@ixo/editor 5.12.0 → 5.14.0

package/dist/{chunk-GCR6VY7O.mjs → chunk-JAB2IBVH.mjs}

@@ -543,7 +543,14 @@ registerAction({
   // events-and-triggers plan.
   eligibleForEventTrigger: true,
   run: async (inputs, ctx) => {
-    const { url, method = "GET", headers = {}, body } = inputs;
+    const endpoint = inputs.endpoint ?? inputs.url;
+    const url = typeof endpoint === "string" ? endpoint : "";
+    if (!url) {
+      throw new Error("HTTP request action requires an endpoint or url input");
+    }
+    const method = typeof inputs.method === "string" ? inputs.method : "GET";
+    const headers = inputs.headers && typeof inputs.headers === "object" && !Array.isArray(inputs.headers) ? inputs.headers : {};
+    const body = inputs.body;
     const requestFn = ctx.services.http?.request;
     if (requestFn) {
       const result = await requestFn({ url, method, headers, body });
@@ -2572,14 +2579,14 @@ var tempDomainCreatorSurvey = {
 function resolveEntityTypeFromSchema(schemaType) {
   const normalized = schemaType.replace(/^schema:/i, "").toLowerCase();
   const schemaToEntity = {
-    organization: "dao",
-    nonprofit: "dao",
-    corporation: "dao",
-    governmentorganization: "dao"
+    organization: "dao/pod",
+    nonprofit: "dao/pod",
+    corporation: "dao/pod",
+    governmentorganization: "dao/pod"
   };
   if (schemaToEntity[normalized]) return schemaToEntity[normalized];
-  const allowed = /* @__PURE__ */ new Set(["dao", "protocol", "oracle", "investment", "project", "asset"]);
-  return allowed.has(normalized) ? normalized : "dao";
+  const allowed = /* @__PURE__ */ new Set(["dao/pod", "protocol", "oracle", "investment", "project", "asset"]);
+  return allowed.has(normalized) ? normalized : "dao/pod";
 }
 function parseJsonInput(value) {
   if (!value) return null;
@@ -2718,7 +2725,7 @@ registerAction({
     if (!domainCardData?.credentialSubject?.name) {
       throw new Error("domainCardData is missing or invalid (credentialSubject.name required)");
     }
-    const entityType = String(inputs.entityType || "").trim() || (domainCardData.credentialSubject?.type?.[0] ? resolveEntityTypeFromSchema(domainCardData.credentialSubject.type[0]) : "dao");
+    const entityType = String(inputs.entityType || "").trim() || (domainCardData.credentialSubject?.type?.[0] ? resolveEntityTypeFromSchema(domainCardData.credentialSubject.type[0]) : "dao/pod");
     const issuerDid = handlers.getEntityDid?.() || handlers.getCurrentUser?.()?.address;
     if (!issuerDid) throw new Error("Unable to determine issuer DID");
     const entityDidPlaceholder = "did:ixo:entity:pending";
@@ -5143,6 +5150,22 @@ function toSupportedDID(did) {
   }
   return void 0;
 }
+function normalizeDid(did) {
+  if (did.startsWith("did:")) return did;
+  if (!did.startsWith("@did-")) return did;
+  const [localpart] = did.split(":");
+  const parts = localpart.split("-");
+  if (parts.length < 3 || parts[0] !== "@did") return did;
+  return `did:${parts[1]}:${parts.slice(2).join("-")}`;
+}
+function toInvocationAudienceDID(did) {
+  const normalized = normalizeDid(did);
+  const supported = toSupportedDID(normalized);
+  if (!supported) {
+    throw new Error(`Invalid DID "${did}", must start with 'did:'`);
+  }
+  return supported;
+}
 function toUcantoCapabilities(capabilities) {
   return capabilities.map((cap) => ({
     can: cap.can,
@@ -5151,13 +5174,14 @@ function toUcantoCapabilities(capabilities) {
   }));
 }
 async function getSigner(handlers, did, didType, entityRoomId, pin) {
-  const supportedDid = toSupportedDID(did);
+  const normalizedDid = normalizeDid(did);
+  const supportedDid = toSupportedDID(normalizedDid);
   if (handlers.getPrivateKey) {
-    const privateKey = await handlers.getPrivateKey({ did, didType, entityRoomId, pin });
+    const privateKey = await handlers.getPrivateKey({ did: normalizedDid, didType, entityRoomId, pin });
     return parseSigner(privateKey, supportedDid);
   }
   if (handlers.getMnemonic) {
-    const mnemonic = await handlers.getMnemonic({ did, didType, entityRoomId, pin });
+    const mnemonic = await handlers.getMnemonic({ did: normalizedDid, didType, entityRoomId, pin });
     const result = await signerFromMnemonic(mnemonic, supportedDid);
     return result.signer;
   }
@@ -5168,6 +5192,7 @@ function getCidFromDelegation(delegation) {
 }
 var createUcanService = (config) => {
   const { delegationStore, invocationStore, handlers, flowOwnerDid } = config;
+  const normalizedFlowOwnerDid = normalizeDid(flowOwnerDid);
   const delegationCache = /* @__PURE__ */ new Map();
   const isConfigured = () => {
     const hasSessionHandlers = !!(handlers.createSignerSession && handlers.signWithSession);
@@ -5202,11 +5227,12 @@ var createUcanService = (config) => {
   };
   const createRootDelegation = async (params) => {
     const { flowOwnerDid: ownerDid, issuerType, entityRoomId, flowUri: uri, pin } = params;
-    const signer = await getSigner(handlers, ownerDid, issuerType, entityRoomId, pin);
+    const normalizedOwnerDid = normalizeDid(ownerDid);
+    const signer = await getSigner(handlers, normalizedOwnerDid, issuerType, entityRoomId, pin);
     const capabilities = [{ can: "flow/*", with: uri }];
     const delegation = await ucanCreateDelegation({
       issuer: signer,
-      audience: ownerDid,
+      audience: toInvocationAudienceDID(normalizedOwnerDid),
       capabilities,
       proofs: []
     });
@@ -5215,8 +5241,8 @@ var createUcanService = (config) => {
     const storedDelegation = {
       cid,
       delegation: serialized,
-      issuerDid: ownerDid,
-      audienceDid: ownerDid,
+      issuerDid: normalizedOwnerDid,
+      audienceDid: normalizedOwnerDid,
       capabilities,
       createdAt: Date.now(),
       format: "car",
@@ -5229,12 +5255,14 @@ var createUcanService = (config) => {
   };
   const createDelegation = async (params) => {
     const { issuerDid, issuerType, entityRoomId, audience, capabilities, proofs = [], expiration, pin } = params;
-    const signer = await getSigner(handlers, issuerDid, issuerType, entityRoomId, pin);
+    const normalizedIssuerDid = normalizeDid(issuerDid);
+    const normalizedAudienceDid = normalizeDid(audience);
+    const signer = await getSigner(handlers, normalizedIssuerDid, issuerType, entityRoomId, pin);
     const proofCids = proofs.length > 0 ? proofs : [delegationStore.getRootCid()].filter(Boolean);
     const proofDelegations = await getProofDelegations(proofCids);
     const delegation = await ucanCreateDelegation({
       issuer: signer,
-      audience,
+      audience: toInvocationAudienceDID(normalizedAudienceDid),
       capabilities: toUcantoCapabilities(capabilities),
       proofs: proofDelegations,
       expiration: expiration ? Math.floor(expiration / 1e3) : void 0
@@ -5244,8 +5272,8 @@ var createUcanService = (config) => {
