@ixo/editor 5.38.0 → 5.40.0

package/dist/{chunk-7MGFSE63.js → chunk-KNMPGX5G.js}

@@ -1,5 +1,12 @@
 // src/core/lib/actionRegistry/registry.ts
 var actions = /* @__PURE__ */ new Map();
+var STEP_COMPLETED_EVENT_NAME = "step.completed";
+var STEP_COMPLETED_EVENT = {
+  name: STEP_COMPLETED_EVENT_NAME,
+  displayName: "Completed",
+  description: "Fires when this step is completed.",
+  payloadSchema: []
+};
 var ACTION_TYPE_ALIASES = {
   bid: "qi/bid.submit",
   claim: "qi/claim.submit",
@@ -51,15 +58,21 @@ function getActionByCan(can) {
 }
 function getEventsForBlock(action, inputs) {
   if (!action) return [];
+  let events;
   if (action.getDynamicEvents) {
     const parsed = normalizeInputs(inputs);
     try {
-      return action.getDynamicEvents(parsed) || [];
+      events = action.getDynamicEvents(parsed) || [];
     } catch {
-      return [];
+      events = [];
     }
+  } else {
+    events = action.events || [];
   }
-  return action.events || [];
+  if (events.some((event) => event.name === STEP_COMPLETED_EVENT_NAME)) {
+    return events;
+  }
+  return [...events, STEP_COMPLETED_EVENT];
 }
 function getOutputSchemaForBlock(action, inputs) {
   if (!action) return [];
@@ -116,7 +129,12 @@ var CAN_TO_TYPE = {
   "pod/governance-config": "qi/pod.governance-config",
   "pod/member-multi-select": "qi/pod.member-multi-select",
   "pod/list-domain-flows": "qi/pod.list-domain-flows",
-  // Calendar integration
+  // Delegated integrations (author connects once, runners execute on their behalf)
+  "gmail.email/send": "qi/gmail.email.send",
+  "outlook.email/send": "qi/outlook.email.send",
+  "slack.message/send": "qi/slack.message.send",
+  "googlecalendar.event/create": "qi/googlecalendar.event.create",
+  // Calendar integration (self-connected)
   "calendar.event/create": "qi/calendar.event.create",
   "calendar.event/update": "qi/calendar.event.update",
   "calendar.event/list": "qi/calendar.event.list",
@@ -238,7 +256,8 @@ function buildServicesFromHandlers(handlers) {
     integrations: handlers?.integrations?.executeTool ? {
       executeTool: async (args) => handlers.integrations.executeTool(args),
       fetchCurrentState: handlers.integrations.fetchCurrentState ? async (args) => handlers.integrations.fetchCurrentState(args) : void 0,
-      getEntityDid: handlers?.getEntityDid ? () => handlers.getEntityDid() : void 0
+      getEntityDid: handlers?.getEntityDid ? () => handlers.getEntityDid() : void 0,
+      executeBinding: handlers.integrations.executeBinding ? async (args) => handlers.integrations.executeBinding(args) : void 0
     } : void 0,
     oracle: handlers?.generateWallet ? {
       generateWallet: async () => handlers.generateWallet(),
@@ -1157,6 +1176,10 @@ function registerFormSubmitAction(type, can) {
     sideEffect: true,
     defaultRequiresConfirmation: false,
     requiredCapability: "flow/execute",
+    // Additive: makes the form an event SOURCE so downstream blocks can
+    // auto-trigger on submission (e.g. form → send email). Nothing existing
+    // consumes this; it only enables new event wiring.
+    eligibleForEventTrigger: true,
     inputSchema: {
       type: "object",
       required: [],
@@ -1168,6 +1191,15 @@ function registerFormSubmitAction(type, can) {
       { path: "form.answers", displayName: "Form Answers JSON", type: "string", description: "JSON stringified form answers, matching form block runtime output." },
       { path: "answers", displayName: "Form Answers", type: "object", description: "Parsed form answers object for convenience." }
     ],
+    events: [
+      {
+        name: "form.submitted",
+        displayName: "Form submitted",
+        description: "Fires when the human submits the form. Payload carries the parsed answers.",
+        payloadSchema: [{ path: "answers", displayName: "Form Answers", type: "object" }],
+        pendingDisplayFields: ["answers"]
+      }
+    ],
     run: async (inputs) => {
       const answers = normalizeAnswers(inputs.answers ?? inputs.form?.answers);
       const answersJson = JSON.stringify(answers);
@@ -1177,7 +1209,8 @@ function registerFormSubmitAction(type, can) {
             answers: answersJson
           },
           answers
-        }
+        },
+        events: [{ name: "form.submitted", payload: { answers } }]
       };
     }
   });
@@ -6292,6 +6325,379 @@ registerAction({
   }
 });
 
+// src/core/lib/actionRegistry/actions/_shared/delegatedTool.ts
+function parseBoundConnection(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const c = raw;
+  if (typeof c.bindingId !== "string" || !c.bindingId) return null;
+  if (typeof c.connectedAccountId !== "string") return null;
+  if (typeof c.toolkit !== "string") return null;
+  return {
+    bindingId: c.bindingId,
+    connectedAccountId: c.connectedAccountId,
+    toolkit: c.toolkit,
+    label: typeof c.label === "string" ? c.label : null
+  };
+}
+function parseDelegatedToolInputs(raw) {
+  let parsed = {};
+  try {
+    parsed = typeof raw === "string" ? JSON.parse(raw || "{}") : raw || {};
+  } catch {
+    parsed = {};
+  }
+  return { ...parsed, connection: parseBoundConnection(parsed.connection) };
+}
+function serializeDelegatedToolInputs(inputs) {
+  return JSON.stringify(inputs);
+}
+function fieldValues(inputs) {
+  const out = {};
+  for (const [k, v] of Object.entries(inputs)) {
+    if (k === "connection") continue;
+    if (typeof v === "string") out[k] = v;
+  }
+  return out;
+}
+function missingRequired(schema, values) {
+  return (schema.parameters.required || []).filter((name) => !(values[name] ?? "").trim());
+}
+function coerceToolArgs(schema, values) {
+  const out = {};
+  for (const [name, prop] of Object.entries(schema.parameters.properties || {})) {
+    const raw = values[name];
+    if (typeof raw !== "string" || raw.trim() === "") continue;
+    const type = prop.type;
+    if (type === "boolean") {
+      out[name] = raw === "true";
+    } else if (type === "array") {
+      out[name] = raw.split(/[\n,]+/).map((s) => s.trim()).filter(Boolean);
+    } else if (type === "number" || type === "integer") {
+      const n = Number(raw);
+      if (!Number.isNaN(n)) out[name] = n;
+    } else {
+      out[name] = raw;
+    }
+  }
+  return out;
+}
+async function executeDelegatedTool(ctx, opts) {
+  const svc = ctx.services.integrations;
+  if (!svc?.executeBinding) {
+    throw new Error(`${opts.toolkitLabel} integration is not configured.`);
+  }
+  const bindingId = opts.connection?.bindingId;
+  if (!bindingId) {
+    throw new Error(`No ${opts.toolkitLabel} account is bound. The template author must connect and bind ${opts.toolkitLabel}.`);
+  }
+  const missing = missingRequired(opts.schema, opts.values);
+  if (missing.length > 0) {
+    throw new Error(`Missing required field${missing.length === 1 ? "" : "s"}: ${missing.join(", ")}`);
+  }
+  const args = coerceToolArgs(opts.schema, opts.values);
+  const result = await svc.executeBinding({ bindingId, toolSlug: opts.toolSlug, arguments: args });
+  if (!result.successful) {
+    if (result.code === "AUTH_EXPIRED") {
+      throw new Error(`The template author's ${opts.toolkitLabel} access expired \u2014 they need to reconnect it in the template.`);
+    }
+    if (result.code === "UPSTREAM_4XX" && /not found|removed/i.test(result.error || "")) {
+      throw new Error(`This ${opts.toolkitLabel} integration was removed by the template author.`);
+    }
+    throw new Error(result.error || `${opts.toolkitLabel} action failed.`);
+  }
+  return result.data ?? {};
+}
+
+// src/core/lib/actionRegistry/actions/gmail/emailSend.types.ts
+var GMAIL_SEND_SLUG = "GMAIL_SEND_EMAIL";
+var GMAIL_SENT_EVENT = "email.sent";
+var GMAIL_SEND_SCHEMA = {
+  slug: GMAIL_SEND_SLUG,
+  name: "Send Email",
+  description: "Send an email from the template author's Gmail account.",
+  parameters: {
+    type: "object",
+    required: ["recipient_email", "body"],
+    properties: {
+      recipient_email: { type: "string", title: "To", description: "Recipient's email address." },
+      subject: { type: "string", title: "Subject" },
+      body: { type: "string", title: "Body", description: 'Email body. Plain text unless "HTML body" is set.' },
+      cc: { type: "array", title: "Cc", description: "Comma-separated email addresses." },
+      bcc: { type: "array", title: "Bcc", description: "Comma-separated email addresses." },
+      is_html: { type: "boolean", title: "HTML body", description: "Render the body as HTML." }
+    }
+  }
+};
+var GMAIL_SEND_OUTPUT_SCHEMA = [
+  { path: "messageId", displayName: "Message ID", type: "string", description: "Gmail id of the sent message" },
+  { path: "threadId", displayName: "Thread ID", type: "string" },
+  { path: "sentAt", displayName: "Sent At", type: "string", description: "ISO timestamp when sent" }
+];
+
+// src/core/lib/actionRegistry/actions/gmail/emailSend.ts
+registerAction({
+  type: "qi/gmail.email.send",
+  can: "gmail.email/send",
+  sideEffect: true,
+  defaultRequiresConfirmation: true,
+  requiredCapability: "flow/block/execute",
+  // Can be wired to another block's event (e.g. form submitted → send email).
