@ixo/editor 5.40.0 → 6.0.0

package/dist/{chunk-KNMPGX5G.js → chunk-5TJK6JKV.js}

@@ -1,3 +1,11 @@
+// src/core/lib/warnOnce.ts
+var seen = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (seen.has(key)) return;
+  seen.add(key);
+  console.warn(message);
+}
+
 // src/core/lib/actionRegistry/registry.ts
 var actions = /* @__PURE__ */ new Map();
 var STEP_COMPLETED_EVENT_NAME = "step.completed";
@@ -47,6 +55,13 @@ function getAction(type) {
 function getAllActions() {
   return Array.from(actions.values());
 }
+function isRepeatableAction(type) {
+  if (!type) return false;
+  return getAction(type)?.cardinality === "many";
+}
+function getAliasEntries() {
+  return Array.from(aliases.entries());
+}
 function hasAction(type) {
   return actions.has(resolveActionType(type));
 }
@@ -62,8 +77,13 @@ function getEventsForBlock(action, inputs) {
   if (action.getDynamicEvents) {
     const parsed = normalizeInputs(inputs);
     try {
-      events = action.getDynamicEvents(parsed) || [];
-    } catch {
+      const dynamic = action.getDynamicEvents(parsed) || [];
+      events = action.dynamicResolutionMode === "replace" ? dynamic : mergeByKey(action.events || [], dynamic, (event) => event.name);
+    } catch (error) {
+      warnOnce(
+        `dynamic-events:${action.type}`,
+        `[flow-config] action ${action.type}: getDynamicEvents threw (${error instanceof Error ? error.message : String(error)}); no events resolved`
+      );
       events = [];
     }
   } else {
@@ -79,13 +99,23 @@ function getOutputSchemaForBlock(action, inputs) {
   if (action.getDynamicOutputSchema) {
     const parsed = normalizeInputs(inputs);
     try {
-      return action.getDynamicOutputSchema(parsed) || [];
-    } catch {
+      const dynamic = action.getDynamicOutputSchema(parsed) || [];
+      if (action.dynamicResolutionMode === "replace") return dynamic;
+      return mergeByKey(action.outputSchema || [], dynamic, (field) => field.path);
+    } catch (error) {
+      warnOnce(
+        `dynamic-output-schema:${action.type}`,
+        `[flow-config] action ${action.type}: getDynamicOutputSchema threw (${error instanceof Error ? error.message : String(error)}); using static schema`
+      );
       return action.outputSchema || [];
     }
   }
   return action.outputSchema || [];
 }
+function mergeByKey(baseline, dynamic, keyOf) {
+  const dynamicKeys = new Set(dynamic.map(keyOf));
+  return [...baseline.filter((item) => !dynamicKeys.has(keyOf(item))), ...dynamic];
+}
 function normalizeInputs(inputs) {
   if (!inputs) return {};
   if (typeof inputs === "object") return inputs;
@@ -94,12 +124,56 @@ function normalizeInputs(inputs) {
       const parsed = JSON.parse(inputs || "{}");
       return parsed && typeof parsed === "object" ? parsed : {};
     } catch {
+      warnOnce(`inputs-normalize:${inputs}`, `[flow-config] block inputs are not valid JSON; treated as empty`);
       return {};
     }
   }
   return {};
 }
 
+// src/core/lib/actionRegistry/manifest.ts
+function serializeProof(action) {
+  const proof = action.proof;
+  if (proof === "none" || proof === void 0) return { kind: "none" };
+  if ("validate" in proof) return { kind: "custom" };
+  return { kind: "fields", fields: [...proof.fields] };
+}
+function generateActionManifest() {
+  const aliasEntries = getAliasEntries();
+  const aliasesByType = /* @__PURE__ */ new Map();
+  for (const [alias, canonical] of aliasEntries) {
+    const list = aliasesByType.get(canonical) || [];
+    list.push(alias);
+    aliasesByType.set(canonical, list);
+  }
+  const actions2 = getAllActions().map((action) => {
+    const entry = {
+      type: action.type,
+      aliases: (aliasesByType.get(action.type) || []).sort(),
+      sideEffect: action.sideEffect,
+      defaultRequiresConfirmation: action.defaultRequiresConfirmation,
+      proof: serializeProof(action),
+      hasDynamicEvents: !!action.getDynamicEvents,
+      hasDynamicOutputSchema: !!action.getDynamicOutputSchema,
+      eligibleForEventTrigger: !!action.eligibleForEventTrigger
+    };
+    if (action.can) entry.can = action.can;
+    if (action.requiredCapability) entry.requiredCapability = action.requiredCapability;
+    if (action.inputSchema) entry.inputSchema = action.inputSchema;
+    if (action.outputSchema) entry.outputSchema = action.outputSchema;
+    if (action.events) {
+      entry.events = action.events.map((event) => ({
+        name: event.name,
+        displayName: event.displayName,
+        description: event.description,
+        payloadSchema: event.payloadSchema
+      }));
+    }
+    return entry;
+  }).sort((a, b) => a.type.localeCompare(b.type));
+  return { manifestVersion: "1", actions: actions2 };
+}
+
 // src/core/lib/actionRegistry/canMapping.ts
 var CAN_TO_TYPE = {
   "bid/submit": "qi/bid.submit",
@@ -167,7 +241,37 @@ function getAllCanMappings() {
 }
 
 // src/core/lib/actionRegistry/adapters.ts
+var SERVICE_GROUP_REQUIRED_HANDLERS = {
+  bid: ["submitBid", "approveBid", "rejectBid", "approveServiceAgentApplication", "approveEvaluatorApplication"],
+  claim: ["requestPin", "submitClaim", "evaluateClaim", "getCurrentUser"],
+  collection: [
+    "collection.get",
+    "collection.create",
+    "collection.updateState",
+    "collection.updateDates",
+    "collection.updateQuota",
+    "collection.updatePayments",
+    "collection.updateIntents"
+  ],
+  collectionUsers: ["collectionUsers.grant", "collectionUsers.revoke", "collectionUsers.list", "collectionUsers.classifyAddress", "collectionUsers.enumerateMembers"],
+  carbon: ["carbon.loadBatches", "carbon.harvest", "carbon.retire"]
+};
+function getHandlerAtPath(handlers, path) {
+  return path.split(".").reduce((acc, key) => acc == null ? void 0 : acc[key], handlers);
+}
+function warnPartialServiceGroups(handlers) {
+  if (!handlers) return;
+  for (const [group, keys] of Object.entries(SERVICE_GROUP_REQUIRED_HANDLERS)) {
+    const missing = keys.filter((key) => !getHandlerAtPath(handlers, key));
+    if (missing.length > 0 && missing.length < keys.length) {
+      console.warn(
+        `[buildServicesFromHandlers] services.${group} is DISABLED: handlers provide ${keys.length - missing.length}/${keys.length} required methods; missing: ${missing.join(", ")}`
+      );
+    }
+  }
+}
 function buildServicesFromHandlers(handlers) {
+  warnPartialServiceGroups(handlers);
   return {
     http: {
       request: async (params) => {
