@ixo/editor 5.19.0 → 5.20.0-experimental.1

package/dist/{chunk-67477PYU.mjs → chunk-XGQRYGA3.mjs}

@@ -571,15 +571,68 @@ registerAction({
 });
 
 // src/core/lib/actionRegistry/actions/pod/listDomainFlows.ts
+function normalizeSelectedTemplates(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map((item) => {
+    if (!item || typeof item !== "object") return null;
+    const raw = item;
+    const protocolDid = String(raw.protocolDid || "").trim();
+    const sourceRoomId = String(raw.sourceRoomId || "").trim();
+    if (!protocolDid || !sourceRoomId) return null;
+    const sourceLabel = String(raw.sourceLabel || raw.label || sourceRoomId).trim();
+    return {
+      protocolDid,
+      protocolName: String(raw.protocolName || protocolDid).trim(),
+      sourceRoomId,
+      sourceLabel,
+      ...raw.path ? { path: String(raw.path) } : {}
+    };
+  }).filter((item) => item !== null);
+}
 registerAction({
   type: "qi/pod.list-domain-flows",
   can: "pod/list-domain-flows",
   sideEffect: false,
   defaultRequiresConfirmation: false,
-  outputSchema: [{ path: "selectedFlowDids", displayName: "Selected Flow DIDs", type: "array", description: "Array of selected flow template DIDs" }],
+  outputSchema: [
+    {
+      path: "selectedProtocolTemplates",
+      displayName: "Selected Protocol Templates",
+      type: "array",
+      description: "Selected protocol templates with protocol DID and source room ID"
+    },
+    { path: "selectedFlowDids", displayName: "Selected Flow Room IDs", type: "array", description: "Source Matrix room IDs for selected templates" },
+    { path: "flowTemplateConfig", displayName: "Flow Template Config", type: "object", description: "Event payload consumed by POD signing/import steps" }
+  ],
+  events: [
+    {
+      name: "configured",
+      displayName: "Flow Templates Configured",
+      description: "Fires when protocol flow templates are selected for the POD.",
+      payloadSchema: [
+        {
+          path: "flowTemplateConfig",
+          displayName: "Flow Template Config",
+          type: "object",
+          description: "Selected templates grouped by their protocol DID for later import"
+        }
+      ],
+      pendingDisplayFields: ["flowTemplateConfig.templateCount", "flowTemplateConfig.protocolCount"]
+    }
+  ],
   run: async (inputs) => {
-    const selectedFlowDids = Array.isArray(inputs.selectedFlowDids) ? inputs.selectedFlowDids : [];
-    return { output: { selectedFlowDids } };
+    const selectedProtocolTemplates = normalizeSelectedTemplates(inputs.selectedProtocolTemplates);
+    const selectedFlowDids = selectedProtocolTemplates.length > 0 ? selectedProtocolTemplates.map((template) => template.sourceRoomId) : Array.isArray(inputs.selectedFlowDids) ? inputs.selectedFlowDids : [];
+    const protocolCount = new Set(selectedProtocolTemplates.map((template) => template.protocolDid)).size;
+    const flowTemplateConfig = {
+      selectedTemplates: selectedProtocolTemplates,
+      templateCount: selectedProtocolTemplates.length,
+      protocolCount
+    };
+    return {
+      output: { selectedProtocolTemplates, selectedFlowDids, flowTemplateConfig },
+      events: [{ name: "configured", payload: { flowTemplateConfig } }]
+    };
   }
 });
 
