return;
+  visited.add(schema);
+  const s = schema;
+  if (s.type === "object" && s.properties && typeof s.properties === "object") {
+    return s;
+  }
+  const variants = s.oneOf ?? s.anyOf;
+  if (Array.isArray(variants)) {
+    for (const variant of variants) {
+      if (typeof variant === "object" && variant !== null) {
+        const v = variant;
+        if (v.type === "object" && v.properties && typeof v.properties === "object") {
+          return v;
+        }
+      }
+    }
+  }
+  const allOf = s.allOf;
+  if (Array.isArray(allOf)) {
+    for (const sub of allOf) {
+      const result = getObjectSchema(sub, visited);
+      if (result !== undefined)
+        return result;
+    }
+  }
+  return;
+}
+function getFormatPrefix(format) {
+  const colonIndex = format.indexOf(":");
+  return colonIndex >= 0 ? format.substring(0, colonIndex) : format;
+}
+function schemaHasFormatAnnotations(schema) {
+  if (typeof schema === "boolean")
+    return false;
+  const properties = schema.properties;
+  if (!properties || typeof properties !== "object")
+    return false;
+  for (const propSchema of Object.values(properties)) {
+    if (getSchemaFormat(propSchema) !== undefined)
+      return true;
+  }
+  return false;
+}
+async function resolveSchemaInputs(input, schema, config, visited = new Set) {
+  if (typeof schema === "boolean")
+    return input;
+  const properties = schema.properties;
+  if (!properties || typeof properties !== "object")
+    return input;
+  const resolvers = getInputResolvers();
+  const resolved = { ...input };
+  for (const [key, propSchema] of Object.entries(properties)) {
+    let value = resolved[key];
+    const format = getSchemaFormat(propSchema);
+    if (format) {
+      let resolver = resolvers.get(format);
+      if (!resolver) {
+        const prefix = getFormatPrefix(format);
+        resolver = resolvers.get(prefix);
+      }
+      if (resolver) {
+        if (typeof value === "string") {
+          value = await resolver(value, format, config.registry);
+          resolved[key] = value;
+        } else if (Array.isArray(value) && value.some((item) => typeof item === "string")) {
+          const results = await Promise.all(value.map((item) => typeof item === "string" ? resolver(item, format, config.registry) : item));
+          value = results.filter((result) => result !== undefined);
+          resolved[key] = value;
+        }
+      }
+    }
+    if (value !== null && value !== undefined && typeof value === "object" && !Array.isArray(value)) {
+      const objectSchema = getObjectSchema(propSchema);
+      if (objectSchema && !visited.has(objectSchema)) {
+        visited.add(objectSchema);
+        try {
+          resolved[key] = await resolveSchemaInputs(value, objectSchema, config, visited);
+        } finally {
+          visited.delete(objectSchema);
+        }
+      }
+    }
+  }
+  return resolved;
+}
+
+// src/task-graph/GraphFormatScanner.ts
+function schemaHasFormat(schema, targetFormat) {
+  if (typeof schema !== "object" || schema === null)
+    return false;
+  const s = schema;
+  const properties = s.properties;
+  if (properties && typeof properties === "object") {
+    for (const propSchema of Object.values(properties)) {
+      const format = getSchemaFormat(propSchema);
+      if (format === targetFormat)
+        return true;
+      const objectSchema = getObjectSchema(propSchema);
+      if (objectSchema && schemaHasFormat(objectSchema, targetFormat))
+        return true;
+    }
+  }
+  return false;
+}
+function scanGraphForFormat(graph, targetFormat) {
+  for (const task of graph.getTasks()) {
+    const inputSchema = task.inputSchema();
+    if (typeof inputSchema !== "boolean" && schemaHasFormat(inputSchema, targetFormat)) {
+      return true;
+    }
+    const configSchema = task.configSchema();
+    if (typeof configSchema !== "boolean" && schemaHasFormat(configSchema, targetFormat)) {
+      return true;
+    }
+  }
+  return false;
+}
+function scanGraphForCredentials(graph) {
+  const credentialFormats = new Set;
+  for (const task of graph.getTasks()) {
+    collectCredentialFormats(task.inputSchema(), credentialFormats);
+    collectCredentialFormats(task.configSchema(), credentialFormats);
+  }
+  return {
+    needsCredentials: credentialFormats.size > 0,
+    credentialFormats
+  };
+}
+function collectCredentialFormats(schema, formats) {
+  if (typeof schema === "boolean" || typeof schema !== "object" || schema === null)
+    return;
+  const s = schema;
+  const properties = s.properties;
+  if (!properties || typeof properties !== "object")
+    return;
+  for (const propSchema of Object.values(properties)) {
+    const format = getSchemaFormat(propSchema);
+    if (format === "credential") {
+      formats.add(format);
+    }
+    const objectSchema = getObjectSchema(propSchema);
+    if (objectSchema) {
+      collectCredentialFormats(objectSchema, formats);
+    }
+  }
+}
 // src/task-graph/GraphSchemaUtils.ts
 import { uuid4 } from "@workglow/util";
 function calculateNodeDepths(graph) {
@@ -606,8 +921,8 @@ function addBoundaryNodesToDependencyJson(items, graph) {
   return [...prependItems, ...items, ...appendItems];
 }
 // src/task-graph/TaskGraph.ts
-import { DirectedAcyclicGraph } from "@workglow/util/graph";
 import { EventEmitter as EventEmitter4, uuid4 as uuid44 } from "@workglow/util";
+import { DirectedAcyclicGraph } from "@workglow/util/graph";
 
 // src/task/GraphAsTask.ts
 import { getLogger as getLogger4 } from "@workglow/util";
@@ -725,8 +1040,8 @@ function getNestedValue(obj, path) {
 }
 
 // src/task/Task.ts
-import { compileSchema } from "@workglow/util/schema";
 import { deepEqual, EventEmitter as EventEmitter3, uuid4 as uuid42 } from "@workglow/util";
+import { compileSchema } from "@workglow/util/schema";
 
 // src/task/TaskError.ts
 import { BaseError } from "@workglow/util";
@@ -806,6 +1121,13 @@ class TaskInvalidInputError extends TaskError {
   }
 }
 
+class TaskEntitlementError extends TaskError {
+  static type = "TaskEntitlementError";
