akm-cli 0.9.5 → 0.9.6

package/dist/workflows/exec/native-executor.js

@@ -115,7 +115,7 @@ import { appendEvent } from "../../core/events.js";
 import { validateJsonSchemaSubset } from "../../core/json-schema.js";
 import { runStructured } from "../../core/structured.js";
 import { warn } from "../../core/warn.js";
-import { assertFrozenDirectoryIdentity } from "../../execution/directory-identity.js";
+import { assertFrozenDirectoryContained } from "../../execution/directory-identity.js";
 import { assertFrozenExecutableIdentity } from "../../execution/executable-identity.js";
 import { withWorkflowRunsConnection, withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-repository.js";
 import { materializeFrozenWorkflowEnvironment } from "../ir/environment-v4.js";
@@ -132,7 +132,7 @@ import { collectWorkflowDispatchSensitiveValues, redactUnitOutcome } from "./dis
 // and the process-outcome → failure-reason mapping.
 import { runExecUnit } from "./exec-unit.js";
 import { mergeLoweringNotices } from "./lowering-notices.js";
-import { LIFETIME_UNIT_CAP, scheduleUnits, UnitCapExceededError } from "./scheduler.js";
+import { scheduleUnits } from "./scheduler.js";
 // Shared step semantics — the ONE implementation consumed by the engine
 // (this module + run-workflow.ts) on both the fresh-execution and the resume
 // path. This module dispatches; step-work.ts owns the pure decisions.
@@ -142,13 +142,13 @@ import { cleanupFrozenScript, frozenScriptCommand, materializeFrozenScript } fro
 import { enqueueUnitWrite } from "./unit-writer.js";
 import { assertGitWorkTree, cleanupUnitWorktree, createUnitWorktree } from "./worktree.js";
 /**
- * Mutable per-step dispatch budget: the lifetime unit cap PLUS the declared
- * run-level budget ceilings (`budget.max_units` / `budget.max_tokens`,
- * addendum R2). Consumed once per journaled dispatch attempt (including
- * retries); durable-row reuses never touch it — the peer-review fix that
- * keeps large partially-completed fan-outs resumable instead of tripping the
- * cap on `journaled + items`. Token usage accumulates per actual dispatch on
- * top of the journal-seeded run total (reused rows' tokens are already in the
+ * Mutable per-step dispatch budget: the declared run-level budget ceilings
+ * (`budget.max_units` / `budget.max_tokens`, addendum R2). Consumed once per
+ * journaled dispatch attempt (including retries); durable-row reuses never
+ * touch it — the peer-review fix that keeps large partially-completed
+ * fan-outs resumable instead of tripping a pre-batch check on
+ * `journaled + items`. Token usage accumulates per actual dispatch on top of
+ * the journal-seeded run total (reused rows' tokens are already in the
  * seed). Check-and-increment is synchronous, so concurrent units cannot race
  * it; crossing a declared ceiling fires `onExceeded` ONCE (the executor's
  * chained AbortController), aborting pending and in-flight dispatches.
@@ -157,8 +157,6 @@ class DispatchBudget {
     used;
     /** Run-total tokens: journal-seeded input + this step's dispatch usage. */
     tokens;
-    /** Set (once) when a dispatch was refused; the step fails with this message. */
-    capMessage;
     /** Set (once) when a declared budget ceiling was hit; the step fails hard with it. */
     budgetMessage;
     maxUnits;
@@ -185,10 +183,6 @@ class DispatchBudget {
                 `against the workflow's declared budget.max_tokens of ${this.maxTokens} — refusing further dispatch.`);
             return false;
         }
-        if (this.used >= LIFETIME_UNIT_CAP) {
-            this.capMessage ??= new UnitCapExceededError(LIFETIME_UNIT_CAP).message;
-            return false;
-        }
         this.used++;
         return true;
     }
@@ -343,7 +337,7 @@ async function prepareStepDispatchPrerequisites(input) {
         const target = workUnits[0]?.frozenTarget;