     const storedDelegation = {
       cid,
       delegation: serialized,
-      issuerDid,
-      audienceDid: audience,
+      issuerDid: normalizedIssuerDid,
+      audienceDid: normalizedAudienceDid,
       capabilities,
       expiration,
       createdAt: Date.now(),
@@ -5319,7 +5347,7 @@ var createUcanService = (config) => {
     for (let i = 0; i < proofChain.length - 1; i++) {
       const current = proofChain[i];
       const parent = proofChain[i + 1];
-      if (parent.audienceDid !== current.issuerDid) {
+      if (normalizeDid(parent.audienceDid) !== normalizeDid(current.issuerDid)) {
         return {
           valid: false,
           error: `Chain broken: ${parent.cid} audience (${parent.audienceDid}) != ${current.cid} issuer (${current.issuerDid})`
@@ -5327,7 +5355,7 @@ var createUcanService = (config) => {
       }
     }
     const root = proofChain[proofChain.length - 1];
-    if (root.issuerDid !== flowOwnerDid) {
+    if (normalizeDid(root.issuerDid) !== normalizedFlowOwnerDid) {
       return { valid: false, error: `Root issuer ${root.issuerDid} is not flow owner ${flowOwnerDid}` };
     }
     return { valid: true, proofChain };
@@ -5352,7 +5380,7 @@ var createUcanService = (config) => {
     };
     const invocation = await ucanCreateInvocation({
       issuer: signer,
-      audience: flowOwnerDid,
+      audience: toInvocationAudienceDID(normalizedFlowOwnerDid),
       capability: ucantoCapability,
       proofs: proofDelegations
     });
@@ -5868,13 +5896,12 @@ var VERSION_MANIFEST = {
   "1.0.0": {
     version: "1.0.0",
     label: "UCAN Required",
-    // TODO: flip to true when ready to enforce UCAN (end of week)
-    ucanRequired: false,
-    delegationRootRequired: false,
-    whitelistOnlyAllowed: true,
-    unrestrictedAllowed: true,
-    executionPath: "legacy",
-    authorizationFn: "v1",
+    ucanRequired: true,
+    delegationRootRequired: true,
+    whitelistOnlyAllowed: false,
+    unrestrictedAllowed: false,
+    executionPath: "invocation",
+    authorizationFn: "v2",
     allowedAuthModes: ["capability"],
     ui: {
       showDelegationPanel: true,
@@ -7571,6 +7598,1218 @@ function setRootMetadata(yDoc, root, plan, creatorDid, docId) {
   });
 }
 
+// src/core/lib/flowAgent/store.ts
+import * as Y6 from "yjs";
+
+// src/core/lib/flowAgent/utils.ts
+function stableStringify(value) {
+  if (value === void 0) return "null";
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  const entries = Object.entries(value).sort(([a], [b]) => a.localeCompare(b));
+  return `{${entries.map(([key, val]) => `${JSON.stringify(key)}:${stableStringify(val)}`).join(",")}}`;
+}
+function fnv1a322(input) {
+  let hash = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    hash ^= input.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function createIntentHash(intent) {
+  return fnv1a322(stableStringify(intent));
+}
+function parseJsonProp(value, fallback) {
+  if (value == null || value === "") return fallback;
+  if (typeof value === "object") return value;
+  if (typeof value !== "string") return fallback;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed;
+  } catch {
+    return fallback;
+  }
+}
+function getBlockActionType(block) {
+  const props = block?.props;
+  const actionType = props?.actionType;
+  return typeof actionType === "string" && actionType.length > 0 ? actionType : void 0;
+}
+function getBlockTitle(block) {
+  const props = block?.props;
+  const title = props?.title;
+  return typeof title === "string" && title.length > 0 ? title : void 0;
+}
+function getBlockType(block) {
+  const type = block?.type;
+  return typeof type === "string" && type.length > 0 ? type : "block";
+}
+function getBlockProps(block) {
+  return block?.props || {};
+}
+function getBlockId(block) {
+  const id = block?.id;
+  return typeof id === "string" && id.length > 0 ? id : void 0;
+}
+function getAssigneeDid(block) {
+  const props = getBlockProps(block);
+  const assignment = parseJsonProp(props.assignment, {});
+  const did = assignment?.assignedActor?.did;
+  return typeof did === "string" && did.length > 0 ? did : void 0;
+}
+function getDueAt(block) {
+  const props = getBlockProps(block);
+  const ttlAbsoluteDueDate = props.ttlAbsoluteDueDate;
+  if (typeof ttlAbsoluteDueDate !== "string" || ttlAbsoluteDueDate.length === 0) return void 0;
+  const parsed = new Date(ttlAbsoluteDueDate).getTime();
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+function capabilityForCommand(can, flowUri, nodeId) {
+  return {
+    can,
+    with: `${flowUri}:${nodeId}`
+  };
+}
+
+// src/core/lib/flowAgent/store.ts
+var FLOW_AGENT_OUTBOX_KEY = "agentOutbox";
+var FLOW_AGENT_LEASES_KEY = "agentLeases";
+var FLOW_AGENT_AUDIT_SCOPE = "__flow_agent__";
+function getFlowAgentMaps(yDoc) {
+  return {
+    outbox: yDoc.getMap(FLOW_AGENT_OUTBOX_KEY),
+    leases: yDoc.getMap(FLOW_AGENT_LEASES_KEY)
+  };
+}
+function computeAgentCommandId(params) {
+  const intentHash = createIntentHash(params);
+  return `${params.flowId}:${params.nodeId}:${intentHash}`;
+}
+function queueAgentCommand(yDoc, command) {
+  const { outbox } = getFlowAgentMaps(yDoc);
+  const existing = outbox.get(command.id);
+  if (existing) {
+    if (existing.type === "assign_actor" && existing.status === "failed") {
+      const retried = {
+        ...existing,
+        status: "queued",
+        error: void 0,
+        lease: void 0,
+        reason: command.reason,
+        payload: command.payload,
+        capability: command.capability,
+        actorDid: command.actorDid,
+        updatedAt: command.updatedAt
+      };
+      outbox.set(command.id, retried);
+      try {
+        appendAgentLedgerEvent(yDoc, {
+          type: "agent.command",
+          flowId: retried.flowId,
+          nodeId: retried.nodeId,
+          commandId: retried.id,
+          actorDid: retried.actorDid,
+          timestamp: retried.updatedAt,
+          details: {
+            commandType: retried.type,
+            status: retried.status,
+            idempotencyKey: retried.idempotencyKey,
+            reason: retried.reason,
+            retry: true
+          }
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Failed to append flow-agent ledger event";
+        if (!message.includes("Unexpected content type") && !message.includes("already been defined with a different constructor")) {
+          throw error;
+        }
+      }
+      return { command: retried, created: true };
+    }
+    return { command: existing, created: false };
+  }
+  outbox.set(command.id, command);
+  try {
+    appendAgentLedgerEvent(yDoc, {
+      type: "agent.command",
+      flowId: command.flowId,
+      nodeId: command.nodeId,
+      commandId: command.id,
+      actorDid: command.actorDid,
+      timestamp: command.createdAt,
+      details: {