+  constructor(message = "Required entitlements denied") {
+    super(message);
+  }
+}
+
 class TaskSerializationError extends TaskError {
   static type = "TaskSerializationError";
   constructor(taskType) {
@@ -821,100 +1143,6 @@ import {
   SpanStatusCode
 } from "@workglow/util";
 
-// src/task/InputResolver.ts
-import { getInputResolvers } from "@workglow/util";
-function getSchemaFormat(schema) {
-  if (typeof schema !== "object" || schema === null)
-    return;
-  const s = schema;
-  if (typeof s.format === "string")
-    return s.format;
-  const variants = s.oneOf ?? s.anyOf;
-  if (Array.isArray(variants)) {
-    for (const variant of variants) {
-      if (typeof variant === "object" && variant !== null) {
-        const v = variant;
-        if (typeof v.format === "string")
-          return v.format;
-      }
-    }
-  }
-  return;
-}
-function getObjectSchema(schema) {
-  if (typeof schema !== "object" || schema === null)
-    return;
-  const s = schema;
-  if (s.type === "object" && s.properties && typeof s.properties === "object") {
-    return s;
-  }
-  const variants = s.oneOf ?? s.anyOf;
-  if (Array.isArray(variants)) {
-    for (const variant of variants) {
-      if (typeof variant === "object" && variant !== null) {
-        const v = variant;
-        if (v.type === "object" && v.properties && typeof v.properties === "object") {
-          return v;
-        }
-      }
-    }
-  }
-  return;
-}
-function getFormatPrefix(format) {
-  const colonIndex = format.indexOf(":");
-  return colonIndex >= 0 ? format.substring(0, colonIndex) : format;
-}
-function schemaHasFormatAnnotations(schema) {
-  if (typeof schema === "boolean")
-    return false;
-  const properties = schema.properties;
-  if (!properties || typeof properties !== "object")
-    return false;
-  for (const propSchema of Object.values(properties)) {
-    if (getSchemaFormat(propSchema) !== undefined)
-      return true;
-  }
-  return false;
-}
-async function resolveSchemaInputs(input, schema, config) {
-  if (typeof schema === "boolean")
-    return input;
-  const properties = schema.properties;
-  if (!properties || typeof properties !== "object")
-    return input;
-  const resolvers = getInputResolvers();
-  const resolved = { ...input };
-  for (const [key, propSchema] of Object.entries(properties)) {
-    let value = resolved[key];
-    const format = getSchemaFormat(propSchema);
-    if (format) {
-      let resolver = resolvers.get(format);
-      if (!resolver) {
-        const prefix = getFormatPrefix(format);
-        resolver = resolvers.get(prefix);
-      }
-      if (resolver) {
-        if (typeof value === "string") {
-          value = await resolver(value, format, config.registry);
-          resolved[key] = value;
-        } else if (Array.isArray(value) && value.some((item) => typeof item === "string")) {
-          const results = await Promise.all(value.map((item) => typeof item === "string" ? resolver(item, format, config.registry) : item));
-          value = results.filter((result) => result !== undefined);
-          resolved[key] = value;
-        }
-      }
-    }
-    if (value !== null && value !== undefined && typeof value === "object" && !Array.isArray(value)) {
-      const objectSchema = getObjectSchema(propSchema);
-      if (objectSchema) {
-        resolved[key] = await resolveSchemaInputs(value, objectSchema, config);
-      }
-    }
-  }
-  return resolved;
-}
-
 // src/task/StreamTypes.ts
 function getPortStreamMode(schema, portId) {
   if (typeof schema === "boolean")
@@ -1206,11 +1434,29 @@ class TaskRunner {
         }
         case "object-delta": {
           if (accumulatedObjects) {
-            accumulatedObjects.set(event.port, event.objectDelta);
+            const existing = accumulatedObjects.get(event.port);
+            if (Array.isArray(event.objectDelta)) {
+              const arr = Array.isArray(existing) ? [...existing] : [];
+              for (const item of event.objectDelta) {
+                const itemObj = item;
+                if (itemObj && typeof itemObj === "object" && "id" in itemObj) {
+                  const idx = arr.findIndex((e) => e.id === itemObj.id);
+                  if (idx >= 0)
+                    arr[idx] = item;
+                  else
+                    arr.push(item);
+                } else {
+                  arr.push(item);
+                }
+              }
+              accumulatedObjects.set(event.port, arr);
+            } else {
+              accumulatedObjects.set(event.port, event.objectDelta);
+            }
           }
           this.task.runOutputData = {
             ...this.task.runOutputData,
-            [event.port]: event.objectDelta
+            [event.port]: accumulatedObjects?.get(event.port) ?? event.objectDelta
           };
           this.task.emit("stream_chunk", event);
           const progress = Math.min(99, Math.round(100 * (1 - Math.exp(-0.05 * chunkCount))));
@@ -1271,11 +1517,6 @@ class TaskRunner {
     this.abortController.signal.addEventListener("abort", () => {
       this.handleAbort();
     });
-    if (config.signal?.aborted) {
-      this.abortController.abort();
-    } else if (config.signal) {
-      config.signal.addEventListener("abort", () => this.abortController.abort(), { once: true });
-    }
     const cache = config.outputCache ?? this.task.runConfig?.outputCache;
     if (cache === true) {
       let instance = globalServiceRegistry.get(TASK_OUTPUT_REPOSITORY);
@@ -1286,6 +1527,21 @@ class TaskRunner {
       this.outputCache = cache;
     }
     this.shouldAccumulate = config.shouldAccumulate !== false;
+    if (config.updateProgress) {
+      this.updateProgress = config.updateProgress;
+    }
+    if (config.registry) {
+      this.registry = config.registry;
+    }
+    if (config.signal) {
+      const onAbort = () => this.abortController.abort();
+      config.signal.addEventListener("abort", onAbort, { once: true });
+      if (config.signal.aborted) {
+        config.signal.removeEventListener("abort", onAbort);
+        this.abortController.abort();
+        return;