         const frozenCwd = target && "cwdIdentity" in target ? target.cwdIdentity : undefined;
         if (frozenCwd)
-            assertFrozenDirectoryIdentity(frozenCwd);
+            assertFrozenDirectoryContained(frozenCwd);
         const base = frozenCwd?.realRoot ?? ctx.workDir ?? process.cwd();
         const preflightWorktree = ctx.preflightWorktree ?? assertGitWorkTree;
         const gitError = preflightWorktree(base);
@@ -464,15 +458,12 @@ async function executeStepPlanInConnection(plan, ctx) {
     // journal-write failures must not erase notices already observed from real
     // dispatches; durable row reuses naturally contribute none.
     const notices = mergeLoweringNotices(...outcomes.map((outcome) => outcome?.notices));
-    // Declared budget ceilings and the lifetime cap are hard backstops: a step
-    // that hit one FAILS regardless of on_error policy (a capped run must never
-    // quietly pass its gate). The budget message names WHICH ceiling tripped.
+    // A declared budget ceiling is a hard backstop: a step that hit one FAILS
+    // regardless of on_error policy (a capped run must never quietly pass its
+    // gate). The budget message names WHICH ceiling tripped.
     if (budget.budgetMessage) {
         return { ...failedStep(budget.used, budget.budgetMessage, notices), tokensUsed: budget.tokens };
     }
-    if (budget.capMessage) {
-        return { ...failedStep(budget.used, budget.capMessage, notices), tokensUsed: budget.tokens };
-    }
     const units = outcomes.map((outcome, index) => outcome ?? {
         unitId: workUnits[index].unitId,
         ok: false,
@@ -597,17 +588,16 @@ async function runUnit(input) {
             });
         }
         const attemptId = attemptIdFor(attempt);
-        // Lifetime cap + declared budget ceilings, consumed per ACTUAL dispatch
-        // (reuses above returned before reaching here). Refusal fails this unit
-        // without journaling a row — nothing was dispatched — and the sticky
-        // capMessage/budgetMessage fails the step.
+        // Declared budget ceilings, consumed per ACTUAL dispatch (reuses above
+        // returned before reaching here). Refusal fails this unit without
+        // journaling a row — nothing was dispatched — and the sticky
+        // budgetMessage fails the step.
         if (!input.budget.tryConsume()) {
-            const budgetHit = input.budget.budgetMessage !== undefined;
             return (outcome ?? {
                 unitId,
                 ok: false,
-                failureReason: budgetHit ? "budget_exceeded" : "unit_cap_exceeded",
-                error: input.budget.budgetMessage ?? input.budget.capMessage ?? "lifetime unit cap exceeded",
+                failureReason: "budget_exceeded",
+                error: input.budget.budgetMessage ?? "budget exceeded",
             });
         }
         outcome = await dispatchJournaledAttempt({
@@ -1055,7 +1045,7 @@ async function dispatchUnit(request, dispatcher) {
 export const defaultUnitDispatcher = async (request, feedback) => {
     const frozenTarget = request.frozenTarget;
     if (frozenTarget.kind === "script") {
-        assertFrozenDirectoryIdentity(frozenTarget.cwdIdentity);
+        assertFrozenDirectoryContained(frozenTarget.cwdIdentity);
         if (frozenTarget.executable) {
             assertFrozenExecutableIdentity(frozenTarget.executable, `unit ${request.unitId} executable`);
         }
@@ -1099,7 +1089,7 @@ export const defaultUnitDispatcher = async (request, feedback) => {
     }
     if (frozenTarget.kind === "shell") {
         if (frozenTarget.cwdIdentity)
-            assertFrozenDirectoryIdentity(frozenTarget.cwdIdentity);
+            assertFrozenDirectoryContained(frozenTarget.cwdIdentity);
         if (frozenTarget.executable) {
             assertFrozenExecutableIdentity(frozenTarget.executable, `unit ${request.unitId} executable`);
         }