+        commandType: command.type,
+        status: command.status,
+        idempotencyKey: command.idempotencyKey,
+        reason: command.reason
+      }
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to append flow-agent ledger event";
+    if (!message.includes("Unexpected content type") && !message.includes("already been defined with a different constructor")) {
+      throw error;
+    }
+  }
+  return { command, created: true };
+}
+function readQueuedAgentCommands(yDoc) {
+  const { outbox } = getFlowAgentMaps(yDoc);
+  const commands = [];
+  outbox.forEach((command) => {
+    if (command.status === "queued" || command.status === "leased" || command.status === "running") {
+      commands.push(command);
+    }
+  });
+  commands.sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id));
+  return commands;
+}
+function updateAgentCommand(yDoc, commandId, patch) {
+  const { outbox } = getFlowAgentMaps(yDoc);
+  const current = outbox.get(commandId);
+  if (!current) return null;
+  const next = { ...current, ...patch };
+  outbox.set(commandId, next);
+  return next;
+}
+function appendAgentLedgerEvent(yDoc, event) {
+  const auditMap = yDoc.getMap("auditTrail");
+  let arr = auditMap.get(FLOW_AGENT_AUDIT_SCOPE);
+  if (!arr) {
+    arr = new Y6.Array();
+    auditMap.set(FLOW_AGENT_AUDIT_SCOPE, arr);
+  }
+  const fullEvent = {
+    id: event.id || `${event.type}:${event.commandId || event.nodeId || "flow"}:${createIntentHash(event.details)}:${event.timestamp}`,
+    type: event.type,
+    flowId: event.flowId,
+    actorDid: event.actorDid,
+    timestamp: event.timestamp,
+    details: JSON.parse(stableStringify(event.details))
+  };
+  if (event.nodeId) fullEvent.nodeId = event.nodeId;
+  if (event.commandId) fullEvent.commandId = event.commandId;
+  arr.push([
+    {
+      id: fullEvent.id,
+      type: fullEvent.type,
+      details: fullEvent,
+      meta: {
+        timestamp: new Date(fullEvent.timestamp).toISOString(),
+        userId: fullEvent.actorDid,
+        editable: false
+      }
+    }
+  ]);
+  return fullEvent;
+}
+function readAgentLedgerEvents(yDoc, eventType) {
+  const auditMap = yDoc.getMap("auditTrail");
+  const arr = auditMap.get(FLOW_AGENT_AUDIT_SCOPE);
+  if (!arr) return [];
+  const events = [];
+  arr.forEach((value) => {
+    if (!value || typeof value !== "object") return;
+    const entry = value;
+    if (!entry.details) return;
+    if (eventType && entry.details.type !== eventType) return;
+    events.push(entry.details);
+  });
+  events.sort((a, b) => a.timestamp - b.timestamp || a.id.localeCompare(b.id));
+  return events;
+}
+
+// src/core/lib/flowAgent/policy.ts
+var COMMAND_CAPABILITIES = {
+  diagnose_blocker: "flow/observe",
+  assign_actor: "flow/node/assign",
+  notify_actor: "flow/notify",
+  execute_action: "flow/node/execute",
+  validate_external_state: "flow/mutation/execute",
+  submit_claim: "flow/claim/submit",
+  watch_udid: "flow/observe",
+  archive_flow: "flow/archive",
+  propose_config_change: "flow/config/propose"
+};
+function requiredCapabilityForCommand(type, flowUri, nodeId) {
+  return capabilityForCommand(COMMAND_CAPABILITIES[type], flowUri, nodeId);
+}
+function isCapabilityMatch(granted, required) {
+  return canMatches(granted.can, required.can) && resourceMatches(granted.with, required.with);
+}
+function canMatches(granted, required) {
+  if (granted === "*" || granted === required) return true;
+  if (granted.endsWith("/*")) {
+    const prefix = granted.slice(0, -1);
+    return required.startsWith(prefix);
+  }
+  return false;
+}
+function resourceMatches(granted, required) {
+  if (granted === "*" || granted === required) return true;
+  if (granted.endsWith("*")) {
+    const prefix = granted.slice(0, -1);
+    return required.startsWith(prefix);
+  }
+  return false;
+}
+function evaluateFlowAgentPolicy({
+  actorDid,
+  commandType,
+  flowUri,
+  nodeId,
+  delegationStore,
+  delegations,
+  now = Date.now()
+}) {
+  const required = requiredCapabilityForCommand(commandType, flowUri, nodeId);
+  const candidates = delegations || delegationStore?.getByAudience(actorDid) || [];
+  for (const delegation of candidates) {
+    if (delegation.audienceDid !== actorDid) continue;
+    if (delegation.expiration != null && delegation.expiration <= now) continue;
+    if (!delegation.capabilities.some((capability) => isCapabilityMatch(capability, required))) continue;
+    return {
+      allowed: true,
+      reason: "Allowed by UCAN delegation",
+      capability: required,
+      proofCids: [delegation.cid, ...delegation.proofCids]
+    };
+  }
+  return {
+    allowed: false,
+    reason: `Actor ${actorDid} lacks ${required.can} on ${required.with}`,
+    capability: required,
+    proofCids: []
+  };
+}
+
+// src/core/lib/flowAgent/commands.ts
+function createAgentCommand({ type, flowId, flowUri, nodeId, actor, reason, payload = {}, now = Date.now() }) {
+  const capability = requiredCapabilityForCommand(type, flowUri, nodeId);
+  const id = computeAgentCommandId({ flowId, nodeId, type, payload });
+  return {
+    id,
+    type,
+    flowId,
+    flowUri,
+    nodeId,
+    actorDid: actor.did,
+    status: "queued",
+    capability,
+    idempotencyKey: `${id}:${createIntentHash({ capability, payload })}`,
+    createdAt: now,
+    updatedAt: now,
+    reason,
+    payload
+  };
+}
+function validateAgentCommand(command) {
+  if (!command.id) return { valid: false, error: "Command id is required" };
+  if (!command.flowId) return { valid: false, error: "flowId is required" };
+  if (!command.flowUri) return { valid: false, error: "flowUri is required" };
+  if (!command.nodeId) return { valid: false, error: "nodeId is required" };
+  if (!command.actorDid) return { valid: false, error: "actorDid is required" };
+  if (!command.capability?.can || !command.capability?.with) return { valid: false, error: "capability is required" };
+  if (!command.idempotencyKey) return { valid: false, error: "idempotencyKey is required" };
+  if (isExternalMutation(command.type) && !command.payload.validator) {
+    return {
+      valid: false,
+      error: `${command.type} requires payload.validator for post-action read-back validation`
+    };
+  }
+  if (command.type === "propose_config_change" && !command.payload.proposal) {
+    return { valid: false, error: "Config changes must be expressed as payload.proposal" };
+  }
+  return { valid: true };
+}
+function isExternalMutation(type) {
+  return type === "validate_external_state";
+}
+
+// src/core/lib/flowAgent/context.ts
+function buildFlowAgentContext({ yDoc, flowId, flowUri = `ixo:flow:${flowId}`, actor, blocks, editor, now }) {
+  return {
+    yDoc,
+    flowId,
+    flowUri,
+    actor,
+    ...blocks ? { blocks } : {},
+    ...editor ? { editor } : {},
+    ...now ? { now } : {}