+      }
+    }
     const timeout = this.task.config.timeout;
     if (timeout !== undefined && timeout > 0) {
       this.pendingTimeoutError = new TaskTimeoutError(timeout);
@@ -1293,12 +1549,6 @@ class TaskRunner {
         this.abort();
       }, timeout);
     }
-    if (config.updateProgress) {
-      this.updateProgress = config.updateProgress;
-    }
-    if (config.registry) {
-      this.registry = config.registry;
-    }
     const telemetry = getTelemetryProvider();
     if (telemetry.isEnabled) {
       this.telemetrySpan = telemetry.startSpan("workglow.task.run", {
@@ -1435,6 +1685,11 @@ class Task {
   static hasDynamicSchemas = false;
   static passthroughInputsToOutputs = false;
   static customizable = false;
+  static isGraphOutput = false;
+  static hasDynamicEntitlements = false;
+  static entitlements() {
+    return EMPTY_ENTITLEMENTS;
+  }
   static inputSchema() {
     return {
       type: "object",
@@ -1489,6 +1744,13 @@ class Task {
   configSchema() {
     return this.constructor.configSchema();
   }
+  entitlements() {
+    return this.constructor.entitlements();
+  }
+  emitEntitlementChange(entitlements) {
+    const final = entitlements ?? this.entitlements();
+    this.emit("entitlementChange", final);
+  }
   get type() {
     return this.constructor.type;
   }
@@ -1526,15 +1788,16 @@ class Task {
     return this._events;
   }
   _events;
-  constructor(callerDefaultInputs = {}, config = {}, runConfig = {}) {
+  constructor(config = {}, runConfig = {}) {
+    const { defaults: callerDefaultInputs, ...restConfig } = config;
     const inputDefaults = this.getDefaultInputsFromStaticInputDefinitions();
-    const mergedDefaults = Object.assign(inputDefaults, callerDefaultInputs);
+    const mergedDefaults = Object.assign(inputDefaults, callerDefaultInputs ?? {});
     this.defaults = this.stripSymbols(mergedDefaults);
     this.resetInputData();
     const title = this.constructor.title || undefined;
     const baseConfig = Object.assign({
       ...title ? { title } : {}
-    }, config);
+    }, restConfig);
     if (baseConfig.id === undefined) {
       baseConfig.id = uuid42();
     }
@@ -1881,6 +2144,10 @@ class Task {
     if (Object.keys(config).length > 0) {
       base.config = config;
     }
+    const taskEntitlements = this.entitlements();
+    if (taskEntitlements.entitlements.length > 0) {
+      base.entitlements = taskEntitlements;
+    }
     return this.stripSymbols(base);
   }
   toDependencyJSON(options) {
@@ -2010,7 +2277,7 @@ class ConditionalTask extends Task {
           }
         }
       } catch (error) {
-        getLogger2().warn(`Condition evaluation failed for branch "${branch.id}":`, { error });
+        getLogger2().error(`Condition evaluation failed for branch "${branch.id}":`, { error });
       }
     }
     if (this.activeBranches.size === 0 && defaultBranch) {
@@ -2134,6 +2401,111 @@ class ConditionalTask extends Task {
   }
 }
 
+// src/task/EntitlementEnforcer.ts
+import { createServiceToken as createServiceToken3 } from "@workglow/util";
+
+// src/task/EntitlementPolicy.ts
+var EMPTY_POLICY = Object.freeze({
+  deny: Object.freeze([]),
+  grant: Object.freeze([]),
+  ask: Object.freeze([])
+});
+function ruleCovers(rule, required) {
+  if (!entitlementCovers(rule.id, required.id))
+    return false;
+  return grantCoversResources(rule, required);
+}
+function evaluatePolicy(policy, required) {
+  const results = [];
+  for (const entitlement of required.entitlements) {
+    if (entitlement.optional)
+      continue;
+    const denyMatch = policy.deny.find((rule) => ruleCovers(rule, entitlement));
+    if (denyMatch) {
+      results.push({ verdict: "denied", entitlement, matchedRule: denyMatch });
+      continue;
+    }
+    const grantMatch = policy.grant.find((rule) => ruleCovers(rule, entitlement));
+    if (grantMatch) {
+      results.push({ verdict: "granted", entitlement, matchedRule: grantMatch });
+      continue;
+    }
+    const askMatch = policy.ask.find((rule) => ruleCovers(rule, entitlement));
+    if (askMatch) {
+      results.push({ verdict: "ask", entitlement, matchedRule: askMatch });
+      continue;
+    }
+    results.push({ verdict: "denied", entitlement });
+  }
+  return results;
+}
+
+// src/task/EntitlementResolver.ts
+import { createServiceToken as createServiceToken2 } from "@workglow/util";
+var PERMISSIVE_RESOLVER = {
+  lookup: () => "grant",
+  prompt: async () => "grant",
+  save: () => {}
+};
+var DENY_ALL_RESOLVER = {
+  lookup: () => "deny",
+  prompt: async () => "deny",
+  save: () => {}
+};
+var ENTITLEMENT_RESOLVER = createServiceToken2("workglow.entitlementResolver");
+
+// src/task/EntitlementEnforcer.ts
+var PERMISSIVE_ENFORCER = {
+  checkAll: async () => [],
+  checkTask: async () => []
+};
+function createPolicyEnforcer(policy, resolver = PERMISSIVE_RESOLVER) {
+  async function resolveAsks(required, taskType, taskId) {
+    const results = evaluatePolicy(policy, required);
+    const denied = [];
+    for (const result of results) {
+      if (result.verdict === "denied") {
+        denied.push(result.entitlement);
+      } else if (result.verdict === "ask") {
+        const request = {
+          entitlement: result.entitlement,
+          taskType: taskType ?? "unknown",
+          taskId: taskId ?? "unknown"
+        };
+        const saved = resolver.lookup(request);
+        if (saved !== undefined) {
+          if (saved === "deny") {
+            denied.push(result.entitlement);
+          }
+          continue;
+        }
+        const answer = await resolver.prompt(request);
+        resolver.save(request, answer);
+        if (answer === "deny") {
+          denied.push(result.entitlement);
+        }
+      }
+    }
+    return denied;
+  }
+  return {
+    async checkAll(required) {
+      return resolveAsks(required);
+    },
+    async checkTask(task) {
+      const entitlements = task.entitlements();
+      return resolveAsks(entitlements, task.constructor.type, task.id);
+    }
+  };
+}
+function createScopedEnforcer(grants) {