+  eligibleForEventTrigger: true,
+  outputSchema: GMAIL_SEND_OUTPUT_SCHEMA,
+  events: [
+    {
+      name: GMAIL_SENT_EVENT,
+      displayName: "Email sent",
+      description: "Fired after the email is sent from the author\u2019s Gmail.",
+      payloadSchema: [
+        { path: "messageId", displayName: "Message ID", type: "string" },
+        { path: "recipient_email", displayName: "To", type: "string" }
+      ],
+      pendingDisplayFields: ["messageId"]
+    }
+  ],
+  run: async (inputs, ctx) => {
+    const parsed = parseDelegatedToolInputs(inputs);
+    const values = fieldValues(parsed);
+    const data = await executeDelegatedTool(ctx, {
+      connection: parsed.connection,
+      schema: GMAIL_SEND_SCHEMA,
+      toolSlug: GMAIL_SEND_SLUG,
+      values,
+      toolkitLabel: "Gmail"
+    });
+    const envelope = data.response_data ?? data;
+    const messageId = String(envelope.id ?? envelope.messageId ?? "");
+    const threadId = String(envelope.threadId ?? "");
+    return {
+      output: {
+        messageId,
+        threadId,
+        sentAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      events: messageId ? [{ name: GMAIL_SENT_EVENT, payload: { messageId, recipient_email: values.recipient_email ?? "" } }] : void 0
+    };
+  }
+});
+
+// src/core/lib/actionRegistry/actions/outlook/emailSend.types.ts
+var OUTLOOK_SEND_SLUG = "OUTLOOK_OUTLOOK_SEND_EMAIL";
+var OUTLOOK_SENT_EVENT = "email.sent";
+var OUTLOOK_SEND_SCHEMA = {
+  slug: OUTLOOK_SEND_SLUG,
+  name: "Send Email",
+  description: "Send an email from the template author's Outlook account.",
+  parameters: {
+    type: "object",
+    required: ["subject", "body", "to_email"],
+    properties: {
+      to_email: { type: "string", title: "To", description: "Recipient's email address." },
+      to_name: { type: "string", title: "To name", description: "Optional display name for the recipient." },
+      subject: { type: "string", title: "Subject" },
+      body: { type: "string", title: "Body", description: 'Email body. Plain text unless "HTML body" is set.' },
+      cc_emails: { type: "array", title: "Cc", description: "Comma-separated email addresses." },
+      bcc_emails: { type: "array", title: "Bcc", description: "Comma-separated email addresses." },
+      is_html: { type: "boolean", title: "HTML body", description: "Render the body as HTML." }
+    }
+  }
+};
+var OUTLOOK_SEND_OUTPUT_SCHEMA = [
+  { path: "messageId", displayName: "Message ID", type: "string" },
+  { path: "sentAt", displayName: "Sent At", type: "string", description: "ISO timestamp when sent" }
+];
+
+// src/core/lib/actionRegistry/actions/outlook/emailSend.ts
+registerAction({
+  type: "qi/outlook.email.send",
+  can: "outlook.email/send",
+  sideEffect: true,
+  defaultRequiresConfirmation: true,
+  requiredCapability: "flow/block/execute",
+  // Can be wired to another block's event (e.g. form submitted → send email).
+  eligibleForEventTrigger: true,
+  outputSchema: OUTLOOK_SEND_OUTPUT_SCHEMA,
+  events: [
+    {
+      name: OUTLOOK_SENT_EVENT,
+      displayName: "Email sent",
+      description: "Fired after the email is sent from the author\u2019s Outlook.",
+      payloadSchema: [
+        { path: "messageId", displayName: "Message ID", type: "string" },
+        { path: "to_email", displayName: "To", type: "string" }
+      ],
+      pendingDisplayFields: ["messageId"]
+    }
+  ],
+  run: async (inputs, ctx) => {
+    const parsed = parseDelegatedToolInputs(inputs);
+    const values = fieldValues(parsed);
+    const data = await executeDelegatedTool(ctx, {
+      connection: parsed.connection,
+      schema: OUTLOOK_SEND_SCHEMA,
+      toolSlug: OUTLOOK_SEND_SLUG,
+      values,
+      toolkitLabel: "Outlook"
+    });
+    const envelope = data.response_data ?? data;
+    const messageId = String(envelope.id ?? envelope.messageId ?? "");
+    return {
+      output: {
+        messageId,
+        sentAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      // Outlook often returns no id, so emit unconditionally.
+      events: [{ name: OUTLOOK_SENT_EVENT, payload: { messageId, to_email: values.to_email ?? "" } }]
+    };
+  }
+});
+
+// src/core/lib/actionRegistry/actions/slack/messageSend.types.ts
+var SLACK_SEND_SLUG = "SLACK_CHAT_POST_MESSAGE";
+var SLACK_SENT_EVENT = "message.sent";
+var SLACK_SEND_SCHEMA = {
+  slug: SLACK_SEND_SLUG,
+  name: "Post Message",
+  description: "Post a message to a Slack channel from the template author's Slack account.",
+  parameters: {
+    type: "object",
+    required: ["channel"],
+    properties: {
+      channel: { type: "string", title: "Channel", description: "Channel ID or name, e.g. #general or C0123456." },
+      markdown_text: {
+        type: "string",
+        title: "Message",
+        description: "Message text in Slack markdown. Preferred over the deprecated plain text field."
+      },
+      thread_ts: { type: "string", title: "Thread", description: "Optional parent message timestamp to reply within a thread." }
+    }
+  }
+};
+var SLACK_SEND_OUTPUT_SCHEMA = [
+  { path: "messageTs", displayName: "Message ts", type: "string" },
+  { path: "channel", displayName: "Channel", type: "string" },
+  { path: "sentAt", displayName: "Sent At", type: "string", description: "ISO timestamp when sent" }
+];
+
+// src/core/lib/actionRegistry/actions/slack/messageSend.ts
+registerAction({
+  type: "qi/slack.message.send",
+  can: "slack.message/send",
+  sideEffect: true,
+  defaultRequiresConfirmation: true,
+  requiredCapability: "flow/block/execute",
+  // Can be wired to another block's event (e.g. form submitted → post message).
+  eligibleForEventTrigger: true,
+  outputSchema: SLACK_SEND_OUTPUT_SCHEMA,
+  events: [
+    {
+      name: SLACK_SENT_EVENT,
+      displayName: "Message posted",
+      description: "Fired after the message is posted to Slack.",
+      payloadSchema: [
+        { path: "messageTs", displayName: "Message ts", type: "string" },
+        { path: "channel", displayName: "Channel", type: "string" }
+      ],
+      pendingDisplayFields: ["messageTs"]
+    }
+  ],
+  run: async (inputs, ctx) => {
+    const parsed = parseDelegatedToolInputs(inputs);
+    const values = fieldValues(parsed);
+    const data = await executeDelegatedTool(ctx, {
+      connection: parsed.connection,
+      schema: SLACK_SEND_SCHEMA,
+      toolSlug: SLACK_SEND_SLUG,
+      values,
+      toolkitLabel: "Slack"
+    });
+    const envelope = data.response_data ?? data;
+    const messageTs = String(envelope.ts ?? "");
+    const channel = String(envelope.channel ?? values.channel ?? "");
+    return {
+      output: {
+        messageTs,
+        channel,
+        sentAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      events: messageTs ? [{ name: SLACK_SENT_EVENT, payload: { messageTs, channel } }] : void 0
+    };
+  }
+});
+
+// src/core/lib/actionRegistry/actions/googlecalendar/eventCreate.types.ts
+var GOOGLECALENDAR_CREATE_SLUG = "GOOGLECALENDAR_CREATE_EVENT";
+var GOOGLECALENDAR_CREATED_EVENT = "event.created";
+var GOOGLECALENDAR_CREATE_SCHEMA = {
+  slug: GOOGLECALENDAR_CREATE_SLUG,
+  name: "Create Event",
+  description: "Create an event on the template author's Google Calendar.",
+  parameters: {
+    type: "object",
+    required: ["start_datetime"],
+    properties: {
+      start_datetime: { type: "string", title: "Start time", description: "ISO 8601, e.g. 2026-05-12T09:00:00." },
+      summary: { type: "string", title: "Title" },
+      description: { type: "string", title: "Description" },
+      location: { type: "string", title: "Location" },
+      timezone: { type: "string", title: "Timezone", description: "IANA name, e.g. Europe/London." },
+      attendees: { type: "array", title: "Attendees", description: "Comma-separated email addresses." },
+      calendar_id: { type: "string", title: "Calendar", description: "Use 'primary' for the author's main calendar." },
+      event_duration_minutes: { type: "number", title: "Duration (minutes)", description: "Defaults to the calendar default if blank." }
+    }
+  }
+};
+var GOOGLECALENDAR_CREATE_OUTPUT_SCHEMA = [
+  { path: "eventId", displayName: "Event ID", type: "string" },
+  { path: "htmlLink", displayName: "Event link", type: "string" },
+  { path: "summary", displayName: "Summary", type: "string" },
+  { path: "startIso", displayName: "Start", type: "string" }
+];
+
+// src/core/lib/actionRegistry/actions/googlecalendar/eventCreate.ts
+registerAction({
+  type: "qi/googlecalendar.event.create",
+  can: "googlecalendar.event/create",
+  sideEffect: true,
+  defaultRequiresConfirmation: true,
+  requiredCapability: "flow/block/execute",
+  eligibleForEventTrigger: true,
+  outputSchema: GOOGLECALENDAR_CREATE_OUTPUT_SCHEMA,
+  events: [
+    {
+      name: GOOGLECALENDAR_CREATED_EVENT,
+      displayName: "Calendar event created",
+      description: "Fired after the event is created on the author\u2019s calendar.",
+      payloadSchema: [
+        { path: "eventId", displayName: "Event ID", type: "string" },
+        { path: "htmlLink", displayName: "Event link", type: "string" },
+        { path: "summary", displayName: "Summary", type: "string" }
+      ],
+      pendingDisplayFields: ["summary", "eventId"]
+    }
+  ],
+  run: async (inputs, ctx) => {
+    const parsed = parseDelegatedToolInputs(inputs);
+    const values = fieldValues(parsed);
+    const data = await executeDelegatedTool(ctx, {
+      connection: parsed.connection,
+      schema: GOOGLECALENDAR_CREATE_SCHEMA,
+      toolSlug: GOOGLECALENDAR_CREATE_SLUG,
+      values,
+      toolkitLabel: "Google Calendar"
+    });
+    const envelope = data.response_data ?? data;
+    const eventId = String(envelope.id ?? "");
+    const htmlLink = String(envelope.htmlLink ?? "");
+    const summary = String(envelope.summary ?? values.summary ?? "");
+    const start = envelope.start;
+    const startIso = String(start?.dateTime ?? start?.date ?? values.start_datetime ?? "");
+    return {
+      output: { eventId, htmlLink, summary, startIso },
+      events: eventId ? [{ name: GOOGLECALENDAR_CREATED_EVENT, payload: { eventId, htmlLink, summary } }] : void 0
+    };
+  }
+});
+
 // src/core/lib/actionRegistry/actions/calendar/eventCreate.types.ts
 var EMPTY = {
   connection: null,
@@ -8638,829 +9044,849 @@ var createUcanService = (config) => {
   };
 };
 
-// src/core/lib/flowEngine/utils.ts
-var buildAuthzFromProps = (props) => {
-  const linkedClaimCollectionId = typeof props.linkedClaimCollectionId === "string" ? props.linkedClaimCollectionId.trim() : "";
-  const authz = {};
-  if (linkedClaimCollectionId) {
-    authz.linkedClaim = { collectionId: linkedClaimCollectionId };
-  }
-  return authz;
-};
-var buildFlowNodeFromBlock = (block) => {
-  const base = {
-    id: block.id,
-    type: block.type,
-    props: block.props || {}
-  };
-  const authz = buildAuthzFromProps(block.props || {});
-  return {
-    ...base,
-    ...authz
-  };
-};
-
-// src/core/lib/flowEngine/runtime.ts
-var XERO_WORK_ITEMS_MAP_NAME = "xeroWorkItems";
-var XERO_CONNECTION_MAP_NAME = "xeroConnection";
-var ensureStateObject = (value) => {
