@open-mercato/core 0.10.1-develop.7741.1.61a2652671 → 0.10.1-develop.7748.1.d745ba61aa

package/src/modules/notifications/i18n/de.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Ungültige Zustelleinstellungen",
   "notifications.empty": "Keine Benachrichtigungen",
   "notifications.error.action": "Aktion konnte nicht ausgeführt werden",
+  "notifications.error.actionCommandNotAllowed": "Über die API erstellte Benachrichtigungsaktionen dürfen keine Befehle ausführen",
+  "notifications.error.actionForbidden": "Sie dürfen diese Benachrichtigungsaktion nicht ausführen",
   "notifications.error.load": "Benachrichtigungen konnten nicht geladen werden",
   "notifications.filters.actionRequired": "Aktion erforderlich",
   "notifications.filters.all": "Alle",

package/src/modules/notifications/i18n/en.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Invalid delivery settings",
   "notifications.empty": "No notifications",
   "notifications.error.action": "Failed to execute action",
+  "notifications.error.actionCommandNotAllowed": "Notification actions created through the API cannot run commands",
+  "notifications.error.actionForbidden": "You are not allowed to run this notification action",
   "notifications.error.load": "Failed to load notifications",
   "notifications.filters.actionRequired": "Action Required",
   "notifications.filters.all": "All",

package/src/modules/notifications/i18n/es.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Configuración de entrega no válida",
   "notifications.empty": "Sin notificaciones",
   "notifications.error.action": "No se pudo ejecutar la acción",
+  "notifications.error.actionCommandNotAllowed": "Las acciones de notificación creadas mediante la API no pueden ejecutar comandos",
+  "notifications.error.actionForbidden": "No tienes permiso para ejecutar esta acción de notificación",
   "notifications.error.load": "No se pudieron cargar las notificaciones",
   "notifications.filters.actionRequired": "Acción requerida",
   "notifications.filters.all": "Todas",

package/src/modules/notifications/i18n/ko.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "잘못된 전달 설정입니다",
   "notifications.empty": "알림 없음",
   "notifications.error.action": "작업을 실행하지 못했습니다",
+  "notifications.error.actionCommandNotAllowed": "API로 생성한 알림 작업은 명령을 실행할 수 없습니다",
+  "notifications.error.actionForbidden": "이 알림 작업을 실행할 권한이 없습니다",
   "notifications.error.load": "알림을 불러오지 못했습니다",
   "notifications.filters.actionRequired": "조치 필요",
   "notifications.filters.all": "전체",

package/src/modules/notifications/i18n/pl.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Nieprawidłowe ustawienia dostarczania",
   "notifications.empty": "Brak powiadomień",
   "notifications.error.action": "Nie udało się wykonać akcji",
+  "notifications.error.actionCommandNotAllowed": "Akcje powiadomień utworzone przez API nie mogą uruchamiać poleceń",
+  "notifications.error.actionForbidden": "Nie masz uprawnień do wykonania tej akcji powiadomienia",
   "notifications.error.load": "Nie udało się załadować powiadomień",
   "notifications.filters.actionRequired": "Wymagana akcja",
   "notifications.filters.all": "Wszystkie",

package/src/modules/notifications/lib/notificationService.ts

@@ -6,8 +6,13 @@ import { Notification, type NotificationStatus } from '../data/entities'
 import type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'
 import {
   NOTIFICATION_ACTION_ALREADY_EXECUTED_ERROR_CODE,
+  NOTIFICATION_ACTION_FORBIDDEN_ERROR_CODE,
+  type NotificationAction,
   type NotificationPollData,
+  type NotificationTypeAction,
 } from '@open-mercato/shared/modules/notifications/types'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { NOTIFICATION_EVENTS, NOTIFICATION_SSE_EVENTS } from './events'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
@@ -97,6 +102,27 @@ function actionAlreadyExecuted(): CrudHttpError {
   })
 }
 