+  return createPolicyEnforcer({ deny: [], grant: grants, ask: [] });
+}
+function createGrantListEnforcer(grants) {
+  return createScopedEnforcer(grants.map((id) => ({ id })));
+}
+var ENTITLEMENT_ENFORCER = createServiceToken3("workglow.entitlementEnforcer");
+
 // src/task-graph/TaskGraphScheduler.ts
 class TopologicalScheduler {
   dag;
@@ -2302,6 +2674,7 @@ class TaskGraphRunner {
   telemetrySpan;
   graphTimeoutTimer;
   pendingGraphTimeoutError;
+  activeEnforcer;
   constructor(graph, outputCache, processScheduler = new DependencyBasedScheduler(graph), reactiveScheduler = new TopologicalScheduler(graph)) {
     this.processScheduler = processScheduler;
     this.reactiveScheduler = reactiveScheduler;
@@ -2370,7 +2743,7 @@ class TaskGraphRunner {
       throw new TaskAbortedError;
     }
     await this.handleComplete();
-    return results;
+    return this.filterLeafResults(results);
   }
   async runGraphReactive(input = {}, config) {
     await this.handleStartReactive(config);
@@ -2394,7 +2767,7 @@ class TaskGraphRunner {
         }
       }
       await this.handleCompleteReactive();
-      return results;
+      return this.filterLeafResults(results);
     } catch (error) {
       await this.handleErrorReactive();
       throw error;
@@ -2426,6 +2799,15 @@ class TaskGraphRunner {
       task.regenerateGraph();
     }
   }
+  filterLeafResults(results) {
+    if (results.length <= 1)
+      return results;
+    const graphOutputResults = results.filter((r) => {
+      const task = this.graph.getTask(r.id);
+      return task && task.constructor.isGraphOutput;
+    });
+    return graphOutputResults.length > 0 ? graphOutputResults : results;
+  }
   mergeExecuteOutputsToRunOutput(results, compoundMerge) {
     if (compoundMerge === GRAPH_RESULT_ARRAY) {
       return results;
@@ -2607,6 +2989,12 @@ class TaskGraphRunner {
     }
     await this.awaitStreamInputs(task);
     this.copyInputFromEdgesToNode(task);
+    if (this.activeEnforcer && task.constructor.hasDynamicEntitlements) {
+      const denied = await this.activeEnforcer.checkTask(task);
+      if (denied.length > 0) {
+        throw new TaskEntitlementError(`Task ${task.constructor.type} denied entitlements: ${denied.map((e) => e.id).join(", ")}`);
+      }
+    }
     if (isStreamable) {
       return this.runStreamingTask(task, input);
     }
@@ -2776,12 +3164,6 @@ class TaskGraphRunner {
       }
       this.graph.outputCache = this.outputCache;
     }
-    if (config?.maxTasks !== undefined && config.maxTasks > 0) {
-      const taskCount = this.graph.getTasks().length;
-      if (taskCount > config.maxTasks) {
-        throw new TaskConfigurationError(`Graph has ${taskCount} tasks, exceeding the limit of ${config.maxTasks}`);
-      }
-    }
     if (this.running || this.reactiveRunning) {
       throw new TaskConfigurationError("Graph is already running");
     }
@@ -2797,13 +3179,16 @@ class TaskGraphRunner {
         this.abortController?.abort();
       }, config.timeout);
     }
-    if (config?.parentSignal?.aborted) {
-      this.abortController.abort();
-      return;
-    } else {
-      config?.parentSignal?.addEventListener("abort", () => {
+    if (config?.parentSignal) {
+      const onParentAbort = () => {
         this.abortController?.abort();
-      }, { once: true });
+      };
+      config.parentSignal.addEventListener("abort", onParentAbort, { once: true });
+      if (config.parentSignal.aborted) {
+        config.parentSignal.removeEventListener("abort", onParentAbort);
+        this.abortController.abort();
+        return;
+      }
     }
     this.runId = uuid43();
     this.resetGraph(this.graph, this.runId);
@@ -2811,6 +3196,36 @@ class TaskGraphRunner {
     this.inProgressTasks.clear();
     this.inProgressFunctions.clear();
     this.failedTaskErrors.clear();
+    try {
+      if (config?.maxTasks !== undefined && config.maxTasks > 0) {
+        const taskCount = this.graph.getTasks().length;
+        if (taskCount > config.maxTasks) {
+          throw new TaskConfigurationError(`Graph has ${taskCount} tasks, exceeding the limit of ${config.maxTasks}`);
+        }
+      }
+      if (config?.enforceEntitlements) {
+        if (!this.registry.has(ENTITLEMENT_ENFORCER)) {
+          throw new TaskConfigurationError("enforceEntitlements is enabled but no IEntitlementEnforcer is registered. " + "Register an enforcer via ENTITLEMENT_ENFORCER before running the graph.");
+        }
+        const enforcer = this.registry.get(ENTITLEMENT_ENFORCER);
+        const denied = await enforcer.checkAll(computeGraphEntitlements(this.graph));
+        if (denied.length > 0) {
+          throw new TaskEntitlementError(`Denied entitlements: ${denied.map((e) => e.id).join(", ")}`);
+        }
+        this.activeEnforcer = enforcer;
+      } else {
+        this.activeEnforcer = undefined;
+      }
+    } catch (err) {
+      if (this.graphTimeoutTimer !== undefined) {
+        clearTimeout(this.graphTimeoutTimer);
+        this.graphTimeoutTimer = undefined;
+      }
+      this.abortController = undefined;
+      this.activeEnforcer = undefined;
+      this.running = false;
+      throw err;
+    }
     const telemetry = getTelemetryProvider2();
     if (telemetry.isEnabled) {
       this.telemetrySpan = telemetry.startSpan("workglow.graph.run", {
@@ -2848,6 +3263,7 @@ class TaskGraphRunner {
   async handleComplete() {
     this.clearGraphTimeout();
     this.running = false;
+    this.activeEnforcer = undefined;
     if (this.telemetrySpan) {
       this.telemetrySpan.setStatus(SpanStatusCode2.OK);
       this.telemetrySpan.end();
@@ -2866,6 +3282,7 @@ class TaskGraphRunner {
       }
     }));
     this.running = false;
+    this.activeEnforcer = undefined;
     if (this.telemetrySpan) {
       this.telemetrySpan.setStatus(SpanStatusCode2.ERROR, error.message);
       this.telemetrySpan.setAttributes({ "workglow.graph.error": error.message });
@@ -2885,6 +3302,7 @@ class TaskGraphRunner {
       }
     }));
     this.running = false;
+    this.activeEnforcer = undefined;
     if (this.telemetrySpan) {