-  if (!value || typeof value !== "object") {
-    return {};
-  }
-  return { ...value };
-};
-var createYMapManager = (map) => {
-  return {
-    get: (nodeId) => {
-      const stored = map.get(nodeId);
-      return ensureStateObject(stored);
-    },
-    update: (nodeId, updates) => {
-      const current = ensureStateObject(map.get(nodeId));
-      map.set(nodeId, { ...current, ...updates });
-    }
-  };
-};
-var createMemoryManager = () => {
-  const memory = /* @__PURE__ */ new Map();
-  return {
-    get: (nodeId) => ensureStateObject(memory.get(nodeId)),
-    update: (nodeId, updates) => {
-      const current = ensureStateObject(memory.get(nodeId));
-      memory.set(nodeId, { ...current, ...updates });
-    }
-  };
-};
-var createRuntimeStateManager = (editor) => {
-  if (editor?._yRuntime) {
-    return createYMapManager(editor._yRuntime);
-  }
-  return createMemoryManager();
-};
-var createYDocRuntimeManager = (yDoc) => {
-  return createYMapManager(yDoc.getMap("runtime"));
-};
-function clearRuntimeForTemplateClone(yDoc) {
-  const runtime = yDoc.getMap("runtime");
-  const invocations = yDoc.getMap("invocations");
-  const pendingInvocations = yDoc.getMap("pendingInvocations");
-  const agentOutbox = yDoc.getMap("agentOutbox");
-  const agentLeases = yDoc.getMap("agentLeases");
-  const auditTrail = yDoc.getMap("auditTrail");
-  const xeroWorkItems = yDoc.getMap(XERO_WORK_ITEMS_MAP_NAME);
-  const xeroConnection = yDoc.getMap(XERO_CONNECTION_MAP_NAME);
-  yDoc.transact(() => {
-    runtime.forEach((_, key) => runtime.delete(key));
-    invocations.forEach((_, key) => invocations.delete(key));
-    pendingInvocations.forEach((_, key) => pendingInvocations.delete(key));
-    agentOutbox.forEach((_, key) => agentOutbox.delete(key));
-    agentLeases.forEach((_, key) => agentLeases.delete(key));
-    auditTrail.forEach((_, key) => auditTrail.delete(key));
-    xeroWorkItems.forEach((_, key) => xeroWorkItems.delete(key));
-    xeroConnection.forEach((_, key) => xeroConnection.delete(key));
-  });
-}
-
 // src/core/types/baseUcan.ts
 function isRuntimeRef(value) {
   return typeof value === "object" && value !== null && "$ref" in value && typeof value.$ref === "string";
 }
 
-// src/core/lib/flowCompiler/resolveRefs.ts
-function resolveRuntimeRefs(nb, getNodeOutput2, triggerContext) {
-  return resolveValue(nb, getNodeOutput2, triggerContext);
+// src/core/lib/flowEngine/triggers.ts
+import * as Y from "yjs";
+var RUN_RECORD_AUDIT_TYPE = "block.run";
+function computePendingInvocationId(args) {
+  const { sourceBlockId, sourceRunId, listenerBlockId, eventName, eventIndex } = args;
+  const input = `${sourceBlockId}:${sourceRunId}:${listenerBlockId}:${eventName}:${eventIndex}`;
+  return `pi-${fnv1a32(input)}`;
 }
-function resolveValue(value, getNodeOutput2, triggerContext) {
-  if (isRuntimeRef(value)) {
-    return resolveRef(value.$ref, getNodeOutput2, triggerContext);
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => resolveValue(item, getNodeOutput2, triggerContext));
-  }
-  if (typeof value === "object" && value !== null) {
-    const result = {};
-    for (const [key, val] of Object.entries(value)) {
-      result[key] = resolveValue(val, getNodeOutput2, triggerContext);
-    }
-    return result;
-  }
-  return value;
+function snapshotInputRefs(inputs, getNodeOutput2) {
+  const snapshots = {};
+  walkRefs(inputs, (ref) => {
+    if (ref.$ref.startsWith("trigger.")) return;
+    const parsed = parseOutputRef(ref.$ref);
+    if (!parsed) return;
+    const output = getNodeOutput2(parsed.nodeId);
+    if (!output) return;
+    snapshots[ref.$ref] = getNestedValue2(output, parsed.fieldPath);
+  });
+  return snapshots;
 }
-function resolveRef(ref, getNodeOutput2, triggerContext) {
-  if (ref.startsWith("trigger.payload.")) {
-    if (!triggerContext) {
-      throw new Error(`Trigger ref "${ref}" used outside of a listener invocation context. trigger.payload.* refs are only valid on block.event-triggered blocks.`);
-    }
-    const fieldPath2 = ref.slice("trigger.payload.".length);
-    return getNestedValue2(triggerContext.payload, fieldPath2);
-  }
-  if (triggerContext && Object.prototype.hasOwnProperty.call(triggerContext.refSnapshots, ref)) {
-    return triggerContext.refSnapshots[ref];
+function walkRefs(value, visit) {
+  if (isRuntimeRef(value)) {
+    visit(value);
+    return;
   }
-  const outputIndex = ref.indexOf(".output.");
-  if (outputIndex === -1) {
-    throw new Error(`Invalid runtime reference "${ref}". Expected format: "nodeId.output.fieldPath" or "trigger.payload.fieldPath"`);
+  if (Array.isArray(value)) {
+    for (const item of value) walkRefs(item, visit);
+    return;
   }
-  const nodeId = ref.slice(0, outputIndex);
-  const fieldPath = ref.slice(outputIndex + ".output.".length);
-  const output = getNodeOutput2(nodeId);
-  if (!output) {
-    return void 0;
+  if (typeof value === "object" && value !== null) {
+    for (const v of Object.values(value)) walkRefs(v, visit);
   }
-  return getNestedValue2(output, fieldPath);
+}
+function parseOutputRef(ref) {
+  const outputIndex = ref.indexOf(".output.");
+  if (outputIndex === -1) return null;
+  return {
+    nodeId: ref.slice(0, outputIndex),
+    fieldPath: ref.slice(outputIndex + ".output.".length)
+  };
 }
 function getNestedValue2(obj, path) {
   const parts = path.split(".");
   let current = obj;
   for (const part of parts) {
-    if (current == null || typeof current !== "object") {
-      return void 0;
-    }
+    if (current == null || typeof current !== "object") return void 0;
     current = current[part];
   }
   return current;
 }
-
-// src/core/lib/flowEngine/versionManifest.ts
-var VERSION_MANIFEST = {
-  "0.3": {
-    version: "0.3",
-    label: "Legacy",
-    ucanRequired: false,
-    delegationRootRequired: false,
-    whitelistOnlyAllowed: true,
-    unrestrictedAllowed: true,
-    executionPath: "legacy",
-    authorizationFn: "v1",
-    allowedAuthModes: ["anyone", "actors", "capability"],
-    ui: {
-      showDelegationPanel: false,
-      showWhitelistConfig: true,
-      showAnyoneConfig: true,
-      showMigrationBanner: true,
-      requirePinForExecution: false
-    },
-    description: "Legacy version. UCAN optional, whitelist-only authorization accepted."
-  },
-  "1.0.0": {
-    version: "1.0.0",
-    label: "UCAN Required",
-    /** TEMP Disablement - needs to be true TODO */
-    ucanRequired: false,
-    delegationRootRequired: true,
-    whitelistOnlyAllowed: false,
-    unrestrictedAllowed: false,
-    executionPath: "invocation",
-    authorizationFn: "v2",
-    allowedAuthModes: ["capability"],
-    ui: {
-      showDelegationPanel: true,
-      showWhitelistConfig: false,
-      showAnyoneConfig: false,
-      showMigrationBanner: false,
-      requirePinForExecution: true
-    },
-    description: "UCAN-enforced. Every block execution requires a valid delegation chain."
+function fnv1a32(input) {
+  let hash = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    hash ^= input.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
   }
-};
-var LATEST_VERSION = "1.0.0";
-function getVersionPolicy(version) {
-  const policy = VERSION_MANIFEST[version];
-  if (!policy) {
-    return VERSION_MANIFEST[LATEST_VERSION];
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+var PENDING_INVOCATIONS_MAP_KEY = "pendingInvocations";
+function getPendingInvocationsMap(yDoc) {
+  return yDoc.getMap(PENDING_INVOCATIONS_MAP_KEY);
+}
+function getOrCreateBlockPendingMap(yDoc, blockId) {
+  const outer = getPendingInvocationsMap(yDoc);
+  let inner = outer.get(blockId);
+  if (!inner) {
+    inner = new Y.Map();
+    outer.set(blockId, inner);
   }
-  return policy;
+  return inner;
 }
-
-// src/core/lib/flowEngine/authorization.ts
-var isAuthorized = async (blockId, actorDid, ucanService, flowUri, schemaVersion) => {
-  const policy = schemaVersion ? getVersionPolicy(schemaVersion) : null;
-  if (policy && !policy.ucanRequired) {
-    return { authorized: true };
+function readPendingInvocations(yDoc, blockId) {
+  const outer = getPendingInvocationsMap(yDoc);
+  const inner = outer.get(blockId);
+  if (!inner) return [];
+  const items = [];
+  inner.forEach((value) => {
+    if (value && typeof value === "object") {
+      items.push(value);
+    }
+  });
+  items.sort((a, b) => a.emittedAt.localeCompare(b.emittedAt));
+  return items;
+}
+function queuePendingInvocation(yDoc, listenerBlockId, invocation) {
+  let created = false;
+  yDoc.transact(() => {
+    const inner = getOrCreateBlockPendingMap(yDoc, listenerBlockId);
+    if (inner.has(invocation.id)) return;
+    inner.set(invocation.id, invocation);
+    created = true;
+  });
+  return created;
+}
+function removePendingInvocation(yDoc, listenerBlockId, pendingInvocationId) {
+  const outer = getPendingInvocationsMap(yDoc);
+  const inner = outer.get(listenerBlockId);
+  if (!inner) return false;
+  if (!inner.has(pendingInvocationId)) return false;
+  inner.delete(pendingInvocationId);
+  return true;
+}
+var BARRIER_STATE_MAP_KEY = "barrierState";
+function getBarrierStateMap(yDoc) {
+  return yDoc.getMap(BARRIER_STATE_MAP_KEY);
+}
+function getOrCreateListenerBarrierMap(yDoc, listenerBlockId) {
+  const outer = getBarrierStateMap(yDoc);
+  let inner = outer.get(listenerBlockId);
+  if (!inner) {
+    inner = new Y.Map();
+    outer.set(listenerBlockId, inner);
   }
-  if (!ucanService) {
-    if (!policy) {
-      return { authorized: true };
+  return inner;
+}
+function recordBarrierEvent(yDoc, listenerBlockId, entry) {
+  let written = false;
+  yDoc.transact(() => {
+    const inner = getOrCreateListenerBarrierMap(yDoc, listenerBlockId);
+    const key = `${entry.sourceBlockId}::${entry.eventName}`;
+    const existing = inner.get(key);
+    if (existing && typeof existing === "object" && existing.runId === entry.runId) return;
+    inner.set(key, entry);
+    written = true;
+  });
+  return written;
+}
+function readBarrierState(yDoc, listenerBlockId) {
+  const outer = getBarrierStateMap(yDoc);
+  const inner = outer.get(listenerBlockId);
+  if (!inner) return [];
+  const entries = [];
+  inner.forEach((value) => {
+    if (value && typeof value === "object") {
+      entries.push(value);
+    }
+  });
+  return entries;
+}
+function clearBarrierState(yDoc, listenerBlockId) {
+  const outer = getBarrierStateMap(yDoc);
+  yDoc.transact(() => {
+    outer.delete(listenerBlockId);
+  });
+}
+function computeBarrierInvocationId(entries, listenerBlockId) {
+  const sorted = [...entries].sort((a, b) => a.sourceBlockId.localeCompare(b.sourceBlockId));
+  const input = sorted.map((e) => `${e.sourceBlockId}:${e.runId}:${e.eventName}`).join("|") + `|>${listenerBlockId}`;
+  return `bi-${fnv1a32(input)}`;
+}
+function mergeBarrierPayloads(entries) {
+  const merged = {};
+  for (const entry of entries) {
+    if (entry.alias) {
+      merged[entry.alias] = entry.payload;
+    } else {
+      Object.assign(merged, entry.payload);
     }
-    return {
-      authorized: false,
-      reason: "UCAN service is not configured. This flow version requires UCAN authorization."