@@ -375,6 +479,7 @@ registerAction({
   type: "qi/pod.domain-indexer-lookup",
   can: "pod/domain-indexer-lookup",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -414,6 +519,7 @@ registerAction({
   type: "qi/pod.domain-single-selection",
   can: "pod/domain-single-selection",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -468,6 +574,7 @@ registerAction({
   type: "qi/pod.entity-single-selection",
   can: "pod/entity-single-selection",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -526,6 +633,7 @@ registerAction({
   type: "qi/pod.member-multi-select",
   can: "pod/member-multi-select",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -619,6 +727,7 @@ registerAction({
   type: "qi/pod.governance-config",
   can: "pod/governance-config",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -703,6 +812,7 @@ registerAction({
   type: "qi/pod.list-domain-flows",
   can: "pod/list-domain-flows",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -792,6 +902,7 @@ registerAction({
   type: "qi/governance.member-proposal",
   can: "governance/member-proposal",
   sideEffect: true,
+  proof: { fields: ["proposalId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   outputSchema: [
@@ -807,6 +918,9 @@ registerAction({
     if (!handlers) {
       throw new Error("Handlers not available");
     }
+    if (!handlers.getPreProposalContractAddress || !handlers.getGroupContractAddress || !handlers.getProposalContractAddress || !handlers.createProposal) {
+      throw new Error("Governance proposal handlers not available");
+    }
     const coreAddress = String(inputs.coreAddress || "").trim();
     if (!coreAddress) throw new Error("coreAddress is required");
     const operation = String(inputs.operation || "").trim();
@@ -874,6 +988,7 @@ registerAction({
   type: "qi/governance.settings-proposal",
   can: "governance/settings-proposal",
   sideEffect: true,
+  proof: { fields: ["proposalId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   outputSchema: [
@@ -888,6 +1003,9 @@ registerAction({
     if (!handlers) {
       throw new Error("Handlers not available");
     }
+    if (!handlers.getPreProposalContractAddress || !handlers.getGroupContractAddress || !handlers.getProposalContractAddress || !handlers.createProposal) {
+      throw new Error("Governance proposal handlers not available");
+    }
     const coreAddress = String(inputs.coreAddress || "").trim();
     if (!coreAddress) throw new Error("coreAddress is required");
     const votingPeriodHours = Number(inputs.votingPeriodHours);
@@ -950,6 +1068,7 @@ registerAction({
   type: "qi/governance.transaction.send-funds",
   can: "governance.transaction/send-funds",
   sideEffect: true,
+  proof: { fields: ["proposalId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   outputSchema: [
@@ -965,6 +1084,9 @@ registerAction({
     if (!handlers) {
       throw new Error("Handlers not available");
     }
+    if (!handlers.getPreProposalContractAddress || !handlers.getGroupContractAddress || !handlers.getProposalContractAddress || !handlers.createProposal) {
+      throw new Error("Governance proposal handlers not available");
+    }
     const coreAddress = String(inputs.coreAddress || "").trim();
     if (!coreAddress) throw new Error("coreAddress is required");
     const recipient = String(inputs.recipient || "").trim();
@@ -1008,6 +1130,7 @@ registerAction({
   type: "qi/http.request",
   can: "http/request",
   sideEffect: false,
+  proof: { fields: ["status"] },
   defaultRequiresConfirmation: false,
   // HTTP request can be triggered as a listener — a human assignee is DM'd
   // to invoke it when the upstream event fires. See §3.6 of the
@@ -1068,6 +1191,7 @@ registerAction({
   type: "qi/email.send",
   can: "email/send",
   sideEffect: true,
+  proof: { fields: ["messageId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "email/send",
   // Email send is autonomous-enough to be triggered by another block's event.
@@ -1133,6 +1257,7 @@ registerAction({
   type: "qi/human.checkbox.set",
   can: "human/checkbox",
   sideEffect: true,
+  proof: "none",
   defaultRequiresConfirmation: false,
   requiredCapability: "flow/execute",
   inputSchema: {
@@ -1174,6 +1299,7 @@ function registerFormSubmitAction(type, can) {
     type,
     can,
     sideEffect: true,
+    proof: "none",
     defaultRequiresConfirmation: false,
     requiredCapability: "flow/execute",
     // Additive: makes the form an event SOURCE so downstream blocks can
@@ -1223,6 +1349,7 @@ registerAction({
   type: "qi/notification.push",
   can: "notification/push",
   sideEffect: true,
+  proof: { fields: ["messageId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "notify/send",
   inputSchema: {
@@ -1279,6 +1406,7 @@ registerAction({
   type: "qi/bid.submit",
   can: "bid/submit",
   sideEffect: true,
+  proof: { fields: ["bidId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   inputSchema: {
@@ -1362,6 +1490,7 @@ registerAction({
   type: "qi/bid.evaluate",
   can: "bid/evaluate",
   sideEffect: true,
+  proof: { fields: ["bidId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   outputSchema: [
@@ -1508,7 +1637,7 @@ function extractSurveyAnswerSchema(survey) {
   if (!survey || typeof survey !== "object") return [];
   const json = survey;
   const collected = [];
-  const seen = /* @__PURE__ */ new Set();
+  const seen2 = /* @__PURE__ */ new Set();
   const walk = (elements) => {
     if (!Array.isArray(elements)) return;
     for (const el of elements) {
@@ -1519,8 +1648,8 @@ function extractSurveyAnswerSchema(survey) {
       }
       const name = typeof el.name === "string" ? el.name.trim() : "";
       if (!name) continue;
-      if (seen.has(name)) continue;
-      seen.add(name);
+      if (seen2.has(name)) continue;
+      seen2.add(name);
       const rawType = typeof el.type === "string" ? el.type : "";
       const mapped = TYPE_MAP[rawType] ?? "string";
       let itemSchema;
@@ -1590,6 +1719,13 @@ registerAction({
   type: "qi/claim.submit",
   can: "claim/submit",
   sideEffect: true,
+  // Dynamic resolvers predate merge-by-default and intentionally control
+  // the full vocabulary (e.g. returning [] to hide the static baseline).
+  dynamicResolutionMode: "replace",
+  proof: { fields: ["claimId"] },
+  // Repeatable: a collection accepts many claims over the flow's life (e.g. a
+  // monthly submission). Never latches to a terminal Done. See cardinality.