+  };
+}
+
+// src/core/lib/flowAgent/lease.ts
+var DEFAULT_FLOW_AGENT_LEASE_TTL_MS = 6e4;
+function acquireFlowAgentLease({
+  leases,
+  commandId,
+  nodeId,
+  actorDid,
+  now = Date.now(),
+  ttlMs = DEFAULT_FLOW_AGENT_LEASE_TTL_MS
+}) {
+  const current = leases.get(commandId);
+  if (current && current.expiresAt > now && current.actorDid !== actorDid) {
+    return null;
+  }
+  const nextEpoch = current ? current.epoch + 1 : 1;
+  const lease = {
+    id: `${commandId}:lease:${nextEpoch}`,
+    commandId,
+    nodeId,
+    actorDid,
+    acquiredAt: now,
+    expiresAt: now + ttlMs,
+    epoch: nextEpoch
+  };
+  leases.set(commandId, lease);
+  return lease;
+}
+function validateFlowAgentLease(leases, lease, now = Date.now()) {
+  const current = leases.get(lease.commandId);
+  return !!current && current.actorDid === lease.actorDid && current.epoch === lease.epoch && current.expiresAt > now;
+}
+function releaseFlowAgentLease(leases, lease) {
+  const current = leases.get(lease.commandId);
+  if (!current || current.actorDid !== lease.actorDid || current.epoch !== lease.epoch) return false;
+  leases.delete(lease.commandId);
+  return true;
+}
+function cleanupExpiredFlowAgentLeases(leases, now = Date.now()) {
+  const expired = [];
+  leases.forEach((lease, commandId) => {
+    if (lease.expiresAt <= now) {
+      expired.push(lease);
+      leases.delete(commandId);
+    }
+  });
+  return expired;
+}
+
+// src/core/lib/flowAgent/state.ts
+function classifyBlockerCause(block, runtime) {
+  const props = getBlockProps(block);
+  if (runtime.error?.code === "missing_ucan") return "missing_ucan";
+  if (runtime.error?.code === "validation_mismatch") return "validation_mismatch";
+  if (runtime.error?.code === "external_confirmation_pending") return "external_confirmation_pending";
+  if (runtime.error) return "service_error";
+  const conditions = parseJsonProp(props.conditions, {});
+  if (conditions.enabled && Array.isArray(conditions.conditions) && conditions.conditions.length > 0) {
+    return "failed_upstream";
+  }
+  const inputs = parseJsonProp(props.inputs, {});
+  const requiredInputs = parseJsonProp(props.requiredInputs, []);
+  if (requiredInputs.some((key) => inputs[key] == null || inputs[key] === "")) {
+    return "missing_input";
+  }
+  return void 0;
+}
+function classifyNodeState({ block, runtime, now, pendingInvocationCount = 0 }) {
+  if (runtime.state === "completed" || runtime.state === "cancelled") return "Done";
+  if (runtime.state === "failed" || runtime.error) return "Blocked";
+  const dueAt = getDueAt(block);
+  if (dueAt != null && dueAt <= now) return "Overdue";
+  if (pendingInvocationCount > 0) return "Pending";
+  return "Pending";
+}
+function snapshotNode(block, runtime, now, pendingInvocationCount = 0) {
+  const nodeId = getBlockId(block);
+  if (!nodeId) {
+    throw new Error("Cannot snapshot a block without an id");
+  }
+  const publicState = classifyNodeState({ block, runtime, now, pendingInvocationCount });
+  const dueAt = getDueAt(block);
+  const assigneeDid = getAssigneeDid(block);
+  const snapshot = {
+    nodeId,
+    blockType: getBlockType(block),
+    runtime,
+    publicState,
+    pendingInvocationCount
+  };
+  const actionType = getBlockActionType(block);
+  if (actionType) snapshot.actionType = actionType;
+  const title = getBlockTitle(block);
+  if (title) snapshot.title = title;
+  if (publicState === "Blocked") {
+    snapshot.blockerCause = classifyBlockerCause(block, runtime) || "unknown";
+  }
+  if (assigneeDid) snapshot.assigneeDid = assigneeDid;
+  if (dueAt != null) snapshot.dueAt = dueAt;
+  return snapshot;
+}
+
+// src/core/lib/flowAgent/orchestrator.ts
+var BLOCKER_DIAGNOSIS_VERSION = 2;
+function getBlocks(context) {
+  return context.blocks || context.editor?.document || [];
+}
+function getRuntime(yDoc, nodeId) {
+  const runtime = yDoc.getMap("runtime");
+  const value = runtime.get(nodeId);
+  return value && typeof value === "object" ? value : {};
+}
+function validateInputs(block) {
+  const props = getBlockProps(block);
+  const inputs = parseJsonProp(props.inputs, {});
+  const requiredInputs = parseJsonProp(props.requiredInputs, []);
+  const missing = requiredInputs.filter((key) => inputs[key] == null || inputs[key] === "");
+  if (missing.length > 0) {
+    return { valid: false, reason: `Missing required inputs: ${missing.join(", ")}` };
+  }
+  return { valid: true };
+}
+function chooseActor(block, options) {
+  const props = getBlockProps(block);
+  const actionType = getBlockActionType(block);
+  const requiredSkill = typeof props.requiredSkill === "string" ? props.requiredSkill : actionType;
+  if (!options.candidateActors || options.candidateActors.length === 0) return void 0;
+  if (!requiredSkill) return options.candidateActors[0];
+  return options.candidateActors.find((actor) => actor.skills?.includes(requiredSkill)) || options.candidateActors[0];
+}
+function canQueueCommand(type, nodeId, context, options) {
+  return evaluateFlowAgentPolicy({
+    actorDid: context.actor.did,
+    commandType: type,
+    flowUri: context.flowUri,
+    nodeId,
+    delegationStore: options.delegationStore,
+    delegations: options.delegations,
+    now: context.now?.() || Date.now()
+  }).allowed;
+}
+function safeAppendAgentLedgerEvent(yDoc, event) {
+  try {
+    appendAgentLedgerEvent(yDoc, event);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to append flow-agent ledger event";
+    if (message.includes("Unexpected content type") || message.includes("already been defined with a different constructor")) {
+      return;
+    }
+    throw error;
+  }
+}
+function queueIfAuthorized(context, options, type, nodeId, reason, payload) {
+  const now = context.now?.() || Date.now();
+  const policy = evaluateFlowAgentPolicy({
+    actorDid: context.actor.did,
+    commandType: type,
+    flowUri: context.flowUri,
+    nodeId,
+    delegationStore: options.delegationStore,
+    delegations: options.delegations,
+    now
+  });
+  safeAppendAgentLedgerEvent(context.yDoc, {
+    type: "agent.decision",
+    flowId: context.flowId,
+    nodeId,
+    actorDid: context.actor.did,
+    timestamp: now,
+    details: {
+      commandType: type,
+      allowed: policy.allowed,
+      reason: policy.reason,
+      capability: policy.capability
+    }
+  });
+  if (!policy.allowed) return null;
+  const command = createAgentCommand({
+    type,
+    flowId: context.flowId,
+    flowUri: context.flowUri,
+    nodeId,
+    actor: context.actor,
+    reason,
+    payload,
+    now
+  });
+  const validation = validateAgentCommand(command);
+  if (!validation.valid) {
+    safeAppendAgentLedgerEvent(context.yDoc, {
+      type: "agent.validation",
+      flowId: context.flowId,
+      nodeId,
+      commandId: command.id,
+      actorDid: context.actor.did,