       this.telemetrySpan.setStatus(SpanStatusCode2.ERROR, "aborted");
       this.telemetrySpan.addEvent("workglow.graph.aborted");
@@ -2986,9 +3404,10 @@ class GraphAsTask extends Task {
   static category = "Flow Control";
   static compoundMerge = PROPERTY_ARRAY;
   static hasDynamicSchemas = true;
-  constructor(input = {}, config = {}) {
+  static hasDynamicEntitlements = true;
+  constructor(config = {}) {
     const { subGraph, ...rest } = config;
-    super(input, rest);
+    super(rest);
     if (subGraph) {
       this.subGraph = subGraph;
     }
@@ -3035,6 +3454,12 @@ class GraphAsTask extends Task {
     }
     return computeGraphOutputSchema(this.subGraph);
   }
+  entitlements() {
+    if (!this.hasChildren()) {
+      return this.constructor.entitlements();
+    }
+    return computeGraphEntitlements(this.subGraph);
+  }
   resetInputData() {
     super.resetInputData();
     if (this.hasChildren()) {
@@ -3073,26 +3498,44 @@ class GraphAsTask extends Task {
         }
       }
       const eventQueue = [];
-      let resolveWaiting;
       let subgraphDone = false;
+      let { promise: notifyPromise, resolve: notifyResolve } = Promise.withResolvers();
+      let isWaiting = false;
+      let hasPending = false;
+      const notify = () => {
+        if (isWaiting) {
+          notifyResolve();
+          ({ promise: notifyPromise, resolve: notifyResolve } = Promise.withResolvers());
+          isWaiting = false;
+        } else {
+          hasPending = true;
+        }
+      };
       const unsub = this.subGraph.subscribeToTaskStreaming({
         onStreamChunk: (taskId, event) => {
           if (endingNodeIds.has(taskId) && event.type !== "finish") {
             eventQueue.push(event);
-            resolveWaiting?.();
+            notify();
           }
         }
       });
       const runPromise = this.subGraph.run(input, { parentSignal: context.signal, accumulateLeafOutputs: false }).then((results2) => {
         subgraphDone = true;
-        resolveWaiting?.();
+        notify();
         return results2;
+      }, (err) => {
+        subgraphDone = true;
+        notify();
+        throw err;
       });
       while (!subgraphDone) {
         if (eventQueue.length === 0) {
-          await new Promise((resolve) => {
-            resolveWaiting = resolve;
-          });
+          if (hasPending) {
+            hasPending = false;
+          } else {
+            isWaiting = true;
+            await notifyPromise;
+          }
         }
         while (eventQueue.length > 0) {
           yield eventQueue.shift();
@@ -3112,6 +3555,7 @@ class GraphAsTask extends Task {
   regenerateGraph() {
     this._inputSchemaNode = undefined;
     this.events.emit("regenerate");
+    this.emitEntitlementChange();
   }
   toJSON(options) {
     let json = super.toJSON(options);
@@ -3146,8 +3590,8 @@ function getWrapperClasses() {
   if (!_OwnGraphTask) {
 
     class ListeningGraphAsTask extends GraphAsTask {
-      constructor(input, config) {
-        super(input, config);
+      constructor(config) {
+        super(config);
         this.subGraph.on("start", () => {
           this.emit("start");
         });
@@ -3208,7 +3652,7 @@ function convertPipeFunctionToTask(fn, config) {
       return fn(input, context);
     }
   }
-  return new QuickTask({}, config);
+  return new QuickTask(config);
 }
 function isWorkflowLike(arg) {
   return arg != null && typeof arg === "object" && "graph" in arg && arg.graph instanceof TaskGraph && "run" in arg && typeof arg.run === "function";
@@ -3221,18 +3665,18 @@ function ensureTask(arg, config = {}) {
     getWrapperClasses();
     const { isOwned, ...cleanConfig } = config;
     if (isOwned) {
-      return new _OwnGraphTask({}, { ...cleanConfig, subGraph: arg });
+      return new _OwnGraphTask({ ...cleanConfig, subGraph: arg });
     } else {
-      return new _GraphTask({}, { ...cleanConfig, subGraph: arg });
+      return new _GraphTask({ ...cleanConfig, subGraph: arg });
     }
   }
   if (isWorkflowLike(arg)) {
     getWrapperClasses();
     const { isOwned, ...cleanConfig } = config;
     if (isOwned) {
-      return new _OwnWorkflowTask({}, { ...cleanConfig, subGraph: arg.graph });
+      return new _OwnWorkflowTask({ ...cleanConfig, subGraph: arg.graph });
     } else {
-      return new _ConvWorkflowTask({}, { ...cleanConfig, subGraph: arg.graph });
+      return new _ConvWorkflowTask({ ...cleanConfig, subGraph: arg.graph });
     }
   }
   return convertPipeFunctionToTask(arg, config);
@@ -3500,6 +3944,43 @@ class TaskGraph {
       unsubscribes.forEach((unsub) => unsub());
     };
   }
+  subscribeToTaskEntitlements(callback) {
+    const globalUnsubs = [];
+    const taskUnsubs = new Map;
+    const emitChange = () => {
+      const entitlements = computeGraphEntitlements(this);
+      this.emit("entitlementChange", entitlements);
+      callback(entitlements);
+    };
+    const subscribeTask = (taskId) => {
+      const task = this.getTask(taskId);
+      if (!task || typeof task.subscribe !== "function")
+        return;
+      const unsub = task.subscribe("entitlementChange", () => emitChange());
+      taskUnsubs.set(taskId, unsub);
+    };
+    for (const task of this.getTasks()) {
+      subscribeTask(task.id);
+    }
+    emitChange();
+    globalUnsubs.push(this.subscribe("task_added", (taskId) => {
+      subscribeTask(taskId);
+      emitChange();
+    }));
+    globalUnsubs.push(this.subscribe("task_removed", (taskId) => {
+      const unsub = taskUnsubs.get(taskId);
+      if (unsub) {
+        unsub();
+        taskUnsubs.delete(taskId);
+      }
+      emitChange();
+    }));
+    return () => {
+      globalUnsubs.forEach((unsub) => unsub());
+      taskUnsubs.forEach((unsub) => unsub());
+      taskUnsubs.clear();
+    };
+  }
   on(name, fn) {
     const dagEvent = EventTaskGraphToDagMapping[name];
     if (dagEvent) {
@@ -3544,11 +4025,7 @@ function serialGraph(tasks, inputHandle, outputHandle) {
   return graph;
 }
 // src/task-graph/Workflow.ts
-import {
-  EventEmitter as EventEmitter5,
-  getLogger as getLogger5,