@@ -2669,6 +2722,77 @@ function parseContextInput(value) {
     return key && val ? { key, val } : null;
   }).filter((entry) => entry !== null);
 }
+function getSelectedProtocolTemplates(flowTemplateConfig) {
+  const raw = flowTemplateConfig?.selectedTemplates;
+  if (!Array.isArray(raw)) return [];
+  return raw.map((item) => {
+    if (!item || typeof item !== "object") return null;
+    const record = item;
+    const protocolDid = String(record.protocolDid || "").trim();
+    const sourceRoomId = String(record.sourceRoomId || "").trim();
+    if (!protocolDid || !sourceRoomId) return null;
+    const sourceLabel = String(record.sourceLabel || record.label || "").trim();
+    return {
+      protocolDid,
+      sourceRoomId,
+      ...sourceLabel ? { sourceLabel } : {}
+    };
+  }).filter((item) => item !== null);
+}
+function groupTemplatesByProtocol(templates) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const template of templates) {
+    const existing = grouped.get(template.protocolDid) || [];
+    existing.push({
+      sourceRoomId: template.sourceRoomId,
+      ...template.sourceLabel ? { sourceLabel: template.sourceLabel } : {}
+    });
+    grouped.set(template.protocolDid, existing);
+  }
+  return grouped;
+}
+var DOMAIN_SIGN_CACHE_KEY = "domainSign";
+function getDomainSignCheckpointKey(inputs, ctx) {
+  return String(ctx.pendingInvocation?.id || inputs.pendingInvocationId || inputs.invocationId || "manual");
+}
+function readDomainSignCheckpoint(ctx, key) {
+  const cache = ctx.runtime?.get?.(ctx.nodeId)?.cache;
+  const bucket = cache?.[DOMAIN_SIGN_CACHE_KEY];
+  if (!bucket || typeof bucket !== "object") return void 0;
+  const checkpoint = bucket[key];
+  return checkpoint && typeof checkpoint === "object" ? checkpoint : void 0;
+}
+function writeDomainSignCheckpoint(ctx, key, checkpoint) {
+  if (!ctx.runtime?.get || !ctx.runtime?.update || !ctx.nodeId) return;
+  const current = ctx.runtime.get(ctx.nodeId) || {};
+  const cache = current.cache && typeof current.cache === "object" ? current.cache : {};
+  const bucket = cache[DOMAIN_SIGN_CACHE_KEY] && typeof cache[DOMAIN_SIGN_CACHE_KEY] === "object" ? cache[DOMAIN_SIGN_CACHE_KEY] : {};
+  ctx.runtime.update(ctx.nodeId, {
+    cache: {
+      ...cache,
+      [DOMAIN_SIGN_CACHE_KEY]: {
+        ...bucket,
+        [key]: checkpoint
+      }
+    }
+  });
+}
+function buildCompletedDomainSignResult(output) {
+  return {
+    output,
+    events: [
+      {
+        name: "created",
+        payload: {
+          entityDid: output.entityDid,
+          governanceGroupCoreAddress: output.governanceGroupCoreAddress || "",
+          transactionHash: output.transactionHash || "",
+          linkedResourceTransactionHash: output.linkedResourceTransactionHash || ""
+        }
+      }
+    ]
+  };
+}
 function parseDuration(raw) {
   const seconds = parseInt(raw, 10) || 0;
   if (seconds % (7 * 86400) === 0) return { amount: seconds / (7 * 86400), unit: "weeks" };
@@ -2755,6 +2879,24 @@ registerAction({
       displayName: "Linked Resource Transaction Hash",
       type: "string",
       description: "The on-chain transaction hash for adding the domain card linked resource"
+    },
+    {
+      path: "flowTemplateConfig",
+      displayName: "Flow Template Config",
+      type: "object",
+      description: "Selected protocol templates captured before POD creation"
+    },
+    {
+      path: "domainSpaces",
+      displayName: "Domain Spaces",
+      type: "object",
+      description: "Matrix space structure sourced for the new domain"
+    },
+    {
+      path: "protocolTemplateImports",
+      displayName: "Protocol Template Imports",
+      type: "array",
+      description: "Import results for selected protocol templates"
     }
   ],
   events: [
@@ -2782,16 +2924,7 @@ registerAction({
     }
   ],
   run: async (inputs, ctx) => {
-    const handlers = ctx.handlers;
-    if (!handlers) {
-      throw new Error("Handlers not available");
-    }
-    if (!handlers.requestPin) throw new Error("requestPin handler not available");
-    if (!handlers.signCredential) throw new Error("signCredential handler not implemented");
-    if (!handlers.publicFileUpload) throw new Error("publicFileUpload handler not available");
-    if (!handlers.createDomain) throw new Error("createDomain handler not implemented");
-    if (!handlers.createAddLinkedResourceMessage) throw new Error("createAddLinkedResourceMessage handler not implemented");
-    if (!handlers.executeTransaction) throw new Error("executeTransaction handler not implemented");
+    const handlers = ctx.handlers || {};
     let domainCardData;
     if (typeof inputs.domainCardData === "string") {
       try {
@@ -2814,99 +2947,238 @@ registerAction({
       d.setFullYear(d.getFullYear() + 100);
       return d.toISOString();
     })();
-    let governanceGroupLinkedEntities = [];
-    let governanceGroupCoreAddress = "";
     const govConfig = parseJsonInput(inputs.governanceConfig);
     const memberConfig = parseJsonInput(inputs.memberConfig);
+    const flowTemplateConfig = parseJsonInput(inputs.flowTemplateConfig);
     const context = parseContextInput(inputs.context);
-    if (govConfig && handlers.createGovernanceGroup) {
-      const groupType = govConfig.groupType;
-      const governance = govConfig.governance || {};
-      const config = buildGroupConfig(groupType, governance, memberConfig);
-      const groupResult = await handlers.createGovernanceGroup({
-        groupType,
-        name: govConfig.groupName || domainCardData.credentialSubject?.name || "Governance Group",
-        config
-      });
-      governanceGroupCoreAddress = groupResult.coreAddress;
-      governanceGroupLinkedEntities = [
-        {
-          id: `{id}#${governanceGroupCoreAddress}`,
-          type: "group",
-          relationship: "governs",
-          service: ""
+    const selectedProtocolTemplates = getSelectedProtocolTemplates(flowTemplateConfig);
+    const checkpointKey = getDomainSignCheckpointKey(inputs, ctx);
+    let checkpoint = readDomainSignCheckpoint(ctx, checkpointKey) || {
+      invocationId: checkpointKey,
+      status: "running",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      completedSteps: {}
+    };
+    if (checkpoint.status === "completed" && checkpoint.output) {
+      return buildCompletedDomainSignResult(checkpoint.output);
+    }
+    if (!ctx.handlers) {
+      throw new Error("Handlers not available");
+    }
+    if (typeof handlers.requestPin !== "function") throw new Error("requestPin handler not available");
+    if (typeof handlers.signCredential !== "function") throw new Error("signCredential handler not implemented");
+    if (typeof handlers.publicFileUpload !== "function") throw new Error("publicFileUpload handler not available");
+    if (typeof handlers.createDomain !== "function") throw new Error("createDomain handler not implemented");
+    if (typeof handlers.createAddLinkedResourceMessage !== "function") throw new Error("createAddLinkedResourceMessage handler not implemented");
+    if (typeof handlers.executeTransaction !== "function") throw new Error("executeTransaction handler not implemented");
+    const saveCheckpoint = (updates) => {
+      checkpoint = {
+        ...checkpoint,
+        ...updates,
+        invocationId: checkpointKey,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        completedSteps: {
+          ...checkpoint.completedSteps || {},
+          ...updates.completedSteps || {}
         }
-      ];
-    }
-    const endDate = domainCardData.endDate || validUntil;
-    const { entityDid: newEntityDid, transactionHash } = await handlers.createDomain({
-      entityType,
-      context: context.length > 0 ? context : void 0,
-      linkedResource: [],
-      linkedEntity: governanceGroupLinkedEntities.length > 0 ? governanceGroupLinkedEntities : void 0,
-      startDate: validFrom,
-      endDate
-    });
-    const issuerDid = handlers.getEntityDid?.() || handlers.getCurrentUser?.()?.address;
-    if (!issuerDid) throw new Error("Unable to determine issuer DID");
-    const credentialSubject = {
-      ...domainCardData.credentialSubject,
-      id: newEntityDid
+      };
+      writeDomainSignCheckpoint(ctx, checkpointKey, checkpoint);
+      return checkpoint;
     };
-    const unsignedCredential = buildVerifiableCredential({
-      entityDid: newEntityDid,
-      issuerDid,
-      credentialSubject,
-      validFrom,
-      validUntil
-    });
-    const pin = await handlers.requestPin({
-      title: "Sign Domain Card",
-      description: "Enter your PIN to sign the Domain Card credential",
-      submitText: "Sign"
-    });
-    const { signedCredential } = await handlers.signCredential({
-      issuerDid,
-      issuerType: "user",
-      credential: unsignedCredential,
-      pin
-    });
-    const credentialBlob = new Blob([JSON.stringify(signedCredential, null, 2)], {
-      type: "application/json"
-    });
-    const credentialFile = new File([credentialBlob], "domainCard.json", {
-      type: "application/json"
-    });
-    const uploadResult = await handlers.publicFileUpload(credentialFile);
-    const domainCardLinkedResource = buildDomainCardLinkedResource({
-      entityDid: newEntityDid,
-      cid: uploadResult.cid,
-      serviceEndpoint: uploadResult.url,
-      description: `Domain Card for ${domainCardData.credentialSubject?.name || "Domain"}`
-    });
-    const addLinkedResourceMessage = await handlers.createAddLinkedResourceMessage({
-      entityDid: newEntityDid,
-      linkedResource: domainCardLinkedResource
-    });
-    const addLinkedResourceResult = await handlers.executeTransaction({
-      messages: [addLinkedResourceMessage],
-      memo: ""
+    saveCheckpoint({
+      status: "running",
+      error: void 0,
+      flowTemplateConfig
     });
-    const linkedResourceTransactionHash = String(addLinkedResourceResult?.transactionHash || "");
-    if (!linkedResourceTransactionHash) {
-      throw new Error("Linked resource transaction completed but no transaction hash received");
-    }
-    return {
-      output: {
+    try {
+      let governanceGroupLinkedEntities = checkpoint.governanceGroupLinkedEntities || [];
+      let governanceGroupCoreAddress = checkpoint.governanceGroupCoreAddress || "";
+      if (govConfig && handlers.createGovernanceGroup && !checkpoint.completedSteps?.createGovernanceGroup) {
+        const groupType = govConfig.groupType;
+        const governance = govConfig.governance || {};
+        const config = buildGroupConfig(groupType, governance, memberConfig);
+        const groupResult = await handlers.createGovernanceGroup({
+          groupType,
+          name: govConfig.groupName || domainCardData.credentialSubject?.name || "Governance Group",
+          config
+        });
+        governanceGroupCoreAddress = groupResult.coreAddress;
+        governanceGroupLinkedEntities = [
+          {
+            id: `{id}#${governanceGroupCoreAddress}`,
+            type: "group",
+            relationship: "governs",
+            service: ""
+          }
+        ];
+        saveCheckpoint({
+          governanceGroupCoreAddress,
+          governanceGroupLinkedEntities,
+          completedSteps: { createGovernanceGroup: true }
+        });
+      } else if (!govConfig) {
+        saveCheckpoint({ completedSteps: { createGovernanceGroup: true } });
+      }
+      const issuerDid = handlers.getEntityDid?.() || handlers.getCurrentUser?.()?.address;
+      if (!issuerDid) throw new Error("Unable to determine issuer DID");
+      const signAndUploadDomainCard = async (entityDid) => {
+        const credentialSubject = {
+          ...domainCardData.credentialSubject,
+          id: entityDid
+        };
+        const unsignedCredential = buildVerifiableCredential({
+          entityDid,
+          issuerDid,
+          credentialSubject,
+          validFrom,
+          validUntil
+        });
+        const pin = await handlers.requestPin({
+          title: "Sign Domain Card",
+          description: "Enter your PIN to sign the Domain Card credential",
+          submitText: "Sign"
+        });
+        const { signedCredential } = await handlers.signCredential({
+          issuerDid,
+          issuerType: "user",
+          credential: unsignedCredential,
+          pin
+        });
+        const credentialBlob = new Blob([JSON.stringify(signedCredential, null, 2)], {
+          type: "application/json"
+        });
+        const credentialFile = new File([credentialBlob], "domainCard.json", {
+          type: "application/json"
+        });
+        const uploadResult = await handlers.publicFileUpload(credentialFile);
+        return {
+          ...buildDomainCardLinkedResource({
+            entityDid,
+            cid: uploadResult.cid,
+            serviceEndpoint: uploadResult.url,
+            description: `Domain Card for ${domainCardData.credentialSubject?.name || "Domain"}`
+          }),
+          id: "{id}#dmn"
+        };
+      };
+      const endDate = domainCardData.endDate || validUntil;
+      let newEntityDid = checkpoint.entityDid || "";
+      let transactionHash = checkpoint.transactionHash || "";
+      let linkedResourceTransactionHash = checkpoint.linkedResourceTransactionHash || "";
+      let domainCardLinkedResource = checkpoint.domainCardLinkedResource;
+      if (!checkpoint.completedSteps?.createDomain || !newEntityDid || !transactionHash) {
+        const createResult = await handlers.createDomain({
+          entityType,
+          context: context.length > 0 ? context : void 0,
+          linkedResource: [],
+          linkedEntity: governanceGroupLinkedEntities.length > 0 ? governanceGroupLinkedEntities : void 0,
+          startDate: validFrom,
+          endDate
+        });
+        newEntityDid = createResult.entityDid;
+        transactionHash = createResult.transactionHash;
+        saveCheckpoint({
+          entityDid: newEntityDid,
+          transactionHash,
+          completedSteps: { createDomain: true }
+        });
+      }
+      if (!checkpoint.completedSteps?.signAndUploadDomainCard || !domainCardLinkedResource) {
+        domainCardLinkedResource = await signAndUploadDomainCard(newEntityDid);
+        saveCheckpoint({
+          domainCardLinkedResource,
+          completedSteps: { signAndUploadDomainCard: true }
+        });
+      }
+      if (!checkpoint.completedSteps?.addLinkedResource || !linkedResourceTransactionHash) {
+        const addLinkedResourceMessage = await handlers.createAddLinkedResourceMessage({
+          entityDid: newEntityDid,
+          linkedResource: domainCardLinkedResource
+        });
+        const addLinkedResourceResult = await handlers.executeTransaction({
+          messages: [addLinkedResourceMessage],
+          memo: ""
+        });
+        linkedResourceTransactionHash = String(addLinkedResourceResult?.transactionHash || "");
+        if (!linkedResourceTransactionHash) {
+          throw new Error("Linked resource transaction completed but no transaction hash received");
+        }
+        saveCheckpoint({
+          linkedResourceTransactionHash,
+          completedSteps: { addLinkedResource: true }
+        });
+      }
+      let domainSpaces = checkpoint.domainSpaces;
+      let protocolTemplateImports = checkpoint.protocolTemplateImports || [];
+      if (handlers.sourceDomainSpaces && (!checkpoint.completedSteps?.sourceDomainSpaces || !domainSpaces)) {
+        domainSpaces = await handlers.sourceDomainSpaces({ entityDid: newEntityDid });
+        if (!domainSpaces?.success) {
+          throw new Error("Domain spaces could not be sourced for the newly created domain");
+        }
+        saveCheckpoint({
+          domainSpaces,
+          completedSteps: { sourceDomainSpaces: true }
+        });
+      } else if (!handlers.sourceDomainSpaces) {
+        saveCheckpoint({ completedSteps: { sourceDomainSpaces: true } });
+      }
+      if (selectedProtocolTemplates.length > 0 && !checkpoint.completedSteps?.importTemplates) {
+        if (!handlers.sourceDomainSpaces) {
+          throw new Error("sourceDomainSpaces handler is required to import selected protocol templates");
+        }
+        if (!handlers.importProtocolTemplatesToSpace) {
+          throw new Error("importProtocolTemplatesToSpace handler is required to import selected protocol templates");
+        }
+        const targetFlowsSubspaceId = domainSpaces?.subspaces?.["domain flows"]?.space_id;
+        if (!targetFlowsSubspaceId) {
+          throw new Error("Domain flows subspace was not returned by sourceDomainSpaces");
+        }
+        const groupedTemplates = groupTemplatesByProtocol(selectedProtocolTemplates);
+        protocolTemplateImports = await Promise.all(
+          Array.from(groupedTemplates.entries()).map(async ([protocolDid, templates]) => {
+            const result = await handlers.importProtocolTemplatesToSpace({
+              protocolDid,
+              entityDid: newEntityDid,
+              targetFlowsSubspaceId,
+              templates
+            });
+            return { protocolDid, imported: result.imported };
+          })
+        );
+        saveCheckpoint({
+          protocolTemplateImports,
+          completedSteps: { importTemplates: true }
+        });
+      } else if (selectedProtocolTemplates.length === 0) {
+        saveCheckpoint({
+          protocolTemplateImports,
+          completedSteps: { importTemplates: true }
+        });
+      }
+      const output = {
         entityDid: newEntityDid,
         governanceGroupCoreAddress,
         linkedEntities: governanceGroupLinkedEntities,
         linkedResources: [domainCardLinkedResource],
+        flowTemplateConfig,
+        domainSpaces,
+        protocolTemplateImports,
         transactionHash,
         linkedResourceTransactionHash
-      },
-      events: [{ name: "created", payload: { entityDid: newEntityDid, governanceGroupCoreAddress, transactionHash, linkedResourceTransactionHash } }]
-    };
+      };
+      saveCheckpoint({
+        status: "completed",
+        output
+      });
+      return buildCompletedDomainSignResult(output);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Domain sign failed";
+      saveCheckpoint({
+        status: "failed",
+        error: message
+      });
+      throw error;
+    }
   }
 });
 