-    };
   }
-  const capability = {
-    can: "flow/block/execute",
-    with: `${flowUri}:${blockId}`
-  };
-  const result = await ucanService.validateDelegationChain(actorDid, capability);
-  if (!result.valid) {
-    return {
-      authorized: false,
-      reason: result.error || "No valid capability chain found"
+  return merged;
+}
+function appendRunRecord(yDoc, blockId, details, userId) {
+  const auditMap = yDoc.getMap("auditTrail");
+  yDoc.transact(() => {
+    let arr = auditMap.get(blockId);
+    if (!arr) {
+      arr = new Y.Array();
+      auditMap.set(blockId, arr);
+    }
+    const event = {
+      id: `${details.runId}`,
+      blockId,
+      type: RUN_RECORD_AUDIT_TYPE,
+      details,
+      message: void 0,
+      meta: {
+        timestamp: details.completedAt,
+        userId,
+        editable: false
+      }
     };
+    arr.push([event]);
+  });
+}
+function readRunRecords(yDoc, blockId) {
+  const auditMap = yDoc.getMap("auditTrail");
+  const arr = auditMap.get(blockId);
+  if (!arr) return [];
+  const records = [];
+  arr.forEach((entry) => {
+    if (!entry || typeof entry !== "object") return;
+    const e = entry;
+    if (e.type === RUN_RECORD_AUDIT_TYPE && e.details) {
+      records.push(e.details);
+    }
+  });
+  return records;
+}
+function findFailedListenersForSourceRun(yDoc, sourceBlockId, sourceRunId, listenerBlockIds) {
+  const failures = [];
+  for (const listenerBlockId of listenerBlockIds) {
+    const records = readRunRecords(yDoc, listenerBlockId);
+    for (const record of records) {
+      if (!record.error) continue;
+      if (record.triggeredBy?.sourceBlockId !== sourceBlockId) continue;
+      if (record.fromPendingInvocationId == null) continue;
+      const sourceRunIdField = record.sourceRunId;
+      if (sourceRunIdField && sourceRunIdField !== sourceRunId) continue;
+      failures.push({ listenerBlockId, record });
+    }
   }
-  const proofCids = result.proofChain?.map((d) => d.cid) || [];
-  return {
-    authorized: true,
-    capabilityId: proofCids[0],
-    proofCids
-  };
-};
-
-// src/core/lib/flowEngine/executor.ts
-var updateRuntimeAfterSuccess = (node, actorDid, runtime, actionResult, invocationCid, now) => {
-  const updates = {
-    submittedByDid: actionResult.submittedByDid || actorDid,
-    evaluationStatus: actionResult.evaluationStatus || "pending",
-    executionTimestamp: now ? now() : Date.now(),
-    lastInvocationCid: invocationCid
-  };
-  if (actionResult.claimId) {
-    updates.claimId = actionResult.claimId;
-  }
-  runtime.update(node.id, updates);
-};
-var executeNode = async ({ node, actorDid, actorType, entityRoomId, context, action, pin }) => {
-  const { runtime, ucanService, invocationStore, flowUri, flowId, schemaVersion, now } = context;
-  const auth = await isAuthorized(node.id, actorDid, ucanService, flowUri, schemaVersion);
-  if (!auth.authorized) {
-    return { success: false, stage: "authorization", error: auth.reason };
-  }
-  if (node.linkedClaim && !node.linkedClaim.collectionId) {
-    return { success: false, stage: "claim", error: "Linked claim collection is required but missing." };
+  return failures;
+}
+function replayFailedListenerRun(yDoc, failedRecord, listenerBlockId, originalPayload, originalRefSnapshots, assigneeDid) {
+  if (!failedRecord.triggeredBy) return false;
+  const replayId = `${failedRecord.runId}:replay-${Date.now().toString(36)}`;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const replay = {
+    id: replayId,
+    triggeringBlockId: failedRecord.triggeredBy.sourceBlockId,
+    sourceRunId: failedRecord.sourceRunId || failedRecord.runId,
+    eventName: failedRecord.triggeredBy.eventName,
+    eventIndex: 0,
+    payload: originalPayload,
+    refSnapshots: originalRefSnapshots,
+    assigneeDid,
+    emittedAt: now,
+    expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1e3).toISOString()
+  };
+  return queuePendingInvocation(yDoc, listenerBlockId, replay);
+}
+
+// src/core/lib/flowEngine/reconcile.ts
+var _reconcileRunning = false;
+function reconcilePendingInvocations(editor) {
+  if (_reconcileRunning) return;
+  _reconcileRunning = true;
+  try {
+    _reconcilePendingInvocationsInner(editor);
+  } finally {
+    _reconcileRunning = false;
   }
-  let invocationCid;
-  let invocationData;
-  if (ucanService && auth.proofCids && auth.proofCids.length > 0) {
-    const capability = {
-      can: "flow/block/execute",
-      with: `${flowUri}:${node.id}`
-    };
-    try {
-      const invocationResult = await ucanService.createAndValidateInvocation(
-        {
-          invokerDid: actorDid,
-          invokerType: actorType,
-          entityRoomId,
-          capability,
-          proofs: auth.proofCids,
-          pin
-        },
-        flowId,
-        node.id
-      );
-      if (!invocationResult.valid) {
-        return {
-          success: false,
-          stage: "authorization",
-          error: `Invocation validation failed: ${invocationResult.error}`
-        };
+}
+function _reconcilePendingInvocationsInner(editor) {
+  const yDoc = editor._yDoc;
+  if (!yDoc) return;
+  const blocks = editor.document || [];
+  if (blocks.length === 0) return;
+  const listenersBySource = /* @__PURE__ */ new Map();
+  const barrierListenersBySource = /* @__PURE__ */ new Map();
+  for (const block of blocks) {
+    const trigger = parseTrigger(block);
+    if (!trigger) continue;
+    if (trigger.type === "block.event") {
+      if (!trigger.sourceBlockId || !trigger.eventName) continue;
+      const key = `${trigger.sourceBlockId}::${trigger.eventName}`;
+      if (!listenersBySource.has(key)) listenersBySource.set(key, []);
+      listenersBySource.get(key).push({ block, trigger });
+    } else if (trigger.type === "block.event.all" && trigger.sources) {
+      for (const source of trigger.sources) {
+        if (!source.sourceBlockId || !source.eventName) continue;
+        const key = `${source.sourceBlockId}::${source.eventName}`;
+        if (!barrierListenersBySource.has(key)) barrierListenersBySource.set(key, []);
+        barrierListenersBySource.get(key).push({ block, trigger, source });
       }
-      invocationCid = invocationResult.cid;
-      invocationData = invocationResult.invocation;
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Failed to create invocation";
-      return { success: false, stage: "authorization", error: message };
     }
   }
-  try {
-    const result = await action();
-    if (node.linkedClaim && !result.claimId) {
-      if (invocationStore && invocationCid && invocationData) {
-        const storedInvocation = {
-          cid: invocationCid,
-          invocation: invocationData,
-          invokerDid: actorDid,
-          capability: { can: "flow/block/execute", with: `${flowUri}:${node.id}` },
-          executedAt: now ? now() : Date.now(),
-          flowId,
-          blockId: node.id,
-          result: "failure",
-          error: "Execution did not return a claimId for linked claim requirement.",
-          proofCids: auth.proofCids || []
-        };
-        invocationStore.add(storedInvocation);
+  if (listenersBySource.size === 0 && barrierListenersBySource.size === 0) return;
+  const runtimeMap = editor._yRuntime;
+  const getNodeOutput2 = (nodeId) => {
+    if (!runtimeMap) return void 0;
+    const state = runtimeMap.get(nodeId);
+    if (!state || typeof state !== "object") return void 0;
+    const out = state.output;
+    return out && typeof out === "object" ? out : void 0;
+  };
+  for (const block of blocks) {
+    const sourceBlockId = block?.id;
+    if (!sourceBlockId) continue;
+    let hasAnyListener = false;
+    for (const key of listenersBySource.keys()) {
+      if (key.startsWith(`${sourceBlockId}::`)) {
+        hasAnyListener = true;
+        break;
       }
-      return {
-        success: false,
-        stage: "claim",
-        error: "Execution did not return a claimId for linked claim requirement.",
-        invocationCid
-      };
     }
-    if (invocationStore && invocationCid && invocationData) {
-      const storedInvocation = {
-        cid: invocationCid,
-        invocation: invocationData,
-        invokerDid: actorDid,
-        capability: { can: "flow/block/execute", with: `${flowUri}:${node.id}` },
-        executedAt: now ? now() : Date.now(),
-        flowId,
-        blockId: node.id,
-        result: "success",
-        proofCids: auth.proofCids || [],
-        claimId: result.claimId
-      };
-      invocationStore.add(storedInvocation);
+    for (const key of barrierListenersBySource.keys()) {
+      if (key.startsWith(`${sourceBlockId}::`)) {
+        hasAnyListener = true;
+        break;
+      }
     }
-    updateRuntimeAfterSuccess(node, actorDid, runtime, result, invocationCid || auth.capabilityId, now);
-    return {
-      success: true,
-      stage: "complete",
-      result,
-      capabilityId: auth.capabilityId,
-      invocationCid
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Execution failed";
-    if (invocationStore && invocationCid && invocationData) {
-      const storedInvocation = {
-        cid: invocationCid,
-        invocation: invocationData,
-        invokerDid: actorDid,
-        capability: { can: "flow/block/execute", with: `${flowUri}:${node.id}` },
-        executedAt: now ? now() : Date.now(),
-        flowId,
-        blockId: node.id,
-        result: "failure",
-        error: message,
-        proofCids: auth.proofCids || []
-      };
-      invocationStore.add(storedInvocation);
+    if (!hasAnyListener) continue;
+    const records = readRunRecords(yDoc, sourceBlockId);
+    for (const record of records) {
+      processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap);
+      processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap);
     }
-    return { success: false, stage: "action", error: message, invocationCid };
-  }
-};
-
-// src/core/lib/flowEngine/triggers.ts
-import * as Y from "yjs";
-var RUN_RECORD_AUDIT_TYPE = "block.run";
-function computePendingInvocationId(args) {
-  const { sourceBlockId, sourceRunId, listenerBlockId, eventName, eventIndex } = args;
-  const input = `${sourceBlockId}:${sourceRunId}:${listenerBlockId}:${eventName}:${eventIndex}`;
-  return `pi-${fnv1a32(input)}`;
-}
-function snapshotInputRefs(inputs, getNodeOutput2) {
-  const snapshots = {};