package/dist/workflows/exec/run-workflow.js

@@ -332,12 +332,11 @@ function workflowSummaryJudge(options, stepPlan, signal, owner) {
     return frozenSummaryJudge(stepPlan.gate.frozenJudge, signal, options.dispatcher ?? defaultUnitDispatcher, owner, options.eventSource);
 }
 /**
- * Seed the lifetime unit cap AND the budget ceilings from the journal so
- * both are truly per-RUN: a resumed or re-invoked run must not restart the
- * runaway backstop — or a declared `budget` — at zero. The append-only attempt
- * journal is authoritative: dispatch attempts count against
- * `budget.max_units`, and their known tokens count against
- * `budget.max_tokens`. Durable result reuse is free.
+ * Seed the declared budget ceilings from the journal so they are truly
+ * per-RUN: a resumed or re-invoked run must not restart a declared `budget`
+ * at zero. The append-only attempt journal is authoritative: dispatch
+ * attempts count against `budget.max_units`, and their known tokens count
+ * against `budget.max_tokens`. Durable result reuse is free.
  *
  * Gate-evaluation rows (`phase = "gate"`, journaled by the completion-gate
  * judge) are EXCLUDED from the seed: the live path never consumes

package/dist/workflows/exec/scheduler.js

@@ -15,17 +15,9 @@
  *   - Cooperative cancellation via AbortSignal (workers stop claiming items;
  *     the same signal is passed into each dispatch so in-flight units can be
  *     preempted too).
- *
- * The lifetime unit cap ({@link LIFETIME_UNIT_CAP}) is DECLARED here but
- * enforced per actual dispatch by the native executor: a pre-batch check
- * (`journaled + items.length`) counted durable-row REUSES as new dispatches,
- * which made any partially-completed fan-out with more than ~cap/2 journaled
- * units impossible to resume (peer review R1). Only work that really
- * dispatches consumes the cap.
  */
 import { concurrentMap } from "../../core/concurrent.js";
 import { cpuDerivedUnitConcurrency, workflowMaxConcurrency } from "../concurrency-policy.js";
-import { WORKFLOW_MAX_MAP_EXPANSION } from "../resource-limits.js";
 export { clampMaxConcurrency, cpuDerivedUnitConcurrency, WORKFLOW_MAX_CONCURRENCY_CEILING, } from "../concurrency-policy.js";
 /**
  * Hard ceiling on an EXPLICIT `workflow.maxConcurrency`. A user value above
@@ -49,21 +41,13 @@ export { clampMaxConcurrency, cpuDerivedUnitConcurrency, WORKFLOW_MAX_CONCURRENC
 export function maxUnitConcurrency(cpuCount, configured) {
     return workflowMaxConcurrency(configured, cpuCount);
 }
-/** Lifetime unit cap per run — a runaway-loop backstop, far above real use. */
-export const LIFETIME_UNIT_CAP = WORKFLOW_MAX_MAP_EXPANSION;
-export class UnitCapExceededError extends Error {
-    constructor(cap) {
-        super(`workflow run exceeded the lifetime unit cap (${cap}). Aborting dispatch — check for a runaway fan-out.`);
-        this.name = "UnitCapExceededError";
-    }
-}
 /**
  * Run `dispatch` over `items` under the engine concurrency caps. Individual
  * failures do not cancel siblings (allSettled semantics from `concurrentMap`);
  * a slot whose dispatch threw or that was never claimed after an abort stays
- * `undefined` in the result array. The lifetime unit cap is NOT checked here
- * — the executor consumes it per actual dispatch, so durable-row reuses on
- * resume stay free.
+ * `undefined` in the result array. A declared `budget.max_units` ceiling is
+ * NOT checked here — the executor consumes it per actual dispatch, so
+ * durable-row reuses on resume stay free.
  */
 export async function scheduleUnits(items, dispatch, options = {}) {
     const concurrency = Math.max(1, Math.min(options.concurrency ?? 1, options.maxConcurrency ?? Number.POSITIVE_INFINITY, options.llmConcurrency ?? Number.POSITIVE_INFINITY, options.hostConcurrency ?? cpuDerivedUnitConcurrency()));