+  cardinality: "many",
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: true,
@@ -1960,7 +2096,7 @@ function serializeXeroPaymentCreateInputs(inputs) {
   return JSON.stringify(inputs);
 }
 
-// src/mantine/utils/referenceResolver.ts
+// src/core/lib/flowEngine/referenceResolver.ts
 var REFERENCE_REGEX = /\{\{([a-zA-Z0-9_-]+)\.([a-zA-Z0-9_.:]+)\}\}/g;
 function parseReferences(input) {
   const references = [];
@@ -1982,68 +2118,78 @@ function getNestedValue(obj, path) {
     return current?.[key];
   }, obj);
 }
-function resolveSingleReference(blockId, propPath, editorDocument, yRuntime, scope) {
+function resolveSingleReferenceDetailed(blockId, propPath, editorDocument, yRuntime, scope) {
   if (scope && Object.prototype.hasOwnProperty.call(scope, blockId)) {
     const root = scope[blockId];
-    if (root == null) return void 0;
-    return getNestedValue(root, propPath);
+    if (root == null) return { value: void 0, reason: "missing-value" };
+    const value2 = getNestedValue(root, propPath);
+    return { value: value2, reason: value2 === void 0 ? "missing-value" : void 0 };
   }
   if (!editorDocument || !Array.isArray(editorDocument)) {
-    return void 0;
+    return { value: void 0, reason: "unknown-block" };
   }
   const block = editorDocument.find((b) => b.id === blockId);
   if (!block) {
-    return void 0;
+    return { value: void 0, reason: "unknown-block" };
   }
   if (propPath.startsWith("output.")) {
-    if (!yRuntime) return void 0;
+    if (!yRuntime) return { value: void 0, reason: "missing-value" };
     const runtimeState = yRuntime.get(blockId);
-    if (!runtimeState?.output) return void 0;
+    if (!runtimeState?.output) return { value: void 0, reason: "missing-value" };
     const innerPath = propPath.substring("output.".length);
     const direct = getNestedValue(runtimeState.output, innerPath);
-    if (direct !== void 0) return direct;
+    if (direct !== void 0) return { value: direct };
     if (runtimeState.output.data !== void 0) {
-      return getNestedValue(runtimeState.output.data, innerPath);
+      const value2 = getNestedValue(runtimeState.output.data, innerPath);
+      return { value: value2, reason: value2 === void 0 ? "missing-value" : void 0 };
     }
     if (runtimeState.output.http?.data !== void 0) {
-      return getNestedValue(runtimeState.output.http.data, innerPath);
+      const value2 = getNestedValue(runtimeState.output.http.data, innerPath);
+      return { value: value2, reason: value2 === void 0 ? "missing-value" : void 0 };
     }
-    return void 0;
+    return { value: void 0, reason: "missing-value" };
   }
   if (propPath.startsWith("response.")) {
     const responseData = block.props.response;
     if (!responseData) {
-      return void 0;
+      return { value: void 0, reason: "missing-value" };
     }
     try {
       const parsedResponse = typeof responseData === "string" ? JSON.parse(responseData) : responseData;
       const innerPath = propPath.substring("response.".length);
       const value2 = getNestedValue(parsedResponse, innerPath);
-      return value2;
-    } catch (error) {
-      return void 0;
+      return { value: value2, reason: value2 === void 0 ? "missing-value" : void 0 };
+    } catch {
+      warnOnce(`ref-response-parse:${blockId}`, `[flow-config] block ${blockId}: props.response is not valid JSON; {{${blockId}.${propPath}}} cannot resolve`);
+      return { value: void 0, reason: "response-parse-error" };
     }
   }
   const value = getNestedValue(block.props, propPath);
-  return value;
+  return { value, reason: value === void 0 ? "missing-value" : void 0 };
 }
-function resolveReferences(input, editorDocument, options = {}) {
-  const { fallback = "", stringifyObjects = true, yRuntime, scope } = options;
+function resolveSingleReference(blockId, propPath, editorDocument, yRuntime, scope) {
+  return resolveSingleReferenceDetailed(blockId, propPath, editorDocument, yRuntime, scope).value;
+}
+function resolveReferencesDetailed(input, editorDocument, options = {}) {
+  const { fallback = "", stringifyObjects = true, yRuntime, scope, warnContext } = options;
+  const unresolved = [];
   if (input == null) {
-    return "";
+    return { value: "", unresolved };
   }
   const inputStr = String(input);
   const references = parseReferences(inputStr);
   if (references.length === 0) {
-    return inputStr;
+    return { value: inputStr, unresolved };
   }
   let result = inputStr;
   for (let i = references.length - 1; i >= 0; i--) {
     const ref = references[i];
-    const resolvedValue = resolveSingleReference(ref.blockId, ref.propPath, editorDocument, yRuntime, scope);
+    const resolution = resolveSingleReferenceDetailed(ref.blockId, ref.propPath, editorDocument, yRuntime, scope);
+    const resolvedValue = resolution.value;
     let replacementStr;
     if (resolvedValue === void 0 || resolvedValue === null) {
       replacementStr = fallback;
+      unresolved.push({ ref: ref.fullMatch, blockId: ref.blockId, propPath: ref.propPath, reason: resolution.reason || "missing-value" });
     } else if (typeof resolvedValue === "object") {
       replacementStr = stringifyObjects ? JSON.stringify(resolvedValue) : fallback;
     } else {
@@ -2051,7 +2197,15 @@ function resolveReferences(input, editorDocument, options = {}) {
     }
     result = result.substring(0, ref.startIndex) + replacementStr + result.substring(ref.endIndex);
   }
-  return result;
+  if (warnContext && unresolved.length > 0) {
+    for (const entry of unresolved) {
+      warnOnce(`ref-unresolved:${warnContext}:${entry.ref}`, `[flow-config] ${warnContext}: reference ${entry.ref} did not resolve (${entry.reason}); using fallback '${fallback}'`);
+    }
+  }
+  return { value: result, unresolved };
+}
+function resolveReferences(input, editorDocument, options = {}) {
+  return resolveReferencesDetailed(input, editorDocument, options).value;
 }
 function hasReferences(input) {
   if (input == null) return false;
@@ -2254,6 +2408,13 @@ registerAction({
   type: "qi/claim.evaluate",
   can: "claim/evaluate",
   sideEffect: true,
+  // Dynamic resolvers predate merge-by-default and intentionally control
+  // the full vocabulary (e.g. returning [] to hide the static baseline).
+  dynamicResolutionMode: "replace",
+  proof: { fields: ["claimId"] },
+  // Repeatable: an evaluator processes many claims over the flow's life. Never
+  // latches to a terminal Done. See cardinality.
+  cardinality: "many",
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   // Static fallback — used until a collection is picked and the survey
@@ -2547,6 +2708,7 @@ registerAction({
   type: "qi/proposal.create",
   can: "proposal/create",
   sideEffect: true,
+  proof: { fields: ["proposalId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   inputSchema: {
@@ -2571,6 +2733,9 @@ registerAction({
     if (!handlers) {
       throw new Error("Handlers not available");
     }
+    if (!handlers.getPreProposalContractAddress || !handlers.getGroupContractAddress || !handlers.getProposalContractAddress || !handlers.createProposal) {
+      throw new Error("Governance proposal handlers not available");
+    }
     const coreAddress = String(inputs.coreAddress || "").trim();
     const title = String(inputs.title || "").trim();
     const description = String(inputs.description || "").trim();
@@ -2624,6 +2789,7 @@ registerAction({
   type: "qi/proposal.vote",
   can: "proposal/vote",
   sideEffect: true,
+  proof: { fields: ["votedAt"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   inputSchema: {
@@ -2647,6 +2813,9 @@ registerAction({
     if (!handlers) {
       throw new Error("Handlers not available");
     }
+    if (!handlers.vote) {
+      throw new Error("vote handler not available");
+    }
     const proposalId = Number(inputs.proposalId);
     const vote = String(inputs.vote || "").trim();
     const rationale = String(inputs.rationale || "").trim();
@@ -2680,6 +2849,7 @@ registerAction({
   type: "qi/protocol.select",
   can: "protocol/select",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -3959,6 +4129,7 @@ registerAction({
   type: "qi/domain.sign",
   can: "domain/sign",
   sideEffect: true,
+  proof: { fields: ["entityDid"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: true,
@@ -4109,6 +4280,7 @@ registerAction({
     if (typeof handlers.createDomain !== "function") throw new Error("createDomain handler not implemented");
     if (typeof handlers.createAddLinkedResourceMessage !== "function") throw new Error("createAddLinkedResourceMessage handler not implemented");
     if (typeof handlers.executeTransaction !== "function") throw new Error("executeTransaction handler not implemented");