-  uuid4 as uuid45
-} from "@workglow/util";
+import { EventEmitter as EventEmitter5, getLogger as getLogger5, uuid4 as uuid45 } from "@workglow/util";
 function getLastTask(workflow) {
   const tasks = workflow.graph.getTasks();
   return tasks.length > 0 ? tasks[tasks.length - 1] : undefined;
@@ -3571,7 +4048,6 @@ function pipe(args, workflow = new Workflow) {
 function parallel(args, mergeFn = PROPERTY_ARRAY, workflow = new Workflow) {
   let previousTask = getLastTask(workflow);
   const tasks = args.map((arg) => ensureTask(arg));
-  const input = {};
   const config = {
     compoundMerge: mergeFn
   };
@@ -3580,7 +4056,7 @@ function parallel(args, mergeFn = PROPERTY_ARRAY, workflow = new Workflow) {
   class ParallelTask extends GraphAsTask {
     static type = name;
   }
-  const mergeTask = new ParallelTask(input, config);
+  const mergeTask = new ParallelTask(config);
   mergeTask.subGraph.addTasks(tasks);
   workflow.graph.addTask(mergeTask);
   if (previousTask) {
@@ -3675,6 +4151,7 @@ class Workflow {
   _error = "";
   _outputCache;
   _registry;
+  _entitlementUnsub;
   _abortController;
   _parentWorkflow;
   _iteratorTask;
@@ -3690,7 +4167,11 @@ class Workflow {
     const helper = function(input = {}, config = {}) {
       this._error = "";
       const parent = getLastTask(this);
-      const task = this.addTaskToGraph(taskClass, input, { id: uuid45(), ...config });
+      const task = this.addTaskToGraph(taskClass, {
+        id: uuid45(),
+        ...config,
+        defaults: input
+      });
       if (this._dataFlows.length > 0) {
         this._dataFlows.forEach((dataflow) => {
           const taskSchema = task.inputSchema();
@@ -3825,6 +4306,9 @@ class Workflow {
   toDependencyJSON(options = { withBoundaryNodes: true }) {
     return this._graph.toDependencyJSON(options);
   }
+  entitlements(options) {
+    return computeGraphEntitlements(this._graph, options);
+  }
   pipe(...args) {
     return pipe(args, this);
   }
@@ -3909,6 +4393,7 @@ class Workflow {
     this._graph.on("dataflow_added", this._onChanged);
     this._graph.on("dataflow_replaced", this._onChanged);
     this._graph.on("dataflow_removed", this._onChanged);
+    this._entitlementUnsub = this._graph.subscribeToTaskEntitlements((entitlements) => this.events.emit("entitlementChange", entitlements));
   }
   clearEvents() {
     this._graph.off("task_added", this._onChanged);
@@ -3917,6 +4402,8 @@ class Workflow {
     this._graph.off("dataflow_added", this._onChanged);
     this._graph.off("dataflow_replaced", this._onChanged);
     this._graph.off("dataflow_removed", this._onChanged);
+    this._entitlementUnsub?.();
+    this._entitlementUnsub = undefined;
   }
   _onChanged(id) {
     this.events.emit("changed", id);
@@ -3948,8 +4435,8 @@ class Workflow {
     this.graph.addDataflow(dataflow);
     return this;
   }
-  addTaskToGraph(taskClass, input, config) {
-    const task = new taskClass(input, config, this._registry ? { registry: this._registry } : undefined);
+  addTaskToGraph(taskClass, config) {
+    const task = new taskClass(config, this._registry ? { registry: this._registry } : undefined);
     const id = this.graph.addTask(task);
     this.events.emit("changed", id);
     return task;
@@ -3961,7 +4448,7 @@ class Workflow {
   addLoopTask(taskClass, config = {}) {
     this._error = "";
     const parent = getLastTask(this);
-    const task = this.addTaskToGraph(taskClass, {}, { id: uuid45(), ...config });
+    const task = this.addTaskToGraph(taskClass, { id: uuid45(), ...config });
     if (this._dataFlows.length > 0) {
       this._dataFlows.forEach((dataflow) => {
         const taskSchema = task.inputSchema();
@@ -4058,10 +4545,29 @@ class Workflow {
           const sourceSchema = sourceTask.outputSchema();
           if (typeof sourceSchema === "boolean")
             continue;
-          const prop = sourceSchema.properties?.[df.sourceTaskPortId];
+          let prop = sourceSchema.properties?.[df.sourceTaskPortId];
+          let propRequired = sourceSchema.required?.includes(df.sourceTaskPortId) ?? false;
+          if (!prop && sourceSchema.additionalProperties === true && sourceTask.constructor.passthroughInputsToOutputs === true) {
+            const upstreamDfs = graph.getSourceDataflows(sourceTask.id);
+            for (const udf of upstreamDfs) {
+              if (udf.targetTaskPortId !== df.sourceTaskPortId)
+                continue;
+              const upstreamTask = graph.getTask(udf.sourceTaskId);
+              if (!upstreamTask)
+                continue;
+              const upstreamSchema = upstreamTask.outputSchema();
+              if (typeof upstreamSchema === "boolean")
+                continue;
+              prop = upstreamSchema.properties?.[udf.sourceTaskPortId];
+              if (prop) {
+                propRequired = upstreamSchema.required?.includes(udf.sourceTaskPortId) ?? false;
+                break;
+              }
+            }
+          }
           if (prop && typeof prop !== "boolean") {
             properties[df.targetTaskPortId] = prop;
-            if (sourceSchema.required?.includes(df.sourceTaskPortId) && !required.includes(df.targetTaskPortId)) {
+            if (propRequired && !required.includes(df.targetTaskPortId)) {
               required.push(df.targetTaskPortId);
             }
           }
@@ -4161,11 +4667,30 @@ class Workflow {
     const makeMatch = (fromSchema, toSchema, fromTaskId, toTaskId, comparator) => {
       if (typeof fromSchema === "object") {
         if (toSchema === true || typeof toSchema === "object" && toSchema.additionalProperties === true) {
-          for (const fromOutputPortId of Object.keys(fromSchema.properties || {})) {
-            if (matches.has(fromOutputPortId))
-              continue;
-            matches.set(fromOutputPortId, fromOutputPortId);
-            graph.addDataflow(new Dataflow(fromTaskId, fromOutputPortId, toTaskId, fromOutputPortId));
+          const outputKeys = Object.keys(fromSchema.properties || {});
+          if (outputKeys.length > 0) {