@@ -3078,9 +3350,7 @@ registerAction({
     }
     const verb = String(inputs.verb || "").trim().toLowerCase();
     if (verb !== "propose" && verb !== "execute" && verb !== "check") {
-      throw new Error(
-        'verb is required and must be one of: "propose", "execute", "check"'
-      );
+      throw new Error('verb is required and must be one of: "propose", "execute", "check"');
     }
     const paymentBlockId = String(inputs.paymentBlockId || "").trim();
     if (!paymentBlockId) {
@@ -3108,6 +3378,15 @@ registerAction({
         verb,
         rowCount: rowIds.length,
         paymentBlockId
+      },
+      completion: {
+        state: "awaiting_readback",
+        readBack: {
+          kind: "paymentRows",
+          paymentBlockId,
+          rowIds,
+          verb
+        }
       }
     };
   }
@@ -5275,6 +5554,7 @@ function toSupportedDID(did) {
 }
 function normalizeDid(did) {
   if (did.startsWith("did:")) return did;
+  if (did.startsWith("ixo1")) return `did:ixo:${did}`;
   if (!did.startsWith("@did-")) return did;
   const [localpart] = did.split(":");
   const parts = localpart.split("-");
@@ -5363,7 +5643,7 @@ var createUcanService = (config) => {
     const capabilities = [{ can: "flow/*", with: uri }];
     if (handlers.createSignerSession && handlers.createDelegationWithSession) {
       const session = await handlers.createSignerSession({
-        did: ownerDid,
+        did: normalizedOwnerDid,
         didType: issuerType,
         entityRoomId,
         pin,
@@ -5371,15 +5651,15 @@ var createUcanService = (config) => {
       });
       const result = await handlers.createDelegationWithSession({
         sessionId: session.sessionId,
-        audience: ownerDid,
+        audience: normalizedOwnerDid,
         capabilities,
         proofs: []
       });
       const storedDelegation2 = {
         cid: result.cid,
         delegation: result.delegation,
-        issuerDid: ownerDid,
-        audienceDid: ownerDid,
+        issuerDid: normalizedOwnerDid,
+        audienceDid: normalizedOwnerDid,
         capabilities,
         createdAt: Date.now(),
         format: "car",
@@ -5420,7 +5700,7 @@ var createUcanService = (config) => {
     const proofCids = proofs;
     if (handlers.createSignerSession && handlers.createDelegationWithSession) {
       const session = await handlers.createSignerSession({
-        did: issuerDid,
+        did: normalizedIssuerDid,
         didType: issuerType,
         entityRoomId,
         pin,
@@ -5429,7 +5709,7 @@ var createUcanService = (config) => {
       const proofCars = await getProofCars(proofCids);
       const result = await handlers.createDelegationWithSession({
         sessionId: session.sessionId,
-        audience,
+        audience: normalizedAudienceDid,
         capabilities,
         proofs: proofCars,
         expiration: expiration ? Math.floor(expiration / 1e3) : void 0
@@ -5437,8 +5717,8 @@ var createUcanService = (config) => {
       const storedDelegation2 = {
         cid: result.cid,
         delegation: result.delegation,
-        issuerDid,
-        audienceDid: audience,
+        issuerDid: normalizedIssuerDid,
+        audienceDid: normalizedAudienceDid,
         capabilities,
         expiration,
         createdAt: Date.now(),
@@ -5491,7 +5771,7 @@ var createUcanService = (config) => {
     const delegations = delegationStore.getByAudience(audienceDid);
     if (delegations.length === 0) {
       const root = delegationStore.getRoot();
-      if (root && root.audienceDid === audienceDid) {
+      if (root && normalizeDid(root.audienceDid) === normalizeDid(audienceDid)) {
         return { found: true, proofCids: [root.cid] };
       }
       return { found: false, error: "No delegations found for actor" };
@@ -5547,7 +5827,7 @@ var createUcanService = (config) => {
     const isFlowScoped = capability.can === "flow/*" || capability.can.startsWith("flow/");
     if (isFlowScoped) {
       const root = proofChain[proofChain.length - 1];
-      if (root.issuerDid !== flowOwnerDid) {
+      if (normalizeDid(root.issuerDid) !== normalizeDid(flowOwnerDid)) {
         return { valid: false, error: `Root issuer ${root.issuerDid} is not flow owner ${flowOwnerDid}` };
       }
     }
@@ -5555,7 +5835,8 @@ var createUcanService = (config) => {
   };
   const createAndValidateInvocation = async (params, _flowId, _blockId) => {
     const { invokerDid, invokerType, entityRoomId, capability, proofs, pin } = params;
-    const validation = await validateDelegationChain(invokerDid, capability);
+    const normalizedInvokerDid = normalizeDid(invokerDid);
+    const validation = await validateDelegationChain(normalizedInvokerDid, capability);
     if (!validation.valid) {
       return {
         cid: "",
@@ -5564,11 +5845,11 @@ var createUcanService = (config) => {
         error: validation.error
       };
     }
-    const audience = params.audience ?? flowOwnerDid;
+    const audience = normalizeDid(params.audience ?? flowOwnerDid);
     if (handlers.createSignerSession && handlers.createInvocationWithSession) {
       try {
         const session = await handlers.createSignerSession({
-          did: invokerDid,
+          did: normalizedInvokerDid,
           didType: invokerType,
           entityRoomId,
           pin,
@@ -6083,6 +6364,9 @@ var createRuntimeStateManager = (editor) => {
   }
   return createMemoryManager();
 };
+var createYDocRuntimeManager = (yDoc) => {
+  return createYMapManager(yDoc.getMap("runtime"));
+};
 function clearRuntimeForTemplateClone(yDoc) {
   const runtime = yDoc.getMap("runtime");
   const invocations = yDoc.getMap("invocations");
@@ -6100,6 +6384,66 @@ function clearRuntimeForTemplateClone(yDoc) {
   });
 }
 
+// src/core/types/baseUcan.ts
+function isRuntimeRef(value) {
+  return typeof value === "object" && value !== null && "$ref" in value && typeof value.$ref === "string";
+}
+
+// src/core/lib/flowCompiler/resolveRefs.ts
+function resolveRuntimeRefs(nb, getNodeOutput2, triggerContext) {
+  return resolveValue(nb, getNodeOutput2, triggerContext);
+}
+function resolveValue(value, getNodeOutput2, triggerContext) {
+  if (isRuntimeRef(value)) {
+    return resolveRef(value.$ref, getNodeOutput2, triggerContext);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => resolveValue(item, getNodeOutput2, triggerContext));
+  }
+  if (typeof value === "object" && value !== null) {
+    const result = {};
+    for (const [key, val] of Object.entries(value)) {
+      result[key] = resolveValue(val, getNodeOutput2, triggerContext);
+    }
+    return result;
+  }
+  return value;
+}
+function resolveRef(ref, getNodeOutput2, triggerContext) {
+  if (ref.startsWith("trigger.payload.")) {
+    if (!triggerContext) {
+      throw new Error(`Trigger ref "${ref}" used outside of a listener invocation context. trigger.payload.* refs are only valid on block.event-triggered blocks.`);
+    }
+    const fieldPath2 = ref.slice("trigger.payload.".length);
+    return getNestedValue(triggerContext.payload, fieldPath2);
+  }
+  if (triggerContext && Object.prototype.hasOwnProperty.call(triggerContext.refSnapshots, ref)) {
+    return triggerContext.refSnapshots[ref];
+  }
+  const outputIndex = ref.indexOf(".output.");
+  if (outputIndex === -1) {
+    throw new Error(`Invalid runtime reference "${ref}". Expected format: "nodeId.output.fieldPath" or "trigger.payload.fieldPath"`);
+  }
+  const nodeId = ref.slice(0, outputIndex);
+  const fieldPath = ref.slice(outputIndex + ".output.".length);
+  const output = getNodeOutput2(nodeId);
+  if (!output) {
+    return void 0;
+  }
+  return getNestedValue(output, fieldPath);
+}
+function getNestedValue(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current == null || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[part];
+  }
+  return current;
+}
+
 // src/core/lib/flowEngine/versionManifest.ts
 var VERSION_MANIFEST = {
   "0.3": {
@@ -6310,11 +6654,6 @@ var executeNode = async ({ node, actorDid, actorType, entityRoomId, context, act
   }
 };
 