+    const { requestPin, signCredential, publicFileUpload } = handlers;
     const saveCheckpoint = (updates) => {
       checkpoint = {
         ...checkpoint,
@@ -4173,14 +4345,14 @@ registerAction({
         });
         let signedCredential;
         for (let attempt = 1; attempt <= MAX_PIN_ATTEMPTS; attempt++) {
-          const pin = await handlers.requestPin({
+          const pin = await requestPin({
             title: "Sign Domain Card",
             description: attempt === 1 ? "Enter your PIN to sign the Domain Card credential" : "Incorrect PIN. Re-enter your PIN to sign the Domain Card credential.",
             submitText: "Sign"
           });
           if (!pin) throw new Error("PIN entry cancelled");
           try {
-            ({ signedCredential } = await handlers.signCredential({
+            ({ signedCredential } = await signCredential({
               issuerDid,
               issuerType: "user",
               credential: unsignedCredential,
@@ -4199,7 +4371,7 @@ registerAction({
         const credentialFile = new File([credentialBlob], "domainCard.json", {
           type: "application/json"
         });
-        const uploadResult = await handlers.publicFileUpload(credentialFile);
+        const uploadResult = await publicFileUpload(credentialFile);
         return {
           ...buildDomainCardLinkedResource({
             entityDid,
@@ -4373,6 +4545,7 @@ registerAction({
   type: "qi/domain.card-preview",
   can: "domain/card-preview",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -4452,6 +4625,7 @@ registerAction({
   type: "oracle",
   can: "oracle/query",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -4479,6 +4653,7 @@ registerAction({
   type: "qi/credential.store",
   can: "credential/store",
   sideEffect: true,
+  proof: { fields: ["storedAt"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/execute",
   inputSchema: {
@@ -4540,6 +4715,7 @@ registerAction({
   type: "qi/payment.execute",
   can: "payment/execute",
   sideEffect: true,
+  proof: { fields: ["paymentBlockId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   inputSchema: {
@@ -4624,6 +4800,7 @@ registerAction({
   type: "qi/matrix.dm",
   can: "matrix/dm",
   sideEffect: true,
+  proof: { fields: ["roomId"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -4661,6 +4838,7 @@ registerAction({
   type: "qi/wallet.generate",
   can: "wallet/generate",
   sideEffect: false,
+  proof: { fields: ["address"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -4687,6 +4865,7 @@ registerAction({
   type: "qi/wallet.fund",
   can: "wallet/fund",
   sideEffect: true,
+  proof: { fields: ["transactionHash"] },
   defaultRequiresConfirmation: true,
   inputSchema: {
     type: "object",
@@ -4715,6 +4894,7 @@ registerAction({
   type: "qi/wallet.generateAndFund",
   can: "wallet/generateAndFund",
   sideEffect: true,
+  proof: { fields: ["transactionHash"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -4765,6 +4945,7 @@ registerAction({
   type: "qi/iid.create",
   can: "iid/create",
   sideEffect: true,
+  proof: { fields: ["transactionHash", "alreadyExisted"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -4803,6 +4984,7 @@ registerAction({
   type: "qi/matrix.register",
   can: "matrix/register",
   sideEffect: true,
+  proof: { fields: ["matrixUserId"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -4852,6 +5034,8 @@ registerAction({
   type: "qi/identity.create",
   can: "identity/create",
   sideEffect: true,
+  // Dual-phase proof: on-chain IID (transactionHash or alreadyExisted) AND matrix registration.
+  proof: { validate: (output) => !!(output.transactionHash || output.alreadyExisted) && !!output.matrixUserId },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -4952,6 +5136,7 @@ registerAction({
   type: "qi/entity.createOracle",
   can: "entity/createOracle",
   sideEffect: true,
+  proof: { fields: ["entityDid"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5054,6 +5239,7 @@ registerAction({
   type: "qi/sandbox.provision",
   can: "sandbox/provision",
   sideEffect: true,
+  proof: { fields: ["status", "sandboxUrl"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5086,6 +5272,7 @@ registerAction({
   type: "qi/oracle.contract",
   can: "oracle/contract",
   sideEffect: true,
+  proof: { fields: ["userOracleRoomId"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5116,6 +5303,7 @@ registerAction({
   type: "qi/oracle.storeSecrets",
   can: "oracle/storeSecrets",
   sideEffect: true,
+  proof: { fields: ["storedSecrets"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5206,6 +5394,7 @@ registerAction({
   type: "qi/oracle.storeConfig",
   can: "oracle/storeConfig",
   sideEffect: true,
+  proof: { fields: ["configStored"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5276,6 +5465,7 @@ registerAction({
   type: "qi/oracle.storeSecretsAndConfig",
   can: "oracle/storeSecretsAndConfig",
   sideEffect: true,
+  proof: { fields: ["storedSecrets"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5427,6 +5617,7 @@ registerAction({
   type: "qi/oracle.configureOracle",
   can: "oracle/configureOracle",
   sideEffect: true,
+  proof: { fields: ["configStored"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5607,6 +5798,7 @@ registerAction({
   type: "qi/oracle.deploySetup",
   can: "oracle/deploySetup",
   sideEffect: true,
+  proof: { fields: ["setupComplete"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5641,6 +5833,7 @@ registerAction({
   type: "qi/oracle.deployStart",
   can: "oracle/deployStart",
   sideEffect: true,
+  proof: { fields: ["processId", "status"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5674,6 +5867,7 @@ registerAction({
   type: "qi/oracle.deploy",
   can: "oracle/deploy",
   sideEffect: true,
+  proof: { fields: ["processId", "status"] },
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -5809,6 +6003,10 @@ registerAction({
   type: COLLECTION_LIFECYCLE_ACTION_TYPE,
   can: "collection/lifecycle",
   sideEffect: true,
+  // Dynamic resolvers predate merge-by-default and intentionally control
+  // the full vocabulary (e.g. returning [] to hide the static baseline).
+  dynamicResolutionMode: "replace",
+  proof: { fields: ["collectionId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   outputSchema: COLLECTION_LIFECYCLE_OUTPUT_SCHEMA,
@@ -6005,6 +6203,13 @@ registerAction({
   type: COLLECTION_USERS_ACTION_TYPE,
   can: "collection/users",
   sideEffect: true,
+  // Dynamic resolvers predate merge-by-default and intentionally control
+  // the full vocabulary (e.g. returning [] to hide the static baseline).
+  dynamicResolutionMode: "replace",
+  proof: { fields: ["transactionHash", "collectionId"] },
+  // Repeatable: members are granted/revoked many times over the flow's life.
+  // Never latches to a terminal Done. See cardinality.
+  cardinality: "many",
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   outputSchema: COLLECTION_USERS_OUTPUT_SCHEMA,
@@ -6168,6 +6373,7 @@ registerAction({
   type: "qi/carbon.loadBatches",
   can: "carbon/load",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   inputSchema: {
     type: "object",
@@ -6194,6 +6400,7 @@ registerAction({
   type: "qi/carbon.harvest",
   can: "carbon/harvest",
   sideEffect: true,
+  proof: { fields: ["transactionHash"] },
   defaultRequiresConfirmation: true,
   inputSchema: {
     type: "object",
@@ -6233,6 +6440,7 @@ registerAction({
   type: "qi/carbon.retire",
   can: "carbon/retire",
   sideEffect: true,
+  proof: { fields: ["transactionHash"] },
   defaultRequiresConfirmation: true,
   inputSchema: {
     type: "object",
@@ -6294,6 +6502,7 @@ registerAction({
   type: "qi/entity.transfer",
   can: "entity/transfer",
   sideEffect: true,
+  proof: { fields: ["transactionHash"] },
   defaultRequiresConfirmation: true,
   outputSchema: ENTITY_TRANSFER_OUTPUT,
   inputSchema: {
@@ -6439,6 +6648,8 @@ registerAction({
   type: "qi/gmail.email.send",
   can: "gmail.email/send",
   sideEffect: true,
+  // Proof of execution: Gmail returns the sent message id. Matches qi/email.send.
+  proof: { fields: ["messageId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   // Can be wired to another block's event (e.g. form submitted → send email).
@@ -6511,6 +6722,11 @@ registerAction({
   type: "qi/outlook.email.send",
   can: "outlook.email/send",
   sideEffect: true,
+  // Outlook's send tool often returns no message id (see run() below), so there
+  // is no reliable output field to prove execution — a successful tool call
+  // (run() throws on failure) is the signal. Declared 'none' rather than
+  // requiring messageId, which would push every id-less send to needs_verification.
