@ixo/editor 6.31.4 → 6.32.1

package/dist/{connections-B24zj0RI.d.ts → connections-1NtNQrsY.d.ts}

@@ -1,4 +1,4 @@
-import { a6 as FlowNodeAuthzExtension, a7 as FlowNode, a8 as EvaluationStatus, F as FlowRuntimeStateManager, G as UcanService, g as InvocationStore, a9 as IxoEditorType, aa as PendingInvocation, ab as ActionServices, ac as ActionHandlers, ad as RunEventAppender, ae as TopicExecutionContext, af as TopicActionBridge, ag as ActionResult, ah as TopicActionWriteBackResult, U as UcanCapability, ai as FlowNodeRuntimeState, z as UcanDelegationStore, v as StoredDelegation, aj as ActionDefinition } from './runtime-DFPayq89.js';
+import { a6 as FlowNodeAuthzExtension, a7 as FlowNode, a8 as EvaluationStatus, F as FlowRuntimeStateManager, G as UcanService, g as InvocationStore, a9 as IxoEditorType, aa as PendingInvocation, ab as ActionServices, ac as ActionHandlers, ad as RunEventAppender, ae as TopicExecutionContext, af as TopicActionBridge, ag as ActionResult, ah as TopicActionWriteBackResult, U as UcanCapability, ai as FlowNodeRuntimeState, z as UcanDelegationStore, v as StoredDelegation, aj as ActionDefinition } from './runtime-BFwvCQDF.js';
 import * as Y from 'yjs';
 import { Doc, Map } from 'yjs';
 import { MatrixClient } from 'matrix-js-sdk';

package/dist/core/index.cjs

@@ -74,8 +74,10 @@ var init_cid = __esm({
 // src/core/index.ts
 var core_exports = {};
 __export(core_exports, {
+  ACTION_MANIFEST_V2_SCHEMA: () => ACTION_MANIFEST_V2_SCHEMA,
   ACTION_MANIFEST_VERSION: () => ACTION_MANIFEST_VERSION,
   ACTION_REGISTRY_VERSION: () => ACTION_REGISTRY_VERSION,
+  ActionManifestV2VerificationError: () => ActionManifestV2VerificationError,
   ExplicitRunRequiredError: () => ExplicitRunRequiredError,
   FLOW_CONNECTIONS_MAP_KEY: () => FLOW_CONNECTIONS_MAP_KEY,
   FLOW_CONNECTION_BINDINGS_MAP_KEY: () => FLOW_CONNECTION_BINDINGS_MAP_KEY,
@@ -141,6 +143,7 @@ __export(core_exports, {
   canToActionType: () => canToActionType,
   canToType: () => canToType,
   cancelRun: () => cancelRun,
+  canonicalizeManifestV2Payload: () => canonicalizeManifestV2Payload,
   capabilityPatternCoversCan: () => capabilityPatternCoversCan,
   classifyBlockerCause: () => classifyBlockerCause,
   classifyNodeState: () => classifyNodeState,
@@ -150,6 +153,7 @@ __export(core_exports, {
   closeRun: () => closeRun,
   collectPhantomLegacyRun: () => collectPhantomLegacyRun,
   compileBaseUcanFlow: () => compileBaseUcanFlow,
+  computeActionManifestV2Digest: () => computeActionManifestV2Digest,
   computeAgentCommandId: () => computeAgentCommandId,
   computeCID: () => computeCID,
   computeJsonCID: () => computeJsonCID,
@@ -326,6 +330,7 @@ __export(core_exports, {
   setTempUcanEnforcementDisabled: () => setTempUcanEnforcementDisabled,
   setupFlowFromBaseUcan: () => setupFlowFromBaseUcan,
   sha256Digest: () => sha256Digest,
+  signActionManifestV2: () => signActionManifestV2,
   snapshotInputRefs: () => snapshotInputRefs,