+async function actionForbidden(): Promise<CrudHttpError> {
+  const { translate } = await resolveTranslations()
+  return new CrudHttpError(403, {
+    error: translate('notifications.error.actionForbidden', 'You are not allowed to run this notification action'),
+    code: NOTIFICATION_ACTION_FORBIDDEN_ERROR_CODE,
+  })
+}
+
+/**
+ * The command action the notification's registered type declares for a stored action: same action
+ * id (across `actions` and `optionalActions`) and same `commandId`. Anything else is not dispatched.
+ */
+function findDeclaredCommandAction(type: string, action: NotificationAction): NotificationTypeAction | null {
+  const definition = getNotificationType(type)
+  if (!definition) return null
+  const declared = [...definition.actions, ...(definition.optionalActions ?? [])]
+    .find((candidate) => candidate.id === action.id)
+  if (!declared?.commandId || declared.commandId !== action.commandId) return null
+  return declared
+}
+
 function applyNotificationContent(
   notification: Notification,
   input: NotificationContentInput,
@@ -285,6 +311,39 @@ export interface NotificationServiceDeps {
 export function createNotificationService(deps: NotificationServiceDeps): NotificationService {
   const { em: rootEm, eventBus, commandBus, container } = deps
 
+  /**
+   * Whether the clicking user holds every feature a declared notification action requires.
+   * Fails closed: no user, no container, or a failing RBAC check denies the action.
+   */
+  const userHoldsActionFeatures = async (
+    requiredFeatures: string[] | undefined,
+    scopeCtx: NotificationServiceContext,
+  ): Promise<boolean> => {
+    if (!requiredFeatures || requiredFeatures.length === 0) return true
+    if (!scopeCtx.userId || !container) return false
+    try {
+      const rbacService = container.resolve('rbacService') as {
+        userHasAllFeatures: (
+          userId: string,
+          features: string[],
+          scope: { tenantId: string | null; organizationId: string | null },
+        ) => Promise<boolean>
+      }
+      const allowed = await rbacService.userHasAllFeatures(
+        scopeCtx.userId,
+        requiredFeatures,
+        { tenantId: scopeCtx.tenantId, organizationId: scopeCtx.organizationId ?? null },
+      )
+      return allowed === true
+    } catch (err) {
+      getTelemetryRuntime()?.reportError(err, {
+        module: 'notifications',
+        code: 'notifications.action_feature_check_failed',
+      })
+      return false
+    }
+  }
+
   /**
    * Resolves the authoritative delivery-channel set for one recipient at create time — the single
    * gate that folds per-send target, per-type eligibility, registered strategies, and the
@@ -696,6 +755,13 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         throw actionAlreadyExecuted()
       }
 
+      if (action.commandId) {
+        const declared = findDeclaredCommandAction(notification.type, action)
+        if (!declared || !(await userHoldsActionFeatures(declared.requiredFeatures, ctx))) {
+          throw await actionForbidden()
+        }
+      }
+
       const actionedAt = new Date()
       const previousStatus = notification.status
       const previousActionedAt = notification.actionedAt ?? null
@@ -749,8 +815,8 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
       if (action.commandId && commandBus && container) {
         const commandInput = {
-          id: notification.sourceEntityId,
           ...input.payload,
+          id: notification.sourceEntityId,
         }
 
         // Build a CommandRuntimeContext from the notification service context

package/src/modules/notifications/lib/routeHelpers.ts

@@ -5,7 +5,9 @@ import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/d
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE } from '@open-mercato/shared/modules/notifications/types'
 import { resolveNotificationService, type NotificationService } from './notificationService'
+import { actionConflictResponseSchema } from '../api/openapi'
 
 /**
  * Mutation-guard resource kind for notification rows.
@@ -60,6 +62,32 @@ export async function notificationValidationErrorResponse(error: z.ZodError): Pr
   )
 }
 
+export type NotificationActionsPayload = { actions?: Array<{ commandId?: string | null }> | null }
+
+/**
+ * Reject an API-supplied action that carries a `commandId`.
+ *
+ * Command-backed actions run with the clicking user's identity, so only server code may attach
+ * them, from the notification type definition. Called after payload validation and before the
+ * mutation guard or the service write.
+ */
+export async function rejectNotificationActionCommands(
+  data: NotificationActionsPayload,
+): Promise<Response | null> {
+  if (!data.actions?.some((action) => action.commandId)) return null
+  const { t } = await resolveTranslations()
+  return Response.json(
+    {
+      error: t(
+        'notifications.error.actionCommandNotAllowed',
+        'Notification actions created through the API cannot run commands',
+      ),
+      code: NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE,
+    },
+    { status: 400 },
+  )
+}
+
 export function notificationCrudErrorResponse(error: unknown): Response | null {
   if (!isCrudHttpError(error)) return null
   return Response.json(error.body ?? { error: 'Notification request failed' }, { status: error.status })
@@ -235,6 +263,8 @@ export function createBulkNotificationRoute<TSchema extends z.ZodTypeAny>(
     if (!parsed.success) {
       return notificationValidationErrorResponse(parsed.error)
     }
+    const commandRejection = await rejectNotificationActionCommands(parsed.data as NotificationActionsPayload)
+    if (commandRejection) return commandRejection
 