+            for (const fromOutputPortId of outputKeys) {
+              if (matches.has(fromOutputPortId))
+                continue;
+              matches.set(fromOutputPortId, fromOutputPortId);
+              graph.addDataflow(new Dataflow(fromTaskId, fromOutputPortId, toTaskId, fromOutputPortId));
+            }
+          } else if (fromSchema.additionalProperties === true) {
+            const sourceGraphTask = graph.getTask(fromTaskId);
+            if (sourceGraphTask && sourceGraphTask.constructor.passthroughInputsToOutputs === true) {
+              const incomingDfs = graph.getSourceDataflows(fromTaskId);
+              for (const df of incomingDfs) {
+                const portId = df.targetTaskPortId;
+                if (portId === DATAFLOW_ALL_PORTS)
+                  continue;
+                if (matches.has(portId))
+                  continue;
+                if (connectedInputKeys.has(portId))
+                  continue;
+                matches.set(portId, portId);
+                graph.addDataflow(new Dataflow(fromTaskId, portId, toTaskId, portId));
+              }
+            }
           }
           return;
         }
@@ -4648,6 +5173,37 @@ ${baseIndent}}`;
 function resetMethodNameCache() {
   methodNameCache = undefined;
 }
+// src/task/EntitlementProfiles.ts
+var BROWSER_GRANTS = [
+  { id: Entitlements.NETWORK },
+  { id: Entitlements.AI },
+  { id: Entitlements.MCP_TOOL_CALL },
+  { id: Entitlements.MCP_RESOURCE_READ },
+  { id: Entitlements.MCP_PROMPT_GET },
+  { id: Entitlements.STORAGE },
+  { id: Entitlements.CREDENTIAL }
+];
+var DESKTOP_GRANTS = [
+  ...BROWSER_GRANTS,
+  { id: Entitlements.FILESYSTEM },
+  { id: Entitlements.CODE_EXECUTION },
+  { id: Entitlements.MCP_STDIO }
+];
+var SERVER_GRANTS = [...DESKTOP_GRANTS];
+var PROFILE_GRANTS = {
+  browser: BROWSER_GRANTS,
+  desktop: DESKTOP_GRANTS,
+  server: SERVER_GRANTS
+};
+function createProfilePolicy(profile) {
+  return { deny: [], grant: PROFILE_GRANTS[profile], ask: [] };
+}
+function createProfileEnforcer(profile, resolver) {
+  return createPolicyEnforcer(createProfilePolicy(profile), resolver);
+}
+function getProfileGrants(profile) {
+  return PROFILE_GRANTS[profile];
+}
 // src/task/FallbackTaskRunner.ts
 class FallbackTaskRunner extends GraphAsTaskRunner {
   async executeTask(input) {
@@ -4849,22 +5405,32 @@ queueMicrotask(() => {
 });
 // src/task/InputCompactor.ts
 import { getInputCompactors } from "@workglow/util";
-function schemaAllowsString(schema) {
+function schemaAllowsString(schema, visited = new WeakSet) {
   if (typeof schema !== "object" || schema === null)
     return false;
+  if (visited.has(schema))
+    return false;
+  visited.add(schema);
   const s = schema;
   if (s.type === "string")
     return true;
   const variants = s.oneOf ?? s.anyOf;
   if (Array.isArray(variants)) {
     for (const variant of variants) {
-      if (schemaAllowsString(variant))
+      if (schemaAllowsString(variant, visited))
+        return true;
+    }
+  }
+  const allOf = s.allOf;
+  if (Array.isArray(allOf)) {
+    for (const sub of allOf) {
+      if (schemaAllowsString(sub, visited))
         return true;
     }
   }
   return false;
 }
-async function compactSchemaInputs(input, schema, config) {
+async function compactSchemaInputs(input, schema, config, visited = new Set) {
   if (typeof schema === "boolean")
     return input;
   const properties = schema.properties;
@@ -4902,8 +5468,13 @@ async function compactSchemaInputs(input, schema, config) {
     }
     if (value !== null && value !== undefined && typeof value === "object" && !Array.isArray(value)) {
       const objectSchema = getObjectSchema(propSchema);
-      if (objectSchema) {
-        compacted[key] = await compactSchemaInputs(value, objectSchema, config);
+      if (objectSchema && !visited.has(objectSchema)) {
+        visited.add(objectSchema);
+        try {
+          compacted[key] = await compactSchemaInputs(value, objectSchema, config, visited);
+        } finally {
+          visited.delete(objectSchema);
+        }
       }
     }
   }
@@ -5027,7 +5598,7 @@ class IteratorTaskRunner extends GraphAsTaskRunner {
       const newId = uuid46();
       idMap.set(task.config.id, newId);
       const clonedConfig = { ...task.config, id: newId };
-      const newTask = new ctor(task.defaults, clonedConfig, task.runConfig);
+      const newTask = new ctor({ ...clonedConfig, defaults: task.defaults }, task.runConfig);
       if (task.hasChildren()) {
         newTask.subGraph = this.cloneGraph(task.subGraph);
       }
@@ -5227,9 +5798,6 @@ class IteratorTask extends GraphAsTask {
   }
   _iteratorPortInfo;
   _iterationInputSchema;
-  constructor(input = {}, config = {}) {
-    super(input, config);
-  }
   get runner() {
     if (!this._runner) {
       this._runner = new IteratorTaskRunner(this);
@@ -5640,9 +6208,6 @@ class WhileTask extends GraphAsTask {
   canSerializeConfig() {
     return typeof this.config.condition !== "function";
   }
-  constructor(input = {}, config = {}) {
-    super(input, config);
-  }
   get runner() {
     if (!this._runner) {
       this._runner = new WhileTaskRunner(this);
@@ -6164,8 +6729,8 @@ import {
   JobQueueServer
 } from "@workglow/job-queue";
 import { InMemoryQueueStorage } from "@workglow/storage";
-import { createServiceToken as createServiceToken2, globalServiceRegistry as globalServiceRegistry3 } from "@workglow/util";
-var JOB_QUEUE_FACTORY = createServiceToken2("taskgraph.jobQueueFactory");
+import { createServiceToken as createServiceToken4, globalServiceRegistry as globalServiceRegistry3 } from "@workglow/util";
+var JOB_QUEUE_FACTORY = createServiceToken4("taskgraph.jobQueueFactory");
 var defaultJobQueueFactory = async ({
   queueName,
   jobClass,
@@ -6330,13 +6895,13 @@ class ReduceTask extends IteratorTask {
   static configSchema() {
     return reduceTaskConfigSchema;
   }
-  constructor(input = {}, config = {}) {
+  constructor(config = {}) {
     const reduceConfig = {
       ...config,
       concurrencyLimit: 1,
       batchSize: 1
     };
-    super(input, reduceConfig);