   snapshotNode: () => snapshotNode,
   startRun: () => startRun,
@@ -355,6 +360,7 @@ __export(core_exports, {
   validateFlowAgentLease: () => validateFlowAgentLease,
   validateTopicSemanticRecord: () => validateTopicSemanticRecord,
   validateTopicSemanticRecordBatch: () => validateTopicSemanticRecordBatch,
+  verifyActionManifestV2: () => verifyActionManifestV2,
   verifyCompletion: () => verifyCompletion,
   writeActionState: () => writeActionState,
   writeCompiledBlocksToFragment: () => writeCompiledBlocksToFragment,
@@ -2677,12 +2683,11 @@ var PRESENTATION = {
   "qi/topic.action.receipt.record": { displayName: "Record Action Receipt", description: "Record a signed Action receipt against its Topic request" },
   "qi/topic.action.request": { displayName: "Request Topic Action", description: "Request an Action against the current Topic revision" },
   "qi/topic.context.link": { displayName: "Link Topic Context", description: "Link a referenced resource or service to the Topic" },
-  "qi/topic.contract.accept": { displayName: "Accept Topic Contract", description: "Accept the exact current Topic contract revision" },
+  "qi/topic.contract.confirm-setup": { displayName: "Confirm Topic Setup", description: "Confirm the exact proposed Topic setup revision" },
   "qi/topic.decision.record": { displayName: "Record Topic Decision", description: "Record an authorised decision and its rationale" },
   "qi/topic.file.attach-reference": { displayName: "Attach File Reference", description: "Attach a pinned VFS file reference to the Topic" },
   "qi/topic.flow.bind": { displayName: "Bind Flow to Topic", description: "Bind a governed Flow revision to the Topic" },
   "qi/topic.flow.unbind": { displayName: "Unbind Flow from Topic", description: "Remove an existing Flow binding from the Topic" },
-  "qi/topic.outcome.confirm": { displayName: "Confirm Topic Outcome", description: "Confirm a proposed outcome using the stated authority" },
   "qi/topic.outcome.propose": { displayName: "Propose Topic Outcome", description: "Propose an evidence-backed outcome for review" },
   "qi/topic.status.transition": { displayName: "Change Topic Status", description: "Move the Topic between permitted lifecycle statuses" },
   "qi/wallet.fund": { displayName: "Fund Wallet", description: "Fund a wallet with an on-chain transfer" },
@@ -2763,7 +2768,11 @@ var ACTION_TYPE_ALIASES = {
   // qi/ixo.calendar.event.* instead.
   "qi/calendar.event.create": "qi/googlecalendar.event.create-self",
   "qi/calendar.event.update": "qi/googlecalendar.event.update-self",
-  "qi/calendar.event.list": "qi/googlecalendar.event.list-self"
+  "qi/calendar.event.list": "qi/googlecalendar.event.list-self",
+  // Topic v3 called setup confirmation "accept contract". Persisted Flow
+  // documents keep that action key, so resolve it to the v4 confirmation
+  // contract while new documents use the canonical name.