     try {
       const guarded = await runGuardedNotificationWrite(
@@ -298,6 +328,14 @@ export function createBulkNotificationOpenApi<TSchema extends z.ZodTypeAny>(
             },
           },
         },
+        400: {
+          description: `Invalid payload, or an action carries a \`commandId\` (code: ${NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE})`,
+          content: {
+            'application/json': {
+              schema: actionConflictResponseSchema,
+            },
+          },
+        },
       },
     },
   }

package/src/modules/payment_gateways/lib/gateway-service.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto'
-import { QueryOrder } from '@mikro-orm/core'
+import { LockMode, QueryOrder } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -21,7 +21,7 @@ import type { IntegrationStateService } from '../../integrations/lib/state-servi
 import type { IntegrationLogService } from '../../integrations/lib/log-service'
 import { conflict, CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { GatewayPaymentOperation, GatewaySessionInitialization, GatewayTransaction } from '../data/entities'
-import { canApplyManualAction, isValidTransition, type ManualGatewayAction } from './status-machine'
+import { canApplyManualAction, isValidTransition, resolveImpliedCaptureStatus, type ManualGatewayAction } from './status-machine'
 import { emitPaymentGatewayEvent } from '../events'
 import { readGatewayMetadata, readWebhookLog } from './transaction-fields'
 import { reconcileSessionAmountWithOrder } from './order-amount-reconciliation'
@@ -124,6 +124,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
     transactionId: string,
     scope: { organizationId: string; tenantId: string },
     targetEm: EntityManager = em,
+    options?: { lockMode: LockMode.PESSIMISTIC_WRITE },
   ): Promise<GatewayTransaction> {
     const transaction = await findOneWithDecryption(
       targetEm,
@@ -134,7 +135,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         tenantId: scope.tenantId,
         deletedAt: null,
       },
-      undefined,
+      options,
       scope,
     )
     if (!transaction) {
@@ -765,42 +766,57 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         receivedAt?: string
       }
     }, scope: { organizationId: string; tenantId: string }): Promise<void> {
-      const transaction = await findTransactionOrThrow(transactionId, scope)
-      const currentStatus = transaction.unifiedStatus as UnifiedPaymentStatus
-      const canTransition = isValidTransition(currentStatus, update.unifiedStatus)
-      const shouldApplyStatus = canTransition && update.unifiedStatus !== currentStatus
-      const previousStatus = transaction.unifiedStatus
-      if (shouldApplyStatus) {
-        transaction.unifiedStatus = update.unifiedStatus
-        alignCapturedAmountWithStatus(transaction, update.unifiedStatus)
-      }
-      if (update.providerStatus) {
-        transaction.gatewayStatus = update.providerStatus
-      }
-      if (update.providerData) {
-        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), ...update.providerData }
-      }
-      if (update.webhookEvent) {
-        const webhookLog = readWebhookLog(transaction.webhookLog)
-        webhookLog.push({
-          eventType: update.webhookEvent.eventType,
-          receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),
-          idempotencyKey: update.webhookEvent.idempotencyKey,
-          unifiedStatus: update.unifiedStatus,
-          processed: update.webhookEvent.processed,
-        })
-        transaction.webhookLog = webhookLog
-      }
-      transaction.lastWebhookAt = new Date()
-      await em.flush()
+      const { transaction, previousStatus, impliedCaptureStatus, shouldApplyStatus } = await em.fork().transactional(async (tx) => {
+        const locked = await findTransactionOrThrow(transactionId, scope, tx, { lockMode: LockMode.PESSIMISTIC_WRITE })
+        const currentStatus = locked.unifiedStatus as UnifiedPaymentStatus
+        const implied = resolveImpliedCaptureStatus(currentStatus, update.unifiedStatus)
+        const canTransition = isValidTransition(currentStatus, update.unifiedStatus) || implied !== null
+        const applies = canTransition && update.unifiedStatus !== currentStatus
+        if (applies) {
+          if (implied) alignCapturedAmountWithStatus(locked, implied)
+          locked.unifiedStatus = update.unifiedStatus
+          alignCapturedAmountWithStatus(locked, update.unifiedStatus)
+        }
+        if (update.providerStatus) {
+          locked.gatewayStatus = update.providerStatus
+        }
+        if (update.providerData) {
+          locked.gatewayMetadata = { ...readGatewayMetadata(locked.gatewayMetadata), ...update.providerData }
+        }
+        if (update.webhookEvent) {
+          const webhookLog = readWebhookLog(locked.webhookLog)
+          webhookLog.push({
+            eventType: update.webhookEvent.eventType,
+            receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),
+            idempotencyKey: update.webhookEvent.idempotencyKey,
+            unifiedStatus: update.unifiedStatus,
+            processed: update.webhookEvent.processed,
+          })
+          locked.webhookLog = webhookLog
+        }
+        locked.lastWebhookAt = new Date()
+        await tx.flush()
+        return {
+          transaction: locked,
+          previousStatus: currentStatus,
+          impliedCaptureStatus: applies ? implied : null,
+          shouldApplyStatus: applies,
+        }
+      })
       if (shouldApplyStatus) {
-        await emitStatusEvent(update.unifiedStatus, {
+        const eventPayload = {
           transactionId: transaction.id,
           paymentId: transaction.paymentId,
           providerKey: transaction.providerKey,
-          previousStatus,
           organizationId: transaction.organizationId,
           tenantId: transaction.tenantId,
+        }
+        if (impliedCaptureStatus) {
+          await emitStatusEvent(impliedCaptureStatus, { ...eventPayload, previousStatus })
+        }
+        await emitStatusEvent(update.unifiedStatus, {
+          ...eventPayload,
+          previousStatus: impliedCaptureStatus ?? previousStatus,
         })
       }
       await writeTransactionLog(
@@ -811,6 +827,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         shouldApplyStatus ? 'Payment status synchronized from webhook' : 'Webhook received with no status transition',
         {
           previousStatus,
+          ...(impliedCaptureStatus ? { impliedStatus: impliedCaptureStatus } : {}),
           nextStatus: update.unifiedStatus,
           providerStatus: update.providerStatus ?? null,
           eventType: update.webhookEvent?.eventType ?? null,