+    super(reduceConfig);
   }
   get initialValue() {
     return this.config.initialValue ?? {};
@@ -6408,24 +6973,48 @@ queueMicrotask(() => {
 });
 // src/task/TaskRegistry.ts
 import {
-  createServiceToken as createServiceToken3,
+  createServiceToken as createServiceToken5,
+  getLogger as getLogger6,
   globalServiceRegistry as globalServiceRegistry4,
   registerInputCompactor,
   registerInputResolver
 } from "@workglow/util";
+import { validateSchema } from "@workglow/util/schema";
 var taskConstructors = new Map;
 function registerTask(baseClass) {
-  if (taskConstructors.has(baseClass.type)) {}
+  const existing = taskConstructors.get(baseClass.type);
+  if (existing) {
+    if (existing === baseClass)
+      return;
+    throw new Error(`Task type "${baseClass.type}" is already registered. Unregister it first to replace.`);
+  }
   taskConstructors.set(baseClass.type, baseClass);
+  const schemas = [
+    { name: "inputSchema", schema: baseClass.inputSchema() },
+    { name: "outputSchema", schema: baseClass.outputSchema() }
+  ];
+  for (const { name, schema } of schemas) {
+    const result = validateSchema(schema);
+    if (!result.valid) {
+      const messages = result.errors.map((e) => `${e.path}: ${e.message}`).join("; ");
+      getLogger6().warn(`Task "${baseClass.type}" has invalid ${name}: ${messages}`, {
+        taskType: baseClass.type,
+        schemaName: name,
+        errors: result.errors
+      });
+    }
+  }
+}
+function unregisterTask(type) {
+  return taskConstructors.delete(type);
 }
 var TaskRegistry = {
   all: taskConstructors,
-  registerTask
+  registerTask,
+  unregisterTask
 };
-var TASK_CONSTRUCTORS = createServiceToken3("task.constructors");
-if (!globalServiceRegistry4.has(TASK_CONSTRUCTORS)) {
-  globalServiceRegistry4.register(TASK_CONSTRUCTORS, () => TaskRegistry.all, true);
-}
+var TASK_CONSTRUCTORS = createServiceToken5("task.constructors");
+globalServiceRegistry4.registerIfAbsent(TASK_CONSTRUCTORS, () => TaskRegistry.all, true);
 function getGlobalTaskConstructors() {
   return globalServiceRegistry4.get(TASK_CONSTRUCTORS);
 }
@@ -6483,11 +7072,15 @@ var createSingleTaskFromJSON = (item, registry, options) => {
   const taskClass = constructors.get(item.type);
   if (!taskClass)
     throw new TaskJSONError(`Task type ${item.type} not found, perhaps not registered?`);
+  if (typeof taskClass !== "function" || typeof taskClass.type !== "string") {
+    throw new TaskJSONError(`Task type ${item.type} resolved to an invalid constructor`);
+  }
   const taskConfig = {
     ...item.config,
-    id: item.id
+    id: item.id,
+    defaults: item.defaults ?? {}
   };
-  const task = new taskClass(item.defaults ?? {}, taskConfig, registry ? { registry } : {});
+  const task = new taskClass(taskConfig, registry ? { registry } : {});
   return task;
 };
 var createTaskFromDependencyJSON = (item, registry, options) => {
@@ -6581,8 +7174,8 @@ var registerBaseTasks = () => {
   return tasks;
 };
 // src/storage/TaskGraphRepository.ts
-import { createServiceToken as createServiceToken4, EventEmitter as EventEmitter7 } from "@workglow/util";
-var TASK_GRAPH_REPOSITORY = createServiceToken4("taskgraph.taskGraphRepository");
+import { createServiceToken as createServiceToken6, EventEmitter as EventEmitter7 } from "@workglow/util";
+var TASK_GRAPH_REPOSITORY = createServiceToken6("taskgraph.taskGraphRepository");
 
 class TaskGraphRepository {
   type = "TaskGraphRepository";
@@ -6748,6 +7341,9 @@ export {
   serialGraph,
   schemaHasFormatAnnotations,
   schemaAcceptsArray,
+  scanGraphForFormat,
+  scanGraphForCredentials,
+  resourcePatternMatches,
   resolveSchemaInputs,
   resetMethodNameCache,
   removeIterationProperties,
@@ -6756,6 +7352,9 @@ export {
   reduceTaskConfigSchema,
   pipe,
   parallel,
+  mergeResources,
+  mergeEntitlements,
+  mergeEntitlementPair,
   mergeChainedOutputToInput,
   mapTaskConfigSchema,
   iteratorTaskConfigSchema,
@@ -6768,11 +7367,13 @@ export {
   hasStructuredOutput,
   graphToWorkflowCode,
   graphAsTaskConfigSchema,
+  grantCoversResources,
   getTaskQueueRegistry,
   getTaskConstructors,
   getStructuredOutputSchemas,
   getStreamingPorts,
   getSchemaFormat,
+  getProfileGrants,
   getPortStreamMode,
   getOutputStreamMode,
   getObjectSchema,
@@ -6791,20 +7392,28 @@ export {
   fallbackTaskConfigSchema,
   extractIterationProperties,
   extractBaseSchema,
+  evaluatePolicy,
   evaluateCondition,
+  entitlementCovers,
   ensureTask,
   edgeNeedsAccumulation,
   createTaskFromGraphJSON,
   createTaskFromDependencyJSON,
+  createScopedEnforcer,
+  createProfilePolicy,
+  createProfileEnforcer,
+  createPolicyEnforcer,
   createJobQueueFactoryWithOptions,
   createGraphFromGraphJSON,
   createGraphFromDependencyJSON,
+  createGrantListEnforcer,
   createFlexibleSchema,
   createArraySchema,
   connect,
   conditionalTaskConfigSchema,
   computeGraphOutputSchema,
   computeGraphInputSchema,
+  computeGraphEntitlements,
   compactSchemaInputs,
   calculateNodeDepths,
   buildIterationInputSchema,
@@ -6836,6 +7445,7 @@ export {
   TaskGraph,
   TaskFailedError,
   TaskError,
+  TaskEntitlementError,
   TaskConfigurationError,
   TaskConfigSchema,
   TaskAbortedError,
@@ -6843,8 +7453,11 @@ export {
   TASK_OUTPUT_REPOSITORY,
   TASK_GRAPH_REPOSITORY,
   TASK_CONSTRUCTORS,
+  SERVER_GRANTS,
   ReduceTask,
   PROPERTY_ARRAY,
+  PERMISSIVE_RESOLVER,
+  PERMISSIVE_ENFORCER,
   MapTask,
   JobTaskFailedError,
   JOB_QUEUE_FACTORY,
@@ -6858,15 +7471,23 @@ export {
   FallbackTask,
   EventTaskGraphToDagMapping,
   EventDagToTaskGraphMapping,
+  Entitlements,
+  ENTITLEMENT_RESOLVER,
+  ENTITLEMENT_ENFORCER,
+  EMPTY_POLICY,
+  EMPTY_ENTITLEMENTS,
   DataflowArrow,
   Dataflow,
+  DESKTOP_GRANTS,
+  DENY_ALL_RESOLVER,
   DATAFLOW_ERROR_PORT,
   DATAFLOW_ALL_PORTS,
   CreateWorkflow,
   CreateLoopWorkflow,
   CreateEndLoopWorkflow,
   CreateAdaptiveWorkflow,
-  ConditionalTask
+  ConditionalTask,
+  BROWSER_GRANTS
 };
 
-//# debugId=BDC0F4EAE393712864756E2164756E21
+//# debugId=022B1E4C55D2D5D864756E2164756E21