+      timestamp: now,
+      details: { valid: false, error: validation.error }
+    });
+    return null;
+  }
+  return queueAgentCommand(context.yDoc, command).created ? command : null;
+}
+function planForSnapshot(context, options, block, snapshot) {
+  const queued = [];
+  const actionType = getBlockActionType(block);
+  if (snapshot.publicState === "Done") {
+    const runtime = snapshot.runtime;
+    if (actionType === "qi/claim.submit" && runtime.output?.claimId && !runtime.output?.udid) {
+      const command = queueIfAuthorized(context, options, "watch_udid", snapshot.nodeId, "Claim submitted but UDID is not yet observed", {
+        claimId: runtime.output.claimId,
+        timeoutMs: 864e5
+      });
+      if (command) queued.push(command);
+    }
+    return queued;
+  }
+  if (snapshot.publicState === "Overdue") {
+    const command = queueIfAuthorized(context, options, "notify_actor", snapshot.nodeId, "Action node is overdue", {
+      assigneeDid: snapshot.assigneeDid,
+      dueAt: snapshot.dueAt,
+      severity: "overdue"
+    });
+    if (command) queued.push(command);
+    return queued;
+  }
+  if (snapshot.publicState === "Blocked") {
+    const command = queueIfAuthorized(context, options, "diagnose_blocker", snapshot.nodeId, "Action node is blocked and requires diagnosis", {
+      cause: snapshot.blockerCause || "unknown",
+      error: snapshot.runtime.error,
+      diagnosisVersion: BLOCKER_DIAGNOSIS_VERSION
+    });
+    if (command) queued.push(command);
+    return queued;
+  }
+  const assigneeDid = getAssigneeDid(block);
+  if (!assigneeDid) {
+    const actor = chooseActor(block, options);
+    const command = queueIfAuthorized(context, options, "assign_actor", snapshot.nodeId, "Action node has no assigned actor", {
+      targetActorDid: actor?.did,
+      targetMatrixUserId: actor?.matrixUserId,
+      requiredActionType: actionType
+    });
+    if (command) queued.push(command);
+    return queued;
+  }
+  const inputValidation = validateInputs(block);
+  if (!inputValidation.valid) {
+    const command = queueIfAuthorized(context, options, "diagnose_blocker", snapshot.nodeId, inputValidation.reason || "Action node inputs are not ready", {
+      cause: "missing_input"
+    });
+    if (command) queued.push(command);
+    return queued;
+  }
+  if (actionType === "qi/claim.submit") {
+    const command = queueIfAuthorized(context, options, "submit_claim", snapshot.nodeId, "Claim action is pending and agent is authorized to submit", {
+      actionType
+    });
+    if (command) queued.push(command);
+    return queued;
+  }
+  if (actionType && canQueueCommand("execute_action", snapshot.nodeId, context, options)) {
+    const command = queueIfAuthorized(context, options, "execute_action", snapshot.nodeId, "Action node is pending and executable", {
+      actionType
+    });
+    if (command) queued.push(command);
+    return queued;
+  }
+  const notifyCommand = queueIfAuthorized(context, options, "notify_actor", snapshot.nodeId, "Action node is pending but the Flow Agent cannot execute it", {
+    assigneeDid,
+    requiredActionType: actionType,
+    severity: "attention"
+  });
+  if (notifyCommand) queued.push(notifyCommand);
+  return queued;
+}
+function planRalphLoopCommands(context, options = {}) {
+  const now = context.now?.() || Date.now();
+  const blocks = getBlocks(context);
+  const snapshots = [];
+  const queuedCommands = [];
+  for (const block of blocks) {
+    const nodeId = getBlockId(block);
+    if (!nodeId) continue;
+    const pendingInvocationCount = readPendingInvocations(context.yDoc, nodeId).length;
+    const snapshot = snapshotNode(block, getRuntime(context.yDoc, nodeId), now, pendingInvocationCount);
+    snapshots.push(snapshot);
+    queuedCommands.push(...planForSnapshot(context, options, block, snapshot));
+  }
+  const flowDone = snapshots.length > 0 && snapshots.every((snapshot) => snapshot.publicState === "Done");
+  if (flowDone && options.archiveWhenDone !== false) {
+    const archiveCommand = queueIfAuthorized(context, options, "archive_flow", context.flowId, "All Ralph loop action nodes are done", {
+      restartIfRepeats: true
+    });
+    if (archiveCommand) queuedCommands.push(archiveCommand);
+  }
+  return { snapshots, queuedCommands, flowDone };
+}
+async function callExecutor(command, context, executor) {
+  switch (command.type) {
+    case "execute_action":
+      return executor.executeAction ? executor.executeAction(command, context) : { commandId: command.id, success: false, error: "No executeAction handler configured" };
+    case "assign_actor":
+      return executor.assignActor ? executor.assignActor(command, context) : { commandId: command.id, success: false, error: "No assignActor handler configured" };
+    case "notify_actor":
+      return executor.notifyActor ? executor.notifyActor(command, context) : { commandId: command.id, success: false, error: "No notifyActor handler configured" };
+    case "validate_external_state":
+      return executor.validateExternalState ? executor.validateExternalState(command, context) : { commandId: command.id, success: false, error: "No validateExternalState handler configured" };
+    case "submit_claim":
+      return executor.submitClaim ? executor.submitClaim(command, context) : { commandId: command.id, success: false, error: "No submitClaim handler configured" };
+    case "watch_udid":
+      return executor.watchUdid ? executor.watchUdid(command, context) : { commandId: command.id, success: false, error: "No watchUdid handler configured" };
+    case "archive_flow":
+      return executor.archiveFlow ? executor.archiveFlow(command, context) : { commandId: command.id, success: false, error: "No archiveFlow handler configured" };
+    case "propose_config_change":
+      return executor.proposeConfigChange ? executor.proposeConfigChange(command, context) : { commandId: command.id, success: false, error: "No proposeConfigChange handler configured" };
+    case "diagnose_blocker":
+      return executor.diagnoseBlocker ? executor.diagnoseBlocker(command, context) : { commandId: command.id, success: false, error: "No diagnoseBlocker handler configured" };
+  }
+}
+async function executeQueuedAgentCommands(context, options = {}) {
+  const executor = options.executor;
+  if (!executor) return [];
+  const now = context.now?.() || Date.now();
+  const { leases } = getFlowAgentMaps(context.yDoc);
+  const results = [];
+  for (const command of readQueuedAgentCommands(context.yDoc)) {
+    const validation = validateAgentCommand(command);
+    if (!validation.valid) {
+      updateAgentCommand(context.yDoc, command.id, { status: "failed", error: validation.error, updatedAt: now });
+      results.push({ commandId: command.id, success: false, error: validation.error });