package/src/modules/payment_gateways/lib/status-machine.ts

@@ -42,3 +42,22 @@ export function canApplyManualAction(action: ManualGatewayAction, from: UnifiedP
   if (targets.includes(from)) return true
   return targets.some((target) => isValidTransition(from, target))
 }
+
+const REFUND_STATUSES: Set<UnifiedPaymentStatus> = new Set(['refunded', 'partially_refunded'])
+
+/**
+ * A provider-confirmed refund proves the payment was captured. When a refund status reaches a
+ * transaction whose capture was not recorded yet (the capture webhook is late, or was never
+ * delivered), the transaction passes through `captured` on its way to the refund status instead
+ * of dropping the refund. Returns that intermediate status, or `null` when no bridge applies.
+ */
+export function resolveImpliedCaptureStatus(
+  from: UnifiedPaymentStatus,
+  to: UnifiedPaymentStatus,
+): UnifiedPaymentStatus | null {
+  if (!REFUND_STATUSES.has(to)) return null
+  if (isValidTransition(from, to)) return null
+  if (!isValidTransition(from, 'captured')) return null
+  if (!isValidTransition('captured', to)) return null
+  return 'captured'
+}

package/src/modules/payment_gateways/lib/webhook-processor.ts

@@ -103,7 +103,7 @@ export async function processPaymentGatewayWebhookJob(
     }
 
     const providerStatus = typeof event.data.status === 'string' ? event.data.status : ''
-    const unifiedStatus = adapter.mapStatus(providerStatus, event.eventType)
+    const unifiedStatus = adapter.mapStatus(providerStatus, event.eventType, { ...event, timestamp: new Date(event.timestamp) })
     await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'info', 'Payment gateway webhook received', {
       eventType: event.eventType,
       providerStatus,

package/src/modules/staff/notifications.ts

@@ -17,6 +17,7 @@ export const notificationTypes: NotificationTypeDefinition[] = [
         variant: 'default',
         icon: 'check',
         commandId: 'staff.leave-requests.accept',
+        requiredFeatures: ['staff.leave_requests.manage'],
       },
       {
         id: 'reject',
@@ -24,6 +25,7 @@ export const notificationTypes: NotificationTypeDefinition[] = [
         variant: 'destructive',
         icon: 'x',
         commandId: 'staff.leave-requests.reject',
+        requiredFeatures: ['staff.leave_requests.manage'],
       },
     ],
     primaryActionId: 'approve',