+  proof: "none",
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   // Can be wired to another block's event (e.g. form submitted → send email).
@@ -6583,6 +6799,8 @@ registerAction({
   type: "qi/slack.message.send",
   can: "slack.message/send",
   sideEffect: true,
+  // Proof of execution: Slack returns the posted message timestamp (ts).
+  proof: { fields: ["messageTs"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   // Can be wired to another block's event (e.g. form submitted → post message).
@@ -6658,6 +6876,8 @@ registerAction({
   type: "qi/googlecalendar.event.create",
   can: "googlecalendar.event/create",
   sideEffect: true,
+  // Proof of execution: the created event's id. Matches qi/calendar.event.create.
+  proof: { fields: ["eventId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: true,
@@ -6754,6 +6974,7 @@ registerAction({
   type: "qi/calendar.event.create",
   can: "calendar.event/create",
   sideEffect: true,
+  proof: { fields: ["eventId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: true,
@@ -6861,6 +7082,7 @@ registerAction({
   type: "qi/calendar.event.update",
   can: "calendar.event/update",
   sideEffect: true,
+  proof: { fields: ["eventId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: true,
@@ -6970,6 +7192,7 @@ registerAction({
   type: "qi/calendar.event.list",
   can: "calendar.event/list",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: false,
@@ -7051,6 +7274,7 @@ registerAction({
   type: "qi/xero.contact.create",
   can: "xero.contact/create",
   sideEffect: true,
+  proof: { fields: ["contactId"] },
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: true,
@@ -7149,6 +7373,10 @@ registerAction({
   type: "qi/xero.invoice.create",
   can: "xero.invoice/create",
   sideEffect: true,
+  proof: { fields: ["invoiceId"] },
+  // Repeatable: many invoices are created over the flow's life. Never latches
+  // to a terminal Done. See cardinality.
+  cardinality: "many",
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: true,
@@ -7254,6 +7482,7 @@ registerAction({
   type: "qi/xero.invoice.list",
   can: "xero.invoice/list",
   sideEffect: false,
+  proof: "none",
   defaultRequiresConfirmation: false,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: false,
@@ -7334,6 +7563,10 @@ registerAction({
   type: "qi/xero.payment.create",
   can: "xero.payment/create",
   sideEffect: true,
+  proof: { fields: ["paymentId"] },
+  // Repeatable: many payments are created over the flow's life. Never latches
+  // to a terminal Done. See cardinality.
+  cardinality: "many",
   defaultRequiresConfirmation: true,
   requiredCapability: "flow/block/execute",
   eligibleForEventTrigger: true,
@@ -9065,7 +9298,7 @@ function snapshotInputRefs(inputs, getNodeOutput2) {
     if (!parsed) return;
     const output = getNodeOutput2(parsed.nodeId);
     if (!output) return;
-    snapshots[ref.$ref] = getNestedValue2(output, parsed.fieldPath);
+    snapshots[ref.$ref] = getNestedValue(output, parsed.fieldPath);
   });
   return snapshots;
 }
@@ -9090,15 +9323,6 @@ function parseOutputRef(ref) {
     fieldPath: ref.slice(outputIndex + ".output.".length)
   };
 }
-function getNestedValue2(obj, path) {
-  const parts = path.split(".");
-  let current = obj;
-  for (const part of parts) {
-    if (current == null || typeof current !== "object") return void 0;
-    current = current[part];
-  }
-  return current;
-}
 function fnv1a32(input) {
   let hash = 2166136261;
   for (let i = 0; i < input.length; i++) {
@@ -9151,6 +9375,32 @@ function removePendingInvocation(yDoc, listenerBlockId, pendingInvocationId) {
   inner.delete(pendingInvocationId);
   return true;
 }
+function readConsumedPendingInvocationIds(yDoc, listenerBlockId) {
+  const consumed = /* @__PURE__ */ new Set();
+  for (const record of readRunRecords(yDoc, listenerBlockId)) {
+    if (record.fromPendingInvocationId) consumed.add(record.fromPendingInvocationId);
+  }
+  return consumed;
+}
+function sweepExpiredPendingInvocations(yDoc, now = Date.now()) {
+  const outer = getPendingInvocationsMap(yDoc);
+  let removed = 0;
+  outer.forEach((inner, listenerBlockId) => {
+    const innerMap = inner;
+    if (!innerMap || typeof innerMap.forEach !== "function") return;
+    const expiredIds = [];
+    innerMap.forEach((value, id) => {
+      const expiresAt = value?.expiresAt;
+      if (expiresAt && Date.parse(expiresAt) < now) expiredIds.push(id);
+    });
+    for (const id of expiredIds) {
+      innerMap.delete(id);
+      removed += 1;
+    }
+    void listenerBlockId;
+  });
+  return removed;
+}
 var BARRIER_STATE_MAP_KEY = "barrierState";
 function getBarrierStateMap(yDoc) {
   return yDoc.getMap(BARRIER_STATE_MAP_KEY);
@@ -9281,6 +9531,63 @@ function replayFailedListenerRun(yDoc, failedRecord, listenerBlockId, originalPa
   return queuePendingInvocation(yDoc, listenerBlockId, replay);
 }
 
+// src/core/lib/flowEngine/versionManifest.ts
+var VERSION_MANIFEST = {
+  "0.3": {
+    version: "0.3",
+    label: "Legacy",
+    ucanRequired: false,
+    delegationRootRequired: false,
+    whitelistOnlyAllowed: true,
+    unrestrictedAllowed: true,
+    executionPath: "legacy",
+    authorizationFn: "v1",
+    allowedAuthModes: ["anyone", "actors", "capability"],
+    ui: {
+      showDelegationPanel: false,
+      showWhitelistConfig: true,
+      showAnyoneConfig: true,
+      showMigrationBanner: true,
+      requirePinForExecution: false
+    },
+    description: "Legacy version. UCAN optional, whitelist-only authorization accepted."
+  },
+  "1.0.0": {
+    version: "1.0.0",
+    label: "UCAN Required",
+    ucanRequired: true,
+    delegationRootRequired: true,
+    whitelistOnlyAllowed: false,
+    unrestrictedAllowed: false,
+    executionPath: "invocation",
+    authorizationFn: "v2",
+    allowedAuthModes: ["capability"],
+    ui: {
+      showDelegationPanel: true,
+      showWhitelistConfig: false,
+      showAnyoneConfig: false,
+      showMigrationBanner: false,
+      requirePinForExecution: true
+    },
+    description: "UCAN-enforced. Every block execution requires a valid delegation chain."