-  walkRefs(inputs, (ref) => {
-    if (ref.$ref.startsWith("trigger.")) return;
-    const parsed = parseOutputRef(ref.$ref);
-    if (!parsed) return;
-    const output = getNodeOutput2(parsed.nodeId);
-    if (!output) return;
-    snapshots[ref.$ref] = getNestedValue3(output, parsed.fieldPath);
-  });
-  return snapshots;
-}
-function walkRefs(value, visit) {
-  if (isRuntimeRef(value)) {
-    visit(value);
-    return;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) walkRefs(item, visit);
-    return;
-  }
-  if (typeof value === "object" && value !== null) {
-    for (const v of Object.values(value)) walkRefs(v, visit);
   }
 }
-function parseOutputRef(ref) {
-  const outputIndex = ref.indexOf(".output.");
-  if (outputIndex === -1) return null;
-  return {
-    nodeId: ref.slice(0, outputIndex),
-    fieldPath: ref.slice(outputIndex + ".output.".length)
-  };
+function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap) {
+  if (!Array.isArray(record.events)) return;
+  record.events.forEach((event, eventIndex) => {
+    if (!event?.name) return;
+    const key = `${sourceBlockId}::${event.name}`;
+    const listeners = listenersBySource.get(key);
+    if (!listeners || listeners.length === 0) return;
+    for (const { block: listenerBlock } of listeners) {
+      const listenerBlockId = listenerBlock.id;
+      if (!listenerBlockId) continue;
+      const id = computePendingInvocationId({
+        sourceBlockId,
+        sourceRunId: record.runId,
+        listenerBlockId,
+        eventName: event.name,
+        eventIndex
+      });
+      const assigneeDid = resolveAssignee(listenerBlock) || "unassigned";
+      const inputs = parseInputs(listenerBlock);
+      const refSnapshots = snapshotInputRefs(inputs, getNodeOutput2);
+      const expiresAt = computeExpiry(listenerBlock, record.completedAt);
+      const invocation = {
+        id,
+        triggeringBlockId: sourceBlockId,
+        sourceRunId: record.runId,
+        eventName: event.name,
+        eventIndex,
+        payload: event.payload,
+        refSnapshots,
+        assigneeDid,
+        emittedAt: record.completedAt,
+        expiresAt
+      };
+      queuePendingInvocation(yDoc, listenerBlockId, invocation);
+      if (runtimeMap) {
+        const prev = runtimeMap.get(listenerBlockId) || {};
+        runtimeMap.set(listenerBlockId, {
+          ...prev,
+          pendingPayload: { ...event.payload, ...refSnapshots }
+        });
+      }
+    }
+  });
 }
-function getNestedValue3(obj, path) {
-  const parts = path.split(".");
-  let current = obj;
-  for (const part of parts) {
-    if (current == null || typeof current !== "object") return void 0;
-    current = current[part];
+function processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap) {
+  if (!Array.isArray(record.events)) return;
+  for (const event of record.events) {
+    if (!event?.name) continue;
+    const key = `${sourceBlockId}::${event.name}`;
+    const listeners = barrierListenersBySource.get(key);
+    if (!listeners || listeners.length === 0) continue;
+    for (const { block: listenerBlock, trigger, source } of listeners) {
+      const listenerBlockId = listenerBlock.id;
+      if (!listenerBlockId) continue;
+      const entry = {
+        sourceBlockId,
+        eventName: event.name,
+        alias: source.alias,
+        runId: record.runId,
+        payload: event.payload || {},
+        emittedAt: record.completedAt
+      };
+      recordBarrierEvent(yDoc, listenerBlockId, entry);
+      if (runtimeMap) {
+        const prev = runtimeMap.get(listenerBlockId) || {};
+        const existing = prev.pendingPayload || {};
+        runtimeMap.set(listenerBlockId, {
+          ...prev,
+          pendingPayload: { ...existing, ...event.payload || {} }
+        });
+      }
+      const allSources = trigger.sources || [];
+      const currentState = readBarrierState(yDoc, listenerBlockId);
+      const requiredSources = allSources.filter((s) => s.optional !== true);
+      const gatingSources = requiredSources.length > 0 ? requiredSources : allSources;
+      const allFired = gatingSources.length > 0 && gatingSources.every((s) => currentState.some((e) => e.sourceBlockId === s.sourceBlockId && e.eventName === s.eventName));
+      if (!allFired) continue;
+      const assigneeDid = resolveAssignee(listenerBlock) || "unassigned";
+      const id = computeBarrierInvocationId(currentState, listenerBlockId);
+      const mergedPayload = mergeBarrierPayloads(currentState);
+      const inputs = parseInputs(listenerBlock);
+      const refSnapshots = snapshotInputRefs(inputs, getNodeOutput2);
+      const expiresAt = computeExpiry(listenerBlock, record.completedAt);
+      const invocation = {
+        id,
+        triggeringBlockId: sourceBlockId,
+        sourceRunId: record.runId,
+        eventName: `barrier:${allSources.map((s) => s.alias).join("+")}`,
+        eventIndex: 0,
+        payload: mergedPayload,
+        refSnapshots,
+        assigneeDid,
+        emittedAt: record.completedAt,
+        expiresAt
+      };
+      queuePendingInvocation(yDoc, listenerBlockId, invocation);
+      clearBarrierState(yDoc, listenerBlockId);
+      if (runtimeMap) {
+        const prev = runtimeMap.get(listenerBlockId) || {};
+        runtimeMap.set(listenerBlockId, {
+          ...prev,
+          pendingPayload: { ...mergedPayload, ...refSnapshots }
+        });
+      }
+    }
   }
-  return current;
 }
-function fnv1a32(input) {
-  let hash = 2166136261;
-  for (let i = 0; i < input.length; i++) {
-    hash ^= input.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
+function parseTrigger(block) {
+  const raw = block?.props?.trigger;
+  if (!raw || typeof raw !== "string") return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && typeof parsed.type === "string") {
+      return parsed;
+    }
+  } catch {
   }
-  return (hash >>> 0).toString(16).padStart(8, "0");
+  return null;
 }
-var PENDING_INVOCATIONS_MAP_KEY = "pendingInvocations";
-function getPendingInvocationsMap(yDoc) {
-  return yDoc.getMap(PENDING_INVOCATIONS_MAP_KEY);
+function parseInputs(block) {
+  const raw = block?.props?.inputs;
+  if (!raw || typeof raw !== "string") return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object") return parsed;
+  } catch {
+  }
+  return {};
 }
-function getOrCreateBlockPendingMap(yDoc, blockId) {
-  const outer = getPendingInvocationsMap(yDoc);
-  let inner = outer.get(blockId);
-  if (!inner) {
-    inner = new Y.Map();
-    outer.set(blockId, inner);
+function resolveAssignee(block) {
+  const raw = block?.props?.assignment;
+  if (!raw) return void 0;
+  try {
+    const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+    const did = parsed?.assignedActor?.did;
+    return typeof did === "string" && did.length > 0 ? did : void 0;
+  } catch {
+    return void 0;
   }
-  return inner;
 }
-function readPendingInvocations(yDoc, blockId) {
-  const outer = getPendingInvocationsMap(yDoc);
-  const inner = outer.get(blockId);
-  if (!inner) return [];
-  const items = [];
-  inner.forEach((value) => {
-    if (value && typeof value === "object") {
-      items.push(value);
+function computeExpiry(block, emittedAt) {
+  const ttlAbsolute = block?.props?.ttlAbsoluteDueDate;
+  if (typeof ttlAbsolute === "string" && ttlAbsolute) {
+    return ttlAbsolute;
+  }
+  const ttlFromEnablement = block?.props?.ttlFromEnablement;
+  if (typeof ttlFromEnablement === "string" && ttlFromEnablement) {
+    const ms = parseIsoDurationToMs(ttlFromEnablement);
+    if (ms != null) {
+      return new Date(new Date(emittedAt).getTime() + ms).toISOString();
     }
-  });
-  items.sort((a, b) => a.emittedAt.localeCompare(b.emittedAt));
-  return items;
+  }
+  return new Date(new Date(emittedAt).getTime() + 7 * 24 * 60 * 60 * 1e3).toISOString();
 }
-function queuePendingInvocation(yDoc, listenerBlockId, invocation) {
-  let created = false;
-  yDoc.transact(() => {
-    const inner = getOrCreateBlockPendingMap(yDoc, listenerBlockId);
-    if (inner.has(invocation.id)) return;
-    inner.set(invocation.id, invocation);
-    created = true;
-  });
-  return created;
+function parseIsoDurationToMs(duration) {
+  const match = /^P(?:(\d+)D)?(?:T(?:(\d+)H)?(?:(\d+)M)?(?:(\d+)S)?)?$/.exec(duration);
+  if (!match) return null;
+  const [, d, h, m, s] = match;
+  let ms = 0;
+  if (d) ms += parseInt(d, 10) * 24 * 60 * 60 * 1e3;
+  if (h) ms += parseInt(h, 10) * 60 * 60 * 1e3;
+  if (m) ms += parseInt(m, 10) * 60 * 1e3;
+  if (s) ms += parseInt(s, 10) * 1e3;
+  return ms;
 }
-function removePendingInvocation(yDoc, listenerBlockId, pendingInvocationId) {
-  const outer = getPendingInvocationsMap(yDoc);
-  const inner = outer.get(listenerBlockId);
-  if (!inner) return false;
-  if (!inner.has(pendingInvocationId)) return false;
-  inner.delete(pendingInvocationId);
-  return true;
+function getActionForBlock(block) {
+  const actionType = block?.props?.actionType;
+  if (typeof actionType !== "string") return void 0;
+  return getAction(actionType);
 }
-var BARRIER_STATE_MAP_KEY = "barrierState";
-function getBarrierStateMap(yDoc) {
-  return yDoc.getMap(BARRIER_STATE_MAP_KEY);
+
+// src/core/lib/flowEngine/emitEvents.ts
+function writeRunRecordAndReconcile(editor, blockId, output, events, actorDid, detailsPatch = {}) {
+  const yDoc = editor._yDoc;
+  if (!yDoc) return;
+  if (events.length === 0) return;
+  const runId = `run-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const details = {
+    runId,
+    output,
+    events,
+    startedAt: now,
+    completedAt: now,
+    actorDid,
+    ...detailsPatch
+  };
+  appendRunRecord(yDoc, blockId, details, actorDid);
+  reconcilePendingInvocations(editor);
 }
-function getOrCreateListenerBarrierMap(yDoc, listenerBlockId) {
-  const outer = getBarrierStateMap(yDoc);
-  let inner = outer.get(listenerBlockId);
-  if (!inner) {
-    inner = new Y.Map();
-    outer.set(listenerBlockId, inner);
+
+// src/core/lib/flowEngine/utils.ts
+var buildAuthzFromProps = (props) => {
+  const linkedClaimCollectionId = typeof props.linkedClaimCollectionId === "string" ? props.linkedClaimCollectionId.trim() : "";
+  const authz = {};
+  if (linkedClaimCollectionId) {
+    authz.linkedClaim = { collectionId: linkedClaimCollectionId };
   }
-  return inner;
-}
-function recordBarrierEvent(yDoc, listenerBlockId, entry) {