package/dist/workflows/exec/step-work.js

@@ -22,7 +22,7 @@ import { canonicalInputJson, validateInputs } from "../../execution/input-contra
 import { withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-repository.js";
 import { canonicalJson as canonicalJsonString } from "../ir/plan-hash.js";
 import { parseReference, resolveReferenceString, } from "../program/expressions.js";
-import { clip, WORKFLOW_MAX_MAP_EXPANSION, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
+import { clip, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
 import { completeWorkflowStep, isTruncatedEvidence, } from "../runtime/runs.js";
 import { GATE_EVALUATION_PHASE } from "../runtime/unit-phases.js";
 import { parseJudgeVerdict } from "../validate-summary.js";
@@ -60,9 +60,6 @@ const GATE_ARTIFACT_CLIP = 4_000;
  * deterministically, before dispatch.
  */
 function validateFanOutItems(stepId, items) {
-    if (items.length > WORKFLOW_MAX_MAP_EXPANSION) {
-        return `Step "${stepId}" fan-out expands to ${items.length} units, exceeding the ${WORKFLOW_MAX_MAP_EXPANSION}-unit resource limit.`;
-    }
     const nullIndex = items.findIndex((item) => item === null || item === undefined);
     if (nullIndex !== -1) {
         return (`Step "${stepId}" fan-out list contains a null item (index ${nullIndex}). ` +

package/dist/workflows/exec/unit-dispatch.js

@@ -2,7 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { ConfigError } from "../../core/errors.js";
-import { assertFrozenDirectoryIdentity } from "../../execution/directory-identity.js";
+import { assertFrozenDirectoryContained } from "../../execution/directory-identity.js";
 import { assertFrozenExecutableIdentity } from "../../execution/executable-identity.js";
 import { canonicalResolvedExecutionRequest, decodeResolvedExecutionRequest, } from "../../execution/resolved-request.js";
 import { dispatchLoweredExecutionRequest, lowerResolvedExecutionRequestWithRunner, } from "../../integrations/agent/execution-lowering.js";
@@ -11,7 +11,7 @@ import { getHarness } from "../../integrations/harnesses/index.js";
 export function prepareWorkflowExecution(request, prompt = request.prompt) {
     const target = request.frozenTarget;
     if (target.cwdIdentity)
-        assertFrozenDirectoryIdentity(target.cwdIdentity);
+        assertFrozenDirectoryContained(target.cwdIdentity);
     if (target.executable)
         assertFrozenExecutableIdentity(target.executable, `unit ${request.unitId} executable`);
     const wire = JSON.parse(canonicalResolvedExecutionRequest(target.request));

package/dist/workflows/exec/worktree.js

@@ -67,7 +67,7 @@ import { spawnSync } from "node:child_process";
 import fsp from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { isWithinAsync, safeRealpathAsync } from "../../core/common.js";
+import { isProcessAlive, isWithinAsync, safeRealpathAsync } from "../../core/common.js";
 import { serializeByKey } from "../../core/concurrent.js";
 import { runManagedSubprocess } from "../../core/subprocess.js";
 import { warn } from "../../core/warn.js";
@@ -417,18 +417,6 @@ async function isWorktreeLeaseLive(candidate) {
         return false;
     return isProcessAlive(lease.pid);
 }
-/** `kill(pid, 0)` liveness probe. EPERM proves the process exists but is not ours. */
-function isProcessAlive(pid) {
-    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (err) {
-        return err.code === "EPERM";
-    }
-}
 // ── Garbage collection ──────────────────────────────────────────────────────
 /**
  * Drop the run-scoped root once its last unit worktree is gone. `rmdir`