-// src/core/types/baseUcan.ts
-function isRuntimeRef(value) {
-  return typeof value === "object" && value !== null && "$ref" in value && typeof value.$ref === "string";
-}
-
 // src/core/lib/flowEngine/triggers.ts
 import * as Y from "yjs";
 var RUN_RECORD_AUDIT_TYPE = "block.run";
@@ -6323,15 +6662,15 @@ function computePendingInvocationId(args) {
   const input = `${sourceBlockId}:${sourceRunId}:${listenerBlockId}:${eventName}:${eventIndex}`;
   return `pi-${fnv1a32(input)}`;
 }
-function snapshotInputRefs(inputs, getNodeOutput) {
+function snapshotInputRefs(inputs, getNodeOutput2) {
   const snapshots = {};
   walkRefs(inputs, (ref) => {
     if (ref.$ref.startsWith("trigger.")) return;
     const parsed = parseOutputRef(ref.$ref);
     if (!parsed) return;
-    const output = getNodeOutput(parsed.nodeId);
+    const output = getNodeOutput2(parsed.nodeId);
     if (!output) return;
-    snapshots[ref.$ref] = getNestedValue(output, parsed.fieldPath);
+    snapshots[ref.$ref] = getNestedValue2(output, parsed.fieldPath);
   });
   return snapshots;
 }
@@ -6356,7 +6695,7 @@ function parseOutputRef(ref) {
     fieldPath: ref.slice(outputIndex + ".output.".length)
   };
 }
-function getNestedValue(obj, path) {
+function getNestedValue2(obj, path) {
   const parts = path.split(".");
   let current = obj;
   for (const part of parts) {
@@ -6584,7 +6923,7 @@ function _reconcilePendingInvocationsInner(editor) {
   }
   if (listenersBySource.size === 0 && barrierListenersBySource.size === 0) return;
   const runtimeMap = editor._yRuntime;
-  const getNodeOutput = (nodeId) => {
+  const getNodeOutput2 = (nodeId) => {
     if (!runtimeMap) return void 0;
     const state = runtimeMap.get(nodeId);
     if (!state || typeof state !== "object") return void 0;
@@ -6610,12 +6949,12 @@ function _reconcilePendingInvocationsInner(editor) {
     if (!hasAnyListener) continue;
     const records = readRunRecords(yDoc, sourceBlockId);
     for (const record of records) {
-      processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput, runtimeMap);
-      processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput, runtimeMap);
+      processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap);
+      processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap);
     }
   }
 }
-function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput, runtimeMap) {
+function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap) {
   if (!Array.isArray(record.events)) return;
   record.events.forEach((event, eventIndex) => {
     if (!event?.name) return;
@@ -6634,7 +6973,7 @@ function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNod
       });
       const assigneeDid = resolveAssignee(listenerBlock) || "unassigned";
       const inputs = parseInputs(listenerBlock);
-      const refSnapshots = snapshotInputRefs(inputs, getNodeOutput);
+      const refSnapshots = snapshotInputRefs(inputs, getNodeOutput2);
       const expiresAt = computeExpiry(listenerBlock, record.completedAt);
       const invocation = {
         id,
@@ -6659,7 +6998,7 @@ function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNod
     }
   });
 }
-function processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput, runtimeMap) {
+function processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap) {
   if (!Array.isArray(record.events)) return;
   for (const event of record.events) {
     if (!event?.name) continue;
@@ -6694,7 +7033,7 @@ function processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBy
       const id = computeBarrierInvocationId(currentState, listenerBlockId);
       const mergedPayload = mergeBarrierPayloads(currentState);
       const inputs = parseInputs(listenerBlock);
-      const refSnapshots = snapshotInputRefs(inputs, getNodeOutput);
+      const refSnapshots = snapshotInputRefs(inputs, getNodeOutput2);
       const expiresAt = computeExpiry(listenerBlock, record.completedAt);
       const invocation = {
         id,
@@ -6804,6 +7143,553 @@ function writeRunRecordAndReconcile(editor, blockId, output, events, actorDid, d
   reconcilePendingInvocations(editor);
 }
 