+  "qi/topic.contract.accept": "qi/topic.contract.confirm-setup"
 };
 var aliases = new Map(Object.entries(ACTION_TYPE_ALIASES));
 function resolveActionType(type) {
@@ -3028,6 +3037,347 @@ function actionManifestIssues(manifest = generateActionManifest()) {
   return issues;
 }
 
+// src/core/lib/actionRegistry/manifestV2.ts
+var import__2 = __toESM(require("ajv/dist/2020.js"), 1);
+
+// src/core/lib/actionRegistry/manifestV2.schema.ts
+var ACTION_MANIFEST_V2_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "https://ixo.world/schemas/qi/action-manifest-v2.schema.json",
+  type: "object",
+  additionalProperties: false,
+  required: ["manifestVersion", "manifestId", "generatedAt", "package", "issuer", "compatibility", "actions", "primitives", "integrity"],
+  properties: {
+    manifestVersion: { const: "2.0" },
+    manifestId: { type: "string", minLength: 1 },
+    generatedAt: {
+      type: "string",
+      pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$"
+    },
+    package: {
+      type: "object",
+      additionalProperties: false,
+      required: ["name", "version", "sourceCommit"],
+      properties: {
+        name: { type: "string", minLength: 1 },
+        version: { type: "string", minLength: 1 },
+        sourceCommit: { type: "string", minLength: 1 },
+        buildId: { type: "string", minLength: 1 },
+        distributionUrl: { type: "string", pattern: "^[a-zA-Z][a-zA-Z0-9+.-]*:" }
+      }
+    },
+    issuer: {
+      type: "object",
+      additionalProperties: false,
+      required: ["did", "verificationMethod"],
+      properties: {
+        did: { type: "string", pattern: "^did:[a-z0-9]+:.+" },
+        verificationMethod: { type: "string", pattern: "^did:[a-z0-9]+:.+#.+" }
+      }
+    },
+    compatibility: {
+      type: "object",
+      additionalProperties: false,
+      required: ["engine", "flowSchemaVersions", "features"],
+      properties: {
+        engine: {
+          type: "object",
+          additionalProperties: false,
+          required: ["versionRange"],
+          properties: {
+            versionRange: { type: "string", minLength: 1 }
+          }
+        },
+        flowSchemaVersions: {
+          type: "array",
+          minItems: 1,
+          uniqueItems: true,
+          items: { type: "string", minLength: 1 }
+        },
+        features: {
+          type: "array",
+          minItems: 1,
+          uniqueItems: true,
+          items: { type: "string", minLength: 1 }
+        }
+      }
+    },
+    actions: {
+      type: "array",
+      items: { $ref: "#/$defs/contract" }
+    },
+    primitives: {
+      type: "array",
+      items: { $ref: "#/$defs/contract" }
+    },
+    integrity: {
+      type: "object",
+      additionalProperties: false,
+      required: ["canonicalization", "digest", "signature"],
+      properties: {
+        canonicalization: { const: "RFC8785" },
+        digest: {
+          type: "object",
+          additionalProperties: false,
+          required: ["algorithm", "value"],
+          properties: {
+            algorithm: { const: "SHA-256" },
+            value: { type: "string", pattern: "^sha256:[0-9a-f]{64}$" }
+          }
+        },
+        signature: {
+          type: "object",
+          additionalProperties: false,
+          required: ["algorithm", "verificationMethod", "value"],
+          properties: {
+            algorithm: { type: "string", minLength: 1 },
+            verificationMethod: { type: "string", pattern: "^did:[a-z0-9]+:.+#.+" },
+            value: { type: "string", minLength: 1 }
+          }
+        }
+      }
+    }
+  },
+  $defs: {
+    contract: {
+      type: "object",
+      required: ["type", "contractVersion"],
+      properties: {
+        type: { type: "string", minLength: 1 },
+        contractVersion: { type: "string", minLength: 1 },
+        aliases: {
+          type: "array",
+          uniqueItems: true,
+          items: { type: "string", minLength: 1 }
+        }
+      }
+    }
+  }
+};
+
+// src/core/lib/actionRegistry/manifestV2.ts