package/dist/workflows/freeze/targets/child-workflow.js

@@ -31,7 +31,7 @@ import { UsageError } from "../../../core/errors.js";
 import { GuardedExecutionSourceCollector } from "../../../execution/guarded-source.js";
 import { workflowParamContract } from "../../ir/params.js";
 import { canonicalJson, canonicalPlanJson } from "../../ir/plan-hash.js";
-import { utf8Bytes, WORKFLOW_MAX_COMPOSITION_DEPTH, WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES, } from "../../resource-limits.js";
+import { utf8Bytes, WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES } from "../../resource-limits.js";
 import { loadWorkflowAsset } from "../../runtime/workflow-asset-loader.js";
 import { resolveOwnedAsset } from "../environment.js";
 import { declaredParamNames, earlierStepIds } from "../step-values.js";
@@ -91,13 +91,6 @@ function assertNoCompositionCycle(stepId, childRef, refPath) {
         `Path: ${compositionPath(refPath, childRef)}.`, "COMPOSITION_INVALID", "Break the cycle: remove or redirect one of the compositions in the path above so no workflow ends up " +
         "composing itself, directly or through intermediates.");
 }
-function assertCompositionDepthAllowed(stepId, childRef, childDepth, refPath) {
-    if (childDepth <= WORKFLOW_MAX_COMPOSITION_DEPTH)
-        return;
-    throw new UsageError(`Workflow step ${stepId} cannot compose ${childRef}: workflow composition is limited to ` +
-        `${WORKFLOW_MAX_COMPOSITION_DEPTH} levels. Path: ${compositionPath(refPath, childRef)}.`, "COMPOSITION_INVALID", `Flatten the composition chain to ${WORKFLOW_MAX_COMPOSITION_DEPTH} levels or fewer — inline one of the ` +
-        "intermediate workflows, or restructure the chain so fewer child compositions are nested.");
-}
 /**
  * Add the child's embedded plan bytes to the shared, tree-wide budget
  * (A-N6) and fail before publication if the AGGREGATE crosses the cap.
@@ -126,10 +119,9 @@ export async function childWorkflowDispatch(input) {
     // path to reach the child run and must reject, not vanish (see
     // assertNoStepEnvironment's doc comment).
     assertNoStepEnvironment(source.id, childRef, source);
-    // §4.2 steps 2-3: the composition bounds, before any child compilation.
+    // §4.2 step 2: the composition cycle check, before any child compilation.
     assertNoCompositionCycle(source.id, childRef, context.composition.refPath);
     const childDepth = context.composition.depth + 1;
-    assertCompositionDepthAllowed(source.id, childRef, childDepth, context.composition.refPath);
     // §4.2 step 4: freeze the child COMPLETELY (compile -> validate -> freeze),
     // with its OWN fresh collector (A-N7) so its plan is a pure function of its
     // own source, and the SAME mutable budget object so the aggregate bound

package/dist/workflows/ir/plan-hash.js

@@ -13,7 +13,7 @@
  * Pure module: no IO beyond node:crypto, no engine imports.
  */
 import { createHash } from "node:crypto";
-import { utf8Bytes, WORKFLOW_MAX_JSON_DEPTH, WORKFLOW_MAX_PLAN_BYTES } from "../resource-limits.js";
+import { utf8Bytes, WORKFLOW_MAX_PLAN_BYTES } from "../resource-limits.js";
 import { decodeWorkflowPlanV4, WORKFLOW_IR_V5_VERSION } from "./schema-v4.js";
 /** sha256 hex of the canonical (recursively sorted-keys) JSON of the plan. */
 export function computePlanHash(plan) {
@@ -53,9 +53,7 @@ export function decodeCanonicalPlan(runId, planJson, planHash, expectedVersion)
         throw new Error(`Workflow run ${runId} has noncanonical frozen plan JSON.`);
     return plan;
 }
-function sortKeys(value, depth = 0) {
-    if (depth > WORKFLOW_MAX_JSON_DEPTH)
-        throw new TypeError("JSON value exceeds maximum depth");
+function sortKeys(value) {
     if (value === null || typeof value === "string" || typeof value === "boolean")
         return value;
     if (typeof value === "number") {
@@ -64,11 +62,11 @@ function sortKeys(value, depth = 0) {
         return value;
     }
     if (Array.isArray(value))
-        return value.map((item) => sortKeys(item, depth + 1));
+        return value.map((item) => sortKeys(item));
     if (value && typeof value === "object") {
         return Object.fromEntries(Object.entries(value)
             .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-            .map(([k, v]) => [k, sortKeys(v, depth + 1)]));
+            .map(([k, v]) => [k, sortKeys(v)]));
     }
     throw new TypeError("JSON value contains a non-JSON value");
 }