+// src/core/lib/flowEngine/actionExecutor.ts
+import * as Y3 from "yjs";
+
+// src/core/lib/flowEngine/readBackReconciler.ts
+import * as Y2 from "yjs";
+function isYDoc(value) {
+  return value instanceof Y2.Doc;
+}
+function getYDoc(editorOrYDoc) {
+  if (!editorOrYDoc) return void 0;
+  if (isYDoc(editorOrYDoc)) return editorOrYDoc;
+  return editorOrYDoc._yDoc;
+}
+function getEditor(editorOrYDoc) {
+  return editorOrYDoc && !isYDoc(editorOrYDoc) ? editorOrYDoc : void 0;
+}
+function getRuntime(editorOrYDoc, runtime) {
+  if (runtime) return runtime;
+  const yDoc = getYDoc(editorOrYDoc);
+  if (yDoc) return createYDocRuntimeManager(yDoc);
+  return createRuntimeStateManager(!isYDoc(editorOrYDoc) ? editorOrYDoc : void 0);
+}
+function getReconcileEditor(params, yDoc, editor) {
+  if (editor) return editor;
+  if (!yDoc || !params.document) return void 0;
+  return {
+    _yDoc: yDoc,
+    _yRuntime: yDoc.getMap("runtime"),
+    document: params.document
+  };
+}
+function makeRunId(now) {
+  return `readback-${now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function asOutput(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {};
+}
+function errorRecord(error) {
+  if (!error) return void 0;
+  return typeof error === "string" ? { message: error } : { message: error.message, code: error.code };
+}
+function normalizeActionReadBackMetadata(params) {
+  const base = params.readBack && typeof params.readBack === "object" && !Array.isArray(params.readBack) ? { ...params.readBack } : {};
+  const kind = typeof base.kind === "string" && base.kind.trim() ? base.kind.trim() : params.actionType;
+  const normalized = {
+    ...base,
+    kind,
+    status: "pending",
+    requestedAt: typeof base.requestedAt === "string" ? base.requestedAt : new Date(params.requestedAt).toISOString(),
+    blockId: params.blockId,
+    actionType: params.actionType,
+    actorDid: params.actorDid,
+    invocationCid: params.invocationCid,
+    capabilityId: params.capabilityId
+  };
+  if (params.pendingInvocation) {
+    normalized.pendingInvocation = {
+      id: params.pendingInvocation.id,
+      triggeringBlockId: params.pendingInvocation.triggeringBlockId,
+      eventName: params.pendingInvocation.eventName,
+      sourceRunId: params.pendingInvocation.sourceRunId
+    };
+  }
+  return normalized;
+}
+function writeReconciliationRunRecord(params) {
+  if (!params.yDoc) return void 0;
+  const completedAt = params.now();
+  const runId = makeRunId(params.now);
+  const pendingInvocation = params.readBack.pendingInvocation;
+  const details = {
+    runId,
+    output: params.output,
+    events: params.events,
+    startedAt: params.readBack.requestedAt || new Date(completedAt).toISOString(),
+    completedAt: new Date(completedAt).toISOString(),
+    actorDid: params.actorDid,
+    invocationCid: params.readBack.invocationCid,
+    capabilityId: params.readBack.capabilityId,
+    error: params.error,
+    readBack: params.readBack,
+    reconciled: true
+  };
+  if (pendingInvocation) {
+    details.fromPendingInvocationId = pendingInvocation.id;
+    details.triggeredBy = {
+      sourceBlockId: pendingInvocation.triggeringBlockId,
+      eventName: pendingInvocation.eventName
+    };
+    details.sourceRunId = pendingInvocation.sourceRunId;
+  }
+  appendRunRecord(params.yDoc, params.blockId, details, params.actorDid);
+  if (params.editor && params.events.length > 0) {
+    reconcilePendingInvocations(params.editor);
+  }
+  return runId;
+}
+async function reconcileActionReadBack(params) {
+  const now = params.now || Date.now;
+  const yDoc = getYDoc(params.editorOrYDoc);
+  const editor = getEditor(params.editorOrYDoc);
+  const runtime = getRuntime(params.editorOrYDoc, params.runtime);
+  const current = runtime.get(params.blockId);
+  const output = asOutput(current.output);
+  const readBack = current.readBack;
+  if (current.state !== "awaiting_readback" || !readBack?.kind) {
+    return {
+      success: false,
+      blockId: params.blockId,
+      state: current.state === "failed" ? "failed" : "pending",
+      output,
+      events: [],
+      error: `Block "${params.blockId}" is not awaiting read-back`,
+      pendingInvocationRemoved: false,
+      readBack
+    };
+  }
+  const resolver = params.resolver || params.resolvers?.[readBack.kind];
+  if (!resolver) {
+    return {
+      success: false,
+      blockId: params.blockId,
+      state: "pending",
+      output,
+      events: [],
+      error: `No read-back resolver registered for "${readBack.kind}"`,
+      pendingInvocationRemoved: false,
+      readBack
+    };
+  }
+  const resolution = await resolver({
+    blockId: params.blockId,
+    runtime: current,
+    output,
+    readBack
+  });
+  const checkedAt = now();
+  const checkedIso = new Date(checkedAt).toISOString();
+  const nextReadBack = {
+    ...readBack,
+    ...resolution.readBack || {},
+    status: resolution.state,
+    lastCheckedAt: checkedIso
+  };
+  if (resolution.state === "pending") {
+    runtime.update(params.blockId, {
+      readBack: nextReadBack
+    });
+    return {
+      success: true,
+      blockId: params.blockId,
+      state: "pending",
+      output,
+      events: resolution.events || [],
+      pendingInvocationRemoved: false,
+      readBack: nextReadBack
+    };
+  }
+  const events = resolution.events || [];
+  const finalOutput = {
+    ...output,
+    ...resolution.output || {}
+  };
+  const actorDid = params.actorDid || readBack.actorDid || current.executedByDid || "system:readback";
+  if (resolution.state === "failed") {
+    const error = errorRecord(resolution.error) || { message: "External read-back failed" };
+    const failedReadBack = {
+      ...nextReadBack,
+      terminalAt: checkedIso
+    };
+    runtime.update(params.blockId, {
+      state: "failed",
+      output: finalOutput,
+      error: { ...error, at: checkedAt },
+      readBack: failedReadBack
+    });
+    const runId2 = writeReconciliationRunRecord({
+      yDoc,
+      editor: getReconcileEditor(params, yDoc, editor),
+      blockId: params.blockId,
+      actorDid,
+      output: finalOutput,
+      events,
+      readBack: failedReadBack,
+      error,
+      now
+    });
+    return {
+      success: false,
+      blockId: params.blockId,
+      state: "failed",
+      output: finalOutput,
+      events,
+      error: error.message,
+      runId: runId2,
+      pendingInvocationRemoved: false,
+      readBack: failedReadBack
+    };
+  }
+  const completedReadBack = {
+    ...nextReadBack,
+    terminalAt: checkedIso
+  };
+  runtime.update(params.blockId, {
+    state: "completed",
+    output: finalOutput,
+    executedAt: checkedAt,
+    error: void 0,
+    readBack: completedReadBack
+  });
+  const runId = writeReconciliationRunRecord({
+    yDoc,
+    editor: getReconcileEditor(params, yDoc, editor),
+    blockId: params.blockId,
+    actorDid,
+    output: finalOutput,
+    events,
+    readBack: completedReadBack,
+    now
+  });
+  const pendingInvocationRemoved = Boolean(yDoc && completedReadBack.pendingInvocation?.id) && removePendingInvocation(yDoc, params.blockId, completedReadBack.pendingInvocation.id);
+  return {
+    success: true,
+    blockId: params.blockId,
+    state: "completed",
+    output: finalOutput,
+    events,
+    runId,
+    pendingInvocationRemoved,
+    readBack: completedReadBack
+  };
+}
+
+// src/core/lib/flowEngine/actionExecutor.ts
+function isYDoc2(value) {
+  return value instanceof Y3.Doc;
+}
+function getYDoc2(editorOrYDoc) {
+  if (!editorOrYDoc) return void 0;
+  if (isYDoc2(editorOrYDoc)) return editorOrYDoc;
+  return editorOrYDoc._yDoc;
+}
+function parseInputs2(value) {
+  if (value == null || value === "") return {};
+  if (typeof value === "object" && !Array.isArray(value)) return { ...value };
+  if (typeof value !== "string") return {};
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function getRuntime2(editorOrYDoc, runtime) {
+  if (runtime) return runtime;
+  const yDoc = getYDoc2(editorOrYDoc);
+  if (yDoc) return createYDocRuntimeManager(yDoc);
+  return createRuntimeStateManager(!isYDoc2(editorOrYDoc) ? editorOrYDoc : void 0);
+}
+function getEditor2(editorOrYDoc) {
+  return editorOrYDoc && !isYDoc2(editorOrYDoc) ? editorOrYDoc : void 0;
+}
+function findBlock(params) {
+  if (params.block) return params.block;
+  const blockId = params.blockId;
+  if (!blockId) return void 0;
+  const editor = getEditor2(params.editorOrYDoc);
+  return (params.document || editor?.document || []).find((block) => block?.id === blockId);
+}
+function getFlowMetadata(editor) {
+  const metadata = editor?.getFlowMetadata?.();
+  const flowId = metadata?.doc_id || "";
+  return {
+    flowId,
+    flowUri: flowId ? `ixo:flow:${flowId}` : "",
+    flowOwnerDid: editor?.getFlowOwnerDid?.() || metadata?.flowOwnerDid || "",
+    schemaVersion: metadata?.schema_version || "0.3"
+  };
+}
+function getPendingInvocation(yDoc, blockId, pendingInvocationId) {
+  if (!pendingInvocationId) return void 0;
+  if (!yDoc) {
+    throw new Error(`Cannot load pending invocation "${pendingInvocationId}" without a Y.Doc`);
+  }
+  if (!blockId) {
+    throw new Error(`Cannot load pending invocation "${pendingInvocationId}" without a block id`);
+  }
+  const pending = readPendingInvocations(yDoc, blockId).find((invocation) => invocation.id === pendingInvocationId);
+  if (!pending) {
+    throw new Error(`Pending invocation "${pendingInvocationId}" was not found for block "${blockId}"`);
+  }
+  return pending;
+}
+function getNodeOutput(runtime, nodeId) {
+  const state = runtime.get(nodeId);
+  const output = state.output;
+  return output && typeof output === "object" && !Array.isArray(output) ? output : void 0;
+}
+function buildActionRunInputs(params) {
+  const blockId = params.blockId || params.block?.id;
+  const yDoc = getYDoc2(params.editorOrYDoc);
+  const runtime = getRuntime2(params.editorOrYDoc, params.runtime);
+  const savedInputs = parseInputs2(params.savedInputs ?? params.block?.props?.inputs);
+  const pendingInvocation = getPendingInvocation(yDoc, blockId, params.pendingInvocationId);
+  const triggerContext = pendingInvocation ? {
+    payload: pendingInvocation.payload || {},
+    refSnapshots: pendingInvocation.refSnapshots || {}
+  } : void 0;
+  const mergedInputs = {
+    ...savedInputs,
+    ...pendingInvocation?.payload || {},
+    ...pendingInvocation?.refSnapshots || {},
+    ...params.runtimeInputs || {}
+  };
+  return {
+    inputs: resolveRuntimeRefs(mergedInputs, (nodeId) => getNodeOutput(runtime, nodeId), triggerContext),
+    savedInputs,
+    mergedInputs,
+    pendingInvocation,
+    triggerContext
+  };
+}
+function buildFailureResult(params) {
+  return {
+    success: false,
+    stage: params.stage,
+    blockId: params.blockId,
+    actionType: params.actionType,
+    events: [],
+    error: params.error,
+    completionState: "failed",
+    pendingInvocation: params.pendingInvocation
+  };
+}
+function updateRuntimeFailure(runtime, blockId, message, now) {
+  runtime.update(blockId, {
+    state: "failed",
+    error: { message, at: now() }
+  });
+}
+function makeRunId2(now) {
+  return `run-${now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function getReconcileEditor2(params, yDoc, editor) {
+  if (editor) return editor;
+  if (!yDoc || !params.document) return void 0;
+  return {
+    _yDoc: yDoc,
+    _yRuntime: yDoc.getMap("runtime"),
+    document: params.document
+  };
+}
+function persistEvents(params) {
+  if (!params.yDoc || params.events.length === 0) return void 0;
+  const runId = makeRunId2(params.now);
+  const details = {
+    runId,
+    output: params.output,
+    events: params.events,
+    startedAt: new Date(params.startedAt).toISOString(),
+    completedAt: new Date(params.completedAt).toISOString(),
+    actorDid: params.actorDid,
+    invocationCid: params.invocationCid,
+    capabilityId: params.capabilityId
+  };
+  if (params.pendingInvocation) {
+    details.fromPendingInvocationId = params.pendingInvocation.id;
+    details.triggeredBy = {
+      sourceBlockId: params.pendingInvocation.triggeringBlockId,
+      eventName: params.pendingInvocation.eventName
+    };
+    details.sourceRunId = params.pendingInvocation.sourceRunId;
+  }
+  appendRunRecord(params.yDoc, params.blockId, details, params.actorDid);
+  if (params.editor) {
+    reconcilePendingInvocations(params.editor);
+  }
+  return runId;
+}
+function cleanupCompletedPendingInvocation(yDoc, blockId, pendingInvocation) {
+  if (!yDoc || !pendingInvocation) return false;
+  return removePendingInvocation(yDoc, blockId, pendingInvocation.id);
+}
+async function executeActionBlock(params) {
+  const block = findBlock(params);
+  const blockId = params.blockId || block?.id;
+  const editor = getEditor2(params.editorOrYDoc);
+  const yDoc = getYDoc2(params.editorOrYDoc);
+  const runtime = getRuntime2(params.editorOrYDoc, params.runtime);
+  const now = params.now || Date.now;
+  if (!block || !blockId) {
+    return buildFailureResult({
+      blockId: blockId || "",
+      stage: "input",
+      error: blockId ? `Block "${blockId}" was not found` : "executeActionBlock requires a blockId or block"
+    });
+  }
+  const actionType = typeof block.props?.actionType === "string" ? block.props.actionType : void 0;
+  if (!actionType) {
+    updateRuntimeFailure(runtime, blockId, "Action block is missing props.actionType", now);
+    return buildFailureResult({
+      blockId,
+      stage: "input",
+      error: "Action block is missing props.actionType"
+    });
+  }
+  const action = getAction(actionType);
+  if (!action) {
+    const message = `No registered action found for ${actionType}`;
+    updateRuntimeFailure(runtime, blockId, message, now);
+    return buildFailureResult({ blockId, actionType, stage: "action_lookup", error: message });
+  }
+  let inputBuild;
+  try {
+    inputBuild = buildActionRunInputs({ ...params, block, blockId, runtime });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to build action inputs";
+    updateRuntimeFailure(runtime, blockId, message, now);
+    return buildFailureResult({ blockId, actionType, stage: "input", error: message });
+  }
+  const flowNode = buildFlowNodeFromBlock(block);
+  const metadata = getFlowMetadata(editor);
+  const flowId = params.flowId || metadata.flowId || blockId;
+  const flowUri = params.flowUri || metadata.flowUri || `ixo:flow:${flowId}`;
+  const flowOwnerDid = params.flowOwnerDid || metadata.flowOwnerDid;
+  const schemaVersion = params.schemaVersion || metadata.schemaVersion;
+  const events = [];
+  let completionState = "completed";
+  let readBack;
+  let rawReadBack;
+  let requestedAwaitingReadBack = false;
+  const startedAt = now();
+  runtime.update(blockId, {
+    state: "running",
+    output: void 0,
+    error: void 0,
+    executedByDid: params.actorDid
+  });
+  const outcome = await executeNode({
+    node: flowNode,
+    actorDid: params.actorDid,
+    actorType: params.actorType,
+    entityRoomId: params.entityRoomId,
+    context: {
+      runtime,
+      ucanService: params.ucanService || editor?.getUcanService?.() || void 0,
+      invocationStore: params.invocationStore || editor?._invocationStore,
+      flowUri,
+      flowId,
+      flowOwnerDid,
+      schemaVersion,
+      now
+    },
+    action: async () => {
+      const result = await action.run(inputBuild.inputs, {
+        actorDid: params.actorDid,
+        flowId,
+        flowUri,
+        nodeId: blockId,
+        flowNode,
+        runtime,
+        services: params.services || {},
+        handlers: params.handlers,
+        editor,
+        pendingInvocation: inputBuild.pendingInvocation
+      });
+      if (result.events?.length) events.push(...result.events);
+      if (result.completion?.state === "awaiting_readback") {
+        requestedAwaitingReadBack = true;
+        rawReadBack = result.completion.readBack;
+      }
+      return {
+        payload: result.output,
+        submittedByDid: params.actorDid || void 0
+      };
+    },
+    pin: params.pin || ""
+  });
+  if (!outcome.success) {
+    const message = outcome.error || "Action execution failed";
+    updateRuntimeFailure(runtime, blockId, message, now);
+    return {
+      ...buildFailureResult({
+        blockId,
+        actionType,
+        stage: outcome.stage,
+        error: message,
+        pendingInvocation: inputBuild.pendingInvocation
+      }),
+      invocationCid: outcome.invocationCid,
+      capabilityId: outcome.capabilityId
+    };
+  }
+  const output = outcome.result?.payload || {};
+  const completedAt = now();
+  if (requestedAwaitingReadBack) {
+    completionState = "awaiting_readback";
+    readBack = normalizeActionReadBackMetadata({
+      readBack: rawReadBack,
+      blockId,
+      actionType,
+      actorDid: params.actorDid,
+      invocationCid: outcome.invocationCid,
+      capabilityId: outcome.capabilityId,
+      requestedAt: startedAt,
+      pendingInvocation: inputBuild.pendingInvocation
+    });
+  }
+  runtime.update(blockId, {
+    state: completionState,
+    output,
+    executedByDid: params.actorDid,
+    executedAt: completedAt,
+    lastInvocationCid: outcome.invocationCid || outcome.capabilityId,
+    readBack
+  });
+  const runId = persistEvents({
+    yDoc,
+    editor: getReconcileEditor2(params, yDoc, editor),
+    blockId,
+    actorDid: params.actorDid,
+    output,
+    events,
+    invocationCid: outcome.invocationCid,
+    capabilityId: outcome.capabilityId,
+    pendingInvocation: inputBuild.pendingInvocation,
+    startedAt,
+    completedAt,
+    now
+  });
+  const pendingInvocationRemoved = completionState === "completed" ? cleanupCompletedPendingInvocation(yDoc, blockId, inputBuild.pendingInvocation) : false;
+  return {
+    success: true,
+    stage: outcome.stage,
+    blockId,
+    actionType,
+    output,
+    events,
+    invocationCid: outcome.invocationCid,
+    capabilityId: outcome.capabilityId,
+    runId,
+    pendingInvocationRemoved,
+    completionState,
+    pendingInvocation: inputBuild.pendingInvocation
+  };
+}
+
 // src/core/lib/flowEngine/migration.ts
 var MIGRATION_REGISTRY = {};
 function registerMigration(definition) {
@@ -7251,13 +8137,13 @@ function detectTriggerCycles(triggerEdges) {
 }
 