+var ActionManifestV2VerificationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "ActionManifestV2VerificationError";
+    this.code = code;
+  }
+};
+var validateSignedManifest = new import__2.default({ allErrors: true, strict: false }).compile(ACTION_MANIFEST_V2_SCHEMA);
+var SIGNATURE_DOMAIN = "qi.action-manifest.v2\0";
+function isPlainObject(value) {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function assertValidUnicode(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const codeUnit = value.charCodeAt(index);
+    if (codeUnit >= 55296 && codeUnit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) {
+        throw new TypeError("Manifest v2 contains an unpaired Unicode surrogate");
+      }
+      index += 1;
+    } else if (codeUnit >= 56320 && codeUnit <= 57343) {
+      throw new TypeError("Manifest v2 contains an unpaired Unicode surrogate");
+    }
+  }
+}
+function canonicalizeManifestV2Payload(payload) {
+  const ancestors = /* @__PURE__ */ new Set();
+  const serialize = (value) => {
+    if (value === null || typeof value === "boolean") {
+      return JSON.stringify(value);
+    }
+    if (typeof value === "string") {
+      assertValidUnicode(value);
+      return JSON.stringify(value);
+    }
+    if (typeof value === "number") {
+      if (!Number.isFinite(value)) {
+        throw new TypeError("Manifest v2 contains a non-finite number");
+      }
+      return JSON.stringify(value);
+    }
+    if (typeof value !== "object") {
+      throw new TypeError(`Manifest v2 contains a non-JSON value: ${typeof value}`);
+    }
+    if (ancestors.has(value)) {
+      throw new TypeError("Manifest v2 contains a circular reference");
+    }
+    ancestors.add(value);
+    try {
+      if (Array.isArray(value)) {
+        return `[${value.map((entry) => serialize(entry)).join(",")}]`;
+      }
+      if (!isPlainObject(value)) {
+        throw new TypeError("Manifest v2 contains a non-plain object");
+      }
+      return `{${Object.keys(value).sort().map((key) => {
+        assertValidUnicode(key);
+        return `${JSON.stringify(key)}:${serialize(value[key])}`;
+      }).join(",")}}`;
+    } finally {
+      ancestors.delete(value);
+    }
+  };
+  return serialize(payload);
+}
+async function computeActionManifestV2Digest(payload) {
+  if (!globalThis.crypto?.subtle) {
+    throw new Error("Web Crypto is required to digest an Action Manifest v2 contract");
+  }
+  const canonicalPayload = canonicalizeManifestV2Payload(payload);
+  const digest2 = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalPayload));
+  const hex = Array.from(new Uint8Array(digest2), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `sha256:${hex}`;
+}
+function signatureInput(digest2) {
+  return new TextEncoder().encode(`${SIGNATURE_DOMAIN}${digest2}`);
+}
+function schemaFailure() {
+  const details = (validateSignedManifest.errors || []).map((error) => `${error.instancePath || "/"} ${error.message || "is invalid"}`).join("; ");
+  return new ActionManifestV2VerificationError("INVALID_MANIFEST", details ? `Action Manifest v2 is invalid: ${details}` : "Action Manifest v2 is invalid");
+}
+function payloadFromSignedManifest(manifest) {
+  const { integrity: _integrity, ...payload } = manifest;
+  return payload;
+}
+function assertContractIdentities(payload) {
+  const contracts = [...payload.actions, ...payload.primitives];
+  const canonicalTypes = /* @__PURE__ */ new Set();
+  for (const contract of contracts) {
+    if (canonicalTypes.has(contract.type)) {
+      throw new ActionManifestV2VerificationError("DUPLICATE_CONTRACT_TYPE", `Manifest contains duplicate canonical contract type: ${contract.type}`);
+    }
+    canonicalTypes.add(contract.type);
+  }
+  for (const [groupName, group] of [
+    ["actions", payload.actions],
+    ["primitives", payload.primitives]
+  ]) {
+    for (let index = 1; index < group.length; index += 1) {
+      if (group[index - 1].type > group[index].type) {