+      continue;
+    }
+    const policy = evaluateFlowAgentPolicy({
+      actorDid: context.actor.did,
+      commandType: command.type,
+      flowUri: context.flowUri,
+      nodeId: command.nodeId,
+      delegationStore: options.delegationStore,
+      delegations: options.delegations,
+      now
+    });
+    if (!policy.allowed) {
+      updateAgentCommand(context.yDoc, command.id, { status: "skipped", error: policy.reason, updatedAt: now });
+      results.push({ commandId: command.id, success: false, error: policy.reason });
+      continue;
+    }
+    const lease = acquireFlowAgentLease({
+      leases,
+      commandId: command.id,
+      nodeId: command.nodeId,
+      actorDid: context.actor.did,
+      now,
+      ttlMs: options.leaseTtlMs
+    });
+    if (!lease) {
+      continue;
+    }
+    updateAgentCommand(context.yDoc, command.id, { status: "running", lease, updatedAt: now });
+    try {
+      const result = await callExecutor({ ...command, lease, status: "running" }, context, executor);
+      if (!validateFlowAgentLease(leases, lease, context.now?.() || Date.now())) {
+        const leaseError = "Lease expired or was superseded before command commit";
+        updateAgentCommand(context.yDoc, command.id, { status: "failed", error: leaseError, updatedAt: context.now?.() || Date.now() });
+        results.push({ commandId: command.id, success: false, error: leaseError });
+        continue;
+      }
+      updateAgentCommand(context.yDoc, command.id, {
+        status: result.success ? "confirmed" : "failed",
+        error: result.error,
+        updatedAt: context.now?.() || Date.now()
+      });
+      safeAppendAgentLedgerEvent(context.yDoc, {
+        type: result.success ? "agent.validation" : "agent.escalation",
+        flowId: context.flowId,
+        nodeId: command.nodeId,
+        commandId: command.id,
+        actorDid: context.actor.did,
+        timestamp: context.now?.() || Date.now(),
+        details: {
+          success: result.success,
+          confirmed: result.confirmed,
+          output: result.output,
+          error: result.error
+        }
+      });
+      results.push(result);
+    } finally {
+      releaseFlowAgentLease(leases, lease);
+    }
+  }
+  return results;
+}
+async function tickFlowAgent(context, options = {}) {
+  const plan = planRalphLoopCommands(context, options);
+  const executedCommands = await executeQueuedAgentCommands(context, options);
+  return {
+    flowDone: plan.flowDone,
+    snapshots: plan.snapshots,
+    queuedCommands: plan.queuedCommands,
+    executedCommands
+  };
+}
+
+// src/core/lib/flowAgent/execution.ts
+var DEFAULT_SCHEMA_VERSION = "1.0.0";
+function safeAppendAgentLedgerEvent2(yDoc, event) {
+  try {
+    appendAgentLedgerEvent(yDoc, event);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to append flow-agent ledger event";
+    if (message.includes("Unexpected content type") || message.includes("already been defined with a different constructor")) {
+      return;
+    }
+    throw error;
+  }
+}
+function createYDocRuntimeManager(yDoc) {
+  const runtime = yDoc.getMap("runtime");
+  return {
+    get: (nodeId) => {
+      const value = runtime.get(nodeId);
+      return value && typeof value === "object" ? { ...value } : {};
+    },
+    update: (nodeId, updates) => {
+      const current = runtime.get(nodeId);
+      runtime.set(nodeId, {
+        ...current && typeof current === "object" ? current : {},
+        ...updates
+      });
+    }
+  };
+}
+function getRuntimeRecord(yDoc, nodeId) {
+  const runtime = yDoc.getMap("runtime");
+  const value = runtime.get(nodeId);
+  return value && typeof value === "object" ? value : {};
+}
+function clearRuntimeBlocker(yDoc, nodeId, updates) {
+  const runtime = yDoc.getMap("runtime");
+  const current = getRuntimeRecord(yDoc, nodeId);
+  const { state: _state, error: _error, ...rest } = current;
+  runtime.set(nodeId, {
+    ...rest,
+    ...updates
+  });
+}
+function findContextBlock(context, nodeId) {
+  const block = (context.blocks || []).find((entry) => getBlockId(entry) === nodeId);
+  return block && typeof block === "object" ? block : null;
+}
+function parseInputs2(value) {
+  return parseJsonProp(value, {});
+}
+function getXmlAttribute(element, key) {
+  return element.getAttribute(key);
+}
+function setXmlAttribute(element, key, value) {
+  element.setAttribute(key, value);
+}
+function isRecord(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function isYXmlContainerLike(value) {
+  return value != null && typeof value === "object" && typeof value.toArray === "function";
+}
+function isYXmlElementLike(value) {
+  return isYXmlContainerLike(value) && typeof value.nodeName === "string" && typeof value.getAttribute === "function" && typeof value.setAttribute === "function";
+}
+function getElementBlockId(element) {
+  const directId = getXmlAttribute(element, "id");
+  if (typeof directId === "string" && directId.length > 0) return directId;
+  const attrs = getXmlAttribute(element, "attrs");
+  const attrsId = isRecord(attrs) ? attrs.id : void 0;
+  return typeof attrsId === "string" && attrsId.length > 0 ? attrsId : void 0;
+}
+function updateXmlElementProps(element, blockId, propsPatch) {
+  const attrs = getXmlAttribute(element, "attrs");
+  if (isRecord(attrs)) {
+    const existingProps = isRecord(attrs.props) ? attrs.props : {};
+    setXmlAttribute(element, "attrs", {
+      ...attrs,
+      id: typeof attrs.id === "string" ? attrs.id : blockId,
+      props: {
+        ...existingProps,
+        ...propsPatch
+      }
+    });
+  }
+  for (const [key, value] of Object.entries(propsPatch)) {
+    element.setAttribute(key, typeof value === "string" ? value : JSON.stringify(value));
+  }
+}
+function findXmlElementById(container, blockId) {
+  for (const node of container.toArray()) {
+    if (!isYXmlElementLike(node)) continue;
+    const id = getElementBlockId(node);
+    if (id === blockId) return node;
+    const nested = findXmlElementById(node, blockId);
+    if (nested) return nested;
+  }
+  return null;
+}
+function updateDocumentBlockProps(yDoc, blockId, propsPatch) {
+  const target = findXmlElementById(yDoc.getXmlFragment("document"), blockId);
+  if (!target) return false;
+  updateXmlElementProps(target, blockId, propsPatch);
+  const content = target.toArray().find((node) => isYXmlElementLike(node) && node.nodeName !== "blockGroup");
+  if (content) {
+    updateXmlElementProps(content, blockId, propsPatch);
+  }
+  return true;
+}
+function assignActorInYDoc(yDoc, command, context) {
+  const targetActorDid = typeof command.payload.targetActorDid === "string" && command.payload.targetActorDid.length > 0 ? command.payload.targetActorDid : context.actor.did;
+  const targetMatrixUserId = typeof command.payload.targetMatrixUserId === "string" ? command.payload.targetMatrixUserId : void 0;