-  let written = false;
-  yDoc.transact(() => {
-    const inner = getOrCreateListenerBarrierMap(yDoc, listenerBlockId);
-    const key = `${entry.sourceBlockId}::${entry.eventName}`;
-    const existing = inner.get(key);
-    if (existing && typeof existing === "object" && existing.runId === entry.runId) return;
-    inner.set(key, entry);
-    written = true;
-  });
-  return written;
-}
-function readBarrierState(yDoc, listenerBlockId) {
-  const outer = getBarrierStateMap(yDoc);
-  const inner = outer.get(listenerBlockId);
-  if (!inner) return [];
-  const entries = [];
-  inner.forEach((value) => {
-    if (value && typeof value === "object") {
-      entries.push(value);
+  return authz;
+};
+var buildFlowNodeFromBlock = (block) => {
+  const base = {
+    id: block.id,
+    type: block.type,
+    props: block.props || {}
+  };
+  const authz = buildAuthzFromProps(block.props || {});
+  return {
+    ...base,
+    ...authz
+  };
+};
+
+// src/core/lib/flowEngine/runtime.ts
+var XERO_WORK_ITEMS_MAP_NAME = "xeroWorkItems";
+var XERO_CONNECTION_MAP_NAME = "xeroConnection";
+var ensureStateObject = (value) => {
+  if (!value || typeof value !== "object") {
+    return {};
+  }
+  return { ...value };
+};
+var createYMapManager = (map) => {
+  return {
+    get: (nodeId) => {
+      const stored = map.get(nodeId);
+      return ensureStateObject(stored);
+    },
+    update: (nodeId, updates) => {
+      const current = ensureStateObject(map.get(nodeId));
+      map.set(nodeId, { ...current, ...updates });
     }
-  });
-  return entries;
-}
-function clearBarrierState(yDoc, listenerBlockId) {
-  const outer = getBarrierStateMap(yDoc);
+  };
+};
+var createMemoryManager = () => {
+  const memory = /* @__PURE__ */ new Map();
+  return {
+    get: (nodeId) => ensureStateObject(memory.get(nodeId)),
+    update: (nodeId, updates) => {
+      const current = ensureStateObject(memory.get(nodeId));
+      memory.set(nodeId, { ...current, ...updates });
+    }
+  };
+};
+var createRuntimeStateManager = (editor) => {
+  if (editor?._yRuntime) {
+    return createYMapManager(editor._yRuntime);
+  }
+  return createMemoryManager();
+};
+var createYDocRuntimeManager = (yDoc) => {
+  return createYMapManager(yDoc.getMap("runtime"));
+};
+function clearRuntimeForTemplateClone(yDoc) {
+  const runtime = yDoc.getMap("runtime");
+  const invocations = yDoc.getMap("invocations");
+  const pendingInvocations = yDoc.getMap("pendingInvocations");
+  const agentOutbox = yDoc.getMap("agentOutbox");
+  const agentLeases = yDoc.getMap("agentLeases");
+  const auditTrail = yDoc.getMap("auditTrail");
+  const xeroWorkItems = yDoc.getMap(XERO_WORK_ITEMS_MAP_NAME);
+  const xeroConnection = yDoc.getMap(XERO_CONNECTION_MAP_NAME);
   yDoc.transact(() => {
-    outer.delete(listenerBlockId);
+    runtime.forEach((_, key) => runtime.delete(key));
+    invocations.forEach((_, key) => invocations.delete(key));
+    pendingInvocations.forEach((_, key) => pendingInvocations.delete(key));
+    agentOutbox.forEach((_, key) => agentOutbox.delete(key));
+    agentLeases.forEach((_, key) => agentLeases.delete(key));
+    auditTrail.forEach((_, key) => auditTrail.delete(key));
+    xeroWorkItems.forEach((_, key) => xeroWorkItems.delete(key));
+    xeroConnection.forEach((_, key) => xeroConnection.delete(key));
   });
 }
-function computeBarrierInvocationId(entries, listenerBlockId) {
-  const sorted = [...entries].sort((a, b) => a.sourceBlockId.localeCompare(b.sourceBlockId));
-  const input = sorted.map((e) => `${e.sourceBlockId}:${e.runId}:${e.eventName}`).join("|") + `|>${listenerBlockId}`;
-  return `bi-${fnv1a32(input)}`;
+
+// src/core/lib/flowCompiler/resolveRefs.ts
+function resolveRuntimeRefs(nb, getNodeOutput2, triggerContext) {
+  return resolveValue(nb, getNodeOutput2, triggerContext);
 }
-function mergeBarrierPayloads(entries) {
-  const merged = {};
-  for (const entry of entries) {
-    if (entry.alias) {
-      merged[entry.alias] = entry.payload;
-    } else {
-      Object.assign(merged, entry.payload);
-    }
+function resolveValue(value, getNodeOutput2, triggerContext) {
+  if (isRuntimeRef(value)) {
+    return resolveRef(value.$ref, getNodeOutput2, triggerContext);
   }
-  return merged;
-}
-function appendRunRecord(yDoc, blockId, details, userId) {
-  const auditMap = yDoc.getMap("auditTrail");
-  yDoc.transact(() => {
-    let arr = auditMap.get(blockId);
-    if (!arr) {
-      arr = new Y.Array();
-      auditMap.set(blockId, arr);
+  if (Array.isArray(value)) {
+    return value.map((item) => resolveValue(item, getNodeOutput2, triggerContext));
+  }
+  if (typeof value === "object" && value !== null) {
+    const result = {};
+    for (const [key, val] of Object.entries(value)) {
+      result[key] = resolveValue(val, getNodeOutput2, triggerContext);
     }
-    const event = {
-      id: `${details.runId}`,
-      blockId,
-      type: RUN_RECORD_AUDIT_TYPE,
-      details,
-      message: void 0,
-      meta: {
-        timestamp: details.completedAt,
-        userId,
-        editable: false
-      }
-    };
-    arr.push([event]);
-  });
+    return result;
+  }
+  return value;
 }
-function readRunRecords(yDoc, blockId) {
-  const auditMap = yDoc.getMap("auditTrail");
-  const arr = auditMap.get(blockId);
-  if (!arr) return [];
-  const records = [];
-  arr.forEach((entry) => {
-    if (!entry || typeof entry !== "object") return;
-    const e = entry;
-    if (e.type === RUN_RECORD_AUDIT_TYPE && e.details) {
-      records.push(e.details);
+function resolveRef(ref, getNodeOutput2, triggerContext) {
+  if (ref.startsWith("trigger.payload.")) {
+    if (!triggerContext) {
+      throw new Error(`Trigger ref "${ref}" used outside of a listener invocation context. trigger.payload.* refs are only valid on block.event-triggered blocks.`);
     }
-  });
-  return records;
+    const fieldPath2 = ref.slice("trigger.payload.".length);
+    return getNestedValue3(triggerContext.payload, fieldPath2);
+  }
+  if (triggerContext && Object.prototype.hasOwnProperty.call(triggerContext.refSnapshots, ref)) {
+    return triggerContext.refSnapshots[ref];
+  }
+  const outputIndex = ref.indexOf(".output.");
+  if (outputIndex === -1) {
+    throw new Error(`Invalid runtime reference "${ref}". Expected format: "nodeId.output.fieldPath" or "trigger.payload.fieldPath"`);
+  }
+  const nodeId = ref.slice(0, outputIndex);
+  const fieldPath = ref.slice(outputIndex + ".output.".length);
+  const output = getNodeOutput2(nodeId);
+  if (!output) {
+    return void 0;
+  }
+  return getNestedValue3(output, fieldPath);
 }
-function findFailedListenersForSourceRun(yDoc, sourceBlockId, sourceRunId, listenerBlockIds) {
-  const failures = [];
-  for (const listenerBlockId of listenerBlockIds) {
-    const records = readRunRecords(yDoc, listenerBlockId);
-    for (const record of records) {
-      if (!record.error) continue;
-      if (record.triggeredBy?.sourceBlockId !== sourceBlockId) continue;
-      if (record.fromPendingInvocationId == null) continue;
-      const sourceRunIdField = record.sourceRunId;
-      if (sourceRunIdField && sourceRunIdField !== sourceRunId) continue;
-      failures.push({ listenerBlockId, record });
+function getNestedValue3(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current == null || typeof current !== "object") {
+      return void 0;
     }
+    current = current[part];
   }
-  return failures;
-}
-function replayFailedListenerRun(yDoc, failedRecord, listenerBlockId, originalPayload, originalRefSnapshots, assigneeDid) {
-  if (!failedRecord.triggeredBy) return false;
-  const replayId = `${failedRecord.runId}:replay-${Date.now().toString(36)}`;
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const replay = {
-    id: replayId,
-    triggeringBlockId: failedRecord.triggeredBy.sourceBlockId,
-    sourceRunId: failedRecord.sourceRunId || failedRecord.runId,
-    eventName: failedRecord.triggeredBy.eventName,
-    eventIndex: 0,
-    payload: originalPayload,
-    refSnapshots: originalRefSnapshots,
-    assigneeDid,
-    emittedAt: now,
-    expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1e3).toISOString()
-  };
-  return queuePendingInvocation(yDoc, listenerBlockId, replay);
+  return current;
 }
 
-// src/core/lib/flowEngine/reconcile.ts
-var _reconcileRunning = false;
-function reconcilePendingInvocations(editor) {
-  if (_reconcileRunning) return;
-  _reconcileRunning = true;
-  try {
-    _reconcilePendingInvocationsInner(editor);
-  } finally {
-    _reconcileRunning = false;
-  }
-}
-function _reconcilePendingInvocationsInner(editor) {
-  const yDoc = editor._yDoc;
-  if (!yDoc) return;
-  const blocks = editor.document || [];
-  if (blocks.length === 0) return;
-  const listenersBySource = /* @__PURE__ */ new Map();
-  const barrierListenersBySource = /* @__PURE__ */ new Map();
-  for (const block of blocks) {
-    const trigger = parseTrigger(block);
-    if (!trigger) continue;
-    if (trigger.type === "block.event") {
-      if (!trigger.sourceBlockId || !trigger.eventName) continue;
-      const key = `${trigger.sourceBlockId}::${trigger.eventName}`;
-      if (!listenersBySource.has(key)) listenersBySource.set(key, []);
-      listenersBySource.get(key).push({ block, trigger });
-    } else if (trigger.type === "block.event.all" && trigger.sources) {
-      for (const source of trigger.sources) {
-        if (!source.sourceBlockId || !source.eventName) continue;
-        const key = `${source.sourceBlockId}::${source.eventName}`;
-        if (!barrierListenersBySource.has(key)) barrierListenersBySource.set(key, []);
-        barrierListenersBySource.get(key).push({ block, trigger, source });
-      }
-    }
+// src/core/lib/flowEngine/versionManifest.ts
+var VERSION_MANIFEST = {
+  "0.3": {
+    version: "0.3",
+    label: "Legacy",
+    ucanRequired: false,
+    delegationRootRequired: false,
+    whitelistOnlyAllowed: true,
+    unrestrictedAllowed: true,
+    executionPath: "legacy",
+    authorizationFn: "v1",
+    allowedAuthModes: ["anyone", "actors", "capability"],
+    ui: {
+      showDelegationPanel: false,
+      showWhitelistConfig: true,
+      showAnyoneConfig: true,
+      showMigrationBanner: true,
+      requirePinForExecution: false
+    },
+    description: "Legacy version. UCAN optional, whitelist-only authorization accepted."