+        throw new ActionManifestV2VerificationError("UNSORTED_CONTRACTS", `Manifest ${groupName} must be sorted by canonical type`);
+      }
+    }
+  }
+  const claimedNames = new Map(Array.from(canonicalTypes, (type) => [type, type]));
+  for (const contract of contracts) {
+    const aliases2 = contract.aliases;
+    if (!Array.isArray(aliases2)) continue;
+    for (const alias of aliases2) {
+      const existingOwner = claimedNames.get(alias);
+      if (existingOwner) {
+        throw new ActionManifestV2VerificationError("AMBIGUOUS_ALIAS", `Manifest alias ${alias} conflicts with contract ${existingOwner}`);
+      }
+      claimedNames.set(alias, contract.type);
+    }
+  }
+}
+function deepFreeze(value) {
+  for (const child of Object.values(value)) {
+    if (typeof child === "object" && child !== null && !Object.isFrozen(child)) {
+      deepFreeze(child);
+    }
+  }
+  return Object.freeze(value);
+}
+async function signActionManifestV2(payload, signer) {
+  if (signer.issuerDid !== payload.issuer.did || signer.verificationMethod !== payload.issuer.verificationMethod) {
+    throw new ActionManifestV2VerificationError("SIGNER_MISMATCH", "The Manifest v2 signer does not match the declared issuer verification method");
+  }
+  assertContractIdentities(payload);
+  let digest2;
+  try {
+    digest2 = await computeActionManifestV2Digest(payload);
+  } catch (error) {
+    throw new ActionManifestV2VerificationError(
+      "INVALID_MANIFEST",
+      error instanceof Error ? `Action Manifest v2 cannot be canonicalized: ${error.message}` : "Action Manifest v2 cannot be canonicalized"
+    );
+  }
+  const signature = await signer.sign(signatureInput(digest2));
+  if (!signature) {
+    throw new ActionManifestV2VerificationError("INVALID_SIGNATURE", "The Manifest v2 signer returned an empty signature");
+  }
+  const signed = {
+    ...payload,
+    integrity: {
+      canonicalization: "RFC8785",
+      digest: {
+        algorithm: "SHA-256",
+        value: digest2
+      },
+      signature: {
+        algorithm: signer.algorithm,
+        verificationMethod: signer.verificationMethod,
+        value: signature
+      }
+    }
+  };
+  if (!validateSignedManifest(signed)) {
+    throw schemaFailure();
+  }
+  assertContractIdentities(payload);
+  return signed;
+}
+async function verifyActionManifestV2(candidate, trustPolicy) {
+  if (typeof candidate !== "object" || candidate === null || !("manifestVersion" in candidate) || candidate.manifestVersion !== "2.0") {
+    throw new ActionManifestV2VerificationError("UNSUPPORTED_MANIFEST_VERSION", "Only Action Manifest version 2.0 can cross this execution boundary");
+  }
+  if (!("integrity" in candidate) || typeof candidate.integrity !== "object") {
+    throw new ActionManifestV2VerificationError("UNSIGNED_MANIFEST", "A signature and digest are required to load Action Manifest v2 for execution");
+  }
+  if (!validateSignedManifest(candidate)) {
+    throw schemaFailure();
+  }
+  const manifest = candidate;
+  const { issuer, integrity } = manifest;
+  assertContractIdentities(manifest);
+  if (!trustPolicy.trustedIssuerDids.includes(issuer.did)) {
+    throw new ActionManifestV2VerificationError("UNTRUSTED_ISSUER", `Manifest issuer is not trusted: ${issuer.did}`);
+  }
+  if (trustPolicy.revokedIssuerDids?.includes(issuer.did)) {
+    throw new ActionManifestV2VerificationError("REVOKED_ISSUER", `Manifest issuer is revoked: ${issuer.did}`);
+  }
+  if (integrity.signature.verificationMethod !== issuer.verificationMethod || !integrity.signature.verificationMethod.startsWith(`${issuer.did}#`)) {
+    throw new ActionManifestV2VerificationError("VERIFICATION_METHOD_MISMATCH", "The signature verification method does not belong to the declared manifest issuer");
+  }
+  if (!trustPolicy.allowedSignatureAlgorithms.includes(integrity.signature.algorithm)) {
+    throw new ActionManifestV2VerificationError("DISALLOWED_SIGNATURE_ALGORITHM", `Manifest signature algorithm is not allowed: ${integrity.signature.algorithm}`);
+  }
+  let digest2;
+  try {