+  const assignment = {
+    assignedActor: {
+      did: targetActorDid,
+      avatar: "",
+      displayName: targetMatrixUserId || targetActorDid
+    },
+    assignedBy: {
+      did: context.actor.did,
+      avatar: "",
+      displayName: context.actor.displayName || context.actor.matrixUserId || ""
+    },
+    assignedTimestamp: new Date(context.now?.() || Date.now()).toISOString()
+  };
+  const assignmentJson = JSON.stringify(assignment);
+  const updatedDocument = updateDocumentBlockProps(yDoc, command.nodeId, {
+    assignment: assignmentJson
+  });
+  if (!updatedDocument) {
+    throw new Error(`Block ${command.nodeId} was not found for assignment`);
+  }
+  const runtime = createYDocRuntimeManager(yDoc);
+  runtime.update(command.nodeId, {
+    assignedActorDid: targetActorDid,
+    assignedByDid: context.actor.did,
+    assignedAt: assignment.assignedTimestamp,
+    lastCommandId: command.id
+  });
+  return assignment;
+}
+async function executeAssignActorCommand(command, context, options) {
+  const capability = { can: "flow/node/assign", with: `${context.flowUri}:${command.nodeId}` };
+  const proofs = await options.ucanService.findValidProofs(context.actor.did, capability);
+  if (!proofs.found || !proofs.proofCids) {
+    return {
+      commandId: command.id,
+      success: false,
+      error: proofs.error || "No valid delegation found for assignment"
+    };
+  }
+  const result = await options.ucanService.executeWithInvocation(
+    {
+      invokerDid: context.actor.did,
+      invokerType: options.actorType,
+      entityRoomId: options.entityRoomId,
+      capability,
+      proofs: proofs.proofCids,
+      pin: options.pin
+    },
+    async () => assignActorInYDoc(context.yDoc, command, context),
+    context.flowId,
+    command.nodeId
+  );
+  return {
+    commandId: command.id,
+    success: result.success,
+    confirmed: result.success,
+    output: result.actionResult && typeof result.actionResult === "object" ? { assignment: result.actionResult, invocationCid: result.invocationCid } : { invocationCid: result.invocationCid },
+    error: result.error
+  };
+}
+async function executeActionCommand(command, context, options) {
+  const actionType = typeof command.payload.actionType === "string" ? command.payload.actionType : void 0;
+  if (!actionType) {
+    return { commandId: command.id, success: false, error: "execute_action command is missing payload.actionType" };
+  }
+  const action = getAction(actionType);
+  if (!action) {
+    return { commandId: command.id, success: false, error: `No registered action found for ${actionType}` };
+  }
+  const block = findContextBlock(context, command.nodeId);
+  if (!block) {
+    return { commandId: command.id, success: false, error: `Block ${command.nodeId} was not found in runtime context` };
+  }
+  const props = getBlockProps(block);
+  const inputs = parseInputs2(props.inputs);
+  const runtime = createYDocRuntimeManager(context.yDoc);
+  const flowNode = buildFlowNodeFromBlock(block);
+  const outcome = await executeNode({
+    node: flowNode,
+    actorDid: context.actor.did,
+    actorType: options.actorType,
+    entityRoomId: options.entityRoomId,
+    context: {
+      runtime,
+      ucanService: options.ucanService,
+      invocationStore: options.invocationStore,
+      flowUri: context.flowUri,
+      flowId: context.flowId,
+      flowOwnerDid: "",
+      schemaVersion: options.schemaVersion || DEFAULT_SCHEMA_VERSION,
+      now: options.now || context.now
+    },
+    action: async () => {
+      const result = await action.run(inputs, {
+        actorDid: context.actor.did,
+        flowId: context.flowId,
+        flowUri: context.flowUri,
+        nodeId: command.nodeId,
+        flowNode,
+        runtime,
+        services: options.actionServices || {}
+      });
+      return { payload: result.output };
+    },
+    pin: options.pin
+  });
+  if (outcome.success && outcome.result) {
+    runtime.update(command.nodeId, {
+      state: "completed",
+      output: outcome.result.payload || {},
+      executedByDid: context.actor.did,
+      executedAt: options.now?.() || context.now?.() || Date.now(),
+      lastInvocationCid: outcome.invocationCid || outcome.capabilityId,
+      lastCommandId: command.id
+    });
+  } else if (!outcome.success) {
+    runtime.update(command.nodeId, {
+      state: "failed",
+      error: {
+        message: outcome.error || "Unknown execution error",
+        at: options.now?.() || context.now?.() || Date.now(),
+        commandId: command.id
+      },
+      lastCommandId: command.id
+    });
+  }
+  return {
+    commandId: command.id,
+    success: outcome.success,
+    confirmed: outcome.success,
+    output: {
+      ...outcome.result?.payload && typeof outcome.result.payload === "object" ? outcome.result.payload : {},
+      ...outcome.invocationCid ? { invocationCid: outcome.invocationCid } : {}
+    },
+    error: outcome.error
+  };
+}
+function getRecoverableBlockerReason(runtime) {
+  const error = runtime.error;
+  const message = error && typeof error === "object" && typeof error.message === "string" ? error.message : typeof error === "string" ? error : void 0;
+  if (!message) return null;
+  if (message.includes("Invalid DID") && message.includes("must start with 'did:'")) {
+    return "matrix_did_normalization";
+  }
+  if (message.includes("Failed to parse URL from undefined")) {
+    return "http_endpoint_input_normalization";
+  }
+  if (message.includes("Unexpected content type") || message.includes("already been defined with a different constructor")) {
+    return "audit_trail_shape";
+  }
+  return null;
+}
+function resetFailedActionCommands(context, nodeId, now) {
+  const { outbox } = getFlowAgentMaps(context.yDoc);
+  const resetIds = [];
+  outbox.forEach((command) => {
+    if (command.nodeId !== nodeId || command.type !== "execute_action" || command.status !== "failed") {
+      return;
+    }
+    outbox.set(command.id, {
+      ...command,
+      status: "queued",
+      error: void 0,
+      lease: void 0,
+      updatedAt: now,
+      reason: `Retry after blocker diagnosis: ${command.reason}`
+    });
+    resetIds.push(command.id);
+  });
+  return resetIds;
+}
+async function executeDiagnoseBlockerCommand(command, context, options) {
+  const now = options.now?.() || context.now?.() || Date.now();
+  const runtime = getRuntimeRecord(context.yDoc, command.nodeId);
+  const recovery = getRecoverableBlockerReason(runtime);
+  if (!recovery) {
+    return {
+      commandId: command.id,
+      success: true,
+      confirmed: true,
+      output: {
+        blockerCause: command.payload.cause || "unknown",
+        recovery: "manual_intervention_required"
+      }
+    };
+  }
+  clearRuntimeBlocker(context.yDoc, command.nodeId, {