+  }
+};
+var LATEST_VERSION = "1.0.0";
+var MIGRATION_PATH = ["0.3", "1.0.0"];
+function getVersionPolicy(version) {
+  const policy = VERSION_MANIFEST[version];
+  if (!policy) {
+    return VERSION_MANIFEST[LATEST_VERSION];
+  }
+  return policy;
+}
+function isVersionAtLeast(current, minimum) {
+  const currentIdx = MIGRATION_PATH.indexOf(current);
+  const minimumIdx = MIGRATION_PATH.indexOf(minimum);
+  const effectiveCurrent = currentIdx === -1 ? MIGRATION_PATH.length : currentIdx;
+  return effectiveCurrent >= minimumIdx;
+}
+
 // src/core/lib/flowEngine/reconcile.ts
 var _reconcileRunning = false;
 function reconcilePendingInvocations(editor) {
@@ -9317,6 +9624,20 @@ function _reconcilePendingInvocationsInner(editor) {
     }
   }
   if (listenersBySource.size === 0 && barrierListenersBySource.size === 0) return;
+  const now = Date.now();
+  sweepExpiredPendingInvocations(yDoc, now);
+  const consumedByListener = /* @__PURE__ */ new Map();
+  const isConsumed = (listenerBlockId, pendingId) => {
+    let consumed = consumedByListener.get(listenerBlockId);
+    if (!consumed) {
+      consumed = readConsumedPendingInvocationIds(yDoc, listenerBlockId);
+      consumedByListener.set(listenerBlockId, consumed);
+    }
+    return consumed.has(pendingId);
+  };
+  const schemaVersionRaw = yDoc.getMap("root").get("schema_version");
+  const ucanRequired = typeof schemaVersionRaw === "string" ? !!getVersionPolicy(schemaVersionRaw)?.ucanRequired : false;
+  const invocationsMap = yDoc.getMap("invocations");
   const runtimeMap = editor._yRuntime;
   const getNodeOutput2 = (nodeId) => {
     if (!runtimeMap) return void 0;
@@ -9344,12 +9665,18 @@ function _reconcilePendingInvocationsInner(editor) {
     if (!hasAnyListener) continue;
     const records = readRunRecords(yDoc, sourceBlockId);
     for (const record of records) {
-      processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap);
-      processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap);
+      if (!isTrustedRunRecord(record, ucanRequired, invocationsMap)) continue;
+      processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap, isConsumed, now);
+      processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap, isConsumed, now);
     }
   }
 }
-function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap) {
+function isTrustedRunRecord(record, ucanRequired, invocationsMap) {
+  if (!ucanRequired) return true;
+  if (!record.invocationCid) return false;
+  return invocationsMap.get(record.invocationCid) !== void 0;
+}
+function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNodeOutput2, runtimeMap, isConsumed, now) {
   if (!Array.isArray(record.events)) return;
   record.events.forEach((event, eventIndex) => {
     if (!event?.name) return;
@@ -9366,10 +9693,12 @@ function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNod
         eventName: event.name,
         eventIndex
       });
+      if (isConsumed(listenerBlockId, id)) continue;
       const assigneeDid = resolveAssignee(listenerBlock) || "unassigned";
       const inputs = parseInputs(listenerBlock);
       const refSnapshots = snapshotInputRefs(inputs, getNodeOutput2);
       const expiresAt = computeExpiry(listenerBlock, record.completedAt);
+      if (expiresAt && Date.parse(expiresAt) < now) continue;
       const invocation = {
         id,
         triggeringBlockId: sourceBlockId,
@@ -9393,7 +9722,7 @@ function processRunRecord(yDoc, sourceBlockId, record, listenersBySource, getNod
     }
   });
 }
-function processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap) {
+function processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBySource, getNodeOutput2, runtimeMap, isConsumed, now) {
   if (!Array.isArray(record.events)) return;
   for (const event of record.events) {
     if (!event?.name) continue;
@@ -9428,10 +9757,12 @@ function processBarrierRunRecord(yDoc, sourceBlockId, record, barrierListenersBy
       if (!allFired) continue;
       const assigneeDid = resolveAssignee(listenerBlock) || "unassigned";
       const id = computeBarrierInvocationId(currentState, listenerBlockId);
+      if (isConsumed(listenerBlockId, id)) continue;
       const mergedPayload = mergeBarrierPayloads(currentState);
       const inputs = parseInputs(listenerBlock);
       const refSnapshots = snapshotInputRefs(inputs, getNodeOutput2);
       const expiresAt = computeExpiry(listenerBlock, record.completedAt);
+      if (expiresAt && Date.parse(expiresAt) < now) continue;
       const invocation = {
         id,
         triggeringBlockId: sourceBlockId,
@@ -9465,6 +9796,7 @@ function parseTrigger(block) {
       return parsed;
     }
   } catch {
+    warnOnce(`trigger-parse:${block?.id}`, `[flow-config] block ${block?.id}: props.trigger is not valid JSON; trigger ignored`);
   }
   return null;
 }
@@ -9475,6 +9807,7 @@ function parseInputs(block) {
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object") return parsed;
   } catch {
+    warnOnce(`inputs-parse:${block?.id}`, `[flow-config] block ${block?.id}: props.inputs is not valid JSON; treated as empty`);
   }
   return {};
 }
@@ -9486,6 +9819,7 @@ function resolveAssignee(block) {
     const did = parsed?.assignedActor?.did;
     return typeof did === "string" && did.length > 0 ? did : void 0;
   } catch {
+    warnOnce(`assignment-parse:${block?.id}`, `[flow-config] block ${block?.id}: props.assignment is not valid JSON; assignee unresolved`);
     return void 0;
   }
 }
@@ -9649,7 +9983,7 @@ function resolveRef(ref, getNodeOutput2, triggerContext) {
       throw new Error(`Trigger ref "${ref}" used outside of a listener invocation context. trigger.payload.* refs are only valid on block.event-triggered blocks.`);
     }
     const fieldPath2 = ref.slice("trigger.payload.".length);
-    return getNestedValue3(triggerContext.payload, fieldPath2);
+    return getNestedValue(triggerContext.payload, fieldPath2);
   }
   if (triggerContext && Object.prototype.hasOwnProperty.call(triggerContext.refSnapshots, ref)) {
     return triggerContext.refSnapshots[ref];
@@ -9664,69 +9998,7 @@ function resolveRef(ref, getNodeOutput2, triggerContext) {
   if (!output) {
     return void 0;
   }
-  return getNestedValue3(output, fieldPath);
-}
-function getNestedValue3(obj, path) {
-  const parts = path.split(".");
-  let current = obj;
-  for (const part of parts) {
-    if (current == null || typeof current !== "object") {
-      return void 0;
-    }
-    current = current[part];
-  }
-  return current;
-}
-
-// src/core/lib/flowEngine/versionManifest.ts
-var VERSION_MANIFEST = {
-  "0.3": {
-    version: "0.3",
-    label: "Legacy",
-    ucanRequired: false,
-    delegationRootRequired: false,
-    whitelistOnlyAllowed: true,
-    unrestrictedAllowed: true,
-    executionPath: "legacy",
-    authorizationFn: "v1",
-    allowedAuthModes: ["anyone", "actors", "capability"],
-    ui: {
-      showDelegationPanel: false,
-      showWhitelistConfig: true,
-      showAnyoneConfig: true,
-      showMigrationBanner: true,
-      requirePinForExecution: false
-    },
-    description: "Legacy version. UCAN optional, whitelist-only authorization accepted."
-  },
-  "1.0.0": {
-    version: "1.0.0",
-    label: "UCAN Required",
-    /** TEMP Disablement - needs to be true TODO */
-    ucanRequired: false,
-    delegationRootRequired: true,
-    whitelistOnlyAllowed: false,
-    unrestrictedAllowed: false,
-    executionPath: "invocation",
-    authorizationFn: "v2",
-    allowedAuthModes: ["capability"],
-    ui: {
-      showDelegationPanel: true,
-      showWhitelistConfig: false,
-      showAnyoneConfig: false,
-      showMigrationBanner: false,
-      requirePinForExecution: true
-    },
-    description: "UCAN-enforced. Every block execution requires a valid delegation chain."