 // src/core/lib/flowCompiler/readFlow.ts
-import * as Y2 from "yjs";
+import * as Y4 from "yjs";
 function readCompiledFlowFromYDoc(yDoc) {
   const flowMeta = yDoc.getMap("qi.flow.meta");
   const flowNodes = yDoc.getMap("qi.flow.nodes");
   const nodes = {};
   flowNodes.forEach((value, nodeId) => {
-    if (value instanceof Y2.Map) {
+    if (value instanceof Y4.Map) {
       nodes[nodeId] = yMapToFlowNode(value);
     }
   });
@@ -7277,7 +8163,7 @@ function readCompiledFlowFromYDoc(yDoc) {
   const flowEdges = yDoc.getMap("qi.flow.edges");
   const edges = [];
   flowEdges.forEach((value) => {
-    if (value instanceof Y2.Map) {
+    if (value instanceof Y4.Map) {
       edges.push(yMapToEdge(value));
     }
   });
@@ -7458,11 +8344,11 @@ function nodeToCapability(node) {
 }
 
 // src/core/lib/flowCompiler/setup.ts
-import * as Y5 from "yjs";
+import * as Y7 from "yjs";
 import { MatrixProvider } from "@ixo/matrix-crdt";
 
 // src/core/lib/flowCompiler/hydrate.ts
-import * as Y3 from "yjs";
+import * as Y5 from "yjs";
 function hydrateYDocFromCompiledFlow(yDoc, compiled) {
   yDoc.transact(() => {
     const flowMeta = yDoc.getMap("qi.flow.meta");
@@ -7477,7 +8363,7 @@ function hydrateYDocFromCompiledFlow(yDoc, compiled) {
     }
     const flowEdges = yDoc.getMap("qi.flow.edges");
     for (const edge of compiled.edges) {
-      const yEdge = new Y3.Map();
+      const yEdge = new Y5.Map();
       yEdge.set("id", edge.id);
       yEdge.set("source", edge.source);
       yEdge.set("target", edge.target);
@@ -7531,7 +8417,7 @@ function hydrateYDocFromMergeResult(yDoc, mergeResult) {
     const flowEdges = yDoc.getMap("qi.flow.edges");
     flowEdges.forEach((_, key) => flowEdges.delete(key));
     for (const edge of merged.edges) {
-      const yEdge = new Y3.Map();
+      const yEdge = new Y5.Map();
       yEdge.set("id", edge.id);
       yEdge.set("source", edge.source);
       yEdge.set("target", edge.target);
@@ -7566,7 +8452,7 @@ function initializeRuntimeForNodes(runtimeMap, compiled, nodeIds) {
   }
 }
 function createYMapFromNode(node) {
-  const yNode = new Y3.Map();
+  const yNode = new Y5.Map();
   yNode.set("id", node.id);
   yNode.set("blockId", node.blockId);
   yNode.set("can", node.can);
@@ -7581,7 +8467,7 @@ function createYMapFromNode(node) {
 }
 