+    diagnosedAt: now,
+    diagnosedByDid: context.actor.did,
+    lastDiagnosisCommandId: command.id,
+    lastRecovery: recovery
+  });
+  const resetCommandIds = resetFailedActionCommands(context, command.nodeId, now);
+  return {
+    commandId: command.id,
+    success: true,
+    confirmed: true,
+    output: {
+      blockerCause: command.payload.cause || "unknown",
+      recovery,
+      resetCommandIds
+    }
+  };
+}
+async function executeFlowAgentCoreCommand(command, context, options) {
+  switch (command.type) {
+    case "assign_actor":
+      return executeAssignActorCommand(command, context, options);
+    case "execute_action":
+      return executeActionCommand(command, context, options);
+    case "diagnose_blocker":
+      return executeDiagnoseBlockerCommand(command, context, options);
+    default:
+      return { commandId: command.id, success: false, error: `No editor-core executor for ${command.type}` };
+  }
+}
+async function callConfiguredExecutor(command, context, options) {
+  if (!options.executor) return void 0;
+  switch (command.type) {
+    case "assign_actor":
+      return options.executor.assignActor?.(command, context);
+    case "execute_action":
+      return options.executor.executeAction?.(command, context);
+    case "diagnose_blocker":
+      return options.executor.diagnoseBlocker?.(command, context);
+    default:
+      return void 0;
+  }
+}
+async function executeQueuedFlowAgentCoreCommands(context, options) {
+  const now = options.now?.() || context.now?.() || Date.now();
+  const { leases } = getFlowAgentMaps(context.yDoc);
+  const results = [];
+  for (const command of readQueuedAgentCommands(context.yDoc)) {
+    if (options.commandTypes && !options.commandTypes.includes(command.type)) {
+      continue;
+    }
+    const validation = validateAgentCommand(command);
+    if (!validation.valid) {
+      updateAgentCommand(context.yDoc, command.id, { status: "failed", error: validation.error, updatedAt: now });
+      results.push({ commandId: command.id, success: false, error: validation.error });
+      continue;
+    }
+    const policy = evaluateFlowAgentPolicy({
+      actorDid: context.actor.did,
+      commandType: command.type,
+      flowUri: context.flowUri,
+      nodeId: command.nodeId,
+      delegationStore: options.delegationStore,
+      delegations: options.delegations,
+      now
+    });
+    if (!policy.allowed) {
+      updateAgentCommand(context.yDoc, command.id, { status: "skipped", error: policy.reason, updatedAt: now });
+      results.push({ commandId: command.id, success: false, error: policy.reason });
+      continue;
+    }
+    const lease = acquireFlowAgentLease({
+      leases,
+      commandId: command.id,
+      nodeId: command.nodeId,
+      actorDid: context.actor.did,
+      now,
+      ttlMs: options.leaseTtlMs
+    });
+    if (!lease) continue;
+    updateAgentCommand(context.yDoc, command.id, { status: "running", lease, updatedAt: now });
+    try {
+      const runningCommand = { ...command, lease, status: "running" };
+      const result = await Promise.resolve(callConfiguredExecutor(runningCommand, context, options)) || await executeFlowAgentCoreCommand(runningCommand, context, options);
+      const normalized = result || {
+        commandId: command.id,
+        success: false,
+        error: `No executor configured for ${command.type}`
+      };
+      if (!validateFlowAgentLease(leases, lease, options.now?.() || context.now?.() || Date.now())) {
+        const error = "Lease expired or was superseded before command commit";
+        updateAgentCommand(context.yDoc, command.id, { status: "failed", error, updatedAt: options.now?.() || context.now?.() || Date.now() });
+        results.push({ commandId: command.id, success: false, error });
+        continue;
+      }
+      updateAgentCommand(context.yDoc, command.id, {
+        status: normalized.success ? "confirmed" : "failed",
+        error: normalized.error,
+        updatedAt: options.now?.() || context.now?.() || Date.now()
+      });
+      safeAppendAgentLedgerEvent2(context.yDoc, {
+        type: normalized.success ? "agent.validation" : "agent.escalation",
+        flowId: context.flowId,
+        nodeId: command.nodeId,
+        commandId: command.id,
+        actorDid: context.actor.did,
+        timestamp: options.now?.() || context.now?.() || Date.now(),
+        details: {
+          success: normalized.success,
+          confirmed: normalized.confirmed,
+          output: normalized.output,
+          error: normalized.error
+        }
+      });
+      results.push(normalized);
+    } finally {
+      releaseFlowAgentLease(leases, lease);
+    }
+  }
+  return results;
+}
+
+// src/core/lib/flowAgent/service.ts
+var FlowAgentService = class {
+  constructor(context, options = {}) {
+    this.context = context;
+    this.options = options;
+    this.timer = null;
+    this.running = false;
+  }
+  async tick() {
+    if (this.running) {
+      return {
+        flowDone: false,
+        snapshots: [],
+        queuedCommands: [],
+        executedCommands: []
+      };
+    }
+    this.running = true;
+    try {
+      const result = await tickFlowAgent(this.context, this.options);
+      await this.options.onTick?.(result);
+      return result;
+    } catch (error) {
+      this.options.onError?.(error);
+      throw error;
+    } finally {
+      this.running = false;
+    }
+  }
+  start() {
+    if (this.timer) return;
+    const intervalMs = this.options.intervalMs || 3e4;
+    this.timer = setInterval(() => {
+      this.tick().catch((error) => {
+        this.options.onError?.(error);
+      });
+    }, intervalMs);
+  }
+  stop() {
+    if (!this.timer) return;
+    clearInterval(this.timer);
+    this.timer = null;
+  }
+};
+
 export {
   resolveActionType,
   registerAction,
@@ -7644,6 +8883,35 @@ export {
   setActiveEditor,
   getActiveEditor,
   readFlow,
-  setupFlowFromBaseUcan
+  setupFlowFromBaseUcan,
+  getFlowAgentMaps,
+  computeAgentCommandId,
+  queueAgentCommand,
+  readQueuedAgentCommands,
+  updateAgentCommand,
+  appendAgentLedgerEvent,
+  readAgentLedgerEvents,
+  requiredCapabilityForCommand,
+  isCapabilityMatch,
+  canMatches,
+  resourceMatches,
+  evaluateFlowAgentPolicy,
+  createAgentCommand,
+  validateAgentCommand,
+  isExternalMutation,
+  buildFlowAgentContext,
+  acquireFlowAgentLease,
+  validateFlowAgentLease,
+  releaseFlowAgentLease,
+  cleanupExpiredFlowAgentLeases,
+  classifyBlockerCause,
+  classifyNodeState,
+  snapshotNode,
+  planRalphLoopCommands,
+  executeQueuedAgentCommands,
+  tickFlowAgent,
+  executeFlowAgentCoreCommand,
+  executeQueuedFlowAgentCoreCommands,
+  FlowAgentService
 };
-//# sourceMappingURL=chunk-GCR6VY7O.mjs.map
+//# sourceMappingURL=chunk-JAB2IBVH.mjs.map