+  },
+  "1.0.0": {
+    version: "1.0.0",
+    label: "UCAN Required",
+    /** TEMP Disablement - needs to be true TODO */
+    ucanRequired: false,
+    delegationRootRequired: true,
+    whitelistOnlyAllowed: false,
+    unrestrictedAllowed: false,
+    executionPath: "invocation",
+    authorizationFn: "v2",
+    allowedAuthModes: ["capability"],
+    ui: {
+      showDelegationPanel: true,
+      showWhitelistConfig: false,
+      showAnyoneConfig: false,
+      showMigrationBanner: false,
+      requirePinForExecution: true
+    },
+    description: "UCAN-enforced. Every block execution requires a valid delegation chain."
   }
-  if (listenersBySource.size === 0 && barrierListenersBySource.size === 0) return;
-  const runtimeMap = editor._yRuntime;
-  const getNodeOutput2 = (nodeId) => {
-    if (!runtimeMap) return void 0;
-    const state = runtimeMap.get(nodeId);
-    if (!state || typeof state !== "object") return void 0;
-    const out = state.output;
-    return out && typeof out === "object" ? out : void 0;
-  };
-  for (const block of blocks) {
-    const sourceBlockId = block?.id;
-    if (!sourceBlockId) continue;
-    let hasAnyListener = false;
-    for (const key of listenersBySource.keys()) {
-      if (key.startsWith(`${sourceBlockId}::`)) {
-        hasAnyListener = true;
-        break;
-      }
-    }
-    for (const key of barrierListenersBySource.keys()) {
-      if (key.startsWith(`${sourceBlockId}::`)) {
-        hasAnyListener = true;
-        break;
-      }
-    }
-    if (!hasAnyListener) continue;
-    const records = readRunRecords(yDoc, sourceBlockId);
-    for (const record of records) {
-      processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap);
-      processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap);
-    }
+};
+var LATEST_VERSION = "1.0.0";
+function getVersionPolicy(version) {
+  const policy = VERSION_MANIFEST[version];
+  if (!policy) {
+    return VERSION_MANIFEST[LATEST_VERSION];
   }
+  return policy;
 }
-function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap) {
-  if (!Array.isArray(record.events)) return;
-  record.events.forEach((event, eventIndex) => {
-    if (!event?.name) return;
-    const key = `${sourceBlockId}::${event.name}`;
-    const listeners = listenersBySource.get(key);
-    if (!listeners || listeners.length === 0) return;
-    for (const { block: listenerBlock } of listeners) {
-      const listenerBlockId = listenerBlock.id;
-      if (!listenerBlockId) continue;
-      const id = computePendingInvocationId({
-        sourceBlockId,
-        sourceRunId: record.runId,
-        listenerBlockId,
-        eventName: event.name,
-        eventIndex
-      });
-      const assigneeDid = resolveAssignee(listenerBlock) || "unassigned";
-      const inputs = parseInputs(listenerBlock);
-      const refSnapshots = snapshotInputRefs(inputs, getNodeOutput2);
-      const expiresAt = computeExpiry(listenerBlock, record.completedAt);
-      const invocation = {
-        id,
-        triggeringBlockId: sourceBlockId,
-        sourceRunId: record.runId,
-        eventName: event.name,
-        eventIndex,
-        payload: event.payload,
-        refSnapshots,
-        assigneeDid,
-        emittedAt: record.completedAt,
-        expiresAt
-      };
-      queuePendingInvocation(yDoc, listenerBlockId, invocation);
-      if (runtimeMap) {
-        const prev = runtimeMap.get(listenerBlockId) || {};
-        runtimeMap.set(listenerBlockId, {
-          ...prev,
-          pendingPayload: { ...event.payload, ...refSnapshots }
-        });
-      }
-    }
-  });
-}
-function processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap) {
-  if (!Array.isArray(record.events)) return;
-  for (const event of record.events) {
-    if (!event?.name) continue;
-    const key = `${sourceBlockId}::${event.name}`;
-    const listeners = barrierListenersBySource.get(key);
-    if (!listeners || listeners.length === 0) continue;
-    for (const { block: listenerBlock, trigger, source } of listeners) {
-      const listenerBlockId = listenerBlock.id;
-      if (!listenerBlockId) continue;
-      const entry = {
-        sourceBlockId,
-        eventName: event.name,
-        alias: source.alias,
-        runId: record.runId,
-        payload: event.payload || {},
-        emittedAt: record.completedAt
-      };
-      recordBarrierEvent(yDoc, listenerBlockId, entry);
-      if (runtimeMap) {
-        const prev = runtimeMap.get(listenerBlockId) || {};
-        const existing = prev.pendingPayload || {};
-        runtimeMap.set(listenerBlockId, {
-          ...prev,
-          pendingPayload: { ...existing, ...event.payload || {} }
-        });
-      }
-      const allSources = trigger.sources || [];
-      const currentState = readBarrierState(yDoc, listenerBlockId);
-      const requiredSources = allSources.filter((s) => s.optional !== true);
-      const gatingSources = requiredSources.length > 0 ? requiredSources : allSources;
-      const allFired = gatingSources.length > 0 && gatingSources.every((s) => currentState.some((e) => e.sourceBlockId === s.sourceBlockId && e.eventName === s.eventName));
-      if (!allFired) continue;
-      const assigneeDid = resolveAssignee(listenerBlock) || "unassigned";
-      const id = computeBarrierInvocationId(currentState, listenerBlockId);
-      const mergedPayload = mergeBarrierPayloads(currentState);
-      const inputs = parseInputs(listenerBlock);
-      const refSnapshots = snapshotInputRefs(inputs, getNodeOutput2);
-      const expiresAt = computeExpiry(listenerBlock, record.completedAt);
-      const invocation = {
-        id,
-        triggeringBlockId: sourceBlockId,
-        sourceRunId: record.runId,
-        eventName: `barrier:${allSources.map((s) => s.alias).join("+")}`,
-        eventIndex: 0,
-        payload: mergedPayload,
-        refSnapshots,
-        assigneeDid,
-        emittedAt: record.completedAt,
-        expiresAt
-      };
-      queuePendingInvocation(yDoc, listenerBlockId, invocation);
-      clearBarrierState(yDoc, listenerBlockId);
-      if (runtimeMap) {
-        const prev = runtimeMap.get(listenerBlockId) || {};
-        runtimeMap.set(listenerBlockId, {
-          ...prev,
-          pendingPayload: { ...mergedPayload, ...refSnapshots }
-        });
-      }
-    }
+
+// src/core/lib/flowEngine/authorization.ts
+var isAuthorized = async (blockId, actorDid, ucanService, flowUri, schemaVersion) => {
+  const policy = schemaVersion ? getVersionPolicy(schemaVersion) : null;
+  if (policy && !policy.ucanRequired) {
+    return { authorized: true };
   }
-}
-function parseTrigger(block) {
-  const raw = block?.props?.trigger;
-  if (!raw || typeof raw !== "string") return null;
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object" && typeof parsed.type === "string") {
-      return parsed;
+  if (!ucanService) {
+    if (!policy) {
+      return { authorized: true };
     }
-  } catch {
+    return {
+      authorized: false,
+      reason: "UCAN service is not configured. This flow version requires UCAN authorization."