+    digest2 = await computeActionManifestV2Digest(payloadFromSignedManifest(manifest));
+  } catch (error) {
+    throw new ActionManifestV2VerificationError(
+      "INVALID_MANIFEST",
+      error instanceof Error ? `Action Manifest v2 cannot be canonicalized: ${error.message}` : "Action Manifest v2 cannot be canonicalized"
+    );
+  }
+  if (digest2 !== integrity.digest.value) {
+    throw new ActionManifestV2VerificationError("DIGEST_MISMATCH", "Manifest payload does not match its signed digest");
+  }
+  let validSignature = false;
+  try {
+    validSignature = await trustPolicy.verifySignature({
+      issuerDid: issuer.did,
+      verificationMethod: integrity.signature.verificationMethod,
+      algorithm: integrity.signature.algorithm,
+      data: signatureInput(digest2),
+      signature: integrity.signature.value
+    });
+  } catch {
+    validSignature = false;
+  }
+  if (!validSignature) {
+    throw new ActionManifestV2VerificationError("INVALID_SIGNATURE", "Manifest signature verification failed");
+  }
+  const trustedSnapshot = JSON.parse(JSON.stringify(manifest));
+  return deepFreeze(trustedSnapshot);
+}
+
 // src/core/lib/actionRegistry/inputRequirements.ts
 function isBlankInputValue(value) {
   if (value == null) return true;
@@ -10717,7 +11067,7 @@ function stripHtml(s) {
 }
 
 // src/core/lib/actionRegistry/actions/evalRubric/schemaGate.ts
-var import__2 = __toESM(require("ajv/dist/2020.js"), 1);
+var import__3 = __toESM(require("ajv/dist/2020.js"), 1);
 
 // src/core/lib/actionRegistry/actions/evalRubric/types.ts
 var RUBRIC_CTX_TOKENS = [
@@ -10790,7 +11140,7 @@ async function getValidator(fetchSchema, evalEngineUrl) {
   if (compiledValidator) return compiledValidator;
   const schema = await fetchSchema(evalEngineUrl);
   if (!schema || typeof schema !== "object") throw new Error("the rules service returned no schema");
-  const validate = new import__2.default({ allErrors: true, strict: false }).compile(schema);
+  const validate = new import__3.default({ allErrors: true, strict: false }).compile(schema);
   compiledValidator = validate;
   return validate;
 }
@@ -12955,6 +13305,7 @@ registerTopicOperation({
       executorPreference: { type: "string", enum: ["qi-flow", "qiforge", "mcp"] },
       bindingId: { type: "string" },
       confirmationPolicy: { type: "string", enum: ["inherit", "required"] },
+      transitionCode: { type: "string" },
       idempotencyKey: { type: "string" }
     }
   },
@@ -12973,6 +13324,7 @@ registerTopicOperation({
     const inputDigest = requiredString(inputs.inputDigest, "inputDigest");
     const derived = (purpose) => sha256Digest({ purpose, parentRequestId: topic.requestId, topicId: topic.topicId, actionType: target.type, inputDigest });
     return {
+      ...inputs.transitionCode ? { transitionCode: String(inputs.transitionCode) } : {},
       request: {
         version: 1,
         requestId: String(inputs.requestId || derived("topic-action-request")),
@@ -13038,9 +13390,15 @@ registerTopicOperation({
   ability: "topic/change-status",
   inputSchema: {
     type: "object",
-    required: ["from", "to", "reason"],
+    required: ["from", "to", "transitionCode", "reason"],
     additionalProperties: false,
-    properties: { from: { type: "string" }, to: { type: "string" }, reason: { type: "string" }, idempotencyKey: { type: "string" } }
+    properties: {
+      from: { type: "string" },
+      to: { type: "string" },
+      transitionCode: { type: "string" },
+      reason: { type: "string" },
+      idempotencyKey: { type: "string" }
+    }
   },
   buildPayload: async (inputs, ctx) => {
     const from = requiredString(inputs.from, "from");
@@ -13053,16 +13411,21 @@ registerTopicOperation({
       const outcome = projection.outcome;
       if (completion?.requiresOutcomeRecord === true && !outcome?.outcomeRecordId) throw new Error("Topic policy requires an accepted outcome record before resolution");
     }
-    return { from, to, reason: requiredString(inputs.reason, "reason") };
+    return {