package/src/modules/workflows/AGENTS.md

@@ -100,7 +100,7 @@ Definition → startWorkflow() → Instance → executeWorkflow() loop
 | `UPDATE_ENTITY` | Mutate an entity via the command bus. `CommandBus.execute` does not declare a signal; a write that has already begun cannot be cancelled on timeout. |
 | `EMIT_EVENT` | Emit a domain event to the event bus. `eventBus.emitEvent` does not declare a signal; an emit that has already begun cannot be cancelled on timeout. |
 | `EXECUTE_FUNCTION` | Run a registered custom function. Functions receive `(args, context, signal?: AbortSignal)` — the third arg is additive; existing two-arg functions are unaffected. |
-| `WAIT` | Delay execution for a configured duration |
+| `WAIT` | Delay execution for a configured duration. A sync WAIT over `MAX_INLINE_WAIT_MS` (60 s) that ENDS its transition is queued like an async one (`executeActivities` `queueLongInlineWaits`, opted into by the transition handler only — the AUTOMATED-step caller does not park on a queued result). An in-process WAIT never hands `setTimeout` more than `MAX_TIMER_DELAY_MS` (2^31−1 ms): Node would fire it after 1 ms. |
 | `SET_VARIABLE` | Write values into workflow context at dot paths (assignments land at top-level context, not namespaced under the activity) |
 
 ## Context Backbone (contextSchema · ledger · picker · samples · test step)
@@ -934,7 +934,7 @@ Treat a regression here as a broken feature, not a nit.
 | Variable | Effect | Default |
 |----------|--------|---------|
 | `OM_WORKFLOWS_ALLOW_PRIVATE_URLS` | When `1`/`true`/`yes`, bypasses the SSRF guard in `CALL_WEBHOOK` so workflow authors can hit `localhost`, RFC1918, and `.internal` targets. For dev only — MUST remain unset in production. | unset (guard enforced) |
-| `OM_WORKFLOWS_MAX_CONDITION_ATTEMPTS` | Hard cap on WAIT_FOR_CONDITION poll re-enqueues; reaching it forces `CONDITION_TIMED_OUT` so a never-satisfiable predicate cannot saturate the queue. | `1000` |
+| `OM_WORKFLOWS_MAX_CONDITION_ATTEMPTS` | Floor of the cap on WAIT_FOR_CONDITION poll re-enqueues; reaching the cap forces `CONDITION_TIMED_OUT` so a never-satisfiable predicate cannot saturate the queue. Each waiter's cap is raised to the polls its own timeout needs (`resolveConditionAttemptCap`: `timeoutMs / pollIntervalMs + 1`), so a long timeout is never cut short by the floor. | `1000` |
 | `OM_WORKFLOWS_ENV_INTERPOLATION_ALLOWLIST` | Comma-separated non-secret process env keys allowed for `{{env.*}}` interpolation in workflow activity config. `APP_URL` is always allowed. Never include secrets. | unset (`APP_URL` only) |
 
 ## DI Services

package/src/modules/workflows/data/entities.ts

@@ -675,6 +675,12 @@ export class StepInstance {
   @Property({ name: 'exited_at', type: Date, nullable: true })
   exitedAt?: Date | null
 
+  /**
+   * @deprecated Written on the COMPLETED path only and `null` for any step that
+   * lasted 2^31 ms (~24.86 days) or longer, which a Postgres `integer` cannot
+   * hold. Derive the duration from `exitedAt - enteredAt` instead; the column
+   * is scheduled for removal no earlier than 0.11.0 (see UPGRADE_NOTES.md).
+   */
   @Property({ name: 'execution_time_ms', type: 'integer', nullable: true })
   executionTimeMs?: number | null
 

package/src/modules/workflows/lib/activity-executor.ts

@@ -62,7 +62,7 @@ import './activity-registry-bootstrap'
 import { bindActivityExecutor } from './activity-types'
 import { getActivityType } from './activity-registry'
 import { logWorkflowEvent } from './event-logger'
-import { calculateWaitDelayMs, parseDuration } from './duration'
+import { MAX_INLINE_WAIT_MS, assertInProcessWaitDelay, calculateWaitDelayMs, parseDuration } from './duration'
 
 export { calculateWaitDelayMs } from './duration'
 import { resolveActivityTimeoutMs } from './activityTimeoutFields'
@@ -683,6 +683,31 @@ export async function executeActivity(
   }
 }
 