-  }
-};
-var LATEST_VERSION = "1.0.0";
-function getVersionPolicy(version) {
-  const policy = VERSION_MANIFEST[version];
-  if (!policy) {
-    return VERSION_MANIFEST[LATEST_VERSION];
-  }
-  return policy;
+  return getNestedValue(output, fieldPath);
 }
 
 // src/core/lib/flowEngine/authorization.ts
@@ -9888,6 +10160,96 @@ var executeNode = async ({ node, actorDid, actorType, entityRoomId, context, act
   }
 };
 
+// src/core/lib/flowEngine/proof.ts
+var PROOF_MISSING_CODE = "PROOF_MISSING";
+function getOutputValue(output, path) {
+  return path.split(".").reduce((acc, key) => {
+    if (acc && typeof acc === "object") return acc[key];
+    return void 0;
+  }, output);
+}
+function isProofValue(value) {
+  if (Array.isArray(value)) return value.length > 0;
+  if (typeof value === "number") return !Number.isNaN(value);
+  return !!value;
+}
+function validateActionProof(action, output) {
+  const proof = action.proof;
+  if (proof === "none") return { valid: true };
+  if (proof === void 0) {
+    if (action.sideEffect) {
+      return {
+        valid: false,
+        reason: `Action '${action.type}' has a side effect but declares no proof of execution. Declare proof (or 'none') on its ActionDefinition.`
+      };
+    }
+    return { valid: true };
+  }
+  if ("validate" in proof) {
+    let valid = false;
+    try {
+      valid = proof.validate(output);
+    } catch {
+      valid = false;
+    }
+    return valid ? { valid: true } : { valid: false, reason: `Action '${action.type}' returned success but its proof validator rejected the output.` };
+  }
+  const satisfied = proof.fields.some((field) => isProofValue(getOutputValue(output, field)));
+  if (satisfied) return { valid: true };
+  return {
+    valid: false,
+    reason: `Action '${action.type}' returned success without proof. Expected at least one of [${proof.fields.join(", ")}] in the output. Check the handler logs.`
+  };
+}
+
+// src/core/lib/flowEngine/verifiedCompletion.ts
+function verifyCompletion(params) {
+  const { runtime, blockId, actionType, getInvocation, schemaVersion } = params;
+  if (!runtime || runtime.state !== "completed") {
+    return { status: "not_completed" };
+  }
+  if (runtime.manuallyVerified === true) {
+    return { status: "verified" };
+  }
+  if (actionType && isRepeatableAction(actionType)) {
+    return { status: "verified" };
+  }
+  if (actionType) {
+    const action = getAction(actionType);
+    if (action) {
+      const proofCheck = validateActionProof(action, runtime.output || {});
+      if (!proofCheck.valid) {
+        return { status: "unverified", reason: proofCheck.reason || "Completed without proof of execution." };
+      }
+    }
+  }
+  const policy = schemaVersion ? getVersionPolicy(schemaVersion) : null;
+  if (!policy?.ucanRequired) {
+    return { status: "verified" };
+  }
+  const invocationCid = runtime.lastInvocationCid;
+  if (!invocationCid) {
+    return { status: "unverified", reason: "Completed without an invocation record on a UCAN-enforced flow." };
+  }
+  if (!getInvocation) {
+    return { status: "unverified", reason: "No invocation store available to verify the completion." };
+  }
+  const invocation = getInvocation(invocationCid);
+  if (!invocation) {
+    return { status: "unverified", reason: `Invocation ${invocationCid} not found in the invocation store.` };
+  }
+  if (invocation.result !== "success") {
+    return { status: "unverified", reason: "Completion references a failed invocation." };
+  }
+  if (invocation.blockId && invocation.blockId !== blockId) {
+    return { status: "unverified", reason: "Completion references an invocation for a different block." };
+  }
+  return { status: "verified" };
+}
+function isVerifiedCompletion(params) {
+  return verifyCompletion(params).status === "verified";
+}
+
 // src/core/lib/ucanDelegationStore.ts
 var ROOT_DELEGATION_KEY = "__root__";
 var STORE_VERSION_KEY = "__version__";
@@ -10419,6 +10781,46 @@ async function reconcileActionReadBack(params) {
       readBack: failedReadBack
     };
   }
+  const readBackActionType = readBack.actionType || readBack.kind;
+  const actionDef = readBackActionType ? getAction(readBackActionType) : void 0;
+  if (actionDef) {
+    const proofCheck = validateActionProof(actionDef, finalOutput || {});
+    if (!proofCheck.valid) {
+      const message = proofCheck.reason || "Read-back resolved completed without proof of execution.";
+      const proofFailedReadBack = {
+        ...nextReadBack,
+        terminalAt: checkedIso
+      };
+      runtime.update(params.blockId, {
+        state: actionDef.sideEffect ? "needs_verification" : "failed",
+        output: finalOutput,
+        error: { message, code: PROOF_MISSING_CODE, at: checkedAt },
+        readBack: proofFailedReadBack
+      });
+      const failedRunId = writeReconciliationRunRecord({
+        yDoc,
+        editor: getReconcileEditor(params, yDoc, editor),
+        blockId: params.blockId,
+        actorDid,
+        output: finalOutput,
+        events,
+        readBack: proofFailedReadBack,
+        error: { message, code: PROOF_MISSING_CODE },
+        now
+      });
+      return {
+        success: false,
+        blockId: params.blockId,
+        state: "failed",
+        output: finalOutput,
+        events,
+        error: message,
+        runId: failedRunId,
+        pendingInvocationRemoved: false,
+        readBack: proofFailedReadBack
+      };
+    }
+  }
   const completedReadBack = {
     ...nextReadBack,
     terminalAt: checkedIso
@@ -10470,6 +10872,7 @@ function parseInputs2(value) {
     const parsed = JSON.parse(value);
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
+    warnOnce(`executor-inputs-parse:${value}`, `[flow-config] saved block inputs are not valid JSON; treated as empty`);
     return {};
   }
 }
@@ -10651,6 +11054,8 @@ async function executeActionBlock(params) {
   let readBack;
   let rawReadBack;
   let requestedAwaitingReadBack = false;
+  let proofFailureReason = null;
+  let proofFailureOutput;
   const startedAt = now();
   runtime.update(blockId, {
     state: "running",
@@ -10690,6 +11095,13 @@ async function executeActionBlock(params) {
       if (result.completion?.state === "awaiting_readback") {
         requestedAwaitingReadBack = true;
         rawReadBack = result.completion.readBack;
+      } else {
+        const proofCheck = validateActionProof(action, result.output || {});
+        if (!proofCheck.valid) {
+          proofFailureReason = proofCheck.reason || "Action returned success without proof of execution.";
+          proofFailureOutput = result.output || {};
+          throw new Error(proofFailureReason);
+        }
       }
       return {
         payload: result.output,
@@ -10700,6 +11112,27 @@ async function executeActionBlock(params) {
   });
   if (!outcome.success) {
     const message = outcome.error || "Action execution failed";
+    if (proofFailureReason) {
+      const proofFailureState = action.sideEffect ? "needs_verification" : "failed";
+      runtime.update(blockId, {
+        state: proofFailureState,
+        output: proofFailureOutput,
+        error: { message, code: PROOF_MISSING_CODE, at: now() }
+      });
+      return {
+        ...buildFailureResult({
+          blockId,
+          actionType,
+          stage: outcome.stage,
+          error: message,
+          pendingInvocation: inputBuild.pendingInvocation