+      from,
+      to,
+      transitionCode: requiredString(inputs.transitionCode, "transitionCode"),
+      reason: requiredString(inputs.reason, "reason")
+    };
   }
 });
 registerTopicOperation({
-  type: "qi/topic.contract.accept",
-  can: "topic/contract.accept",
-  operationType: "accept-contract",
+  type: "qi/topic.contract.confirm-setup",
+  can: "topic/contract.confirm-setup",
+  operationType: "confirm-setup",
   confirmation: true,
   owner: "human",
-  ability: "topic/accept-contract",
+  ability: "topic/confirm-setup",
   inputSchema: {
     type: "object",
     required: ["contractRevision", "contractDigest", "confirmationReference"],
@@ -13071,6 +13434,7 @@ registerTopicOperation({
       contractRevision: { type: "string" },
       contractDigest: { type: "string", pattern: "^sha256:" },
       confirmationReference: { type: "string" },
+      transitionCode: { type: "string" },
       idempotencyKey: { type: "string" }
     }
   },
@@ -13078,8 +13442,13 @@ registerTopicOperation({
     const revision = requiredString(inputs.contractRevision, "contractRevision");
     const digest2 = requiredString(inputs.contractDigest, "contractDigest");
     if (revision !== topicContext(ctx).contract.revision || digest2 !== topicContext(ctx).contract.digest)
-      throw new Error("Contract acceptance must target the exact effective revision and digest");
-    return { contractRevision: revision, contractDigest: digest2, confirmationReference: requiredString(inputs.confirmationReference, "confirmationReference") };
+      throw new Error("Setup confirmation must target the exact proposed contract revision and digest");
+    return {
+      contractRevision: revision,
+      contractDigest: digest2,
+      confirmationReference: requiredString(inputs.confirmationReference, "confirmationReference"),
+      ...inputs.transitionCode ? { transitionCode: String(inputs.transitionCode) } : {}
+    };
   }
 });
 registerTopicOperation({
@@ -13103,35 +13472,6 @@ registerTopicOperation({
     }
   })
 });
-registerTopicOperation({
-  type: "qi/topic.outcome.confirm",
-  can: "topic/outcome.confirm",
-  operationType: "update-contract",
-  confirmation: true,
-  owner: "human",
-  ability: "topic/update-contract",
-  inputSchema: {
-    type: "object",
-    required: ["proposedOutcomeRecordId", "confirmationAuthorityDid", "confirmationReference"],
-    additionalProperties: false,
-    properties: {
-      proposedOutcomeRecordId: { type: "string" },
-      confirmationAuthorityDid: { type: "string", pattern: "^did:" },
-      confirmationReference: { type: "string" },
-      idempotencyKey: { type: "string" }
-    }
-  },
-  buildPayload: (inputs) => ({
-    patch: {
-      outcome: {
-        status: "achieved",
-        outcomeRecordId: requiredString(inputs.proposedOutcomeRecordId, "proposedOutcomeRecordId"),
-        confirmedBy: requiredString(inputs.confirmationAuthorityDid, "confirmationAuthorityDid"),
-        confirmationReference: requiredString(inputs.confirmationReference, "confirmationReference")
-      }
-    }
-  })
-});
 registerTopicOperation({
   type: "qi/topic.decision.record",
   can: "topic/decision.record",
@@ -13540,6 +13880,60 @@ registerSemanticAction({
     occurredAt: String(inputs.occurredAt || (/* @__PURE__ */ new Date()).toISOString())
   })
 });
+registerAction({
+  type: "qi/topic.remind",
+  can: "topic/reminder.deliver",
+  displayName: "Send a Topic reminder",
+  description: "Posts a reminder into the Topic thread and notifies the people responsible for it.",
+  sideEffect: true,
+  proof: { fields: ["deliveredAt"] },
+  done: doneWhenCompleted,
+  defaultRequiresConfirmation: false,
+  executionOwner: "agent",
+  riskTier: "low",
+  requiredServices: ["topic"],
+  eligibleForTimeTrigger: true,
+  scheduling: {
+    riskTier: "R0",
+    misfirePolicies: ["run_once_immediately", "skip"],
+    // Reminders never queue: two firings of the same reminder are the same
+    // reminder, and delivering it twice is the failure mode, not the goal.