+export interface ExecuteActivitiesOptions {
+  /**
+   * Hand a synchronous activity with a long `enqueueDelayMs` (a WAIT over
+   * `MAX_INLINE_WAIT_MS`) to the activity queue instead of sleeping in-process.
+   * Only the transition's LAST activity qualifies, so nothing authored after the
+   * wait can run before it elapses. Only callers that park on an `async` result
+   * (the transition handler) may opt in — a caller that does not would let the
+   * run move on without waiting at all.
+   */
+  queueLongInlineWaits?: boolean
+}
+
+function isLongInlineWait(activity: ActivityDefinition, context: ActivityContext): boolean {
+  const entry = getActivityType(activity.activityType)
+  if (!entry?.enqueueDelayMs || entry.async.capable === false) return false
+  try {
+    const delayMs = entry.enqueueDelayMs(
+      interpolateActivityConfig(activity.config, context, activity.activityType, activity.activityName)
+    )
+    return delayMs !== null && delayMs > MAX_INLINE_WAIT_MS
+  } catch {
+    return false
+  }
+}
+
 /**
  * Execute multiple activities in sequence
  * Supports both synchronous and asynchronous (queued) execution
@@ -697,7 +722,8 @@ export async function executeActivities(
   em: EntityManager,
   container: AwilixContainer,
   activities: ActivityDefinition[],
-  context: ActivityContext
+  context: ActivityContext,
+  options: ExecuteActivitiesOptions = {}
 ): Promise<ActivityExecutionResult[]> {
   const results: ActivityExecutionResult[] = []
 
@@ -709,9 +735,15 @@ export async function executeActivities(
 
   for (let i = 0; i < activities.length; i++) {
     const activity = activities[i]
+    const isLastActivity = i === activities.length - 1
+    const queueAsLongWait =
+      !activity.async &&
+      options.queueLongInlineWaits === true &&
+      isLastActivity &&
+      isLongInlineWait(activity, context)
 
     // Check if activity should run async
-    if (activity.async && !forceSynchronous) {
+    if ((activity.async || queueAsLongWait) && !forceSynchronous) {
       // Enqueue for background execution
       const jobId = await enqueueActivity(em, activity, context)
 
@@ -1389,7 +1421,7 @@ export async function executeFunction(
  *   this handler returns immediately when called from the worker
  */
 export async function executeWait(config: any): Promise<any> {
-  const durationMs = calculateWaitDelayMs(config)
+  const durationMs = assertInProcessWaitDelay(calculateWaitDelayMs(config))
 
   // In sync mode, actually sleep for the duration
   // In async mode (called from worker), the delay already happened via queue scheduling

package/src/modules/workflows/lib/activity-types.ts

@@ -23,7 +23,7 @@
 import { z, type ZodTypeAny } from 'zod'
 import { commandRegistry } from '@open-mercato/shared/lib/commands/registry'
 import { getActivityType, registerActivityType } from './activity-registry'
-import { calculateWaitDelayMs } from './duration'
+import { assertInProcessWaitDelay, calculateWaitDelayMs } from './duration'
 import {
   callApiConfigSchema,
   callWebhookConfigSchema,
@@ -342,7 +342,7 @@ export function registerBuiltinActivityTypes(): void {
       { id: 'until', component: 'datetime' },
     ],
     execute: (config) => {
-      const durationMs = calculateWaitDelayMs(config)
+      const durationMs = assertInProcessWaitDelay(calculateWaitDelayMs(config))
       return new Promise((resolve) => {
         setTimeout(() => resolve({ waited: true, durationMs }), durationMs)
       })

package/src/modules/workflows/lib/condition-handler.ts

@@ -106,6 +106,21 @@ export function resolveMaxConditionAttempts(): number {
   return parsed
 }
 