 // src/core/lib/flowCompiler/documentFragment.ts
-import * as Y4 from "yjs";
+import * as Y6 from "yjs";
 function writeCompiledBlocksToFragment(fragment, blocks) {
   const documentBlockGroup = getOrCreateDocumentBlockGroup(fragment);
   for (const block of blocks) {
@@ -7600,7 +8486,7 @@ function replaceBlockInFragment(fragment, block) {
   if (!blockGroup) return false;
   for (let i = 0; i < blockGroup.length; i++) {
     const container = blockGroup.get(i);
-    if (container instanceof Y4.XmlElement && container.getAttribute("id") === block.id) {
+    if (container instanceof Y6.XmlElement && container.getAttribute("id") === block.id) {
       blockGroup.delete(i, 1);
       const newContainer = createBlockContainer(block);
       blockGroup.insert(i, [newContainer]);
@@ -7634,12 +8520,12 @@ function applyMergeResultToFragment(fragment, mergeResult) {
   }
 }
 function createBlockContainer(block) {
-  const blockContainer = new Y4.XmlElement("blockContainer");
+  const blockContainer = new Y6.XmlElement("blockContainer");
   const { backgroundColor: rawBackgroundColor, textColor: rawTextColor, ...contentProps } = block.props;
   blockContainer.setAttribute("id", block.id);
   blockContainer.setAttribute("textColor", rawTextColor || "default");
   blockContainer.setAttribute("backgroundColor", rawBackgroundColor || "default");
-  const blockContent = new Y4.XmlElement(block.type);
+  const blockContent = new Y6.XmlElement(block.type);
   for (const [key, value] of Object.entries(contentProps)) {
     if (value !== "") {
       blockContent.setAttribute(key, value);
@@ -7654,13 +8540,13 @@ function appendBlockToGroup(blockGroup, block) {
 }
 function getOrCreateDocumentBlockGroup(fragment) {
   if (fragment.length === 0) {
-    const blockGroup = new Y4.XmlElement("blockGroup");
+    const blockGroup = new Y6.XmlElement("blockGroup");
     fragment.insert(0, [blockGroup]);
     return blockGroup;
   }
   if (fragment.length === 1) {
     const rootNode = fragment.get(0);
-    if (rootNode instanceof Y4.XmlElement && rootNode.nodeName === "blockGroup") {
+    if (rootNode instanceof Y6.XmlElement && rootNode.nodeName === "blockGroup") {
       return rootNode;
     }
   }
@@ -7670,7 +8556,7 @@ function getExistingBlockGroup(fragment) {
   if (fragment.length === 0) return null;
   if (fragment.length === 1) {
     const rootNode = fragment.get(0);
-    if (rootNode instanceof Y4.XmlElement && rootNode.nodeName === "blockGroup") {
+    if (rootNode instanceof Y6.XmlElement && rootNode.nodeName === "blockGroup") {
       return rootNode;
     }
   }
@@ -7773,7 +8659,7 @@ async function setupFlowFromBaseUcan(options) {
   };
 }
 async function connectToRoom(roomId, matrixClient) {
-  const yDoc = new Y5.Doc();
+  const yDoc = new Y7.Doc();
   const client = matrixClient;
   client.canSupportVoip = false;
   client.clientOpts = { lazyLoadMembers: true };
@@ -7828,7 +8714,7 @@ function setRootMetadata(yDoc, root, plan, creatorDid, docId) {
 }
 
 // src/core/lib/flowAgent/store.ts
-import * as Y6 from "yjs";
+import * as Y8 from "yjs";
 
 // src/core/lib/flowAgent/utils.ts
 function stableStringify(value) {
@@ -8009,7 +8895,7 @@ function appendAgentLedgerEvent(yDoc, event) {
   const auditMap = yDoc.getMap("auditTrail");
   let arr = auditMap.get(FLOW_AGENT_AUDIT_SCOPE);
   if (!arr) {
-    arr = new Y6.Array();
+    arr = new Y8.Array();
     auditMap.set(FLOW_AGENT_AUDIT_SCOPE, arr);
   }
   const fullEvent = {
@@ -8273,12 +9159,88 @@ function snapshotNode(block, runtime, now, pendingInvocationCount = 0) {
   return snapshot;
 }
 