+    overlapPolicies: ["skip"],
+    approvalRequirement: "none",
+    idempotencyStrategy: "idempotency_key",
+    inputModes: ["resolve_at_fire"],
+    runModes: ["new_run_per_occurrence"]
+  },
+  topic: topicMetadata(ALL_KINDS2, [], ["topic/manage-reminder"], "contextual"),
+  inputSchema: {
+    type: "object",
+    required: ["recipients"],
+    additionalProperties: false,
+    properties: {
+      recipients: { type: "array", items: { type: "string" } },
+      message: { type: "string" },
+      idempotencyKey: { type: "string" }
+    }
+  },
+  outputSchema: [
+    { path: "deliveredAt", displayName: "Delivered at", type: "string" },
+    { path: "recipients", displayName: "Reminded", type: "string" }
+  ],
+  run: async (inputs, ctx) => {
+    const service = topicService(ctx);
+    if (!service.deliverReminder) throw new Error("The host did not grant a Topic reminder delivery service");
+    const recipients = requiredArray(inputs.recipients, "recipients");
+    if (recipients.length === 0) throw new Error("A reminder needs at least one recipient");
+    return {
+      output: await service.deliverReminder({
+        context: topicContext(ctx),
+        recipients,
+        message: String(inputs.message || ""),
+        idempotencyKey: idempotencyKey("qi/topic.remind", inputs, ctx)
+      })
+    };
+  }
+});
 
 // src/core/lib/actionRegistry/actions/calendar/eventCreate.types.ts
 function parseAttendeesField(raw) {
@@ -22616,8 +23010,10 @@ function createOracleInitFlowTemplate() {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACTION_MANIFEST_V2_SCHEMA,
   ACTION_MANIFEST_VERSION,
   ACTION_REGISTRY_VERSION,
+  ActionManifestV2VerificationError,
   ExplicitRunRequiredError,
   FLOW_CONNECTIONS_MAP_KEY,
   FLOW_CONNECTION_BINDINGS_MAP_KEY,
@@ -22683,6 +23079,7 @@ function createOracleInitFlowTemplate() {
   canToActionType,
   canToType,
   cancelRun,
+  canonicalizeManifestV2Payload,
   capabilityPatternCoversCan,
   classifyBlockerCause,
   classifyNodeState,
@@ -22692,6 +23089,7 @@ function createOracleInitFlowTemplate() {
   closeRun,
   collectPhantomLegacyRun,
   compileBaseUcanFlow,
+  computeActionManifestV2Digest,
   computeAgentCommandId,
   computeCID,
   computeJsonCID,
@@ -22868,6 +23266,7 @@ function createOracleInitFlowTemplate() {
   setTempUcanEnforcementDisabled,
   setupFlowFromBaseUcan,
   sha256Digest,
+  signActionManifestV2,
   snapshotInputRefs,
   snapshotNode,
   startRun,
@@ -22897,6 +23296,7 @@ function createOracleInitFlowTemplate() {
   validateFlowAgentLease,
   validateTopicSemanticRecord,
   validateTopicSemanticRecordBatch,
+  verifyActionManifestV2,
   verifyCompletion,
   writeActionState,
   writeCompiledBlocksToFragment,