package/dist/workflows/ir/schema-v4.js

@@ -182,15 +182,6 @@ function decodeFrozenTarget(value, unit, environment, requiredSources, depth, bu
         return decodeChildWorkflowTarget(target, unit, depth, budget);
     fail(`unit ${unit.id} frozenTarget has unsupported kind ${String(target.kind)}`);
 }
-/**
- * Composition-depth corruption bound (spec §3.6 step 6, §4.5, row A-23).
- * Mirrors `WORKFLOW_MAX_COMPOSITION_DEPTH` (= 8), which Lane B adds to
- * `src/workflows/resource-limits.ts` in a later commit as the freeze-time
- * `COMPOSITION_INVALID` gate. Reproduced here — the decode-time corruption
- * gate — rather than imported across the lane boundary, matching
- * `tests/workflows/plan-v5-schema.test.ts`'s own header comment.
- */
-const CHILD_WORKFLOW_DECODE_MAX_DEPTH = 8;
 /**
  * Decode a `kind: "child-workflow"` frozen target (§3.5): the embedded
  * COMPLETE child plan, re-verified against its own `planHash` and this
@@ -241,9 +232,6 @@ function decodeChildWorkflowTarget(target, unit, depth, budget) {
         fail(`unit ${unit.id} child workflow contentHash does not match its frozen dispatch`);
     }
     const childDepth = depth + 1;
-    if (childDepth > CHILD_WORKFLOW_DECODE_MAX_DEPTH) {
-        fail(`unit ${unit.id} child workflow ${target.ref} exceeds the max composition depth of ${CHILD_WORKFLOW_DECODE_MAX_DEPTH}`);
-    }
     const frozenPlan = decodeWorkflowPlanV4(target.frozenPlan, {}, childDepth, budget);
     const embeddedPlanJson = canonicalJsonLocal(frozenPlan);
     const actualPlanHash = sha256(embeddedPlanJson);