+/**
+ * The attempt cap one waiter actually gets: the configured floor, raised to the
+ * number of polls its own timeout needs (`timeoutMs / pollIntervalMs`, plus
+ * the entry poll). A fixed 1000 would force a 90-day wait polled hourly to
+ * time out after ~42 days. The deadline still ends the wait first; this only
+ * bounds a loop whose deadline arithmetic went wrong.
+ */
+export function resolveConditionAttemptCap(
+  config: Pick<WaitForConditionConfig, 'timeoutMs' | 'pollIntervalMs'>
+): number {
+  const floor = resolveMaxConditionAttempts()
+  if (!(config.timeoutMs > 0) || !(config.pollIntervalMs > 0)) return floor
+  return Math.max(floor, Math.ceil(config.timeoutMs / config.pollIntervalMs) + 1)
+}
+
 /**
  * Read and normalise a WAIT_FOR_CONDITION step's config. Fails closed: the
  * predicate and the timeout are both mandatory, and the poll interval is
@@ -499,7 +514,7 @@ export async function evaluateWaitCondition(
 
   const deadlineMs = Date.parse(options.deadlineAt)
   const deadlinePassed = Number.isFinite(deadlineMs) ? nowMs >= deadlineMs : true
-  const attemptCapReached = attempts >= resolveMaxConditionAttempts()
+  const attemptCapReached = attempts >= resolveConditionAttemptCap(waiter.config)
 
   if (deadlinePassed || attemptCapReached) {
     const eventLogger = container.resolve<typeof eventLoggerModule>('eventLogger')

package/src/modules/workflows/lib/duration.ts

@@ -147,6 +147,31 @@ export function calculateDueDate(duration: string, from: Date = new Date()): Dat
   return new Date(from.getTime() + parseDuration(duration))
 }
 
+/**
+ * Largest delay Node's `setTimeout` honours (a signed 32-bit millisecond count,
+ * ~24.86 days). A longer delay is not rejected — it fires after 1 ms with only a
+ * `TimeoutOverflowWarning` — so an in-process wait must refuse it explicitly.
+ */
+export const MAX_TIMER_DELAY_MS = 2_147_483_647
+
+/**
+ * A WAIT longer than this is not slept inside the executing request: when it is
+ * the last activity of its transition it is handed to the activity queue (the
+ * path an `async: true` WAIT already takes). One minute keeps the short pauses
+ * people use for pacing inline while anything that would hold a request or a
+ * worker slot open for minutes becomes durable.
+ */
+export const MAX_INLINE_WAIT_MS = 60_000
+
+export function assertInProcessWaitDelay(delayMs: number): number {
+  if (delayMs > MAX_TIMER_DELAY_MS) {
+    throw new Error(
+      `WAIT activity: a ${delayMs}ms delay cannot be slept in-process (limit ${MAX_TIMER_DELAY_MS}ms); make it the last activity of its transition, mark it async, or use a WAIT_FOR_TIMER step`
+    )
+  }
+  return delayMs
+}
+
 export function calculateWaitDelayMs(config: { duration?: string; until?: string }): number {
   if (config.until) {
     const targetDate = new Date(config.until)

package/src/modules/workflows/lib/step-handler.ts

@@ -222,6 +222,21 @@ async function emitStepMilestone(em: EntityManager, stepInstance: StepInstance):
   }
 }
 
+/**
+ * `step_instances.execution_time_ms` is a Postgres `integer`, so a step that
+ * lasted 2^31 ms (~24.86 days) or longer cannot be stored there — the flush
+ * that completes the step would throw after its task already committed,
+ * stranding the run. Such a duration persists as `null` (every reader already
+ * falls back to `exitedAt - enteredAt`); the exact value still travels on the
+ * `STEP_EXITED` event, whose payload is jsonb.
+ */
+export const MAX_PERSISTED_EXECUTION_TIME_MS = 2_147_483_647
+
+export function toPersistableExecutionTimeMs(executionTimeMs: number | null): number | null {
+  if (executionTimeMs === null || !Number.isFinite(executionTimeMs)) return null
+  return Math.abs(executionTimeMs) > MAX_PERSISTED_EXECUTION_TIME_MS ? null : executionTimeMs
+}
+
 export async function exitStep(
   em: EntityManager,
   stepInstance: StepInstance,
@@ -239,7 +254,7 @@ export async function exitStep(
   stepInstance.status = 'COMPLETED'
   stepInstance.outputData = outputData || null
   stepInstance.exitedAt = now
-  stepInstance.executionTimeMs = executionTimeMs
+  stepInstance.executionTimeMs = toPersistableExecutionTimeMs(executionTimeMs)
   stepInstance.updatedAt = now
 
   await em.flush()