+    };
   }
-  return null;
-}
-function parseInputs(block) {
-  const raw = block?.props?.inputs;
-  if (!raw || typeof raw !== "string") return {};
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object") return parsed;
-  } catch {
+  const capability = {
+    can: "flow/block/execute",
+    with: `${flowUri}:${blockId}`
+  };
+  const result = await ucanService.validateDelegationChain(actorDid, capability);
+  if (!result.valid) {
+    return {
+      authorized: false,
+      reason: result.error || "No valid capability chain found"
+    };
   }
-  return {};
-}
-function resolveAssignee(block) {
-  const raw = block?.props?.assignment;
-  if (!raw) return void 0;
-  try {
-    const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
-    const did = parsed?.assignedActor?.did;
-    return typeof did === "string" && did.length > 0 ? did : void 0;
-  } catch {
-    return void 0;
+  const proofCids = result.proofChain?.map((d) => d.cid) || [];
+  return {
+    authorized: true,
+    capabilityId: proofCids[0],
+    proofCids
+  };
+};
+
+// src/core/lib/flowEngine/executor.ts
+var updateRuntimeAfterSuccess = (node, actorDid, runtime, actionResult, invocationCid, now) => {
+  const updates = {
+    submittedByDid: actionResult.submittedByDid || actorDid,
+    evaluationStatus: actionResult.evaluationStatus || "pending",
+    executionTimestamp: now ? now() : Date.now(),
+    lastInvocationCid: invocationCid
+  };
+  if (actionResult.claimId) {
+    updates.claimId = actionResult.claimId;
   }
-}
-function computeExpiry(block, emittedAt) {
-  const ttlAbsolute = block?.props?.ttlAbsoluteDueDate;
-  if (typeof ttlAbsolute === "string" && ttlAbsolute) {
-    return ttlAbsolute;
+  runtime.update(node.id, updates);
+};
+var executeNode = async ({ node, actorDid, actorType, entityRoomId, context, action, pin }) => {
+  const { runtime, ucanService, invocationStore, flowUri, flowId, schemaVersion, now } = context;
+  const auth = await isAuthorized(node.id, actorDid, ucanService, flowUri, schemaVersion);
+  if (!auth.authorized) {
+    return { success: false, stage: "authorization", error: auth.reason };
   }
-  const ttlFromEnablement = block?.props?.ttlFromEnablement;
-  if (typeof ttlFromEnablement === "string" && ttlFromEnablement) {
-    const ms = parseIsoDurationToMs(ttlFromEnablement);
-    if (ms != null) {
-      return new Date(new Date(emittedAt).getTime() + ms).toISOString();
+  if (node.linkedClaim && !node.linkedClaim.collectionId) {
+    return { success: false, stage: "claim", error: "Linked claim collection is required but missing." };
+  }
+  let invocationCid;
+  let invocationData;
+  if (ucanService && auth.proofCids && auth.proofCids.length > 0) {
+    const capability = {
+      can: "flow/block/execute",
+      with: `${flowUri}:${node.id}`
+    };
+    try {
+      const invocationResult = await ucanService.createAndValidateInvocation(
+        {
+          invokerDid: actorDid,
+          invokerType: actorType,
+          entityRoomId,
+          capability,
+          proofs: auth.proofCids,
+          pin
+        },
+        flowId,
+        node.id
+      );
+      if (!invocationResult.valid) {
+        return {
+          success: false,
+          stage: "authorization",
+          error: `Invocation validation failed: ${invocationResult.error}`
+        };
+      }
+      invocationCid = invocationResult.cid;
+      invocationData = invocationResult.invocation;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to create invocation";
+      return { success: false, stage: "authorization", error: message };
     }
   }
-  return new Date(new Date(emittedAt).getTime() + 7 * 24 * 60 * 60 * 1e3).toISOString();
-}
-function parseIsoDurationToMs(duration) {
-  const match = /^P(?:(\d+)D)?(?:T(?:(\d+)H)?(?:(\d+)M)?(?:(\d+)S)?)?$/.exec(duration);
-  if (!match) return null;
-  const [, d, h, m, s] = match;
-  let ms = 0;
-  if (d) ms += parseInt(d, 10) * 24 * 60 * 60 * 1e3;
-  if (h) ms += parseInt(h, 10) * 60 * 60 * 1e3;
-  if (m) ms += parseInt(m, 10) * 60 * 1e3;
-  if (s) ms += parseInt(s, 10) * 1e3;
-  return ms;
-}
-function getActionForBlock(block) {
-  const actionType = block?.props?.actionType;
-  if (typeof actionType !== "string") return void 0;
-  return getAction(actionType);
-}
+  try {
+    const result = await action();
+    if (node.linkedClaim && !result.claimId) {
+      if (invocationStore && invocationCid && invocationData) {
+        const storedInvocation = {
+          cid: invocationCid,
+          invocation: invocationData,
+          invokerDid: actorDid,
+          capability: { can: "flow/block/execute", with: `${flowUri}:${node.id}` },
+          executedAt: now ? now() : Date.now(),
+          flowId,
+          blockId: node.id,
+          result: "failure",
+          error: "Execution did not return a claimId for linked claim requirement.",
+          proofCids: auth.proofCids || []
+        };
+        invocationStore.add(storedInvocation);
+      }
+      return {
+        success: false,
+        stage: "claim",
+        error: "Execution did not return a claimId for linked claim requirement.",
+        invocationCid
+      };
+    }
+    if (invocationStore && invocationCid && invocationData) {
+      const storedInvocation = {
+        cid: invocationCid,
+        invocation: invocationData,
+        invokerDid: actorDid,
+        capability: { can: "flow/block/execute", with: `${flowUri}:${node.id}` },
+        executedAt: now ? now() : Date.now(),
+        flowId,
+        blockId: node.id,
+        result: "success",
+        proofCids: auth.proofCids || [],
+        claimId: result.claimId
+      };
+      invocationStore.add(storedInvocation);
+    }
+    updateRuntimeAfterSuccess(node, actorDid, runtime, result, invocationCid || auth.capabilityId, now);
+    return {
+      success: true,
+      stage: "complete",
+      result,
+      capabilityId: auth.capabilityId,
+      invocationCid
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Execution failed";
+    if (invocationStore && invocationCid && invocationData) {
+      const storedInvocation = {
+        cid: invocationCid,
+        invocation: invocationData,
+        invokerDid: actorDid,
+        capability: { can: "flow/block/execute", with: `${flowUri}:${node.id}` },
+        executedAt: now ? now() : Date.now(),
+        flowId,
+        blockId: node.id,
+        result: "failure",
+        error: message,
+        proofCids: auth.proofCids || []
+      };
+      invocationStore.add(storedInvocation);
+    }
+    return { success: false, stage: "action", error: message, invocationCid };
+  }
+};
 
 // src/core/lib/ucanDelegationStore.ts
 var ROOT_DELEGATION_KEY = "__root__";
@@ -9794,26 +10220,6 @@ var createMemoryInvocationStore = () => {
   };
 };
 
-// src/core/lib/flowEngine/emitEvents.ts
-function writeRunRecordAndReconcile(editor, blockId, output, events, actorDid, detailsPatch = {}) {
-  const yDoc = editor._yDoc;
-  if (!yDoc) return;
-  if (events.length === 0) return;
-  const runId = `run-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const details = {
-    runId,
-    output,
-    events,
-    startedAt: now,
-    completedAt: now,
-    actorDid,
-    ...detailsPatch
-  };
-  appendRunRecord(yDoc, blockId, details, actorDid);
-  reconcilePendingInvocations(editor);
-}
-
 // src/core/lib/flowEngine/actionExecutor.ts
 import * as Y3 from "yjs";
 
@@ -10725,6 +11131,9 @@ function compileBaseUcanFlow(plan, registry) {
     if (cap.condition) {
       props.conditions = compileCondition(cap.condition, blockIndex);
     }
+    if (cap.trigger) {
+      props.trigger = compileTrigger(cap.trigger, blockIndex);
+    }
     props.triggerMode = cap.trigger?.type || "manual";
     blocks.push({
       id: blockId,
@@ -10795,6 +11204,18 @@ function compileCondition(condition, blockIndex) {
   };
   return JSON.stringify(conditionConfig);
 }
+function compileTrigger(trigger, blockIndex) {
+  if (trigger.type === "block.event" && trigger.sourceBlockId) {
+    return JSON.stringify({ ...trigger, sourceBlockId: blockIndex[trigger.sourceBlockId.trim()] });
+  }
+  if (trigger.type === "block.event.all" && trigger.sources) {
+    return JSON.stringify({
+      ...trigger,
+      sources: trigger.sources.map((src) => ({ ...src, sourceBlockId: blockIndex[src.sourceBlockId.trim()] }))
+    });
+  }
+  return JSON.stringify(trigger);
+}
 function collectOutputRefs(value) {
   const refs = [];
   walk(value);
@@ -11150,9 +11571,13 @@ function mergeCompiledFlows(existing, incoming, strategy) {
 
 // src/core/lib/flowCompiler/decompile.ts
 function decompileToBaseUcanFlow(compiled) {
+  const nodeIdByBlockId = {};
+  for (const [nodeId, blockId] of Object.entries(compiled.blockIndex)) {
+    nodeIdByBlockId[blockId] = nodeId;
+  }
   const capabilities = compiled.order.map((nodeId) => {
     const node = compiled.nodes[nodeId];
-    return nodeToCapability(node);
+    return nodeToCapability(node, nodeIdByBlockId);
   });
   return {
     kind: "qi.flow.base-ucan",
@@ -11167,7 +11592,7 @@ function decompileToBaseUcanFlow(compiled) {
     capabilities
   };
 }
-function nodeToCapability(node) {
+function nodeToCapability(node, nodeIdByBlockId) {
   const cap = {
     id: node.id,
     can: node.can,
@@ -11202,7 +11627,7 @@ function nodeToCapability(node) {
     try {
       const trigger = JSON.parse(node.props.trigger);
       if (trigger && typeof trigger === "object" && typeof trigger.type === "string") {
-        cap.trigger = trigger;
+        cap.trigger = triggerToNodeIds(trigger, nodeIdByBlockId);
       }
     } catch {
     }
@@ -11218,6 +11643,18 @@ function nodeToCapability(node) {
   }
   return cap;
 }
+function triggerToNodeIds(trigger, nodeIdByBlockId) {
+  if (trigger.type === "block.event" && trigger.sourceBlockId) {
+    return { ...trigger, sourceBlockId: nodeIdByBlockId[trigger.sourceBlockId] ?? trigger.sourceBlockId };
+  }
+  if (trigger.type === "block.event.all" && trigger.sources) {
+    return {
+      ...trigger,
+      sources: trigger.sources.map((src) => ({ ...src, sourceBlockId: nodeIdByBlockId[src.sourceBlockId] ?? src.sourceBlockId }))
+    };
+  }
+  return trigger;
+}
 
 // src/core/lib/flowCompiler/setup.ts
 import * as Y7 from "yjs";
@@ -12801,6 +13238,8 @@ var FlowAgentService = class {
 };
 
 export {
+  STEP_COMPLETED_EVENT_NAME,
+  STEP_COMPLETED_EVENT,
   resolveActionType,
   registerAction,
   getAction,
@@ -12851,6 +13290,14 @@ export {
   didToMatrixUserId,
   findOrCreateDMRoom,
   sendDirectMessage,
+  parseDelegatedToolInputs,
+  serializeDelegatedToolInputs,
+  fieldValues,
+  missingRequired,
+  GMAIL_SEND_SCHEMA,
+  OUTLOOK_SEND_SCHEMA,
+  SLACK_SEND_SCHEMA,
+  GOOGLECALENDAR_CREATE_SCHEMA,
   parseCalendarEventCreateInputs,
   serializeCalendarEventCreateInputs,
   parseAttendeesField,
@@ -12860,15 +13307,7 @@ export {
   formatCoin2 as formatCoin,
   formatCoinAmount,
   createUcanService,
-  buildAuthzFromProps,
-  buildFlowNodeFromBlock,
-  createRuntimeStateManager,
-  clearRuntimeForTemplateClone,
   isRuntimeRef,
-  resolveRuntimeRefs,
-  LATEST_VERSION,
-  isAuthorized,
-  executeNode,
   RUN_RECORD_AUDIT_TYPE,
   computePendingInvocationId,
   snapshotInputRefs,
@@ -12883,6 +13322,15 @@ export {
   replayFailedListenerRun,
   reconcilePendingInvocations,
   getActionForBlock,
+  writeRunRecordAndReconcile,
+  buildAuthzFromProps,
+  buildFlowNodeFromBlock,
+  createRuntimeStateManager,
+  clearRuntimeForTemplateClone,
+  resolveRuntimeRefs,
+  LATEST_VERSION,
+  isAuthorized,
+  executeNode,
   reconcileActionReadBack,
   buildActionRunInputs,
   executeActionBlock,
@@ -12890,7 +13338,6 @@ export {
   createMemoryUcanDelegationStore,
   createInvocationStore,
   createMemoryInvocationStore,
-  writeRunRecordAndReconcile,
   compileBlockProps,
   COMPILED_BLOCK_TYPE,
   toEvaluatorOperator,
@@ -12942,4 +13389,4 @@ export {
   executeQueuedFlowAgentCoreCommands,
   FlowAgentService
 };
-//# sourceMappingURL=chunk-7MGFSE63.js.map
+//# sourceMappingURL=chunk-KNMPGX5G.js.map