package/dist/workflows/ir/schema.js

@@ -5,12 +5,11 @@ import { isContainedRelativePath } from "../../core/common.js";
 import { UsageError } from "../../core/errors.js";
 import { parseReference } from "../program/expressions.js";
 import { PROGRAM_PARAM_NAME_PATTERN, PROGRAM_RETRY_REASONS, PROGRAM_STEP_ID_PATTERN } from "../program/schema.js";
-import { jsonBytes, utf8Bytes, WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_EXEC_ARG_BYTES, WORKFLOW_MAX_EXEC_ARGV, WORKFLOW_MAX_EXEC_CWD_LENGTH, WORKFLOW_MAX_EXEC_PASS_ENV, WORKFLOW_MAX_GATE_LOOPS, WORKFLOW_MAX_INPUTS, WORKFLOW_MAX_INSTRUCTION_BYTES, WORKFLOW_MAX_JSON_DEPTH, WORKFLOW_MAX_MAP_EXPANSION, WORKFLOW_MAX_PARAMS, WORKFLOW_MAX_PLAN_BYTES, WORKFLOW_MAX_RETRIES, WORKFLOW_MAX_ROUTE_BRANCHES, WORKFLOW_MAX_SCHEMA_BYTES, WORKFLOW_MAX_STEPS, WORKFLOW_MAX_TIMEOUT_MS, } from "../resource-limits.js";
+import { jsonBytes, utf8Bytes, WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_INSTRUCTION_BYTES, WORKFLOW_MAX_PLAN_BYTES, WORKFLOW_MAX_SCHEMA_BYTES, WORKFLOW_MAX_TIMEOUT_MS, } from "../resource-limits.js";
 // Shared dispatch-significant bounds now live in `../resource-limits` so the
 // parser, the published JSON Schema, and this decoder enforce identical
 // values. Re-exported here for existing importers (e.g. `commands/workflow-cli.ts`).
-export { WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_GATE_LOOPS, WORKFLOW_MAX_RETRIES, WORKFLOW_MAX_TIMEOUT_MS };
-export const WORKFLOW_MAX_UNITS = WORKFLOW_MAX_MAP_EXPANSION;
+export { WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_TIMEOUT_MS };
 const MAX_LIST_ITEMS = 1024;
 const MAX_STRING_LENGTH = 1_000_000;
 /** Validate the current durable execution graph. */
@@ -33,8 +32,8 @@ export function validateWorkflowPlanStructure(input, options, hooks = {}) {
         fail(`execution.maxConcurrency must be an integer from 1 through ${WORKFLOW_MAX_CONCURRENCY}`);
     }
     assertKeys(plan.execution, ["maxConcurrency"], "execution");
-    if (!Array.isArray(plan.steps) || plan.steps.length === 0 || plan.steps.length > WORKFLOW_MAX_STEPS)
-        fail("steps must contain 1 through 256 entries");
+    if (!Array.isArray(plan.steps) || plan.steps.length === 0)
+        fail("steps must be a non-empty array");
     const stepIds = new Set();
     const nodeIds = new Set();
     for (let index = 0; index < plan.steps.length; index++) {
@@ -126,7 +125,7 @@ function validateNode(node, stepId, nodeIds, unitExtraKeys) {
         validateSchema(node.schema, `unit ${node.id} schema`);
     validateRetry(node.retry, node.id);
     validateStringArray(node.env, `unit ${node.id} env`, MAX_LIST_ITEMS, true);
-    validateStringArray(node.inputs, `unit ${node.id} inputs`, WORKFLOW_MAX_INPUTS, true);
+    validateStringArray(node.inputs, `unit ${node.id} inputs`, Infinity, true);
     validateSource(node.source, `unit ${node.id} source`);
 }
 /**
@@ -143,15 +142,11 @@ function validateExecSpec(value, label) {
     const command = value.command;
     if (!Array.isArray(command) ||
         command.length === 0 ||
-        command.length > WORKFLOW_MAX_EXEC_ARGV ||
-        !command.every((arg) => typeof arg === "string" && arg.length > 0 && utf8Bytes(arg) <= WORKFLOW_MAX_EXEC_ARG_BYTES)) {
-        fail(`${label}.command must be an argv array of 1 through ${WORKFLOW_MAX_EXEC_ARGV} bounded non-empty strings`);
+        !command.every((arg) => typeof arg === "string" && arg.length > 0)) {
+        fail(`${label}.command must be an argv array of non-empty strings`);
     }
     if (value.cwd !== undefined) {
-        if (typeof value.cwd !== "string" ||
-            value.cwd.length === 0 ||
-            value.cwd.length > WORKFLOW_MAX_EXEC_CWD_LENGTH ||
-            !isContainedRelativePath(value.cwd)) {
+        if (typeof value.cwd !== "string" || value.cwd.length === 0 || !isContainedRelativePath(value.cwd)) {
             fail(`${label}.cwd must be a relative path contained in the unit working directory`);
         }
     }
@@ -183,11 +178,10 @@ function validateExecEnvScope(value, label) {
     const passEnv = value.passEnv;
     if (!Array.isArray(passEnv) ||
         passEnv.length === 0 ||
-        passEnv.length > WORKFLOW_MAX_EXEC_PASS_ENV ||
         !passEnv.every((name) => typeof name === "string" && WORKFLOW_ENV_VAR_NAME_PATTERN.test(name)) ||