+// src/core/lib/flowAgent/actionExecutionPolicy.ts
+var RUNTIME_INPUT_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["qi/form.submit", "qi/human.form.submit", "qi/human.checkbox.set", "qi/protocol.select"]);
+function isRecord(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function parseStringList(value) {
+  const parsed = parseJsonProp(value, []);
+  if (!Array.isArray(parsed)) return [];
+  return parsed.filter((item) => typeof item === "string" && item.length > 0);
+}
+function normalizeMode(value) {
+  if (value === "saved-input" || value === "saved_input" || value === "savedInput") return "saved-input";
+  if (value === "runtime-input-required" || value === "runtime_input_required" || value === "runtimeInputRequired") return "runtime-input-required";
+  if (value === "human-only" || value === "human_only" || value === "humanOnly") return "human-only";
+  return void 0;
+}
+function parseExecutionConfig(value) {
+  if (value == null || value === "") return {};
+  if (typeof value === "string") {
+    const directMode = normalizeMode(value);
+    if (directMode) return { mode: directMode };
+  }
+  const parsed = parseJsonProp(value, {});
+  if (!isRecord(parsed)) return {};
+  return {
+    mode: normalizeMode(parsed.mode),
+    requiredRuntimeInputs: parseStringList(parsed.requiredRuntimeInputs)
+  };
+}
+function inferDefaultMode(actionType, requiredRuntimeInputs) {
+  if (requiredRuntimeInputs.length > 0) return "runtime-input-required";
+  if (actionType && RUNTIME_INPUT_REQUIRED_ACTIONS.has(actionType)) return "runtime-input-required";
+  return "saved-input";
+}
+function getFlowAgentActionExecutionPolicy(block) {
+  const props = getBlockProps(block);
+  const actionType = getBlockActionType(block);
+  const config = parseExecutionConfig(props.flowAgentExecution || props.flowAgentExecutionMode || props.agentExecutionMode);
+  const requiredRuntimeInputs = [
+    ...config.requiredRuntimeInputs || [],
+    ...parseStringList(props.requiredRuntimeInputs || props.runtimeRequiredInputs || props.flowAgentRequiredRuntimeInputs)
+  ];
+  return {
+    mode: config.mode || inferDefaultMode(actionType, requiredRuntimeInputs),
+    requiredRuntimeInputs: Array.from(new Set(requiredRuntimeInputs))
+  };
+}
+function getCommandRuntimeInputs(payload) {
+  return isRecord(payload.runtimeInputs) ? payload.runtimeInputs : void 0;
+}
+function validateFlowAgentExecuteActionPayload(block, payload) {
+  const policy = getFlowAgentActionExecutionPolicy(block);
+  if (policy.mode === "human-only") {
+    return {
+      valid: false,
+      mode: policy.mode,
+      missingRuntimeInputs: [],
+      reason: "Action requires human execution and cannot be run by the Flow Agent"
+    };
+  }
+  if (policy.mode !== "runtime-input-required") {
+    return { valid: true, mode: policy.mode, missingRuntimeInputs: [] };
+  }
+  const runtimeInputs = getCommandRuntimeInputs(payload);
+  const missingRuntimeInputs = policy.requiredRuntimeInputs.length > 0 ? policy.requiredRuntimeInputs.filter((key) => runtimeInputs?.[key] == null || runtimeInputs[key] === "") : runtimeInputs ? [] : ["runtimeInputs"];
+  if (missingRuntimeInputs.length > 0) {
+    return {
+      valid: false,
+      mode: policy.mode,
+      missingRuntimeInputs,
+      reason: policy.requiredRuntimeInputs.length > 0 ? `Missing required runtimeInputs: ${missingRuntimeInputs.join(", ")}` : "Action requires runtimeInputs before the Flow Agent can execute it"
+    };
+  }
+  return { valid: true, mode: policy.mode, missingRuntimeInputs: [] };
+}
+
 // src/core/lib/flowAgent/orchestrator.ts
 var BLOCKER_DIAGNOSIS_VERSION = 2;
 function getBlocks(context) {
   return context.blocks || context.editor?.document || [];
 }
-function getRuntime(yDoc, nodeId) {
+function getRuntime3(yDoc, nodeId) {
   const runtime = yDoc.getMap("runtime");
   const value = runtime.get(nodeId);
   return value && typeof value === "object" ? value : {};
@@ -8373,6 +9335,11 @@ function queueIfAuthorized(context, options, type, nodeId, reason, payload) {
   }
   return queueAgentCommand(context.yDoc, command).created ? command : null;
 }
+function statusForResult(result) {
+  if (result.status) return result.status;
+  if (!result.success) return "failed";
+  return result.confirmed === false ? "awaiting_readback" : "confirmed";
+}
 function planForSnapshot(context, options, block, snapshot) {
   const queued = [];
   const actionType = getBlockActionType(block);
@@ -8432,8 +9399,25 @@ function planForSnapshot(context, options, block, snapshot) {
     return queued;
   }
   if (actionType && canQueueCommand("execute_action", snapshot.nodeId, context, options)) {
+    const pendingInvocation = readPendingInvocations(context.yDoc, snapshot.nodeId)[0];
+    const payload = {
+      actionType,
+      ...pendingInvocation ? { pendingInvocationId: pendingInvocation.id } : {}
+    };
+    const actionValidation = validateFlowAgentExecuteActionPayload(block, payload);
+    if (!actionValidation.valid) {
+      const commandType = actionValidation.mode === "human-only" ? "notify_actor" : "diagnose_blocker";
+      const command2 = queueIfAuthorized(context, options, commandType, snapshot.nodeId, actionValidation.reason || "Action node cannot be executed by Flow Agent yet", {
+        cause: actionValidation.mode === "runtime-input-required" ? "missing_input" : "unknown",
+        requiredActionType: actionType,
+        requiredRuntimeInputs: actionValidation.missingRuntimeInputs,
+        severity: actionValidation.mode === "human-only" ? "attention" : void 0
+      });
+      if (command2) queued.push(command2);
+      return queued;
+    }
     const command = queueIfAuthorized(context, options, "execute_action", snapshot.nodeId, "Action node is pending and executable", {
-      actionType
+      ...payload
     });
     if (command) queued.push(command);
     return queued;
@@ -8455,7 +9439,7 @@ function planRalphLoopCommands(context, options = {}) {
     const nodeId = getBlockId(block);
     if (!nodeId) continue;
     const pendingInvocationCount = readPendingInvocations(context.yDoc, nodeId).length;
-    const snapshot = snapshotNode(block, getRuntime(context.yDoc, nodeId), now, pendingInvocationCount);
+    const snapshot = snapshotNode(block, getRuntime3(context.yDoc, nodeId), now, pendingInvocationCount);
     snapshots.push(snapshot);
     queuedCommands.push(...planForSnapshot(context, options, block, snapshot));
   }
@@ -8538,7 +9522,7 @@ async function executeQueuedAgentCommands(context, options = {}) {
         continue;
       }
       updateAgentCommand(context.yDoc, command.id, {
-        status: result.success ? "confirmed" : "failed",
+        status: statusForResult(result),
         error: result.error,
         updatedAt: context.now?.() || Date.now()
       });
@@ -8587,7 +9571,7 @@ function safeAppendAgentLedgerEvent2(yDoc, event) {
     throw error;
   }
 }
-function createYDocRuntimeManager(yDoc) {
+function createYDocRuntimeManager2(yDoc) {
   const runtime = yDoc.getMap("runtime");
   return {
     get: (nodeId) => {
@@ -8618,19 +9602,16 @@ function clearRuntimeBlocker(yDoc, nodeId, updates) {
   });
 }
 function findContextBlock(context, nodeId) {
-  const block = (context.blocks || []).find((entry) => getBlockId(entry) === nodeId);
+  const block = (context.blocks || context.editor?.document || []).find((entry) => getBlockId(entry) === nodeId);
   return block && typeof block === "object" ? block : null;
 }
-function parseInputs2(value) {
-  return parseJsonProp(value, {});
-}
 function getXmlAttribute(element, key) {
   return element.getAttribute(key);
 }
 function setXmlAttribute(element, key, value) {
   element.setAttribute(key, value);
 }
-function isRecord(value) {
+function isRecord2(value) {
   return value != null && typeof value === "object" && !Array.isArray(value);
 }
 function isYXmlContainerLike(value) {
@@ -8643,13 +9624,13 @@ function getElementBlockId(element) {
   const directId = getXmlAttribute(element, "id");
   if (typeof directId === "string" && directId.length > 0) return directId;
   const attrs = getXmlAttribute(element, "attrs");
-  const attrsId = isRecord(attrs) ? attrs.id : void 0;
+  const attrsId = isRecord2(attrs) ? attrs.id : void 0;
   return typeof attrsId === "string" && attrsId.length > 0 ? attrsId : void 0;
 }
 function updateXmlElementProps(element, blockId, propsPatch) {
   const attrs = getXmlAttribute(element, "attrs");
-  if (isRecord(attrs)) {
-    const existingProps = isRecord(attrs.props) ? attrs.props : {};
+  if (isRecord2(attrs)) {
+    const existingProps = isRecord2(attrs.props) ? attrs.props : {};
     setXmlAttribute(element, "attrs", {
       ...attrs,
       id: typeof attrs.id === "string" ? attrs.id : blockId,
@@ -8706,7 +9687,7 @@ function assignActorInYDoc(yDoc, command, context) {
   if (!updatedDocument) {
     throw new Error(`Block ${command.nodeId} was not found for assignment`);
   }
-  const runtime = createYDocRuntimeManager(yDoc);
+  const runtime = createYDocRuntimeManager2(yDoc);
   runtime.update(command.nodeId, {
     assignedActorDid: targetActorDid,
     assignedByDid: context.actor.did,
@@ -8751,76 +9732,69 @@ async function executeActionCommand(command, context, options) {
   if (!actionType) {
     return { commandId: command.id, success: false, error: "execute_action command is missing payload.actionType" };
   }
-  const action = getAction(actionType);
-  if (!action) {
-    return { commandId: command.id, success: false, error: `No registered action found for ${actionType}` };
-  }
   const block = findContextBlock(context, command.nodeId);
   if (!block) {
     return { commandId: command.id, success: false, error: `Block ${command.nodeId} was not found in runtime context` };
   }
   const props = getBlockProps(block);
-  const inputs = parseInputs2(props.inputs);
-  const runtime = createYDocRuntimeManager(context.yDoc);
-  const flowNode = buildFlowNodeFromBlock(block);
-  const outcome = await executeNode({
-    node: flowNode,
+  if (typeof props.actionType === "string" && props.actionType !== actionType) {
+    return {
+      commandId: command.id,
+      success: false,
+      error: `execute_action payload.actionType ${actionType} does not match block actionType ${props.actionType}`
+    };
+  }
+  const runtimeInputs = command.payload.runtimeInputs;
+  if (runtimeInputs != null && !isRecord2(runtimeInputs)) {
+    return { commandId: command.id, success: false, error: "execute_action payload.runtimeInputs must be an object when provided" };
+  }
+  const inputValidation = validateFlowAgentExecuteActionPayload(block, command.payload);
+  if (!inputValidation.valid) {
+    return {
+      commandId: command.id,
+      success: false,
+      confirmed: false,
+      status: inputValidation.mode === "human-only" ? "skipped" : "failed",
+      error: inputValidation.reason
+    };
+  }
+  const pendingInvocationId = typeof command.payload.pendingInvocationId === "string" ? command.payload.pendingInvocationId : void 0;
+  const outcome = await executeActionBlock({
+    editorOrYDoc: context.editor || context.yDoc,
+    block,
+    blockId: command.nodeId,
+    document: context.blocks || context.editor?.document || [],
     actorDid: context.actor.did,
     actorType: options.actorType,
     entityRoomId: options.entityRoomId,
-    context: {
-      runtime,
-      ucanService: options.ucanService,
-      invocationStore: options.invocationStore,
-      flowUri: context.flowUri,
-      flowId: context.flowId,
-      flowOwnerDid: "",
-      schemaVersion: options.schemaVersion || DEFAULT_SCHEMA_VERSION,
-      now: options.now || context.now
-    },
-    action: async () => {
-      const result = await action.run(inputs, {
-        actorDid: context.actor.did,
-        flowId: context.flowId,
-        flowUri: context.flowUri,
-        nodeId: command.nodeId,
-        flowNode,
-        runtime,
-        services: options.actionServices || {}
-      });
-      return { payload: result.output };
-    },
-    pin: options.pin
+    ucanService: options.ucanService,
+    invocationStore: options.invocationStore,
+    services: options.actionServices || {},
+    handlers: options.actionHandlers,
+    runtimeInputs: getCommandRuntimeInputs(command.payload),
+    pendingInvocationId,
+    pin: options.pin,
+    flowUri: context.flowUri,
+    flowId: context.flowId,
+    flowOwnerDid: options.flowOwnerDid || "",
+    schemaVersion: options.schemaVersion || DEFAULT_SCHEMA_VERSION,
+    now: options.now || context.now
   });
-  if (outcome.success && outcome.result) {
-    runtime.update(command.nodeId, {
-      state: "completed",
-      output: outcome.result.payload || {},
-      executedByDid: context.actor.did,
-      executedAt: options.now?.() || context.now?.() || Date.now(),
-      lastInvocationCid: outcome.invocationCid || outcome.capabilityId,
-      lastCommandId: command.id
-    });
-  } else if (!outcome.success) {
-    runtime.update(command.nodeId, {
-      state: "failed",
-      error: {
-        message: outcome.error || "Unknown execution error",
-        at: options.now?.() || context.now?.() || Date.now(),
-        commandId: command.id
-      },
-      lastCommandId: command.id
-    });
-  }
   return {
     commandId: command.id,
     success: outcome.success,
-    confirmed: outcome.success,
+    confirmed: outcome.success && outcome.completionState === "completed",
     output: {
-      ...outcome.result?.payload && typeof outcome.result.payload === "object" ? outcome.result.payload : {},
-      ...outcome.invocationCid ? { invocationCid: outcome.invocationCid } : {}
+      ...outcome.output && typeof outcome.output === "object" ? outcome.output : {},
+      ...outcome.invocationCid ? { invocationCid: outcome.invocationCid } : {},
+      ...outcome.capabilityId ? { capabilityId: outcome.capabilityId } : {},
+      ...outcome.runId ? { runId: outcome.runId } : {},
+      ...outcome.events.length > 0 ? { events: outcome.events } : {},
+      ...pendingInvocationId ? { pendingInvocationId, pendingInvocationRemoved: outcome.pendingInvocationRemoved } : {},
+      completionState: outcome.completionState
     },
-    error: outcome.error
+    error: outcome.error,
+    completionState: outcome.completionState
   };
 }
 function getRecoverableBlockerReason(runtime) {
@@ -8915,6 +9889,11 @@ async function callConfiguredExecutor(command, context, options) {
       return void 0;
   }
 }
+function statusForResult2(result) {
+  if (result.status) return result.status;
+  if (!result.success) return "failed";
+  return result.confirmed === false ? "awaiting_readback" : "confirmed";
+}
 async function executeQueuedFlowAgentCoreCommands(context, options) {
   const now = options.now?.() || context.now?.() || Date.now();
   const { leases } = getFlowAgentMaps(context.yDoc);
@@ -8968,7 +9947,7 @@ async function executeQueuedFlowAgentCoreCommands(context, options) {
         continue;
       }
       updateAgentCommand(context.yDoc, command.id, {
-        status: normalized.success ? "confirmed" : "failed",
+        status: statusForResult2(normalized),
         error: normalized.error,
         updatedAt: options.now?.() || context.now?.() || Date.now()
       });
@@ -9085,9 +10064,10 @@ export {
   buildFlowNodeFromBlock,
   createRuntimeStateManager,
   clearRuntimeForTemplateClone,
+  isRuntimeRef,
+  resolveRuntimeRefs,
   isAuthorized,
   executeNode,
-  isRuntimeRef,
   RUN_RECORD_AUDIT_TYPE,
   computePendingInvocationId,
   snapshotInputRefs,
@@ -9102,6 +10082,9 @@ export {
   replayFailedListenerRun,
   reconcilePendingInvocations,
   getActionForBlock,
+  reconcileActionReadBack,
+  buildActionRunInputs,
+  executeActionBlock,
   writeRunRecordAndReconcile,
   compileBaseUcanFlow,
   readCompiledFlowFromYDoc,
@@ -9143,4 +10126,4 @@ export {
   executeQueuedFlowAgentCoreCommands,
   FlowAgentService
 };
-//# sourceMappingURL=chunk-67477PYU.mjs.map
+//# sourceMappingURL=chunk-XGQRYGA3.mjs.map