+        }),
+        completionState: proofFailureState === "needs_verification" ? "needs_verification" : "failed",
+        output: proofFailureOutput,
+        invocationCid: outcome.invocationCid,
+        capabilityId: outcome.capabilityId
+      };
+    }
     updateRuntimeFailure(runtime, blockId, message, now);
     return {
       ...buildFailureResult({
@@ -10767,6 +11200,29 @@ async function executeActionBlock(params) {
   };
 }
 
+// src/core/lib/flowEngine/validateBlockConfig.ts
+function validateBlockConfig(block) {
+  const issues = [];
+  if (!block?.props) return issues;
+  const checkJson = (propName, value, expectObject = true) => {
+    if (value == null || value === "") return;
+    if (typeof value !== "string") return;
+    try {
+      const parsed = JSON.parse(value);
+      if (expectObject && (parsed == null || typeof parsed !== "object")) {
+        issues.push(`${propName} is valid JSON but not an object`);
+      }
+    } catch {
+      issues.push(`${propName} is not valid JSON`);
+    }
+  };
+  checkJson("inputs", block.props.inputs);
+  checkJson("trigger", block.props.trigger);
+  checkJson("assignment", block.props.assignment);
+  checkJson("conditions", block.props.conditions);
+  return issues;
+}
+
 // src/core/lib/flowEngine/migration.ts
 var MIGRATION_REGISTRY = {};
 function registerMigration(definition) {
@@ -12343,20 +12799,30 @@ function classifyBlockerCause(block, runtime) {
   }
   return void 0;
 }
-function classifyNodeState({ block, runtime, now, pendingInvocationCount = 0 }) {
+function classifyNodeState({
+  block,
+  runtime,
+  now,
+  pendingInvocationCount = 0,
+  completionVerification,
+  isRepeatable = false
+}) {
+  if (isRepeatable && runtime.state === "completed") return "Active";
+  if (runtime.state === "completed" && completionVerification?.status === "unverified") return "Blocked";
   if (runtime.state === "completed" || runtime.state === "cancelled") return "Done";
+  if (runtime.state === "needs_verification") return "Blocked";
   if (runtime.state === "failed" || runtime.error) return "Blocked";
   const dueAt = getDueAt(block);
   if (dueAt != null && dueAt <= now) return "Overdue";
   if (pendingInvocationCount > 0) return "Pending";
   return "Pending";
 }
-function snapshotNode(block, runtime, now, pendingInvocationCount = 0) {
+function snapshotNode(block, runtime, now, pendingInvocationCount = 0, completionVerification, isRepeatable = false) {
   const nodeId = getBlockId(block);
   if (!nodeId) {
     throw new Error("Cannot snapshot a block without an id");
   }
-  const publicState = classifyNodeState({ block, runtime, now, pendingInvocationCount });
+  const publicState = classifyNodeState({ block, runtime, now, pendingInvocationCount, completionVerification, isRepeatable });
   const dueAt = getDueAt(block);
   const assigneeDid = getAssigneeDid(block);
   const snapshot = {
@@ -12371,7 +12837,13 @@ function snapshotNode(block, runtime, now, pendingInvocationCount = 0) {
   const title = getBlockTitle(block);
   if (title) snapshot.title = title;
   if (publicState === "Blocked") {
-    snapshot.blockerCause = classifyBlockerCause(block, runtime) || "unknown";
+    if (runtime.state === "needs_verification") {
+      snapshot.blockerCause = "awaiting_verification";
+    } else if (runtime.state === "completed" && completionVerification?.status === "unverified") {
+      snapshot.blockerCause = "unverified_completion";
+    } else {
+      snapshot.blockerCause = classifyBlockerCause(block, runtime) || "unknown";
+    }
   }
   if (assigneeDid) snapshot.assigneeDid = assigneeDid;
   if (dueAt != null) snapshot.dueAt = dueAt;
@@ -12562,7 +13034,7 @@ function statusForResult(result) {
 function planForSnapshot(context, options, block, snapshot) {
   const queued = [];
   const actionType = getBlockActionType(block);
-  if (snapshot.publicState === "Done") {
+  const queueClaimUdidWatch = () => {
     const runtime = snapshot.runtime;
     if (actionType === "qi/claim.submit" && runtime.output?.claimId && !runtime.output?.udid) {
       const command = queueIfAuthorized(context, options, "watch_udid", snapshot.nodeId, "Claim submitted but UDID is not yet observed", {
@@ -12571,6 +13043,13 @@ function planForSnapshot(context, options, block, snapshot) {
       });
       if (command) queued.push(command);
     }
+  };
+  if (snapshot.publicState === "Active") {
+    queueClaimUdidWatch();
+    return queued;
+  }
+  if (snapshot.publicState === "Done") {
+    queueClaimUdidWatch();
     return queued;
   }
   if (snapshot.publicState === "Overdue") {
@@ -12654,11 +13133,24 @@ function planRalphLoopCommands(context, options = {}) {
   const blocks = getBlocks(context);
   const snapshots = [];
   const queuedCommands = [];
+  const invocationsMap = context.yDoc.getMap("invocations");
+  const schemaVersionRaw = context.yDoc.getMap("root").get("schema_version");
+  const schemaVersion = typeof schemaVersionRaw === "string" ? schemaVersionRaw : void 0;
+  const getInvocation = (cid) => invocationsMap.get(cid);
   for (const block of blocks) {
     const nodeId = getBlockId(block);
     if (!nodeId) continue;
     const pendingInvocationCount = readPendingInvocations(context.yDoc, nodeId).length;
-    const snapshot = snapshotNode(block, getRuntime3(context.yDoc, nodeId), now, pendingInvocationCount);
+    const runtime = getRuntime3(context.yDoc, nodeId);
+    const actionType = getBlockActionType(block);
+    const completionVerification = verifyCompletion({
+      runtime,
+      blockId: nodeId,
+      actionType,
+      getInvocation,
+      schemaVersion
+    });
+    const snapshot = snapshotNode(block, runtime, now, pendingInvocationCount, completionVerification, isRepeatableAction(actionType));
     snapshots.push(snapshot);
     queuedCommands.push(...planForSnapshot(context, options, block, snapshot));
   }
@@ -13238,16 +13730,20 @@ var FlowAgentService = class {
 };
 
 export {
+  warnOnce,
   STEP_COMPLETED_EVENT_NAME,
   STEP_COMPLETED_EVENT,
   resolveActionType,
   registerAction,
   getAction,
   getAllActions,
+  isRepeatableAction,
+  getAliasEntries,
   hasAction,
   getActionByCan,
   getEventsForBlock,
   getOutputSchemaForBlock,
+  generateActionManifest,
   canToType,
   typeToCan,
   getAllCanMappings,
@@ -13271,6 +13767,7 @@ export {
   serializeXeroPaymentCreateInputs,
   parseReferences,
   resolveSingleReference,
+  resolveReferencesDetailed,
   resolveReferences,
   hasReferences,
   createReference,
@@ -13320,6 +13817,10 @@ export {
   readRunRecords,
   findFailedListenersForSourceRun,
   replayFailedListenerRun,
+  VERSION_MANIFEST,
+  LATEST_VERSION,
+  getVersionPolicy,
+  isVersionAtLeast,
   reconcilePendingInvocations,
   getActionForBlock,
   writeRunRecordAndReconcile,
@@ -13328,12 +13829,16 @@ export {
   createRuntimeStateManager,
   clearRuntimeForTemplateClone,
   resolveRuntimeRefs,
-  LATEST_VERSION,
   isAuthorized,
   executeNode,
+  PROOF_MISSING_CODE,
+  validateActionProof,
   reconcileActionReadBack,
   buildActionRunInputs,
   executeActionBlock,
+  verifyCompletion,
+  isVerifiedCompletion,
+  validateBlockConfig,
   createUcanDelegationStore,
   createMemoryUcanDelegationStore,
   createInvocationStore,
@@ -13389,4 +13894,4 @@ export {
   executeQueuedFlowAgentCoreCommands,
   FlowAgentService
 };
-//# sourceMappingURL=chunk-KNMPGX5G.js.map
+//# sourceMappingURL=chunk-5TJK6JKV.js.map