         new Set(passEnv).size !== passEnv.length) {
-        fail(`${label}.passEnv must be 1 through ${WORKFLOW_MAX_EXEC_PASS_ENV} distinct environment variable names ` +
-            `matching ${WORKFLOW_ENV_VAR_NAME_PATTERN.source}`);
+        fail(`${label}.passEnv must be a non-empty list of distinct environment variable names matching ` +
+            `${WORKFLOW_ENV_VAR_NAME_PATTERN.source}`);
     }
 }
 function validateGate(gate, stepId, nodeIds, gateExtraKeys) {
@@ -199,8 +193,7 @@ function validateGate(gate, stepId, nodeIds, gateExtraKeys) {
         gate.criteria.length > MAX_LIST_ITEMS ||
         !gate.criteria.every((x) => typeof x === "string" && x.length > 0 && x.length <= MAX_STRING_LENGTH) ||
         !Number.isInteger(gate.maxLoops) ||
-        gate.maxLoops < 1 ||
-        gate.maxLoops > WORKFLOW_MAX_GATE_LOOPS)
+        gate.maxLoops < 1)
         fail(`gate for step ${stepId} is invalid`);
     if (nodeIds.has(gate.id))
         fail(`gate id ${gate.id} collides with a node`);
@@ -213,7 +206,6 @@ function validateRoute(route, stepId) {
         !route.input ||
         !isRecord(route.when) ||
         Object.keys(route.when).length === 0 ||
-        Object.keys(route.when).length > WORKFLOW_MAX_ROUTE_BRANCHES ||
         !Object.keys(route.when).every((match) => match.length > 0 && match.length <= MAX_STRING_LENGTH) ||
         !Object.values(route.when).every((target) => typeof target === "string" && target))
         fail(`route for step ${stepId} is invalid`);
@@ -226,9 +218,7 @@ function assertKeys(value, allowed, label) {
         if (!allowed.includes(key))
             fail(`${label} contains unknown key ${key}`);
 }
-function assertJson(value, depth = 0) {
-    if (depth > WORKFLOW_MAX_JSON_DEPTH)
-        fail("plan exceeds JSON depth limit of 64");
+function assertJson(value) {
     if (value === null || typeof value === "boolean")
         return;
     if (typeof value === "string") {
@@ -243,23 +233,23 @@ function assertJson(value, depth = 0) {
     }
     if (Array.isArray(value)) {
         for (const item of value)
-            assertJson(item, depth + 1);
+            assertJson(item);
         return;
     }
     if (isRecord(value)) {
         for (const item of Object.values(value))
-            assertJson(item, depth + 1);
+            assertJson(item);
         return;
     }
     fail("plan contains a non-JSON value");
 }
 function validateParams(params, schemas) {
-    validateStringArray(params, "params", WORKFLOW_MAX_PARAMS, true);
+    validateStringArray(params, "params", Infinity, true);
     if (params?.some((name) => !PROGRAM_PARAM_NAME_PATTERN.test(name)))
         fail("params contains an invalid name");
     if (schemas !== undefined) {
-        if (!isRecord(schemas) || Object.keys(schemas).length > WORKFLOW_MAX_PARAMS)
-            fail("paramSchemas must be a bounded object");
+        if (!isRecord(schemas))
+            fail("paramSchemas must be an object");
         for (const [name, schema] of Object.entries(schemas)) {
             if (!PROGRAM_PARAM_NAME_PATTERN.test(name))
                 fail(`paramSchemas.${name} is invalid`);
@@ -284,9 +274,8 @@ function validateBudget(budget) {
         fail("budget must declare a ceiling");
     validateOptionalPositiveInteger(budget.maxTokens, "budget.maxTokens");
     const maxUnits = budget.maxUnits;
-    if (maxUnits !== undefined &&
-        (!Number.isSafeInteger(maxUnits) || maxUnits < 1 || maxUnits > WORKFLOW_MAX_UNITS))
-        fail(`budget.maxUnits must be an integer from 1 through ${WORKFLOW_MAX_UNITS}`);
+    if (maxUnits !== undefined && (!Number.isSafeInteger(maxUnits) || maxUnits < 1))
+        fail("budget.maxUnits must be a positive integer");
 }
 function validateRetry(retry, nodeId) {
     if (retry === undefined)
@@ -294,7 +283,7 @@ function validateRetry(retry, nodeId) {
     if (!isRecord(retry))
         fail(`unit ${nodeId} retry must be an object`);
     assertKeys(retry, ["max", "on"], `unit ${nodeId} retry`);
-    if (!Number.isSafeInteger(retry.max) || retry.max < 0 || retry.max > WORKFLOW_MAX_RETRIES)
+    if (!Number.isSafeInteger(retry.max) || retry.max < 0)
         fail(`unit ${nodeId} retry.max is invalid`);
     validateStringArray(retry.on, `unit ${nodeId} retry.on`, PROGRAM_RETRY_REASONS.length, true);
     if (retry.on === undefined ||